27a3d3dae2
end0/wlan0 ended up with addr_gen_mode=none (cause not fully identified;
neither NixOS's networking module nor dhcpcd.denyInterfaces obviously
account for it), leaving them without an auto-generated link-local
address. radvd requires one to source Router Advertisements and was
silently refusing to advertise ("interface is not ready" at debug
verbosity) -- WLAN/LAN clients got a DHCPv4 lease but no IPv6 default
route, so no working internet path (this setup is IPv6-only + DNS64).
`ip link set dev <if> addrgenmode eui64` reproducibly fixes it; a oneshot
unit now does this after every boot, before radvd starts.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5FvfdKcQjEFQ4aLrepcS1
109 lines
3.6 KiB
Nix
109 lines
3.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
{
|
|
# Gefunden am 13.09.2026: end0 und wlan0 landen ohne erkennbare erzeugende
|
|
# Ursache (weder NixOS' Netzwerk-Modul noch dhcpcd.denyInterfaces treffen
|
|
# zu) mit addr_gen_mode=none hoch -- ohne automatisch erzeugte
|
|
# Link-Local-Adresse verweigert radvd stillschweigend jede Advertisement
|
|
# ("interface is not ready" im Debug-Log), WLAN-Clients bekommen also nie
|
|
# eine Standardroute. Manuell mit `ip link set dev <if> addrgenmode eui64`
|
|
# reproduzierbar behoben; dieser Dienst macht das bei jedem Boot, nach
|
|
# allem, was die Interfaces sonst anfasst.
|
|
systemd.services.pinix-lan-linklocal = {
|
|
description = "Restore auto-generated link-local addresses on end0/wlan0 for radvd";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [
|
|
"network-addresses-end0.service"
|
|
"network-addresses-wlan0.service"
|
|
"dhcpcd.service"
|
|
];
|
|
wants = [
|
|
"network-addresses-end0.service"
|
|
"network-addresses-wlan0.service"
|
|
];
|
|
before = [ "radvd.service" ];
|
|
serviceConfig.Type = "oneshot";
|
|
path = [ pkgs.iproute2 ];
|
|
script = ''
|
|
ip link set dev end0 addrgenmode eui64
|
|
ip link set dev wlan0 addrgenmode eui64
|
|
'';
|
|
};
|
|
systemd.services.radvd.after = [ "pinix-lan-linklocal.service" ];
|
|
systemd.services.radvd.wants = [ "pinix-lan-linklocal.service" ];
|
|
|
|
networking.wireless.enable = lib.mkForce false;
|
|
networking.interfaces = {
|
|
end0.ipv6.addresses = [ { address = "fd42:50:0::1"; prefixLength = 64; } ];
|
|
wlan0 = {
|
|
useDHCP = lib.mkForce false;
|
|
ipv4.addresses = [ { address = "192.168.51.1"; prefixLength = 24; } ];
|
|
ipv6.addresses = [ { address = "fd42:50:1::1"; prefixLength = 64; } ];
|
|
};
|
|
};
|
|
boot.kernel.sysctl = {
|
|
"net.ipv6.conf.end0.accept_ra" = 0;
|
|
"net.ipv6.conf.wlan0.accept_ra" = 0;
|
|
};
|
|
networking.nat = {
|
|
enable = true;
|
|
enableIPv6 = true;
|
|
externalInterface = "wan0";
|
|
internalInterfaces = [ "end0" "wlan0" ];
|
|
internalIPv6s = [ "fd42:50::/48" ];
|
|
};
|
|
networking.firewall.interfaces.wlan0 = {
|
|
allowedTCPPorts = [ 22 53 ];
|
|
allowedUDPPorts = [ 53 67 ];
|
|
};
|
|
|
|
age.secrets.pinix-wifi.file = ../../secrets/pinix-wifi.age;
|
|
services.hostapd = {
|
|
enable = true;
|
|
radios.wlan0 = {
|
|
countryCode = "DE";
|
|
band = "2g";
|
|
channel = 6;
|
|
networks.wlan0 = {
|
|
ssid = "pinix";
|
|
authentication = {
|
|
# wpa2-sha256 (HMAC-SHA256 key derivation) statt des ueblichen
|
|
# wpa2-sha1 (Standard-WPA2-PSK trotz des Namens) verhinderte am
|
|
# 13.09.2026 den Beitritt eines iPad -- die Anfrage kam serverseitig
|
|
# nie an, hostapd loggte nichts. wpa2-sha1 ist der Modus, den
|
|
# praktisch jedes Geraet unterstuetzt.
|
|
mode = "wpa2-sha1";
|
|
wpaPasswordFile = config.age.secrets.pinix-wifi.path;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
services.dnsmasq = {
|
|
enable = true;
|
|
settings = {
|
|
port = 0;
|
|
interface = "wlan0";
|
|
bind-dynamic = true;
|
|
dhcp-authoritative = true;
|
|
dhcp-range = "192.168.51.50,192.168.51.200,255.255.255.0,12h";
|
|
# Local IPv4 only. Internet uses IPv6 + Telekom NAT64/DNS64.
|
|
dhcp-option = [ "option:router" "option:dns-server,192.168.51.1" ];
|
|
};
|
|
};
|
|
services.radvd = {
|
|
enable = true;
|
|
config = ''
|
|
interface end0 {
|
|
AdvSendAdvert on;
|
|
MaxRtrAdvInterval 30;
|
|
prefix fd42:50:0::/64 { AdvOnLink on; AdvAutonomous on; };
|
|
RDNSS fd42:50:0::1 {};
|
|
};
|
|
interface wlan0 {
|
|
AdvSendAdvert on;
|
|
MaxRtrAdvInterval 30;
|
|
prefix fd42:50:1::/64 { AdvOnLink on; AdvAutonomous on; };
|
|
RDNSS fd42:50:1::1 {};
|
|
};
|
|
'';
|
|
};
|
|
}
|