3.2NixOS 声明式路由器

{ config, pkgs, ... }:
{
  networking.hostName = "router";
  # ↓ 下面 §3 把路由器的五样东西填进来
}

{ config, pkgs, ... }:
{
  networking.hostName = "router";
  networking.useDHCP = false;   # 关掉全局默认，改为逐接口声明

  # ① 配地址：WAN 走 DHCP，LAN 静态网关地址
  networking.interfaces.eth0.useDHCP = true;                   # WAN
  networking.interfaces.eth1.ipv4.addresses = [                # LAN
    { address = "192.168.10.1"; prefixLength = 24; }
  ];

  # ② 打开转发（0.3）
  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;

  # ③ NAT masquerade（0.6 / 1.3）
  networking.nat.enable = true;
  networking.nat.externalInterface = "eth0";    # 出口 = WAN
  networking.nat.internalInterfaces = [ "eth1" ];

  # ④ 防火墙（1.3）：默认拦，信任 LAN 侧
  networking.firewall.enable = true;
  networking.firewall.trustedInterfaces = [ "eth1" ];

  # ⑤ dnsmasq：LAN 发 DHCP + DNS（2.3）
  services.dnsmasq.enable = true;
  services.dnsmasq.settings = {
    interface = "eth1";
    dhcp-range = "192.168.10.100,192.168.10.200,12h";
    dhcp-option = [ "3,192.168.10.1" "6,192.168.10.1" ];
  };
}