kurogeek
8090ab3e6d
With stagingPort set, the box itself had internet over the staging DHCP
uplink but LAN/Wi-Fi clients had none: forward and masquerade were scoped
to ppp0 only. Worse, pppd's `defaultroute` refuses to install its route
while the staging DHCP default route (metric 1024) exists ("not replacing
existing default route"), so even a live PPPoE session was never used.
- firewall: forward-allow + masquerade allowWan VLANs -> stagingPort in a
separate `router-staging-nat` postrouting chain (networking.nat only
takes one external interface). Same allowWan set as nixos-nat.
- pppoe: `defaultroute-metric 0`, so pppd only checks for a metric-0
default route, installs ppp0 as the preferred exit and removes it on
hangup, leaving the staging route as the fallback.
68 lines
2.3 KiB
Nix
68 lines
2.3 KiB
Nix
# PPPoE WAN session. ISP credentials are entered once at `clan vars generate`
|
|
# (prompts). Both are secret — AIS often uses the same string for username and
|
|
# password — so neither may land in the Nix store: pppd reads the username from
|
|
# an included secret options file and the password from chap/pap-secrets.
|
|
{ settings }:
|
|
{ config, ... }:
|
|
let
|
|
cfg = settings;
|
|
creds = config.clan.core.vars.generators.pppoe-credentials;
|
|
# Interface pppd dials on: the WAN port itself, or its ISP VLAN (network.nix).
|
|
pppInterface = if cfg.wan.vlanId == null then cfg.wan.interface else "wan-vlan";
|
|
in
|
|
{
|
|
clan.core.vars.generators.pppoe-credentials = {
|
|
prompts.username = {
|
|
description = "PPPoE username (from the ISP)";
|
|
type = "hidden";
|
|
};
|
|
prompts.password = {
|
|
description = "PPPoE password (from the ISP)";
|
|
type = "hidden";
|
|
};
|
|
files."user-opts".secret = true;
|
|
files."chap-secrets".secret = true;
|
|
script = ''
|
|
user="$(cat "$prompts"/username)"
|
|
pass="$(cat "$prompts"/password)"
|
|
printf 'user "%s"\n' "$user" > "$out"/user-opts
|
|
printf '"%s" * "%s"\n' "$user" "$pass" > "$out"/chap-secrets
|
|
'';
|
|
};
|
|
|
|
# defaultroute-metric 0: pppd refuses `defaultroute` while any other
|
|
# default route exists (e.g. the staging uplink's DHCP route, metric 1024,
|
|
# network.nix) unless given a metric; with 0 it only checks for a metric-0
|
|
# route, installs its own as the preferred exit, and removes it again on
|
|
# hangup so the staging route takes over.
|
|
services.pppd = {
|
|
enable = true;
|
|
peers.wan = {
|
|
autostart = true;
|
|
config = ''
|
|
plugin pppoe.so ${pppInterface}
|
|
ifname ppp0
|
|
file ${creds.files."user-opts".path}
|
|
noipdefault
|
|
defaultroute
|
|
defaultroute-metric 0
|
|
noauth
|
|
hide-password
|
|
persist
|
|
maxfail 0
|
|
holdoff 5
|
|
lcp-echo-interval 15
|
|
lcp-echo-failure 3
|
|
+ipv6
|
|
mtu 1492
|
|
mru 1492
|
|
'';
|
|
};
|
|
};
|
|
|
|
# pppd looks up the password for `user` in these files at dial time; both
|
|
# point at the same generated `"<user>" * "<pass>"` line (PAP and CHAP).
|
|
environment.etc."ppp/chap-secrets".source = creds.files."chap-secrets".path;
|
|
environment.etc."ppp/pap-secrets".source = creds.files."chap-secrets".path;
|
|
}
|