diff options
Diffstat (limited to 'modules/services')
-rw-r--r-- | modules/services/networking/nat.nix | 95 |
1 files changed, 95 insertions, 0 deletions
diff --git a/modules/services/networking/nat.nix b/modules/services/networking/nat.nix new file mode 100644 index 00000000000..2f9715e9fab --- /dev/null +++ b/modules/services/networking/nat.nix @@ -0,0 +1,95 @@ +# This module enables Network Address Translation (NAT). + +{ config, pkgs, ... }: + +with pkgs.lib; + +let + + cfg = config.networking.nat; + +in + +{ + + ###### interface + + options = { + + networking.nat.enable = mkOption { + default = false; + description = + '' + Whether to enable Network Address Translation (NAT). + ''; + }; + + networking.nat.internalIPs = mkOption { + example = "192.168.1.0/24"; + description = + '' + The IP address range for which to perform NAT. Packets + coming from these addresses and destined for the external + interface will be rewritten. + ''; + }; + + networking.nat.externalInterface = mkOption { + example = "eth1"; + description = + '' + The name of the external network interface. + ''; + }; + + networking.nat.externalIP = mkOption { + default = ""; + example = "203.0.113.123"; + description = + '' + The public IP address to which packets from the local + network are to be rewritten. If this is left empty, the + IP address associated with the external interface will be + used. + ''; + }; + + }; + + + ###### implementation + + config = mkIf config.networking.nat.enable { + + environment.systemPackages = [ pkgs.iptables ]; + + jobs.nat = + { description = "Network Address Translation"; + + startOn = "started network-interfaces"; + + path = [ pkgs.iptables ]; + + preStart = + '' + iptables -t nat -F + iptables -t nat -X + + iptables -t nat -A POSTROUTING \ + -s ${cfg.internalIPs} -o ${cfg.externalInterface} \ + ${if cfg.externalIP == "" + then "-j MASQUERADE" + else "-j SNAT --to-source ${cfg.externalIP}"} + + echo 1 > /proc/sys/net/ipv4/ip_forward + ''; + + postStop = + '' + iptables -t nat -F + ''; + }; + + }; + +} |