nixos-module/container/upstream: fix SNAT by adding a staticIpv4Address option

This commit is contained in:
Astro 2021-09-06 22:58:52 +02:00
parent fd4c8ad65b
commit 1b4f761de8
3 changed files with 35 additions and 25 deletions

View File

@ -149,6 +149,7 @@ in
upstream1.interfaces.up1.upstream = { upstream1.interfaces.up1.upstream = {
provider = "vodafone"; provider = "vodafone";
staticIpv4Address = "24.134.104.53";
noNat.subnets6 = [ noNat.subnets6 = [
"2a02:8106:208:5200::/56" "2a02:8106:208:5200::/56"
]; ];
@ -165,6 +166,7 @@ in
upstream = { upstream = {
provider = "dsi"; provider = "dsi";
link = "up4"; link = "up4";
staticIpv4Address = "81.201.149.152";
upBandwidth = 98000; upBandwidth = 98000;
noNat.subnets6 = [ noNat.subnets6 = [
"2a00:8180:2000:37::1/128" "2a00:8180:2000:37::1/128"

View File

@ -111,6 +111,9 @@ let
default = null; default = null;
description = "Underlying interface name for eg. PPPoE"; description = "Underlying interface name for eg. PPPoE";
}; };
staticIpv4Address = mkOption {
type = with types; nullOr str;
};
upBandwidth = mkOption { upBandwidth = mkOption {
type = with types; nullOr int; type = with types; nullOr int;
default = null; default = null;

View File

@ -77,32 +77,37 @@ in
-j ${net}_nat -j ${net}_nat
'') (builtins.attrNames upstreamInterfaces) '') (builtins.attrNames upstreamInterfaces)
) + ) +
# Do SNAT on connection attempts so that the actual return path # Do SNAT on connection attempts so that forwarded ports will
# won't matter. Forwarded ports will work from internal networks # work from internal networks.
# and on services that have Internet through another upstream routers. ''
builtins.concatStringsSep "\n" ( iptables -w -t nat -N nixos-nat-post-forward 2>/dev/null || \
map ({ proto, destination, sourcePort, ... }: iptables -w -t nat -F nixos-nat-post-forward
${lib.concatMapStringsSep "\n" (net:
let
inherit (upstreamInterfaces.${net}.upstream) staticIpv4Address;
in lib.optionalString (staticIpv4Address != null) ''
iptables -w -t nat -A nixos-nat-post \
--source 172.20.0.0/14 \
--dest ${staticIpv4Address}/32 \
-j nixos-nat-post-forward
'') (builtins.attrNames upstreamInterfaces)}
${lib.concatMapStringsSep "\n" ({ proto, destination, sourcePort, ... }:
let let
ds = builtins.split ":" destination; ds = builtins.split ":" destination;
ds' = port =
if builtins.length ds == 3 if builtins.length ds == 3
then { then lib.elemAt ds 2
dest = lib.elemAt ds 0;
port = lib.elemAt ds 2;
}
else if builtins.length ds == 1 else if builtins.length ds == 1
then { then toString sourcePort
dest = lib.elemAt ds 0;
port = toString sourcePort;
}
else throw "Too many colons in a forwardPorts destination"; else throw "Too many colons in a forwardPorts destination";
inherit (ds') dest port;
in '' in ''
iptables -t nat -A nixos-nat-post \ iptables -t nat -A nixos-nat-post-forward \
-p ${proto} --dest ${dest} --dport ${port} \ -p ${proto} --dport ${port} \
-j SNAT --to-source ${config.site.net.core.hosts4.${hostName}} -j SNAT --to-source ${config.site.net.core.hosts4.${hostName}}
'') hostConf.forwardPorts '') hostConf.forwardPorts}
); '';
extraStopCommands = extraStopCommands =
builtins.concatStringsSep "\n" ( builtins.concatStringsSep "\n" (
map (net: '' map (net: ''