1
0
localhost/networking.nix
2020-12-14 18:20:32 +00:00

98 lines
3.1 KiB
Nix

{ config, pkgs, ... }:
let
secrets = import ./secrets.nix;
in {
networking.hostName = "local";
networking.nameservers = [ "1.1.1.1" ];
networking.usePredictableInterfaceNames = false;
networking.wireless.enable = true;
imports = [ ./wireless-networks.nix ];
networking.firewall = {
enable = true;
extraCommands = ''
ip6tables -F OUTPUT
ip6tables -P OUTPUT DROP
ip6tables -A OUTPUT -o lo+ -j ACCEPT
iptables -F OUTPUT
iptables -P OUTPUT DROP
iptables -A OUTPUT -o lo+ -j ACCEPT
iptables -A OUTPUT -o vpn+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A OUTPUT -o tap+ -j ACCEPT
iptables -A OUTPUT -o veth+ -j ACCEPT
iptables -A OUTPUT -o vnet+ -j ACCEPT
iptables -A OUTPUT -o docker+ -j ACCEPT
iptables -A OUTPUT -o virbr+ -j ACCEPT
iptables -A OUTPUT -o virbr0-nic -j ACCEPT
# Allow access for special user for use captive portals without
# disabling vpn-only restrictions (to avoid leaks at the first seconds
# after connection)
iptables -A OUTPUT -m owner --uid-owner captive \
-p tcp -m multiport --dports 80,443,2443 \
-j ACCEPT
iptables -A OUTPUT -m owner --uid-owner captive \
-p udp -m multiport --dports 53 \
-j ACCEPT
# iptables -A OUTPUT -d 192.0.2.17 -j ACCEPT
${secrets.iptables}
'';
allowPing = false;
};
# User without vpn-only restrictions (for captive portals)
users.users.captive = {
isNormalUser = true;
};
# FIXME Broken in 20.09
#services.nscd.enable = false;
services.openvpn.servers.vpn = {
autoStart = true;
config = secrets.vpn-config;
authUserPass.username = secrets.vpn-username;
authUserPass.password = secrets.vpn-password;
updateResolvConf = true;
};
systemd = {
services = {
"macchanger-wlan0" = {
description = "Changes MAC of wlan0 for privacy reasons";
wants = [ "network-pre.target" ];
wantedBy = [ "multi-user.target" ];
before = [ "network-pre.target" ];
bindsTo = [ "sys-subsystem-net-devices-wlan0.device" ];
after = [ "sys-subsystem-net-devices-wlan0.device" ];
script = "${pkgs.macchanger}/bin/macchanger -e wlan0 || true";
serviceConfig.Type = "oneshot";
};
"macchanger-eth0" = {
description = "Changes MAC of eth0 for privacy reasons";
wants = [ "network-pre.target" ];
wantedBy = [ "multi-user.target" ];
before = [ "network-pre.target" ];
bindsTo = [ "sys-subsystem-net-devices-eth0.device" ];
after = [ "sys-subsystem-net-devices-eth0.device" ];
script = "${pkgs.macchanger}/bin/macchanger -e eth0 || true";
serviceConfig.Type = "oneshot";
};
"openvpn-restart-after-suspend" = {
description = "Restart OpenVPN after suspend";
after = [ "suspend.target" "hibernate.target" "hybrid-sleep.target" ];
wantedBy = [ "suspend.target" "hibernate.target" "hybrid-sleep.target" ];
script = "${pkgs.systemd}/bin/systemctl try-restart openvpn-vpn.service";
};
};
};
}