|
|
|
@ -1,9 +1,11 @@
|
|
|
|
|
{ hostName, config, lib, ... }:
|
|
|
|
|
|
|
|
|
|
let
|
|
|
|
|
hostConf = config.site.hosts.${hostName};
|
|
|
|
|
|
|
|
|
|
upstreamInterfaces =
|
|
|
|
|
lib.filterAttrs (_: { upstream, ... }: upstream != null)
|
|
|
|
|
config.site.hosts.${hostName}.interfaces;
|
|
|
|
|
hostConf.interfaces;
|
|
|
|
|
|
|
|
|
|
firstUpstreamInterface =
|
|
|
|
|
if builtins.length (builtins.attrNames upstreamInterfaces) > 0
|
|
|
|
@ -46,6 +48,27 @@ in
|
|
|
|
|
enable = true;
|
|
|
|
|
internalInterfaces = [ "core" ];
|
|
|
|
|
externalInterface = firstUpstreamInterface;
|
|
|
|
|
inherit (config.site.hosts.${hostName}) forwardPorts;
|
|
|
|
|
# Provide IPv6 upstream for everyone, using NAT66 when not from
|
|
|
|
|
# our static prefixes
|
|
|
|
|
extraCommands =
|
|
|
|
|
builtins.concatStringsSep "\n" (
|
|
|
|
|
map (net: ''
|
|
|
|
|
ip6tables -t nat -X ${net}_nat || true
|
|
|
|
|
ip6tables -t nat -N ${net}_nat
|
|
|
|
|
${builtins.concatStringsSep "\n" (
|
|
|
|
|
map (subnet: ''
|
|
|
|
|
ip6tables -t nat -A ${net}_nat \
|
|
|
|
|
-s ${subnet} \
|
|
|
|
|
-j RETURN
|
|
|
|
|
'') upstreamInterfaces.${net}.upstream.noNat.subnets6
|
|
|
|
|
)}
|
|
|
|
|
ip6tables -t nat -A ${net}_nat -j MASQUERADE
|
|
|
|
|
|
|
|
|
|
ip6tables -t nat -A POSTROUTING \
|
|
|
|
|
-o ${net} \
|
|
|
|
|
-j ${net}_nat
|
|
|
|
|
'') (builtins.attrNames upstreamInterfaces)
|
|
|
|
|
);
|
|
|
|
|
inherit (hostConf) forwardPorts;
|
|
|
|
|
};
|
|
|
|
|
}
|
|
|
|
|