services/router: init

2026-09-17 08:57:32 +07:00
parent b85d6637f1
commit 60aac6efb2
39 changed files with 1831 additions and 929 deletions
@@ -0,0 +1,65 @@
+# Router firewall/NAT policy (nftables). Trust model:
+#   mgmt VLAN  -> trusted: router services, all VLANs, WAN
+#   other VLANs -> DNS/DHCP on the router + WAN (if allowWan); no inter-VLAN
+#   WAN (ppp0) -> nothing inbound beyond established/related
+#   mesh       -> admin SSH + metrics scrapes (same trust boundary as the fleet)
+#   staging    -> admin SSH only (pre-cutover uplink into the old LAN)
+{ settings }:
+{ lib, ... }:
+let
+  cfg = settings;
+
+  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
+  wanVlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") (
+    lib.filterAttrs (_: vlan: vlan.allowWan) cfg.vlans
+  );
+  nonMgmtIfs = lib.filter (i: i != "vlan-mgmt") vlanIfs;
+in
+{
+  networking.nftables.enable = true;
+
+  # SSH reachable only from the mgmt VLAN (trusted) and the mesh — never
+  # from the WAN or the other VLANs.
+  services.openssh.openFirewall = false;
+
+  networking.firewall = {
+    enable = true;
+    filterForward = true;
+    trustedInterfaces = [ "vlan-mgmt" ];
+
+    # Non-mgmt VLANs may only talk to the router's DNS and DHCP; the staging
+    # uplink (old LAN, pre-cutover) gets admin SSH so the box can be reached
+    # before the mgmt VLAN or the mesh are up.
+    interfaces =
+      lib.genAttrs nonMgmtIfs (_: {
+        allowedTCPPorts = [ 53 ];
+        allowedUDPPorts = [
+          53
+          67
+        ];
+      })
+      // lib.optionalAttrs (cfg.stagingPort != null) {
+        ${cfg.stagingPort}.allowedTCPPorts = [ 22 ];
+      };
+
+    extraInputRules = ''
+      ip6 saddr ${cfg.mesh.subnet} tcp dport 22 accept comment "admin ssh over the mesh"
+      ip6 saddr ${cfg.mesh.subnet} tcp dport 4000 accept comment "blocky metrics scrape from control"
+    '';
+
+    extraForwardRules = ''
+      tcp flags syn tcp option maxseg size set rt mtu comment "MSS clamp for PPPoE mtu 1492"
+      iifname "vlan-mgmt" accept comment "mgmt reaches all VLANs and the WAN"
+    '';
+  };
+
+  # networking.nat both masquerades and opens forward-to-WAN for exactly its
+  # internalInterfaces — so this list, not a rule of our own, is where
+  # `allowWan` is enforced. Listing every VLAN here would silently let
+  # allowWan = false VLANs out.
+  networking.nat = {
+    enable = true;
+    externalInterface = "ppp0";
+    internalInterfaces = wanVlanIfs;
+  };
+}