Add router module and dhcp config

modules-linux/default.nix

@@ -10,6 +10,7 @@
 		./linode.nix
 		./linux.nix
 		./proxy.nix
+		./router.nix
 		./rpi4.nix
 		./tailscale.nix
 	];

modules-linux/router.nix

@@ -0,0 +1,76 @@
+{ config, lib, pkgs, ... }:
+
+let
+	names = mylist: (lib.strings.concatMapStringsSep "," (x: ''"${x}"'') mylist);
+	# Pass the names of the wan/lan ports
+	nftConfig = { wan, lan, limitedLan ? [] }:
+		let
+			lanList = names lan;
+			allLan = names (lan ++ limitedLan);
+			wanName = ''"${wan}"'';
+		in
+''
+table ip filter {
+	chain input {
+		type filter hook input priority 0; policy drop;
+
+		iifname { ${lanList} } accept comment "Allows LAN traffic and outgoing"
+		iifname ${wanName} ct state { established, related } accept comment "Allows existing connections"
+		iifname ${wanName} icmp type { echo-request, destination-unreachable, time-exceeded } counter accept comment "Allow some ICMP traffic"
+		iifname ${wanName} counter drop comment "Drop other incoming traffic, and count how much"
+	}
+	chain forward {
+		type filter hook forward priority 0; policy drop;
+		iifname { ${allLan} } oifname { ${wanName} } accept comment "Forward LAN to WAN"
+		iifname { ${wanName} } oifname { ${allLan} } ct state established, related accept comment "Allow incoming established traffic"
+	}
+}
+
+table ip nat {
+	chain postrouting {
+		type nat hook postrouting priority 100; policy accept;
+		oifname "${wan}" masquerade
+	}
+}
+
+table ip6 filter {
+	chain input {
+		type filter hook input priority 0; policy drop;
+	}
+	chain forward {
+		type filter hook forward priority 0; policy drop;
+	}
+}
+'';
+	cfg = config.greg.router;
+
+in with lib; {
+	options.greg.router = {
+		enable = mkEnableOption "Enable NFTables and routing";
+		wan = mkOption {
+			type = types.str;
+			description = "The name of the network interface that is the WAN connection";
+		};
+		lan = mkOption {
+			type = (types.listOf types.str);
+			description = "A list of all network interfaces that are considered LAN connections";
+		};
+		limited = mkOption {
+			type = (types.listOf types.str);
+			description = "A list of limited access LAN connections - such as IOT connections and similar.";
+			default = [];
+		};
+	};
+
+	config = mkIf cfg.enable {
+		networking.nftables = {
+			enable = true;
+			ruleset = (nftConfig { lan = cfg.lan; wan = cfg.wan; });
+		};
+
+		environment.systemPackages = [
+			pkgs.pciutils
+			pkgs.tcpdump
+		];
+	};
+}