Linux Formbi • 1y ago • 100%

How can I troubleshoot a DIY router?

Hi! I'm trying to make a DIY router. I used configs from some online guides (the nftables one is from the project's website), but nothing happens when I connect a different machine. I know that description doesn't say much, so I'd like to know how can I check what's actually wrong. My system (Guix) config is below: ``` (use-modules (gnu)) (use-service-modules cups desktop networking ssh xorg sysctl linux dns) (define wan "enp0s29u1u5") (define lan "enp0s25") (define dnsmasq-config "# Listen on this specific port instead of the standard DNS port # (53). Setting this to zero completely disables DNS function, # leaving only DHCP and/or TFTP. port=53 # Never forward plain names (without a dot or domain part) domain-needed # Never forward addresses in the non-routed address spaces. bogus-priv # By default, dnsmasq will send queries to any of the upstream # servers it knows about and tries to favour servers to are known # to be up. Uncommenting this forces dnsmasq to try each query # with each server strictly in the order they appear in # /etc/resolv.conf strict-order # Set this (and domain: see below) if you want to have a domain # automatically added to simple names in a hosts-file. expand-hosts # Set the domain for dnsmasq. this is optional, but if it is set, it # does the following things. # 1) Allows DHCP hosts to have fully qualified domain names, as long # as the domain part matches this setting. # 2) Sets the \"domain\" DHCP option thereby potentially setting the # domain of all systems configured by DHCP # 3) Provides the domain part for \"expand-hosts\" #domain=thekelleys.org.uk domain=example.com # Set Listen address listen-address=127.0.0.1 # Set to Server IP for network responses dhcp-range=192.168.3.25,192.168.3.50,24h dhcp-option=option:router,192.168.3.1 dhcp-option=option:ntp-server,192.168.3.5 dhcp-option=option:dns-server,192.168.3.5 dhcp-option=option:netmask,255.255.255.0 ") (define nftables-config (format #f "flush ruleset define DEV_PRIVATE = ~a define DEV_WORLD = ~a define NET_PRIVATE = 192.168.0.0/16 table ip global { chain inbound_world { # accepting ping (icmp-echo-request) for diagnostic purposes. # However, it also lets probes discover this host is alive. # This sample accepts them within a certain rate limit: # # icmp type echo-request limit rate 5/second accept # allow SSH connections from some well-known internet host ip saddr 81.209.165.42 tcp dport ssh accept } chain inbound_private { # accepting ping (icmp-echo-request) for diagnostic purposes. icmp type echo-request limit rate 5/second accept # allow DHCP, DNS and SSH from the private network ip protocol . th dport vmap { tcp . 22 : accept, udp . 53 : accept, tcp . 53 : accept, udp . 67 : accept} } chain inbound { type filter hook input priority 0; policy drop; # Allow traffic from established and related packets, drop invalid ct state vmap { established : accept, related : accept, invalid : drop } # allow loopback traffic, anything else jump to chain for further evaluation iifname vmap { lo : accept, $DEV_WORLD : jump inbound_world, $DEV_PRIVATE : jump inbound_private } # the rest is dropped by the above policy } chain forward { type filter hook forward priority 0; policy drop; # Allow traffic from established and related packets, drop invalid ct state vmap { established : accept, related : accept, invalid : drop } # connections from the internal net to the internet or to other # internal nets are allowed iifname $DEV_PRIVATE accept # the rest is dropped by the above policy } chain postrouting { type nat hook postrouting priority 100; policy accept; # masquerade private IP addresses ip saddr $NET_PRIVATE oifname $DEV_WORLD masquerade } } " lan wan)) (operating-system (locale "en_GB.utf8") (timezone "Europe/Warsaw") (keyboard-layout (keyboard-layout "pl" "legacy" #:options '("ctrl:nocaps"))) (host-name "router") (kernel-arguments (list "modprobe.blacklist=pcspkr,snd_pcsp")) ;; The list of user accounts ('root' is implicit). (users (cons* (user-account (name "formbi") (comment "Formbi") (group "users") (home-directory "/home/formbi") (supplementary-groups '("wheel" "netdev" "audio" "video"))) %base-user-accounts)) ;; Packages installed system-wide. Users can also install packages ;; under their own account: use 'guix search KEYWORD' to search ;; for packages and 'guix install PACKAGE' to install a package. (packages (append (list (specification->package "nss-certs")) %base-packages)) ;; Below is the list of system services. To search for available ;; services, run 'guix system search KEYWORD' in a terminal. (services (append (list (service xfce-desktop-service-type) (service guix-publish-service-type (guix-publish-configuration (port 2137) (advertise? #t))) (service earlyoom-service-type (earlyoom-configuration (avoid-regexp "emacs") (minimum-available-memory 5) (minimum-free-swap 20))) (service openssh-service-type) (service cups-service-type) (service dnsmasq-service-type) (extra-special-file "/etc/dnsmasq.conf" (plain-file "dnsmasq.conf" dnsmasq-config)) (service nftables-service-type (nftables-configuration (ruleset (plain-file "nftables.conf" nftables-config)))) (set-xorg-configuration (xorg-configuration (keyboard-layout keyboard-layout)))) ;; This is the default list of services we ;; are appending to. (modify-services %desktop-services (sysctl-service-type config => (sysctl-configuration (settings (append '(("vm.swappiness" . "10") ("net.ipv4.ip_forward" . "1")) %default-sysctl-settings)))) (network-manager-service-type config => (network-manager-configuration ;(dns "dnsmasq") )) (guix-service-type config => (guix-configuration (discover? #t)))))) (bootloader (bootloader-configuration (bootloader grub-bootloader) (targets (list "/dev/sda")) (keyboard-layout keyboard-layout))) (swap-devices (list (swap-space (target (uuid "a32aa366-c966-460f-9592-2a08c5cad947"))))) ;; The list of file systems that get "mounted". The unique ;; file system identifiers there ("UUIDs") can be obtained ;; by running 'blkid' in a terminal. (file-systems (cons* (file-system (mount-point "/") (device (uuid "30b3a834-f23e-42ad-addf-0cde5538a96f" 'ext4)) (type "ext4")) %base-file-systems))) ```