infrastruktur:host:dobby-setup
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.
| Beide Seiten, vorherige ÜberarbeitungVorherige ÜberarbeitungNächste Überarbeitung | Vorherige Überarbeitung | ||
| infrastruktur:host:dobby-setup [02.02.2025 12:58] – [Apt Unattended updates] Linus Lüssing | infrastruktur:host:dobby-setup [15.02.2025 01:32] (aktuell) – [Netfilter Firewall] Linus Lüssing | ||
|---|---|---|---|
| Zeile 36: | Zeile 36: | ||
| * IPv6/CIDR: 2a01: | * IPv6/CIDR: 2a01: | ||
| * Gateway: 2a01: | * Gateway: 2a01: | ||
| + | |||
| + | ===== Basic Network Settings ===== | ||
| + | |||
| + | / | ||
| + | |||
| + | < | ||
| + | [Match] | ||
| + | Name=eth0 | ||
| + | |||
| + | [Network] | ||
| + | DHCP=no | ||
| + | IPv6AcceptRA=no | ||
| + | Address=172.23.208.8/ | ||
| + | Address=2a01: | ||
| + | Address=fd20: | ||
| + | Gateway=172.23.208.1 | ||
| + | Gateway=2a01: | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | apt-get remove ifupdown | ||
| + | systemctl enable systemd-networkd | ||
| + | systemctl enable systemd-networkd | ||
| + | reboot | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | root@dobby: | ||
| + | # --- BEGIN PVE --- | ||
| + | search nobreakspace.org | ||
| + | nameserver 172.23.208.1 | ||
| + | nameserver 2a01: | ||
| + | # --- END PVE --- | ||
| + | </ | ||
| ===== Apt Unattended updates ===== | ===== Apt Unattended updates ===== | ||
| Zeile 49: | Zeile 83: | ||
| < | < | ||
| - | echo ' | + | $ echo ' |
| - | echo ' | + | $ echo ' |
| </ | </ | ||
| Zeile 56: | Zeile 90: | ||
| $ reboot | $ reboot | ||
| </ | </ | ||
| + | |||
| ===== Netfilter Firewall ===== | ===== Netfilter Firewall ===== | ||
| Zeile 71: | Zeile 106: | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| - | nft add rule inet filter forward counter reject | + | nft add rule inet filter forward counter reject |
| </ | </ | ||
| - | Testen, dann persistent | + | Persistent |
| < | < | ||
| Zeile 87: | Zeile 122: | ||
| </ | </ | ||
| + | Forwarding aktivieren: | ||
| + | |||
| + | < | ||
| + | $ echo " | ||
| + | net.ipv4.ip_forward=1 | ||
| + | $ echo " | ||
| + | </ | ||
| + | |||
| + | ===== OPNSense Firewall fw01.nobreakspace.org ===== | ||
| + | |||
| + | * [x]: announce fd20: | ||
| + | * https:// | ||
| + | * dort `fd69: | ||
| + | * [x]: dobby alias | ||
| + | * https:// | ||
| + | * Firewall-> | ||
| + | * Enabled: true | ||
| + | * Name: dobby | ||
| + | * Type: Host(s) | ||
| + | * Categories: services | ||
| + | * Content: 172.23.208.8, | ||
| + | * Description: | ||
| + | * [x]: statisches DHCPv4 mapping (optional, eigentlich stat. IPs): | ||
| + | * https:// | ||
| + | * MAC address: BC: | ||
| + | * IP address: 172.23.208.8 | ||
| + | * Hostname: dobby | ||
| + | * [x]: IPv4 port forwarding: | ||
| + | * https:// | ||
| + | * Description: | ||
| + | * Interface: WAN | ||
| + | * Destination: | ||
| + | * Redirect target IP: 172.23.208.8 | ||
| + | * Protocol: UDP | ||
| + | * Destination port range: 2300-2399 | ||
| + | * [x]: IPv6 incoming erlauben: | ||
| + | * https:// | ||
| + | * Firewall-> | ||
| + | * Action: Pass | ||
| + | * Disabled: false | ||
| + | * Quick: Apply the action immediately on match | ||
| + | * Interface: WAN | ||
| + | * Direction: in | ||
| + | * TCP/IP version: IPv6 | ||
| + | * Protocol: any | ||
| + | * Source/ | ||
| + | * Source: any | ||
| + | * Destination/ | ||
| + | * Destination: | ||
| + | * Destination port range: from: any, to: any | ||
| + | * Gateway: default | ||
| + | * [x]: Variante A) statische Routen zu dobby hinzufügen | ||
| + | * ~~Routing: General:~~ | ||
| + | * ~~Enable: yes~~ | ||
| + | * ~~Routing: STATIC -> General:~~ | ||
| + | * ~~Enable: yes~~ | ||
| + | * ~~Routing: STATIC -> Routes, Add:~~ | ||
| + | * ~~IPv6:~~ | ||
