<hexa->
Unbound and kresd are far better resolvers
<hexa->
dnsmasq is an embedded devices product with lots of compromises
ottidmes has quit [Ping timeout: 240 seconds]
ottidmes has joined #nixos-on-your-router
<ottidmes>
hexa-: Thanks for the info! Then I won't bother with dnsmasq anymore, the router is powerful enough to do pretty much anything, I could replace my parents desktop with it probably :P so it should handle heavier software than dnsmasq just fine
<ottidmes>
I see someone on the kresd team is someone from the NixOS community, cool
<ottidmes>
And used by 1.1.1.1, that's awesome
<thefloweringash>
the main reason I've been using dnsmasq is to have easy reverse dns for dhcp leases
<thefloweringash>
I've set it up with the isc components before, but didn't enjoy it and went back to dnsmasq
<thefloweringash>
what's the story with kresd + ... ?
<ottidmes>
So far I have read, most people that tried kresd were very positive about it and kept using it, haven't used it myself, I guess you would use it with dhcpd, but not sure if there are alternative to that
<ottidmes>
I am working on my router config at the moment, the router configs I see at the moment have all their vlans on a bridge, that would be tagged vlans then? With my 6 gigabit port router, there is no need, right? (my knowledge about networking is still not quite at the level you would need to run your own router, but what better way to learn then to setup your own :P)
<cransom>
i don't have my vlans on a bridge, just a single interface. do you have a managed/vlan capable switch?
<ottidmes>
vlan capable switch, you mean as its own device? I have mostly TP-Link 8 port switches laying around
<cransom>
you can configure a vlan on your router, but if the device on the other end (being another router or a switch) doesn't speak vlans, it won't work. if you have 6 ports on your router, you'll probably just be doing your own bridging. there won't be vlans.
<cransom>
you should make a diagram.
<cransom>
talking about networks is like dancing about architecture.
<ottidmes>
I do now have like 4 different subnets in terms of cabling that come together where the router will be
<ottidmes>
A got that already, not as a diagram per se, but that part is crystal clear
<ottidmes>
Got a nice Nix structure stating all devices in each vlan (guess I have to start renaming them)
<ottidmes>
And this is based on reality, I copied the data straight out of my current router's DHCP config
<ottidmes>
I am just trying to understand how to approach my firewall and other networking config
<cransom>
and i'd love to help, but the terminology barrier is making it hard as you keep saying vlans, but you aren't going to have vlans. as far as i know.
<ottidmes>
Sorry for that confusion, but other than that, it is just 4 seperated groups of ethernet connected devices coming seperately at the place where the router is
<cransom>
ok, then yes. no vlans involved. maybe some bridging for one subnet on 2 ports.
<ottidmes>
Right, so if I connected one device to one of the left over ports, but it should be part of one of the other ports subnet, I would use a bridge, connecting those two interfaces as one?
<cransom>
correct
<ottidmes>
and the ACCEPT/DROP names in calls to iptables, how are they different from nixos-fw-refuse and kind?
<cransom>
why use nixos-fw-refuse instead just a drop?
<ottidmes>
And wondering if there is any special meaning to -j nixos-fw-accept compared to -j ACCEPT, or that ACCEPT is just the default from iptables and the nixos-fw- ones are just there to make clear they have been defined by nixos
<ottidmes>
Basically that question, yes
<cransom>
it makes statistics nicer if you use it. iptables -vL and you see packets/bytes by each rule.
<cransom>
but, it's just organization/style.
<ottidmes>
Ah, thanks for clearing that up :)
<ottidmes>
And to make sure any guest device does not communicate to anything in the network, except the internet, I would use this rule repeatedly for those interfaces, right? ip46tables -A FORWARD -m state --state NEW -i guest -o guest -j DROP (but also for -o home, -o pro, for each of the LAN interfaces)
<cransom>
that would allow devices from home to connect to guest though. if you don't want that, i would remove the state checking.
<ottidmes>
good call, thanks
<ottidmes>
And probably a dumb question, why is that enough to also block home going in to guest? Naively I would have expected the need for: ip46tables -A FORWARD -i home -o guest -j DROP, too (i.e. the other way around in terms of in/out)
<cransom>
it's mostly enough. technically you can get packets from home to guest, but if there's no state check, guest->home traffic is dropped.
<cransom>
doing the opposite would be good hygiene.
<ottidmes>
Ah, then I will add them :)
<cransom>
the well set up firewalls drop all traffic by default, but it's extra admin overhead so typically not a thing on residential setups.