simon/nixos-config
simon/nixos-config
1
1
Fork 0
Code Issues 8 Pull requests Actions Projects Activity

shinobu/router: Switch to nftables

Browse source
This commit is contained in:
Simon Bruder 2023-08-08 14:19:48 +02:00
parent ba1f9262fb
commit 826929571b
Signed by: simon
GPG key ID: 8D3C82F9F309F8EC
1 changed files with 26 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
machines/shinobu/services/router.nix
View file

@ -43,13 +43,33 @@ in
networking = { networking = {
# networkd handles this # networkd handles this
useDHCP = false; useDHCP = false;
# networkd didn’t work that well for this
nat = { nftables = {
enable = true; enable = true;
enableIPv6 = true; ruleset = ''
externalInterface = "wg-upstream"; define NAT_LAN_IFACES = { "br-lan" }
internalInterfaces = [ "br-lan" ]; define NAT_WAN_IFACES = { "wg-upstream" }
internalIPv6s = [ "fd00:80:1::/64" ];
table inet filter {
chain forward {
type filter hook forward priority filter; policy drop;
iifname $NAT_LAN_IFACES oifname $NAT_WAN_IFACES counter accept;
iifname $NAT_WAN_IFACES oifname $NAT_LAN_IFACES ct state established,related counter accept;
}
}
table inet nat {
chain prerouting {
type nat hook prerouting priority filter; policy accept;
}
chain postrouting {
type nat hook postrouting priority filter; policy accept;
oifname $NAT_WAN_IFACES masquerade;
}
}
'';
}; };
}; };