ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

add tcpdump tool and fix bond interface

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2025-08-07 10:00:41 -05:00
parent 618ab4f500
commit e8679aa177
2 changed files with 20 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/h003/flake.nix
View file

@ -36,6 +36,7 @@
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
lua lua
sqlite sqlite
tcpdump
]; ];
ringofstorms_common = { ringofstorms_common = {

39
hosts/h003/networking.nix
View file

@ -14,9 +14,11 @@
"enp2s0" "enp2s0"
]; ];
driverOptions = { driverOptions = {
mode = "802.3ad"; # LACP # My shitty switch doesn't support this
# mode = "802.3ad"; # LACP
# lacp_rate = "fast";
mode = "balance-xor";
miimon = "100"; miimon = "100";
lacp_rate = "fast";
}; };
}; };
}; };
@ -24,15 +26,17 @@
# Configure VLANs on the bonded interface # Configure VLANs on the bonded interface
vlans = { vlans = {
vlan10 = { vlan10 = {
# WAN
id = 10; id = 10;
interface = "bond0"; interface = "bond0";
}; };
vlan20 = { vlan20 = {
# LAN
id = 20; id = 20;
interface = "bond0"; interface = "bond0";
}; };
vlan30 = {
id = 30;
interface = "bond0";
};
}; };
# enable ipv6 or not # enable ipv6 or not
@ -61,7 +65,7 @@
]; ];
}; };
# Management VLAN 1 # Management VLAN 1
bond0 = { vlan30 = {
ipv4.addresses = [ ipv4.addresses = [
{ {
address = "10.12.16.1"; # Management network address = "10.12.16.1"; # Management network
@ -83,7 +87,7 @@
externalInterface = "vlan10"; # WAN externalInterface = "vlan10"; # WAN
internalInterfaces = [ internalInterfaces = [
"vlan20" "vlan20"
"bond0" "vlan30"
]; # LAN/Management ]; # LAN/Management
enableIPv6 = lib.mkIf config.networking.enableIPv6 true; # Enable IPv6 NAT enableIPv6 = lib.mkIf config.networking.enableIPv6 true; # Enable IPv6 NAT
}; };
@ -93,11 +97,6 @@
enable = true; enable = true;
allowPing = true; # For ddiagnostics allowPing = true; # For ddiagnostics
# trustedInterfaces = [
# "vlan20" # Allow all on LAN
# "bond0" # Allow all on management
# ];
# Block vlan to vlan communication # Block vlan to vlan communication
filterForward = true; filterForward = true;
extraForwardRules = '' extraForwardRules = ''
@ -106,11 +105,11 @@
ip protocol udp ct state {established, related} accept ip protocol udp ct state {established, related} accept
ip6 nexthdr tcp ct state {established, related} accept ip6 nexthdr tcp ct state {established, related} accept
ip6 nexthdr udp ct state {established, related} accept ip6 nexthdr udp ct state {established, related} accept
# --- Inter-VLAN Security --- # --- Inter-VLAN Security ---
# Block any NEW connection attempts between LAN and Management # Block any NEW connection attempts between LAN and Management
iifname "vlan20" oifname "bond0" drop iifname "vlan20" oifname "vlan30" drop
iifname "bond0" oifname "vlan20" drop iifname "vlan30" oifname "vlan20" drop
# Explicitly allow LAN and Management to go to the WAN # Explicitly allow LAN and Management to go to the WAN
oifname "vlan10" accept oifname "vlan10" accept
@ -143,7 +142,7 @@
}; };
# Management interface (VLAN 1) - LIMITED SERVICE # Management interface (VLAN 1) - LIMITED SERVICE
bond0 = { vlan30 = {
allowedTCPPorts = [ allowedTCPPorts = [
22 # SSH (for remote admin access) 22 # SSH (for remote admin access)
53 # DNS 53 # DNS
@ -177,22 +176,22 @@
# Listen only on LAN interface # Listen only on LAN interface
interface = [ interface = [
"vlan20" "vlan20"
"bond0" "vlan30"
]; ];
bind-interfaces = true; bind-interfaces = true;
# DHCP range and settings # DHCP range and settings
dhcp-range = [ dhcp-range = [
"set:lan,10.12.14.100,10.12.14.200,1h"
"set:mng,10.12.16.100,10.12.16.200,1h" # Management devices "set:mng,10.12.16.100,10.12.16.200,1h" # Management devices
"set:lan,10.12.14.100,10.12.14.200,1h"
] ]
++ lib.optionals config.networking.enableIPv6 [ ++ lib.optionals config.networking.enableIPv6 [
"set:lan,fd12:14::100,fd12:14::200,64,6h"
"set:mng,fd12:14:1::100,fd12:14:1::200,64,6h" # For Management "set:mng,fd12:14:1::100,fd12:14:1::200,64,6h" # For Management
"set:lan,fd12:14::100,fd12:14::200,64,6h"
]; ];
dhcp-option = [ dhcp-option = [
"tag:lan,option:router,10.12.14.1"
"tag:mng,option:router,10.12.16.1" "tag:mng,option:router,10.12.16.1"
"tag:lan,option:router,10.12.14.1"
# "option:dns-server,10.12.14.1,1.1.1.1,8.8.8.8" # "option:dns-server,10.12.14.1,1.1.1.1,8.8.8.8"
]; ];
@ -211,7 +210,7 @@
# interface, min interval, max interval # interface, min interval, max interval
ra-param = lib.mkIf config.networking.enableIPv6 [ ra-param = lib.mkIf config.networking.enableIPv6 [
"vlan20,60,120" "vlan20,60,120"
"bond0,60,120" "vlan30,60,120"
]; ];
# DNS settings # DNS settings