nixos-config/systems/LoutreOS/network.nix

{ config, pkgs, inputs, ... }:

{
  boot = {
    kernel.sysctl."net.ipv6.conf.all.forwarding" = true;
  };

  # Enable LTE drivers
  hardware.usb-modeswitch.enable = true;

  ##################
  # NETWORK CONFIG #
  ##################

  # eno1      -> VLAN100 -> Internet
  # eno2      -> LAN
  # eno3      -> Pas utilisé
  # eno4      -> Pas utilisé
  # enp0s21u1 -> Clé 4G Bouygues
  # wg0       -> Tunnel Wireguard ARN

  networking = {
    hostName = "loutreos"; # Define your hostname.
    hostId = "7e66e347";

    useNetworkd = true;
    useDHCP = false;

    nameservers = [
      "1.1.1.1"
      "1.0.0.1"
    ];

    vlans = {
      bouygues = {
        id = 100;
        interface = "eno1";
      };
    };

    interfaces = {
      bouygues = {
        # Adresse MAC BBox ? https://lafibre.info/remplacer-bbox/informations-de-connexion-ftth/msg598303/#msg598303
        macAddress = "E8:AD:A6:21:73:68";
        useDHCP = true;
      };
      eno2 = {
        ipv4.addresses = [
          { address = "10.30.0.1"; prefixLength = 16; }
        ];
      };
      enp0s21u1.useDHCP = true;
    };

    firewall = {
      enable = true;
      allowedTCPPorts = [ 80 443 ];
      allowedUDPPorts = [ ];

      # Open ports on local netwok only
      interfaces.eno2 = {
        allowedTCPPorts = [
          111 2049 4000 4001 4002 # NFS
          3483 9000 9090 # Slimserver
          1935 # RTMP
        ];
        allowedUDPPorts = [
          111 2049 4000 4001 4002 # NFS
          3483 # Slimserver
          67 # DHCP
        ];
      };

      extraCommands = ''

        ################
        # MANGLE rules #
        ################

        # Clean and recreate target
        ip46tables -w -t mangle -D PREROUTING -j loutreos-mangle-pre 2>/dev/null || true
        ip46tables -w -t mangle -F loutreos-mangle-pre 2>/dev/null || true
        ip46tables -w -t mangle -X loutreos-mangle-pre 2>/dev/null || true
        ip46tables -w -t mangle -N loutreos-mangle-pre

        # Restore the packet's CONNMARK to the MARK for existing connections
        ip46tables -w -t mangle -A loutreos-mangle-pre -j CONNMARK --restore-mark

        # If packet MARK is set, then it means that there is already a connection mark
        ip46tables -w -t mangle -A loutreos-mangle-pre -m mark ! --mark 0 -j ACCEPT

        # Else, we need to mark the packet.
        # If the packet is incoming on bouygues then set MARK to 1, LTE MARK 2 and VPN MARK 3
        ip46tables -w -t mangle -A loutreos-mangle-pre -i bouygues -j MARK --set-mark 1
        ip46tables -w -t mangle -A loutreos-mangle-pre -i enp0s21u1 -j MARK --set-mark 2
        ip46tables -w -t mangle -A loutreos-mangle-pre -i wg0 -j MARK --set-mark 3

        # Jump to newly created target 
        ip46tables -w -t mangle -A PREROUTING -j loutreos-mangle-pre

        # Save MARK to CONNMARK.
        ip46tables -w -t mangle -D POSTROUTING -j CONNMARK --save-mark 2>/dev/null || true
        ip46tables -w -t mangle -A POSTROUTING -j CONNMARK --save-mark

        ######################
        # IPv6 FORWARD rules #
        ######################

