A simple module to make NixOS act as a router!

This uses:

• nftables for firewalling & NAT,
• dnsmasq as a DHCP server; it also forwards DNS to…
• stubby for secure DNS over TLS & DNSSEC validation
• hostapd for running a WLAN Access Point with WPA3 SAE-PK security

Simply include the module in your NixOS config flake:

# flake.nix { inputs = { nixos-router.url = "github:42LoCo42/nixos-router"; # no need to "follow" any inputs! }; }

And configure it like this:

# configuration.nix { self, ... }: { imports = [ self.inputs.nixos-router.nixosModules.default ]; services.router = { enable = true; lanIF = "wlan0"; wanIF = "eth0"; wlan = { ssid = "My Network"; passwordFile = "/var/lib/wlan-password.sae"; }; }; }

You need a SAE password file to use WLAN; to generate it do this:

# obtain required tools nix shell nixpkgs#openssl github:42LoCo42/obscura#sae_pk_gen # generate the EC keypair openssl ecparam -name prime256v1 -genkey -noout -out wlan-password.der -outform der # convert to SAE password file # use the same SSID here! sae_pk_gen wlan-password.der 3 "My Network" | sed 's|sae_password=||' >wlan-password.sae

The file wlan-password.der can now be deleted. Its contents are part of wlan-password.sae. Speaking of, check out that file to get the WLAN password!

You can also select a longer one from the list in the file (but you can’t pick your own due to how SAE-PK works). To change the password, just put it at the start of the line that’s not a comment!

YOUR-WLAN-PASS-WORD|pk=<very long string> 

Tired of manually entering passwords? Run sudo qr to display a QR code that you can scan with your phone to automatically connect to the WLAN!

• enable (bool): Enable this module. Default: false
• lanIF (string): Name of the LAN (internal) network interface. Required!
• wanIF (string): Name of the WAN (external) network interface. Required!
• lanIP (string): LAN IP of the router. Default: 10.0.0.1
• lanSize (number, 0..32): Size of the LAN in CIDR notation (the part after the slash). Default: 24
• lanAlloc (string): DHCP allocation range & duration. Must match lanIP and lanSize! Default: 10.0.0.2,10.0.0.254,12h
• blockFakeLocals (bool): Whether to block incoming connections on the WAN that originate from local IP ranges. Disable this when testing in a VM! Default: true

• enable (bool): Enable the WLAN. Default: true
• ssid (string): SSID of the WLAN. Required!
• passwordFile (path): Path to the SAE password file. Required!
• hide (bool): Ignore SSID broadcast requests to hide the WLAN. Default: false