home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

enable ipv6 networking on DMZ

Browse source
This commit is contained in:
Pim Kunis 2024-01-13 17:33:14 +01:00
parent 76501362f7
commit 13f0f036e9
4 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
nixos/default.nix
View file

@ -113,6 +113,7 @@
tcpdump tcpdump
lsof lsof
parted parted
radvd
]; ];
hardware.cpu.intel.updateMicrocode = hardware.cpu.intel.updateMicrocode =

6
nixos/modules/networking/default.nix
View file

@ -124,9 +124,9 @@ in {
linkConfig.RequiredForOnline = "carrier"; linkConfig.RequiredForOnline = "carrier";
networkConfig = { networkConfig = {
IPv6AcceptRA = false; IPv6AcceptRA = cfg.allowDMZConnectivity;
LinkLocalAddressing = "no"; LinkLocalAddressing = if cfg.allowDMZConnectivity then "ipv6" else "no";
DHCP = lib.mkIf cfg.allowDMZConnectivity "yes"; DHCP = lib.mkIf (cfg.allowDMZConnectivity && cfg.staticDMZIpv4Address != "") "yes";
Address = lib.mkIf (cfg.staticDMZIpv4Address != "") cfg.staticDMZIpv4Address; Address = lib.mkIf (cfg.staticDMZIpv4Address != "") cfg.staticDMZIpv4Address;
}; };
}; };

4
nixos/modules/networking/dmz/default.nix
View file

@ -21,6 +21,8 @@ in
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable {
lab.networking.allowDMZConnectivity = true;
networking.firewall.interfaces.${config.lab.networking.dmzBridgeName} = { networking.firewall.interfaces.${config.lab.networking.dmzBridgeName} = {
allowedTCPPorts = [ 53 5353 ]; allowedTCPPorts = [ 53 5353 ];
allowedUDPPorts = [ 53 67 5353 ]; allowedUDPPorts = [ 53 67 5353 ];
@ -30,8 +32,6 @@ in
bind = { bind = {
enable = true; enable = true;
forwarders = [ ]; forwarders = [ ];
# TODO: disable ipv6 for now, as the hosts themselves lack routes it seems.
ipv4Only = true;
extraOptions = '' extraOptions = ''
allow-transfer { none; }; allow-transfer { none; };

3
nixos/modules/networking/dmz/dnsmasq.nix
View file

@ -24,6 +24,7 @@ in
dhcp-range = [ dhcp-range = [
"192.168.30.50,192.168.30.127,15m" "192.168.30.50,192.168.30.127,15m"
"2a0d:6e00:1a77:30::,ra-stateless,ra-names"
]; ];
dhcp-host = [ dhcp-host = [
@ -34,9 +35,11 @@ in
dhcp-option = [ dhcp-option = [
"3,${dmzRouterIPv4}" "3,${dmzRouterIPv4}"
"option:dns-server,${dmzRouterIPv4}" "option:dns-server,${dmzRouterIPv4}"
"option6:dns-server,[2a02:58:19a:30::1]"
]; ];
address = [ address = [
"/ns.pizzapim.nl/ns.geokunis2.nl/${dmzDHCPIPv4}" "/ns.pizzapim.nl/ns.geokunis2.nl/${dmzDHCPIPv4}"
# "/ns.pizzapim.nl/ns.geokunis2.nl/TODOIPV6"
]; ];
} }