nixos/home: Rework river WAN to single-tag VLAN 140/141
Digiweb's ONT delivers its untagged management traffic (192.168.100.0/24) alongside the tagged ISP VLAN 10. The switch feeding river now tags the ONT's untagged port as wan-pon-ont (140) and swaps the ISP VLAN 10 to wan-pon-isp (141) on ingress, so both reach river single-tagged: river takes an address in the ONT's /24 on 140 to reach its web UI, and PPPoE runs directly on 141. Replaces the old QinQ-into-131 (wanStacked) transport; the wan-pon (131) VLAN constant is dropped and prefixes.ont added. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
+9
-1
@@ -312,9 +312,14 @@ rec {
|
|||||||
lo = 110;
|
lo = 110;
|
||||||
untrusted = 120;
|
untrusted = 120;
|
||||||
wan = 130;
|
wan = 130;
|
||||||
wan-pon = 131;
|
|
||||||
|
|
||||||
|
# Digiweb delivers the ISP VLAN (pon-isp, 10) single-tagged at the ONT alongside the ONT's
|
||||||
|
# own untagged management traffic. The switch feeding river tags the untagged ONT port as
|
||||||
|
# wan-pon-ont (140) and swaps ingress VLAN 10 to wan-pon-isp (141), so river sees both
|
||||||
|
# single-tagged and never has to touch VLAN 10 itself (PPPoE runs on wan-pon-isp).
|
||||||
pon-isp = 10;
|
pon-isp = 10;
|
||||||
|
wan-pon-ont = 140;
|
||||||
|
wan-pon-isp = 141;
|
||||||
};
|
};
|
||||||
hiMTU = 9000;
|
hiMTU = 9000;
|
||||||
routers = [
|
routers = [
|
||||||
@@ -330,6 +335,9 @@ rec {
|
|||||||
modem = {
|
modem = {
|
||||||
v4 = "192.168.0.0/24";
|
v4 = "192.168.0.0/24";
|
||||||
};
|
};
|
||||||
|
ont = {
|
||||||
|
v4 = "192.168.100.0/24";
|
||||||
|
};
|
||||||
all = {
|
all = {
|
||||||
v4 = "192.168.64.0/18";
|
v4 = "192.168.64.0/18";
|
||||||
v6 = "2a0e:97c0:4d0::/60";
|
v6 = "2a0e:97c0:4d0::/60";
|
||||||
|
|||||||
@@ -9,16 +9,19 @@
|
|||||||
configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
|
configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
|
||||||
let
|
let
|
||||||
inherit (builtins) elemAt;
|
inherit (builtins) elemAt;
|
||||||
inherit (lib) mkForce mkMerge mkIf;
|
inherit (lib) mkForce mkMerge;
|
||||||
inherit (lib.my) networkdAssignment mkVLAN;
|
inherit (lib.my) net networkdAssignment mkVLAN;
|
||||||
inherit (lib.my.c) networkd;
|
inherit (lib.my.c) networkd;
|
||||||
inherit (lib.my.c.home) vlans domain prefixes roceBootModules routersPubV4;
|
inherit (lib.my.c.home) vlans domain prefixes roceBootModules routersPubV4;
|
||||||
|
|
||||||
# Digiweb currently delivers the ISP VLAN (pon-isp, 10) single-tagged, so PPPoE runs on a
|
# river reaches the ONT over its 100G `lan` uplink to the dave switch (which downlinks to
|
||||||
# VLAN 10 sitting directly on the physical WAN link. Flip this to true to nest it back
|
# jim, where the ONT's fibre lands). Digiweb delivers the ISP VLAN (pon-isp, 10) single-tagged
|
||||||
# inside the wan-pon (131) transport VLAN — double-stacking also needs QinQ (tag-stacking)
|
# at the ONT alongside the ONT's untagged management traffic. The switch tags the ONT's
|
||||||
# on the switch feeding the ONT, or the BRAS never answers PADI.
|
# untagged port as wan-pon-ont (140) and swaps the ISP's VLAN 10 to wan-pon-isp (141) on
|
||||||
wanStacked = false;