        # Forward all IPv6 traffic from local network and reject incoming traffic
        ip6tables -w -D FORWARD -j loutreos-forward 2>/dev/null || true
        ip6tables -w -F loutreos-forward 2>/dev/null || true
        ip6tables -w -X loutreos-forward 2>/dev/null || true
        ip6tables -w -N loutreos-forward
        ip6tables -w -A loutreos-forward -m state --state RELATED,ESTABLISHED -j ACCEPT
        ip6tables -w -A loutreos-forward -j ACCEPT -i eno2
        ip6tables -w -A loutreos-forward -j nixos-fw-log-refuse
        ip6tables -w -A FORWARD -j loutreos-forward

        #############################################
        # Enable server access when fiber link down #
        #############################################

        # Redirect local network request from server external IP to internal IP
        iptables -t nat -D PREROUTING -s 10.30.0.0/16 -d 176.180.172.105 -j DNAT --to 10.30.0.1 || true
        iptables -t nat -A PREROUTING -s 10.30.0.0/16 -d 176.180.172.105 -j DNAT --to 10.30.0.1
      '';

      # remove refs to nixos-fw-log-refuse before restarting firewall
      # prevents "ressource busy" errors
      extraStopCommands = ''
        ip6tables -D loutreos-forward -j nixos-fw-log-refuse 2>/dev/null || true
      '';
    };
  };

  systemd.services.systemd-networkd.serviceConfig = {
      LoadCredential = [
          "network.wireguard.private.wg0:/mnt/secrets/wireguard/wireguard.private"
          "network.wireguard.preshared.wg0:/mnt/secrets/wireguard/wireguard.preshared"
      ];
  };

  #################
  # ROUTING RULES #
  #################

  # 0:      from all lookup local
  # 60:     from all iif lo dport 25 lookup vpn  # mails are forced to vpn table
  # 4000:   from all fwmark 0x1 lookup fiber     # fwmark indicate established connection that must go through same interface
  # 5000:   from all fwmark 0x2 lookup lte
  # 6000:   from all fwmark 0x3 lookup vpn
  # 32766:  from all lookup main                 # main table should contain no default routes, only local network routes
  # 32767:  from all lookup default
  # 40000:  from all lookup fiber                # first table encountered with a default route if fiber is up
  # 50000:  from all lookup lte                  # first table encountered with a default route if fiber is down

  systemd.network = let
    routeTables = {
      fiber = 1;
      lte = 2; 
      vpn = 3;
    };
  in {
    enable = true;

    config = {
      inherit routeTables;
      addRouteTablesToIPRoute2 = true;
    };

    # Wireguard ARN device configuation
    netdevs = {
      "10-wg0" = {
        netdevConfig = {
          Kind = "wireguard";
          Name = "wg0";
          MTUBytes = "1450";
        };
        wireguardConfig = {
          PrivateKeyFile = "/run/credentials/systemd-networkd.service/network.wireguard.private.wg0";
          # Wait for 24.11
          # PrivateKey = "@network.wireguard.private.wg0";
          RouteTable = routeTables.vpn;
        };
        wireguardPeers = [
          {
            wireguardPeerConfig = {
              Endpoint = "89.234.141.83:8095";
              PublicKey = "t3+JkBfXI1uw8fa9P6JfxXJfTPm9cOHcgIN215UHg2g=";
              PresharedKeyFile = "/run/credentials/systemd-networkd.service/network.wireguard.preshared.wg0";
              # Wait for 24.11
              # PresharedKey = "@network.wireguard.preshared.wg0";
              AllowedIPs = ["0.0.0.0/0" "::/0"];
              PersistentKeepalive = 15;
            };
          }
        ];
      };
    };

    networks = {
      #########
      # FIBER #
      #########

      # Set route metric to highest priority
      # Set DHCP client magic settings for Bouygues
      "40-bouygues" = {
        dhcpV4Config.RouteTable = routeTables.fiber;

        dhcpV6Config = {
          DUIDRawData = "00:03:00:01:E8:AD:A6:21:73:68";
          WithoutRA = "solicit";
        };

        ipv6AcceptRAConfig = {
          DHCPv6Client = true;
          RouteTable = routeTables.fiber;
        };

        networkConfig = {
          KeepConfiguration = "dhcp-on-stop";
          IPv6AcceptRA = true;
          DHCPPrefixDelegation = true;
        };

