On Tue, Aug 30, 2022 at 13:27:45 -0400, Peter Polidoro wrote:
This looks great, thank you!
I will test it out as soon as I get a chance.
Great!
- Set up static IPv4-only networking.
For my particular case I would like a dynamic IP address on the wan
interface and static IP addresses on the lan interfaces if that is
possible.
I haven't used DHCP. If you find out that dhcp-client-service-type is
not flexible enough to listen only on the wan interface, you can always
write your own service definition as I did for Dnsmasq.
To run without error, the code requires
nftables to be installed as it is used to check the rules.
Does nftables-service-type automatically install nftables?
Good you ask! My wording was a bit sloppy.
By specifying nftables-service-type, Guix does all necessary steps to
configure the Linux kernel's Netfilter. So you don't have to think about
that.
But have a look at these lines from my last mail:
(let ((port (open-output-pipe "nft -c -f -")))
(display (plain-file-content %my-nftables-ruleset) port)
(if (not (eqv? 0 (status:exit-val (close-pipe port))))
(error "Nftables rules don't pass check")))
For the first test, you can just remove these four lines of code and
don't worry about it.
I wrote this code, because I wanted to ensure that the rules are at
least syntactically correct before Guix activates the new operating
system definition. The main reason is that my router machine is quite
slow and reconfiguration takes, say, a minute or so.
If you configure your system with syntactically incorrect rules, 'herd
status' (perhaps with 'sudo' in front of it) will report the service
failing and there might be log messages at /var/log/messages. Make sure
to have console access to the machine, as SSH (and networking in
general) is likely to not work.
The above code invokes the 'nft' binary in check mode (-c) and pipes to
it's standard input the rules, which are to be included in the operating
system definition.
If you don't have nft in a directory listed in your PATH environment
variable, trying to invoke nft will lead to some error (a non-zero exit
code of the shell). At this point, my code will just fail and you get no
operating system definition at all.
There are more elegant ways to perform such a check. I am convinced it
is possible to let the build daemon execute the check, but I haven't
looked into that.
Greetings
Niklas