|
# ingress, so both arrive at river single-tagged and PPPoE runs directly on wan-pon-isp.
|
||||||
|
# river takes .100 in the ONT's /24 (matching stream's modem-mgmt .100) to reach its web
|
||||||
|
# UI at 192.168.100.1.
|
||||||
|
ontV4 = net.cidr.host 100 prefixes.ont.v4;
|
||||||
|
|
||||||
# river is routing-common index 0; the Digiweb static IP we request via IPCP
|
# river is routing-common index 0; the Digiweb static IP we request via IPCP
|
||||||
pubV4 = elemAt routersPubV4 0;
|
pubV4 = elemAt routersPubV4 0;
|
||||||
@@ -93,7 +96,7 @@
|
|||||||
enable = true;
|
enable = true;
|
||||||
# Password is shared across all Digiweb customers, so no need for a secret
|
# Password is shared across all Digiweb customers, so no need for a secret
|
||||||
config = ''
|
config = ''
|
||||||
plugin pppoe.so wan-vlan-inner
|
plugin pppoe.so wan-pon-isp
|
||||||
name "digiweb@nga.digiweb.ie"
|
name "digiweb@nga.digiweb.ie"
|
||||||
password "digiweb"
|
password "digiweb"
|
||||||
# request our static IP as the local address in IPCP (local:remote, remote left open)
|
# request our static IP as the local address in IPCP (local:remote, remote left open)
|
||||||
@@ -115,9 +118,10 @@
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
# PPPoE WAN (Digiweb): pppd owns the `wan` interface on top of VLAN 10, and its
|
# PPPoE WAN (Digiweb): pppd owns the `wan` interface on top of wan-pon-isp (the switch's
|
||||||
# ip-up/ip-down hooks toggle the shared wan-online.target. Nothing else Wants the
|
# swap of the ISP's VLAN 10), and its ip-up/ip-down hooks toggle the shared
|
||||||
# target, so it stays inactive until the link is actually up.
|
# wan-online.target. Nothing else Wants the target, so it stays inactive until the link
|
||||||
|
# is actually up.
|
||||||
systemd.targets.wan-online.unitConfig.DefaultDependencies = false;
|
systemd.targets.wan-online.unitConfig.DefaultDependencies = false;
|
||||||
|
|
||||||
environment.etc = {
|
environment.etc = {
|
||||||
@@ -143,8 +147,8 @@
|
|||||||
|
|
||||||
systemd.network = {
|
systemd.network = {
|
||||||
netdevs = mkMerge [
|
netdevs = mkMerge [
|
||||||
(mkIf wanStacked (mkVLAN "wan-vlan-outer" vlans.wan-pon))
|
(mkVLAN "wan-pon-ont" vlans.wan-pon-ont)
|
||||||
(mkVLAN "wan-vlan-inner" vlans.pon-isp)
|
(mkVLAN "wan-pon-isp" vlans.wan-pon-isp)
|
||||||
];
|
];
|
||||||
|
|
||||||
links = {
|
links = {
|
||||||
@@ -176,24 +180,26 @@
|
|||||||
|
|
||||||
networks = {
|
networks = {
|
||||||
"55-lan" = {
|
"55-lan" = {
|
||||||
# outer transport VLAN when stacked, otherwise the ISP VLAN directly on lan
|
# both WAN VLANs arrive single-tagged on the 100G uplink to dave
|
||||||
vlan = [ (if wanStacked then "wan-vlan-outer" else "wan-vlan-inner") ];
|
vlan = [ "wan-pon-ont" "wan-pon-isp" ];
|
||||||
};
|
};
|
||||||
# So we don't drop the IP we use to connect to NVMe-oF!
|
# So we don't drop the IP we use to connect to NVMe-oF!
|
||||||
"60-lan-hi".networkConfig.KeepConfiguration = "static";
|
"60-lan-hi".networkConfig.KeepConfiguration = "static";
|
||||||
|
|
||||||
"70-wan-vlan-outer" = mkIf wanStacked {
|
# ONT management: the switch tags the ONT's untagged port as wan-pon-ont, so give
|
||||||
matchConfig.Name = "wan-vlan-outer";
|
# ourselves an address in its /24 to reach the ONT's web UI at 192.168.100.1.
|
||||||
vlan = [ "wan-vlan-inner" ];
|
"70-wan-pon-ont" = {
|
||||||
networkConfig = networkd.noL3;
|
matchConfig.Name = "wan-pon-ont";
|
||||||
# baby jumbo: carries the inner VLAN's frames, whose 4B tag counts as payload
|
address = [ "${ontV4}/24" ];
|
||||||
# at this layer, so it needs 1512 (inner's 1508B payload + the inner 802.1Q tag)
|
linkConfig = {
|
||||||
linkConfig.MTUBytes = "1512";
|
RequiredForOnline = "no";
|
||||||
|
MTUBytes = "1500";
|
||||||
};
|
};
|
||||||
# pppd attaches PPPoE to this; just needs to be up with no L3. Hangs off
|
};
|
||||||
# wan-vlan-outer when stacked, otherwise directly off lan (see "55-lan").
|
# pppd attaches PPPoE to this; just needs to be up with no L3. Carries the ISP's
|
||||||
"71-wan-vlan-inner" = {
|
# VLAN 10, swapped to wan-pon-isp by the switch (see "55-lan").
|
||||||
matchConfig.Name = "wan-vlan-inner";
|
"71-wan-pon-isp" = {
|
||||||
|
matchConfig.Name = "wan-pon-isp";
|
||||||
linkConfig = {
|
linkConfig = {
|
||||||
RequiredForOnline = "no";
|
RequiredForOnline = "no";
|
||||||
# baby jumbo: PPPoE's 8B overhead leaves a clean 1500 on ppp
|
# baby jumbo: PPPoE's 8B overhead leaves a clean 1500 on ppp
|
||||||
|
|||||||
Reference in New Issue
Block a user