        # Static attribution of first IPv6 subnet
        dhcpPrefixDelegationConfig.SubnetId = "0";

        # Route everything to fiber link with a priority of 40000
        routingPolicyRules = [
          {
            routingPolicyRuleConfig = {
              FirewallMark = 1;
              Table = routeTables.fiber;
              Priority = 4000;
              Family = "both";
            };
          }
          {
            routingPolicyRuleConfig = {
              Table = routeTables.fiber;
              Priority = 40000;
              Family = "both";
            };
          }
        ];
      };

      # Don't check VLAN physical interface as it is not directly used
      "40-eno1".linkConfig.RequiredForOnline = "no";

      #######
      # LTE #
      #######

      # Set LTE route to lower priority
      "40-enp0s21u1" = {
        dhcpV4Config.RouteTable = routeTables.lte;

        # Route all to lte link with a priority of 50000
        routingPolicyRules = [
          {
            routingPolicyRuleConfig = {
              FirewallMark = 2;
              Table = routeTables.lte;
              Priority = 5000;
              Family = "both";
            };
          }
          {
            routingPolicyRuleConfig = {
              Table = routeTables.lte;
              Priority = 50000;
              Family = "both";
            };
          }
        ];
      };

      #######
      # VPN #
      #######

      # Wireguard ARN network configuation
      "10-wg0" = {
        matchConfig.Name = "wg0";
        address = [
          "89.234.141.196/32"
          "2a00:5881:8119:400::1/128"
        ];
        routingPolicyRules = [
          # Route outgoing emails to VPN table
          {
            routingPolicyRuleConfig = {
              IncomingInterface = "lo";
              DestinationPort = "25";
              Table = routeTables.vpn;
              Priority = 60;
              Family = "both";
            };
          }
          # Route packets originating from wg0 device to VPN table
          # Allow server to respond on the wg0 interface requests
          {
            routingPolicyRuleConfig = {
              FirewallMark = 3;
              Table = routeTables.vpn;
              Priority = 6000;
              Family = "both";
            };
          }
        ];
      };

      #######
      # LAN #
      #######

      # LAN DHCP server config
      "40-eno2" = {
        networkConfig = {
          IPv6SendRA = true;
          DHCPPrefixDelegation = true;
          DHCPServer = true;
          IPMasquerade = "ipv4";
        };
        dhcpServerConfig = {
          EmitRouter = true;
          EmitDNS = true;
          DNS = [
            "1.1.1.1"
            "1.0.0.1"
          ];
        };
        dhcpServerStaticLeases = [
          # IPMI
          {
            dhcpServerStaticLeaseConfig = {
              Address = "10.30.1.1";
              MACAddress = "ac:1f:6b:4b:01:15";
            };
          }
          # paul-fixe
          {
            dhcpServerStaticLeaseConfig = {
              Address = "10.30.50.1";
              MACAddress = "b4:2e:99:ed:24:26";
            };
          }
          # salonled
          {
            dhcpServerStaticLeaseConfig = {
              Address = "10.30.40.1";
              MACAddress = "e0:98:06:85:e9:ce";
            };
          }
          # miroir-bleu
          {
            dhcpServerStaticLeaseConfig = {
              Address = "10.30.40.2";
              MACAddress = "e0:98:06:86:38:fc";
            };
          }
          # miroir-orange
          {
            dhcpServerStaticLeaseConfig = {
              Address = "10.30.40.3";
              MACAddress = "50:02:91:78:be:be";
            };
          }
        ];
        ipv6SendRAConfig = {
          EmitDNS = true;
          DNS = [
            "2606:4700:4700::1111"
            "2606:4700:4700::1001"
          ];
        };
      };
    };
  };
}