Hi!

I’m trying to make a DIY router. I used configs from some online guides (the nftables one is from the project’s website), but nothing happens when I connect a different machine. I know that description doesn’t say much, so I’d like to know how can I check what’s actually wrong. My system (Guix) config is below:

(use-modules (gnu))
(use-service-modules cups desktop networking ssh xorg sysctl linux dns)

(define wan "enp0s29u1u5")

(define lan "enp0s25")

(define dnsmasq-config
  "# Listen on this specific port instead of the standard DNS port
# (53). Setting this to zero completely disables DNS function,
# leaving only DHCP and/or TFTP.
port=53
# Never forward plain names (without a dot or domain part)
domain-needed
# Never forward addresses in the non-routed address spaces.
bogus-priv
# By  default,  dnsmasq  will  send queries to any of the upstream
# servers it knows about and tries to favour servers to are  known
# to  be  up.  Uncommenting this forces dnsmasq to try each query
# with  each  server  strictly  in  the  order  they   appear   in
# /etc/resolv.conf
strict-order
# Set this (and domain: see below) if you want to have a domain
# automatically added to simple names in a hosts-file.
expand-hosts
# Set the domain for dnsmasq. this is optional, but if it is set, it
# does the following things.
# 1) Allows DHCP hosts to have fully qualified domain names, as long
#     as the domain part matches this setting.
# 2) Sets the \"domain\" DHCP option thereby potentially setting the
#    domain of all systems configured by DHCP
# 3) Provides the domain part for \"expand-hosts\"
#domain=thekelleys.org.uk
domain=example.com

# Set Listen address
listen-address=127.0.0.1 # Set to Server IP for network responses

dhcp-range=192.168.3.25,192.168.3.50,24h
dhcp-option=option:router,192.168.3.1
dhcp-option=option:ntp-server,192.168.3.5
dhcp-option=option:dns-server,192.168.3.5
dhcp-option=option:netmask,255.255.255.0
")

(define nftables-config
  (format #f
	  "flush ruleset

define DEV_PRIVATE = ~a
define DEV_WORLD = ~a
define NET_PRIVATE = 192.168.0.0/16

table ip global {

    chain inbound_world {
        # accepting ping (icmp-echo-request) for diagnostic purposes.
        # However, it also lets probes discover this host is alive.
        # This sample accepts them within a certain rate limit:
        #
        # icmp type echo-request limit rate 5/second accept

        # allow SSH connections from some well-known internet host
        ip saddr 81.209.165.42 tcp dport ssh accept
    }

    chain inbound_private {
        # accepting ping (icmp-echo-request) for diagnostic purposes.
        icmp type echo-request limit rate 5/second accept

        # allow DHCP, DNS and SSH from the private network
        ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept}
    }

    chain inbound {
        type filter hook input priority 0; policy drop;

        # Allow traffic from established and related packets, drop invalid
        ct state vmap { established : accept, related : accept, invalid : drop }

        # allow loopback traffic, anything else jump to chain for further evaluation
        iifname vmap { lo : accept, $DEV_WORLD : jump inbound_world, $DEV_PRIVATE : jump inbound_private }

        # the rest is dropped by the above policy
    }

    chain forward {
        type filter hook forward priority 0; policy drop;

        # Allow traffic from established and related packets, drop invalid
        ct state vmap { established : accept, related : accept, invalid : drop }

        # connections from the internal net to the internet or to other
        # internal nets are allowed
        iifname $DEV_PRIVATE accept

        # the rest is dropped by the above policy
    }

    chain postrouting {
        type nat hook postrouting priority 100; policy accept;

        # masquerade private IP addresses
        ip saddr $NET_PRIVATE oifname $DEV_WORLD masquerade
    }
}
" lan wan))

(operating-system
 (locale "en_GB.utf8")
 (timezone "Europe/Warsaw")
 (keyboard-layout (keyboard-layout "pl" "legacy" #:options '("ctrl:nocaps")))
 (host-name "router")