| + | * ~~Network: fd00::/8~~ | ||
| + | * ~~Gateway: fd20: | ||
| + | * ~~Interface: | ||
| + | * System: Gateways: Configuration, | ||
| + | * IPv6: | ||
| + | * Name: dobby_dn42_ipv6 | ||
| + | * Description: | ||
| + | * Interface: LAN | ||
| + | * Address Family: IPv6 | ||
| + | * IP address: fd20: | ||
| + | * (Upstream Gateway: no!) | ||
| + | * IPv4: | ||
| + | * Name: dobby_dn42_ipv4 | ||
| + | * Description: | ||
| + | * Interface: LAN | ||
| + | * Address Family: IPv4 | ||
| + | * IP address: 172.23.208.8 | ||
| + | * (Upstream Gateway: no!) | ||
| + | * System: Routes: Configuration, | ||
| + | * IPv6: | ||
| + | * Network Address: fd00::/8 | ||
| + | * Gateway: dobby_dn42_ipv6 | ||
| + | * Description: | ||
| + | * IPv4, dn42: | ||
| + | * Network Address: 172.20.0.0/ | ||
| + | * Gateway: dobby_dn42_ipv4 | ||
| + | * Description: | ||
| + | * IPv4, ChaosVPN: | ||
| + | * Network Address: 172.31.0.0/ | ||
| + | * Gateway: dobby_dn42_ipv4 | ||
| + | * Description: | ||
| + | * IPv4, ChaosVPN, neonetwork, Freifunk: | ||
| + | * Network Address: 10.0.0.0/8 | ||
| + | * Gateway: dobby_dn42_ipv4 | ||
| + | * Description: | ||
| + | * [ ]: Variante B) full BGP import von dobby, export Filter auf dobby (-> Routing: BGP) | ||
| + | * [x]: DNS hinzufügen: | ||
| + | * Services: Unbound DNS: Advanced: | ||
| + | * Private Domains: add " | ||
| + | * Services: Unbound DNS: Query Forwarding -> Custom forwarding, add: | ||
| + | * Enabled: yes | ||
| + | * Domain: dn42 | ||
| + | * Address: fd42: | ||
| + | * Description: | ||
| ===== Bird2 ===== | ===== Bird2 ===== | ||
| Zeile 269: | Zeile 406: | ||
| export filter { if is_valid_network() && source ~ [RTS_STATIC, | export filter { if is_valid_network() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| Zeile 282: | Zeile 419: | ||
| }; | }; | ||
| export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| } | } | ||
| Zeile 290: | Zeile 427: | ||
| </ | </ | ||
| + | ==== ROA updaten ==== | ||
| + | |||
| + | < | ||
| + | # / | ||
| + | [Unit] | ||
| + | Description=Update DN42 ROA | ||
| + | |||
| + | [Service] | ||
| + | Type=oneshot | ||
| + | ExecStart=curl -sfSLR -o / | ||
| + | ExecStart=curl -sfSLR -o / | ||
| + | ExecStart=birdc configure | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | # / | ||
| + | [Unit] | ||
| + | Description=Update DN42 ROA periodically | ||
| + | |||
| + | [Timer] | ||
| + | OnBootSec=2m | ||
| + | OnUnitActiveSec=15m | ||
| + | AccuracySec=1m | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=timers.target | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | $ systemctl daemon-reload | ||
| + | $ systemctl enable dn42-roa.timer | ||
| + | $ systemctl start dn42-roa.timer | ||
| + | </ | ||
| ==== Peer hinzufügen ==== | ==== Peer hinzufügen ==== | ||
| Zeile 362: | Zeile 532: | ||
| neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| } | } | ||
| + | EOF | ||
| </ | </ | ||
| + | |||
| + | Oder alternativ/ | ||
| + | |||
| + | < | ||
| + | $ cat << EOF > / | ||
| + | protocol bgp dn42_${PEERNAME}_v6 from dnpeers { | ||
| + | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| + | | ||
| + | ipv4 { | ||
| + | extended next hop on; | ||
| + | }; | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | Dann hat man lustige Routen wie diese: | ||
| + | |||
| + | < | ||
| + | $ ip -4 route show prot bird via inet6 fe80::b | ||
| + | 10.26.0.0/ | ||
| + | 10.29.0.0/ | ||
| + | 10.37.0.0/ | ||
| + | 10.56.0.0/ | ||
| + | 10.60.128.0/ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Und man benötigt keine IPv4 Adress Absprachen für den Wireguard Tunnel, für dn42-${PEERNAME}-wg.network. | ||
infrastruktur/host/dobby-setup.1738501106.txt.gz · Zuletzt geändert: 02.02.2025 12:58 von Linus Lüssing