eyJhb changed the topic of #nixos-on-your-router to: NixOS on your Router || https://logs.nix.samueldr.com/nixos-on-your-router
vuko has joined #nixos-on-your-router
bpye has quit [Ping timeout: 240 seconds]
bpye has joined #nixos-on-your-router
vuko has quit [Ping timeout: 246 seconds]
teozkr_ has quit [Ping timeout: 258 seconds]
teozkr_ has joined #nixos-on-your-router
bpye has quit [Ping timeout: 240 seconds]
bpye has joined #nixos-on-your-router
lopsided98 has quit [Ping timeout: 258 seconds]
lopsided98 has joined #nixos-on-your-router
monotux has joined #nixos-on-your-router
monotux has left #nixos-on-your-router [#nixos-on-your-router]
monotux has joined #nixos-on-your-router
vuko has joined #nixos-on-your-router
<bpye> I also don't suppose anyone has used the networking.sits config to setup an IPv6 tunnel? I played around last night but ended up reverting my changes because I ended up confusing myself...
vuko_ has joined #nixos-on-your-router
vuko has quit [Ping timeout: 265 seconds]
early` has quit [Quit: Leaving]
early has joined #nixos-on-your-router
vuko has joined #nixos-on-your-router
vuko_ has quit [Ping timeout: 268 seconds]
<aleph-> Alright bird2/ospf is... interesting
<aleph-> And a right pain to debug
vuko_ has joined #nixos-on-your-router
<hexa-> compared to what? :D
<aleph-> Heh compared to not getting it to work :p
<hexa-> right, that sounds tough :D
<hexa-> basically you have a `protocol ospf v3` block
<hexa-> that has an `area 0` block, in which you enable ospf on a certain interface
<hexa-> then you add an ipv6/ipv4 channel to handle export/import filters
<aleph-> Yep got that
<aleph-> Sec
<aleph-> Is my config
vuko has quit [Ping timeout: 260 seconds]
<hexa-> why do you need ptp?
<hexa-> is your other end openbsd?
<hexa-> s/other/remote/
<aleph-> FreeBSD(OPNSENSE)
<aleph-> I thought ptp was needed since we're on a point to point link
<hexa-> multicast will simply be broadcasted to the other party on a ptp link
<aleph-> Okay so lemme try that
<aleph-> Do they need multicast as well?
<hexa-> not entirely sure what the multicast toggle on an interface does
<aleph-> Hmm is that `type broadcast`? Or `type multicast`?
<aleph-> Think the former, latter errors
<hexa-> just don't give it a type
<hexa-> it will default to multicast
<aleph-> Ah
<hexa-> also drop the neighbor
<aleph-> Ah how come?
<hexa-> ospf will send messages to ff02::5
<hexa-> and both ends will subscribe to that group
<aleph-> Which is? (My ipv6 is negligent sadly)
<hexa-> all-somethings ._.
<aleph-> Got it.
<hexa-> OSPFIGP
<aleph-> Ah what if I'm not using ipv6? Was planning on ipv4 only for now
<hexa-> ff02::1 -> all nodes
<hexa-> ff02::2 -> all routers
<hexa-> does your tunnel support ipv6?
<hexa-> s/tunnel/link/
<aleph-> Yep it should, just plain wireguard
<hexa-> so add fe80::/64 addresses onto the link and you'll be fine
<hexa-> fe80::1/64 and fe80::2/64 for example
<aleph-> Hmm still seems like this should just work without ipv6 however :p
<hexa-> uh yeah, hmm
<hexa-> *duck*
<hexa-> or use ospfv2
<aleph-> Heh guess I should just use 2 for now yeah
<hexa-> not really :D
<aleph-> Heh
<hexa-> ospfv3 supports both ipv4 and ipv6
<hexa-> but communicates over ipv6
<hexa-> ospfv2 only supports ipv4
<aleph-> Ahhh that's... kinda odd
<aleph-> Guess it makes sense to networking folks
<aleph-> Okay yeah `ip a add fe80::/64 dev wg0` got the interface showing up
<hexa-> actually, fe80::1/64
<hexa-> and fe80::2/64
<hexa-> fe80::/64 is only the prefix
<hexa-> for link local addresses
<cransom> i'm not sure about the 'makes sense to networking folks' holds, its just because thats the way it's always been. you could swap to ISIS if you are particularly obsessed about one routing protocol.
<hexa-> yeah, and personally I use babel
<hexa-> also over wireguard
<aleph-> Heh which is easier? Thought OSPF was the simplest routing protocol to start with
<hexa-> it is not really about 'easier'
<cransom> i don' tknow about easier, but you can read about them and see if there's one in particular that suits your requirements. ospf however, is ubiquitous and everything speaks it, and most kind of know how to use it.
<hexa-> ospf works out ok on fixed links
<aleph-> Hmm well this is progress at least.
<aleph-> `ospf1: Socket error on wg0: Required key not available`
<aleph-> Probably need to add ipv6 to my allowed ips
<hexa-> wg show
<hexa-> tl;dr: no handshake has occured yet with the other end
<hexa-> oh yeah, that
<hexa-> fe80::/64 to allowedips
<aleph-> Yeah I really need to read up on ipv6 finally heh
<hexa-> the gist about link local addresses is: they're free and you can use them on any link, they are scoped to a link, so you can reuse them everywhere
<aleph-> Good to know.
<hexa-> scoped to link means, that given an fe80::1 address, to reach it you must also specify the interface it is sc oped to
<hexa-> fe80::1%wg0
<aleph-> Interesting.
<hexa-> and you could have fe80::1/64 on 5 interfaces on your system
<aleph-> Nifty
<hexa-> it is only valid on that link, and it is not routable
<aleph-> Now just need to update wg on the remote to have `fe80::/64` in the AlloweIps
<aleph-> Hmm wonder if I can set wireguard to set multiple addresses so I can stop manually adding this...
<aleph-> Yep
<aleph-> Okay yeah just doing ospf v2 for now heh
<aleph-> I'll need to do some reading on ipv6 late tonight heh
<aleph-> Hmm. hexa- say I'm using ospf v2 I only want to route one subnet to my friends remote and they want to route to my remote. I want unicast I think and not multicast, so setting type to ptp/pointopint and setting the neighbor explicitly to wg hop to his end) should work no?
<aleph-> Is my bird conf now: https://paste.rs/Gxj
<aleph-> And my wg config is: https://paste.rs/ZGt
<cransom> i don't think you want point to point. that behavior relies more on things like direct serial connections where there can only be 2 machines chatting on the line.
<aleph-> Ah, is there another way to denote unicast then?
<cransom> i don't think it's useful to state it at all
<aleph-> Hmm doesn't it default to multicast then no? Or at least that's what I'm reading
<cransom> well, maybe the unicast is required. i haven't done this over wireguard before. i would probably say that if you are communicating with another administrative domain, that's where bgp should be happening rather than ospf.
<aleph-> Possibly yeah. Just wanted to start with OSPF first before moving onto EBPG
<cransom> they aren't exclusive of eachother. there's no graduation from one to the other. bgp has protection and more interesting filtering options that ospf wasn't meant to provide.
<aleph-> Fair enough
<cransom> you can do lots of weird things with networks, and i won't stop you. just if you were curious about doing more, using the right tools for the job helps.
<aleph-> Hmm I need to do more reading on ospf and bgp then. I'm this close to getting these idjits to say hello
vuko_ has quit [Ping timeout: 260 seconds]
mmlb has quit [Quit: The Lounge - https://thelounge.github.io]
mmlb has joined #nixos-on-your-router