Hi!
I'm trying to make a DIY router. I used configs from some online guides (the nftables one is from the project's website), but nothing happens when I connect a different machine. I know that description doesn't say much, so I'd like to know how can I check what's actually wrong. My system (Guix) config is below:
(use-modules (gnu))
(use-service-modules cups desktop networking ssh xorg sysctl linux dns)
(define wan "enp0s29u1u5")
(define lan "enp0s25")
(define dnsmasq-config
"# Listen on this specific port instead of the standard DNS port
# (53). Setting this to zero completely disables DNS function,
# leaving only DHCP and/or TFTP.
port=53
# Never forward plain names (without a dot or domain part)
domain-needed
# Never forward addresses in the non-routed address spaces.
bogus-priv
# By default, dnsmasq will send queries to any of the upstream
# servers it knows about and tries to favour servers to are known
# to be up. Uncommenting this forces dnsmasq to try each query
# with each server strictly in the order they appear in
# /etc/resolv.conf
strict-order
# Set this (and domain: see below) if you want to have a domain
# automatically added to simple names in a hosts-file.
expand-hosts
# Set the domain for dnsmasq. this is optional, but if it is set, it
# does the following things.
# 1) Allows DHCP hosts to have fully qualified domain names, as long
# as the domain part matches this setting.
# 2) Sets the \"domain\" DHCP option thereby potentially setting the
# domain of all systems configured by DHCP
# 3) Provides the domain part for \"expand-hosts\"
#domain=thekelleys.org.uk
domain=example.com
# Set Listen address
listen-address=127.0.0.1 # Set to Server IP for network responses
dhcp-range=192.168.3.25,192.168.3.50,24h
dhcp-option=option:router,192.168.3.1
dhcp-option=option:ntp-server,192.168.3.5
dhcp-option=option:dns-server,192.168.3.5
dhcp-option=option:netmask,255.255.255.0
")
(define nftables-config
(format #f
"flush ruleset
define DEV_PRIVATE = ~a
define DEV_WORLD = ~a
define NET_PRIVATE = 192.168.0.0/16
table ip global {
chain inbound_world {
# accepting ping (icmp-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit:
#
# icmp type echo-request limit rate 5/second accept
# allow SSH connections from some well-known internet host
ip saddr 81.209.165.42 tcp dport ssh accept
}
chain inbound_private {
# accepting ping (icmp-echo-request) for diagnostic purposes.
icmp type echo-request limit rate 5/second accept
# allow DHCP, DNS and SSH from the private network
ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept}
}
chain inbound {
type filter hook input priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
# allow loopback traffic, anything else jump to chain for further evaluation
iifname vmap { lo : accept, $DEV_WORLD : jump inbound_world, $DEV_PRIVATE : jump inbound_private }
# the rest is dropped by the above policy
}
chain forward {
type filter hook forward priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
# connections from the internal net to the internet or to other
# internal nets are allowed
iifname $DEV_PRIVATE accept
# the rest is dropped by the above policy
}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
# masquerade private IP addresses
ip saddr $NET_PRIVATE oifname $DEV_WORLD masquerade
}
}
" lan wan))
(operating-system
(locale "en_GB.utf8")
(timezone "Europe/Warsaw")
(keyboard-layout (keyboard-layout "pl" "legacy" #:options '("ctrl:nocaps")))
(host-name "router")
(kernel-arguments
(list
"modprobe.blacklist=pcspkr,snd_pcsp"))
;; The list of user accounts ('root' is implicit).
(users (cons* (user-account
(name "formbi")
(comment "Formbi")
(group "users")
(home-directory "/home/formbi")
(supplementary-groups '("wheel" "netdev" "audio" "video")))
%base-user-accounts))
;; Packages installed system-wide. Users can also install packages
;; under their own account: use 'guix search KEYWORD' to search
;; for packages and 'guix install PACKAGE' to install a package.
(packages
(append (list (specification->package "nss-certs"))
%base-packages))
;; Below is the list of system services. To search for available
;; services, run 'guix system search KEYWORD' in a terminal.
(services
(append (list
(service xfce-desktop-service-type)
(service guix-publish-service-type
(guix-publish-configuration
(port 2137)
(advertise? #t)))
(service earlyoom-service-type
(earlyoom-configuration
(avoid-regexp "emacs")
(minimum-available-memory 5)
(minimum-free-swap 20)))
(service openssh-service-type)
(service cups-service-type)
(service dnsmasq-service-type)
(extra-special-file "/etc/dnsmasq.conf"
(plain-file "dnsmasq.conf" dnsmasq-config))
(service nftables-service-type
(nftables-configuration
(ruleset (plain-file "nftables.conf" nftables-config))))
(set-xorg-configuration
(xorg-configuration (keyboard-layout keyboard-layout))))
;; This is the default list of services we
;; are appending to.
(modify-services
%desktop-services
(sysctl-service-type
config =>
(sysctl-configuration
(settings (append '(("vm.swappiness" . "10")
("net.ipv4.ip_forward" . "1"))
%default-sysctl-settings))))
(network-manager-service-type
config =>
(network-manager-configuration
;(dns "dnsmasq")
))
(guix-service-type
config =>
(guix-configuration
(discover? #t))))))
(bootloader (bootloader-configuration
(bootloader grub-bootloader)
(targets (list "/dev/sda"))
(keyboard-layout keyboard-layout)))
(swap-devices (list (swap-space
(target (uuid
"a32aa366-c966-460f-9592-2a08c5cad947")))))
;; The list of file systems that get "mounted". The unique
;; file system identifiers there ("UUIDs") can be obtained
;; by running 'blkid' in a terminal.
(file-systems (cons* (file-system
(mount-point "/")
(device (uuid
"30b3a834-f23e-42ad-addf-0cde5538a96f"
'ext4))
(type "ext4")) %base-file-systems)))
