qbit/xin
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

router: add nf_tables module, use regular kernel for now.

Browse Source
This commit is contained in:
Aaron Bieber 2022-10-16 10:10:13 -06:00
parent f314cafa5c
commit 0399a3ba21
No known key found for this signature in database
4 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
flake.nix
View File

@ -14,7 +14,8 @@
nixos-hardware = { url = "github:NixOS/nixos-hardware/master"; }; nixos-hardware = { url = "github:NixOS/nixos-hardware/master"; };
emacs-overlay = { emacs-overlay = {
url = "github:nix-community/emacs-overlay/08445dd7824253ee8580f06127460a7d14e942cf"; url =
"github:nix-community/emacs-overlay/08445dd7824253ee8580f06127460a7d14e942cf";
inputs.nixpkgs.follows = "stable"; inputs.nixpkgs.follows = "stable";
}; };

4
hosts/router/default.nix
View File

@ -11,6 +11,8 @@ in {
_module.args.isUnstable = false; _module.args.isUnstable = false;
imports = [ ./hardware-configuration.nix ]; imports = [ ./hardware-configuration.nix ];
boot.kernelPackages = pkgs.linuxPackages;
boot.kernel.sysctl = { boot.kernel.sysctl = {
"net.ipv4.conf.all.forwarding" = true; "net.ipv4.conf.all.forwarding" = true;
"net.ipv6.conf.all.forwarding" = true; "net.ipv6.conf.all.forwarding" = true;
@ -29,7 +31,7 @@ in {
firewall.enable = false; firewall.enable = false;
nftables = { nftables = {
enable = false; enable = true;
rulesetFile = ./router.nft; rulesetFile = ./router.nft;
}; };

2
hosts/router/hardware-configuration.nix
View File

@ -13,7 +13,7 @@
boot.initrd.availableKernelModules = boot.initrd.availableKernelModules =
[ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" ]; [ "ehci_pci" "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ ]; boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ]; boot.kernelModules = [ "nf_tables" ];
boot.extraModulePackages = [ ]; boot.extraModulePackages = [ ];
fileSystems."/" = { fileSystems."/" = {

2
hosts/router/router.nft
View File

@ -1,3 +1,5 @@
add table ip nat
table ip nat { table ip nat {
chain postrouting { chain postrouting {
type nat hook postrouting priority 100 type nat hook postrouting priority 100