hexa- changed the topic of #nixos-on-your-router to: NixOS on your Router
gchristensen has joined #nixos-on-your-router
<clever> gchristensen: hairpin nat?, is that when it port-forwards for accessing the pubip from inside its own network?
<gchristensen> yeah
<gchristensen> clever:
<clever> gchristensen: ive done it before, when my router ran linux from scratch, lol
<clever> ive not bothered doing it on nixos yet, but i remember roughly how it works, i would need to edit nixpkgs to make it work right
<clever> it basically doubles the number of rules in iptables
<clever> it needs both snat and dnat, you must mess with the source ip and claim the packets come from 192.168.1.1
<clever> so when the destination replies to the router, the router can un-nat things
<gchristensen> ouch
<clever> without the snat, the dest replies to the origin, and then the reply is coming from the wrong addr, and it fails
<clever> but nixos would make it possible to do on a per-forwarding basis
<clever> { destination = "192.168.2.62"; sourcePort = 80; }-
<clever> could become
<clever> { destination = "192.168.2.62"; sourcePort = 80; enableHairpin = true; }
<clever> and then only 80 can hairpin, and your rules dont double
<clever> back on LFS, it was much simpler, pure custom bash :P
<gchristensen> "simpler" :D
<gchristensen> I'd rather just use IPv6 but I've not managed to get that working either.
<clever> i did have v6 fully working
<clever> but after updating something, it ceased to forward packets
<clever> and i noticed a bit late, so i dont know how far to rollback, lol
<clever> was simpler to just disable v6, rather then fix
<gchristensen> hehe
<gchristensen> also maybe your ISP broke it somehow
<clever> nope, using a tunnel
<clever> the router itself has working v6
<clever> but it wont forward packets from the lan
<gchristensen> ahh
<gchristensen> huh, do we have the same problem?
<clever> possibly
<clever> let me see...
<clever> i have a wan6 interface on the router, with a v6 ip
<clever> ping6 fails currently...
<gchristensen> ehh I'm too tired to actually look in to why it is broken
<clever> because my ISP changed the v4 addr from 165 to 156 one night
<clever> and the tunnel is offline
<gchristensen> heh
<clever> [root@router:~]# ping6 irc.freenode.net -c 3
<clever> 64 bytes from leguin.acc.umu.se: icmp_seq=1 ttl=42 time=167 ms
<clever> PING irc.freenode.net(leguin.acc.umu.se) 56 data bytes
<clever> ok, tunnel is back online
<clever> next is radvd
<clever> services.radvd.enable = true;
<clever> nixops deploy -d house --include router
<clever> wait, what? lol
<clever> router> restarting systemd...
<clever> ping?
<clever> gchristensen: ok, i think its back online
<gchristensen> :)
<clever> the desktop has noticed radvd, and configured itself
<clever> `ip addr` and `ip -6 route` look right at a glance
<clever> but it cant ping
<clever> [root@router:~]# tcpdump -i enp4s2f1 -p -n ip6 and icmp6
<clever> 00:36:57.043144 IP6 2001:470:1d:19a:4216:7eff:feb3:3248 > 2001:1ad8:8:6667:5718::: ICMP6, echo request, seq 1, length 64
<clever> i can see the pings coming into the router LAN port
<gchristensen> can you see them leaving the WAN port?
<clever> nothing going out wan or wan6(the tunnel)
<clever> [root@router:~]# ip -6 route
<clever> default dev wan6 metric 1024 pref medium
<clever> but the default route says it should
<clever> so the router is choosing to not route?
<clever> [root@router:~]# cat /proc/sys/net/ipv6/conf/all/forwarding
<clever> 0
<clever> wait, why is that 0?
<clever> writting a 1 to it (despite having ran a bash script that does just that) gets the packets going out wan6, but no reply yet
<clever> 00:40:32.834313 IP6 2001:470:1d:19a:4216:7eff:feb3:3248 > 2001:708:40:2001::f5ee:d0de: ICMP6, echo request, seq 1, length 64
<clever> From router.local (2001:470:1d:19a:3d38:e4f5:6d3e:2eeb): icmp_seq=1 Destination unreachable: Address unreachable
<clever> the router is both forwarding the packets, and claiming it cant forward them
<clever> 2001:470:1d:19a::/64
<clever> ah, wait, miscounted the bits
<clever> gchristensen: i'm starting to suspect that it might be the nixos firewall
<gchristensen> hmmm oh?
<gchristensen> hmm
<gchristensen> like the packet marking?
<clever> previously, nixos didnt touch v6 at all
<clever> so if you knew the v6 addr of an internal machine, it was like the router wasnt even there
<clever> so half the house was wide open :P
<clever> i think somebody "fixed" that
<clever> i'll need to do more testing...
<gchristensen> ouch.
<gchristensen> but
<gchristensen> hmm
<gchristensen> other people here have working ipv6 with a nixos router
v0|d has joined #nixos-on-your-router
gchristensen has quit [Quit: Connection closed for inactivity]
gchristensen has joined #nixos-on-your-router
Guanin has joined #nixos-on-your-router
Guanin_ has joined #nixos-on-your-router
Guanin_ has quit [Client Quit]