3 ms·
I just finished building a router based on NixOS and I must disagree. NixOS modules mostly targets desktop and servers, but the network specific configuration i
by rnhmjoj 3y ago
I just finished building a router based on NixOS and I must disagree.
NixOS modules mostly targets desktop and servers, but the network specific configuration is still very lacking. A few examples:
- up until a couple of weeks ago the hostapd module was basically a toy: could only manage a single SSID, no way to configure the radios, hardcoded to WPA2-PSK;
- the NixOS firewall is still based on iptables and conflicts with nftables, so you must disable and manually write rules;
- the `networking.nat` module (NAT44) doesn't do NAT reflection;
- I had to write a module for Jool (NAT64, SIIT);
- I had to write a module for libreswan (IPsec);
- I had to write a module for automatic rollbacks, otherwise you can loose access if you make a mistake.
Vyatta and VyOS also provide a much higher level abstraction over the software that is being configured (e.g. you don't have to deal with a specific IPsec implementation). Finally, once you do `nixos-rebuild switch` you're on your own, while with vyatta you have a clean command line interface to inspect the state of the router and manage it.
- gbraad 3y agodoes vyatta/vyos store the configuration in a single file or easy to back up config? I do not remember anymore how this was done, but I believe that is the appeal what 'nix' was mentioned.
- rnhmjoj 3y agoYes, it does.
- solarkraft 3y agoThanks for the warning; sounds like my mileage would have varied quite a bit. Do you think that, had your use case been simpler, you'd have enjoyed the experience?
- rnhmjoj 3y agoWell, I actually enjoyed contributing to NixOS, but running it on a router is certainly not a "it works out-of-the-box" experience. Even if you are building a simple SOHO router you need to know a lot more about the implementation details (which daemon does what, how to write firewall rules, how to setup the network interfaces, etc.). This is because NixOS is general-purpose OS, unlike VyOS or openwrt.
- sp0ck 3y agoAnd this is just basic routing and firewall with NAT. Now try to setup 20 MPLS L3-VPN's + dozen VPLS services on top of IS-IS routed network with that ;-)