infrastruktur:host:dobby-setup
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.
| Beide Seiten, vorherige ÜberarbeitungVorherige ÜberarbeitungNächste Überarbeitung | Vorherige Überarbeitung | ||
| infrastruktur:host:dobby-setup [02.02.2025 13:37] – [Basic Network Settings] Linus Lüssing | infrastruktur:host:dobby-setup [15.02.2025 01:32] (aktuell) – [Netfilter Firewall] Linus Lüssing | ||
|---|---|---|---|
| Zeile 70: | Zeile 70: | ||
| # --- END PVE --- | # --- END PVE --- | ||
| </ | </ | ||
| + | |||
| ===== Apt Unattended updates ===== | ===== Apt Unattended updates ===== | ||
| Zeile 89: | Zeile 90: | ||
| $ reboot | $ reboot | ||
| </ | </ | ||
| + | |||
| ===== Netfilter Firewall ===== | ===== Netfilter Firewall ===== | ||
| Zeile 104: | Zeile 106: | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| - | nft add rule inet filter forward counter reject | + | nft add rule inet filter forward counter reject |
| </ | </ | ||
| Zeile 126: | Zeile 128: | ||
| net.ipv4.ip_forward=1 | net.ipv4.ip_forward=1 | ||
| $ echo " | $ echo " | ||
| - | < | + | </code> |
| ===== OPNSense Firewall fw01.nobreakspace.org ===== | ===== OPNSense Firewall fw01.nobreakspace.org ===== | ||
| - | * [x]: announce fd20: | + | |
| * https:// | * https:// | ||
| * dort `fd69: | * dort `fd69: | ||
| - | * [x]: dobby alias | + | |
| * https:// | * https:// | ||
| * Firewall-> | * Firewall-> | ||
| Zeile 141: | Zeile 144: | ||
| * Content: 172.23.208.8, | * Content: 172.23.208.8, | ||
| * Description: | * Description: | ||
| - | * [x]: statisches DHCPv4 mapping (optional, eigentlich stat. IPs): | + | |
| * https:// | * https:// | ||
| * MAC address: BC: | * MAC address: BC: | ||
| * IP address: 172.23.208.8 | * IP address: 172.23.208.8 | ||
| * Hostname: dobby | * Hostname: dobby | ||
| - | * [x]: IPv4 port forwarding: | + | |
| * https:// | * https:// | ||
| * Description: | * Description: | ||
| Zeile 154: | Zeile 157: | ||
| * Protocol: UDP | * Protocol: UDP | ||
| * Destination port range: 2300-2399 | * Destination port range: 2300-2399 | ||
| - | * [x]: IPv6 incoming erlauben: | + | |
| * https:// | * https:// | ||
| * Firewall-> | * Firewall-> | ||
| Zeile 170: | Zeile 173: | ||
| * Destination port range: from: any, to: any | * Destination port range: from: any, to: any | ||
| * Gateway: default | * Gateway: default | ||
| - | * [x]: Variante A) statische Routen zu dobby hinzufügen | + | |
| * ~~Routing: General:~~ | * ~~Routing: General:~~ | ||
| * ~~Enable: yes~~ | * ~~Enable: yes~~ | ||
| Zeile 212: | Zeile 215: | ||
| * Gateway: dobby_dn42_ipv4 | * Gateway: dobby_dn42_ipv4 | ||
| * Description: | * Description: | ||
| - | * [ ]: Variante B) full BGP import von dobby, export Filter auf dobby (-> Routing: BGP) | + | |
| - | + | * [x]: DNS hinzufügen: | |
| + | * Services: Unbound DNS: Advanced: | ||
| + | * Private Domains: add " | ||
| + | * Services: Unbound DNS: Query Forwarding -> Custom forwarding, add: | ||
| + | * Enabled: yes | ||
| + | * Domain: dn42 | ||
| + | * Address: fd42: | ||
| + | * Description: | ||
| ===== Bird2 ===== | ===== Bird2 ===== | ||
| Zeile 397: | Zeile 406: | ||
| export filter { if is_valid_network() && source ~ [RTS_STATIC, | export filter { if is_valid_network() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| Zeile 410: | Zeile 419: | ||
| }; | }; | ||
| export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| } | } | ||
| Zeile 418: | Zeile 427: | ||
| </ | </ | ||
| + | ==== ROA updaten ==== | ||
| + | |||
| + | < | ||
| + | # / | ||
| + | [Unit] | ||
| + | Description=Update DN42 ROA | ||
| + | |||
| + | [Service] | ||
| + | Type=oneshot | ||
| + | ExecStart=curl -sfSLR -o / | ||
| + | ExecStart=curl -sfSLR -o / | ||
| + | ExecStart=birdc configure | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | # / | ||
| + | [Unit] | ||
| + | Description=Update DN42 ROA periodically | ||
| + | |||
| + | [Timer] | ||
| + | OnBootSec=2m | ||
| + | OnUnitActiveSec=15m | ||
| + | AccuracySec=1m | ||
| + | |||
| + | [Install] | ||
| + | WantedBy=timers.target | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | $ systemctl daemon-reload | ||
| + | $ systemctl enable dn42-roa.timer | ||
| + | $ systemctl start dn42-roa.timer | ||
| + | </ | ||
| ==== Peer hinzufügen ==== | ==== Peer hinzufügen ==== | ||
| Zeile 490: | Zeile 532: | ||
| neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| } | } | ||
| + | EOF | ||
| </ | </ | ||
| + | |||
| + | Oder alternativ/ | ||
| + | |||
| + | < | ||
| + | $ cat << EOF > / | ||
| + | protocol bgp dn42_${PEERNAME}_v6 from dnpeers { | ||
| + | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| + | | ||
| + | ipv4 { | ||
| + | extended next hop on; | ||
| + | }; | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | Dann hat man lustige Routen wie diese: | ||
| + | |||
| + | < | ||
| + | $ ip -4 route show prot bird via inet6 fe80::b | ||
| + | 10.26.0.0/ | ||
| + | 10.29.0.0/ | ||
| + | 10.37.0.0/ | ||
| + | 10.56.0.0/ | ||
| + | 10.60.128.0/ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Und man benötigt keine IPv4 Adress Absprachen für den Wireguard Tunnel, für dn42-${PEERNAME}-wg.network. | ||
infrastruktur/host/dobby-setup.1738503468.txt.gz · Zuletzt geändert: 02.02.2025 13:37 von Linus Lüssing