···
cfg = config.networking.nat;
+
mkDest = externalIP: if externalIP == null
+
else "-j SNAT --to-source ${externalIP}";
+
dest = mkDest cfg.externalIP;
+
destIPv6 = mkDest cfg.externalIPv6;
+
# Whether given IP (plus optional port) is an IPv6.
+
isIPv6 = ip: builtins.length (lib.splitString ":" ip) > 2;
helpers = import ./helpers.nix { inherit config lib; };
···
+
mkSetupNat = { iptables, dest, internalIPs, forwardPorts }: ''
# We can't match on incoming interface in POSTROUTING, so
# mark packets coming from the internal interfaces.
${concatMapStrings (iface: ''
+
${iptables} -w -t nat -A nixos-nat-pre \
-i '${iface}' -j MARK --set-mark 1
'') cfg.internalInterfaces}
# NAT the marked packets.
${optionalString (cfg.internalInterfaces != []) ''
+
${iptables} -w -t nat -A nixos-nat-post -m mark --mark 1 \
${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
# NAT packets coming from the internal IPs.
${concatMapStrings (range: ''
+
${iptables} -w -t nat -A nixos-nat-post \
-s '${range}' ${optionalString (cfg.externalInterface != null) "-o ${cfg.externalInterface}"} ${dest}
# NAT from external ports to internal ports.
${concatMapStrings (fwd: ''
+
${iptables} -w -t nat -A nixos-nat-pre \
-i ${toString cfg.externalInterface} -p ${fwd.proto} \
--dport ${builtins.toString fwd.sourcePort} \
-j DNAT --to-destination ${fwd.destination}
${concatMapStrings (loopbackip:
+
matchIP = if isIPv6 fwd.destination then "[[]([0-9a-fA-F:]+)[]]" else "([0-9.]+)";
+
m = builtins.match "${matchIP}:([0-9-]+)" fwd.destination;
+
destinationIP = if m == null then throw "bad ip:ports `${fwd.destination}'" else elemAt m 0;
+
destinationPorts = if m == null then throw "bad ip:ports `${fwd.destination}'" else builtins.replaceStrings ["-"] [":"] (elemAt m 1);
# Allow connections to ${loopbackip}:${toString fwd.sourcePort} from the host itself
+
${iptables} -w -t nat -A nixos-nat-out \
-d ${loopbackip} -p ${fwd.proto} \
--dport ${builtins.toString fwd.sourcePort} \
-j DNAT --to-destination ${fwd.destination}
# Allow connections to ${loopbackip}:${toString fwd.sourcePort} from other hosts behind NAT
+
${iptables} -w -t nat -A nixos-nat-pre \
-d ${loopbackip} -p ${fwd.proto} \
--dport ${builtins.toString fwd.sourcePort} \
-j DNAT --to-destination ${fwd.destination}
+
${iptables} -w -t nat -A nixos-nat-post \
-d ${destinationIP} -p ${fwd.proto} \
--dport ${destinationPorts} \
-j SNAT --to-source ${loopbackip}
+
# Create subchains where we store rules
+
ip46tables -w -t nat -N nixos-nat-pre
+
ip46tables -w -t nat -N nixos-nat-post
+
ip46tables -w -t nat -N nixos-nat-out
+
inherit (cfg) internalIPs;
+
forwardPorts = filter (x: !(isIPv6 x.destination)) cfg.forwardPorts;
+
${optionalString cfg.enableIPv6 (mkSetupNat {
+
iptables = "ip6tables";
+
internalIPs = cfg.internalIPv6s;
+
forwardPorts = filter (x: isIPv6 x.destination) cfg.forwardPorts;
${optionalString (cfg.dmzHost != null) ''
iptables -w -t nat -A nixos-nat-pre \
···
+
networking.nat.enableIPv6 = mkOption {
+
Whether to enable IPv6 NAT.
networking.nat.internalInterfaces = mkOption {
type = types.listOf types.str;
···
+
networking.nat.internalIPv6s = mkOption {
+
type = types.listOf types.str;
+
example = [ "fc00::/64" ];
+
The IPv6 address ranges for which to perform NAT. Packets
+
coming from these addresses (on any interface) and destined
+
for the external interface will be rewritten.
networking.nat.externalInterface = mkOption {
type = types.nullOr types.str;
···
+
networking.nat.externalIPv6 = mkOption {
+
type = types.nullOr types.str;
+
example = "2001:dc0:2001:11::175";
+
The public IPv6 address to which packets from the local
+
network are to be rewritten. If this is left empty, the
+
IP address associated with the external interface will be
networking.nat.forwardPorts = mkOption {
type = with types; listOf (submodule {
···
+
description = "Forward connection to destination ip:port (or [ipv6]:port); to specify a port range, use ip:start-end";
···
+
{ sourcePort = 8080; destination = "10.0.0.1:80"; proto = "tcp"; }
+
{ sourcePort = 8080; destination = "[fc00::2]:80"; proto = "tcp"; }
List of forwarded ports from the external interface to
+
internal destinations by using DNAT. Destination can be
+
IPv6 if IPv6 NAT is enabled.
···
(mkIf config.networking.nat.enable {
+
{ assertion = cfg.enableIPv6 -> config.networking.enableIPv6;
+
message = "networking.nat.enableIPv6 requires networking.enableIPv6";
{ assertion = (cfg.dmzHost != null) -> (cfg.externalInterface != null);
message = "networking.nat.dmzHost requires networking.nat.externalInterface";
···
"net.ipv4.conf.all.forwarding" = mkOverride 99 true;
"net.ipv4.conf.default.forwarding" = mkOverride 99 true;
+
} // optionalAttrs cfg.enableIPv6 {
+
# Do not prevent IPv6 autoconfiguration.
+
# See <http://strugglers.net/~andy/blog/2011/09/04/linux-ipv6-router-advertisements-and-forwarding/>.
+
"net.ipv6.conf.all.accept_ra" = mkOverride 99 2;
+
"net.ipv6.conf.default.accept_ra" = mkOverride 99 2;
+
# Forward IPv6 packets.
+
"net.ipv6.conf.all.forwarding" = mkOverride 99 true;
+
"net.ipv6.conf.default.forwarding" = mkOverride 99 true;
pyrox.dev