 (kernel-arguments
  (list
   "modprobe.blacklist=pcspkr,snd_pcsp"))
 
 ;; The list of user accounts ('root' is implicit).
 (users (cons* (user-account
                (name "formbi")
                (comment "Formbi")
                (group "users")
                (home-directory "/home/formbi")
                (supplementary-groups '("wheel" "netdev" "audio" "video")))
               %base-user-accounts))

 ;; Packages installed system-wide.  Users can also install packages
 ;; under their own account: use 'guix search KEYWORD' to search
 ;; for packages and 'guix install PACKAGE' to install a package.
 (packages
  (append (list (specification->package "nss-certs"))
                   %base-packages))

 ;; Below is the list of system services.  To search for available
 ;; services, run 'guix system search KEYWORD' in a terminal.
 (services
  (append (list
	   (service xfce-desktop-service-type)
	   (service guix-publish-service-type
		    (guix-publish-configuration
		     (port 2137)
		     (advertise? #t)))
	   (service earlyoom-service-type
		    (earlyoom-configuration
		     (avoid-regexp "emacs")
		     (minimum-available-memory 5)
		     (minimum-free-swap 20)))

           (service openssh-service-type)
           (service cups-service-type)

	   (service dnsmasq-service-type)

	   (extra-special-file "/etc/dnsmasq.conf"
			       (plain-file "dnsmasq.conf" dnsmasq-config))

	   (service nftables-service-type
		    (nftables-configuration
		     (ruleset (plain-file "nftables.conf" nftables-config))))


	   (set-xorg-configuration
            (xorg-configuration (keyboard-layout keyboard-layout))))

          ;; This is the default list of services we
          ;; are appending to.
	  (modify-services
	   %desktop-services
	   
	   (sysctl-service-type
	    config =>
	    (sysctl-configuration
	     (settings (append '(("vm.swappiness" . "10")
				 ("net.ipv4.ip_forward" . "1"))
			       %default-sysctl-settings))))

	   (network-manager-service-type
	    config =>
	    (network-manager-configuration
					;(dns "dnsmasq")
	     ))
	   
	   (guix-service-type
	    config =>
	    (guix-configuration
	     (discover? #t))))))
 
 (bootloader (bootloader-configuration
              (bootloader grub-bootloader)
              (targets (list "/dev/sda"))
              (keyboard-layout keyboard-layout)))
 (swap-devices (list (swap-space
                      (target (uuid
                               "a32aa366-c966-460f-9592-2a08c5cad947")))))

 ;; The list of file systems that get "mounted".  The unique
 ;; file system identifiers there ("UUIDs") can be obtained
 ;; by running 'blkid' in a terminal.
 (file-systems (cons* (file-system
                       (mount-point "/")
                       (device (uuid
                                "30b3a834-f23e-42ad-addf-0cde5538a96f"
                                'ext4))
                       (type "ext4")) %base-file-systems)))
  • lack@sh.itjust.worksEnglish
    1·
    1 year ago

    The first thing I noticed was that your servers “lan” interface has no IPv4 address. Compare the section for enp0s25 to that of your wan port… notice how the inet line is missing.

    Based on your dnsmasq config I assume you’d want the server to have a static IP of 192.168.3.1

    Dnsmasq is also going to configure the client with the DNS server and NTP set 192.168.3.5. Is this another machine in your network already, or is that a typo?

    • Formbi@lemmy.worldOPEnglish
      1·
      1 year ago

      «your servers “lan” interface has no IPv4 address» ok, so how can that be fixed?

      «Is this another machine in your network already, or is that a typo?» Probably a typo, I just copied it mindlessly :/. Now I have this:

      dhcp-range=192.168.0.25,192.168.0.50,24h
dhcp-option=option:router,192.168.0.1
dhcp-option=option:ntp-server,192.168.0.1
dhcp-option=option:dns-server,192.168.0.1
dhcp-option=option:netmask,255.255.255.0