Hi!
I’m trying to make a DIY router. I used configs from some online guides (the nftables one is from the project’s website), but nothing happens when I connect a different machine. I know that description doesn’t say much, so I’d like to know how can I check what’s actually wrong. My system (Guix) config is below:
(use-modules (gnu))
(use-service-modules cups desktop networking ssh xorg sysctl linux dns)
(define wan "enp0s29u1u5")
(define lan "enp0s25")
(define dnsmasq-config
"# Listen on this specific port instead of the standard DNS port
# (53). Setting this to zero completely disables DNS function,
# leaving only DHCP and/or TFTP.
port=53
# Never forward plain names (without a dot or domain part)
domain-needed
# Never forward addresses in the non-routed address spaces.
bogus-priv
# By default, dnsmasq will send queries to any of the upstream
# servers it knows about and tries to favour servers to are known
# to be up. Uncommenting this forces dnsmasq to try each query
# with each server strictly in the order they appear in
# /etc/resolv.conf
strict-order
# Set this (and domain: see below) if you want to have a domain
# automatically added to simple names in a hosts-file.
expand-hosts
# Set the domain for dnsmasq. this is optional, but if it is set, it
# does the following things.
# 1) Allows DHCP hosts to have fully qualified domain names, as long
# as the domain part matches this setting.
# 2) Sets the \"domain\" DHCP option thereby potentially setting the
# domain of all systems configured by DHCP
# 3) Provides the domain part for \"expand-hosts\"
#domain=thekelleys.org.uk
domain=example.com
# Set Listen address
listen-address=127.0.0.1 # Set to Server IP for network responses
dhcp-range=192.168.3.25,192.168.3.50,24h
dhcp-option=option:router,192.168.3.1
dhcp-option=option:ntp-server,192.168.3.5
dhcp-option=option:dns-server,192.168.3.5
dhcp-option=option:netmask,255.255.255.0
")
(define nftables-config
(format #f
"flush ruleset
define DEV_PRIVATE = ~a
define DEV_WORLD = ~a
define NET_PRIVATE = 192.168.0.0/16
table ip global {
chain inbound_world {
# accepting ping (icmp-echo-request) for diagnostic purposes.
# However, it also lets probes discover this host is alive.
# This sample accepts them within a certain rate limit:
#
# icmp type echo-request limit rate 5/second accept
# allow SSH connections from some well-known internet host
ip saddr 81.209.165.42 tcp dport ssh accept
}
chain inbound_private {
# accepting ping (icmp-echo-request) for diagnostic purposes.
icmp type echo-request limit rate 5/second accept
# allow DHCP, DNS and SSH from the private network
ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept}
}
chain inbound {
type filter hook input priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
# allow loopback traffic, anything else jump to chain for further evaluation
iifname vmap { lo : accept, $DEV_WORLD : jump inbound_world, $DEV_PRIVATE : jump inbound_private }
# the rest is dropped by the above policy
}
chain forward {
type filter hook forward priority 0; policy drop;
# Allow traffic from established and related packets, drop invalid
ct state vmap { established : accept, related : accept, invalid : drop }
# connections from the internal net to the internet or to other
# internal nets are allowed
iifname $DEV_PRIVATE accept
# the rest is dropped by the above policy
}
chain postrouting {
type nat hook postrouting priority 100; policy accept;
# masquerade private IP addresses
ip saddr $NET_PRIVATE oifname $DEV_WORLD masquerade
}
}
" lan wan))
(operating-system
(locale "en_GB.utf8")
(timezone "Europe/Warsaw")
(keyboard-layout (keyboard-layout "pl" "legacy" #:options '("ctrl:nocaps")))
(host-name "router")
(kernel-arguments
(list
"modprobe.blacklist=pcspkr,snd_pcsp"))
;; The list of user accounts ('root' is implicit).
(users (cons* (user-account
(name "formbi")
(comment "Formbi")
(group "users")
(home-directory "/home/formbi")
(supplementary-groups '("wheel" "netdev" "audio" "video")))
%base-user-accounts))
;; Packages installed system-wide. Users can also install packages
;; under their own account: use 'guix search KEYWORD' to search
;; for packages and 'guix install PACKAGE' to install a package.
(packages
(append (list (specification->package "nss-certs"))
%base-packages))
;; Below is the list of system services. To search for available
;; services, run 'guix system search KEYWORD' in a terminal.
(services
(append (list
(service xfce-desktop-service-type)
(service guix-publish-service-type
(guix-publish-configuration
(port 2137)
(advertise? #t)))
(service earlyoom-service-type
(earlyoom-configuration
(avoid-regexp "emacs")
(minimum-available-memory 5)
(minimum-free-swap 20)))
(service openssh-service-type)
(service cups-service-type)
(service dnsmasq-service-type)
(extra-special-file "/etc/dnsmasq.conf"
(plain-file "dnsmasq.conf" dnsmasq-config))
(service nftables-service-type
(nftables-configuration
(ruleset (plain-file "nftables.conf" nftables-config))))
(set-xorg-configuration
(xorg-configuration (keyboard-layout keyboard-layout))))
;; This is the default list of services we
;; are appending to.
(modify-services
%desktop-services
(sysctl-service-type
config =>
(sysctl-configuration
(settings (append '(("vm.swappiness" . "10")
("net.ipv4.ip_forward" . "1"))
%default-sysctl-settings))))
(network-manager-service-type
config =>
(network-manager-configuration
;(dns "dnsmasq")
))
(guix-service-type
config =>
(guix-configuration
(discover? #t))))))
(bootloader (bootloader-configuration
(bootloader grub-bootloader)
(targets (list "/dev/sda"))
(keyboard-layout keyboard-layout)))
(swap-devices (list (swap-space
(target (uuid
"a32aa366-c966-460f-9592-2a08c5cad947")))))
;; The list of file systems that get "mounted". The unique
;; file system identifiers there ("UUIDs") can be obtained
;; by running 'blkid' in a terminal.
(file-systems (cons* (file-system
(mount-point "/")
(device (uuid
"30b3a834-f23e-42ad-addf-0cde5538a96f"
'ext4))
(type "ext4")) %base-file-systems)))
I mean, if you don’t understand the components that you are using to build your custom router enough to be able to debug it’s function, you most likely shouldn’t be building it in the first place