infrastruktur:host:dobby-setup
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.
| Beide Seiten, vorherige ÜberarbeitungVorherige ÜberarbeitungNächste Überarbeitung | Vorherige Überarbeitung | ||
| infrastruktur:host:dobby-setup [03.02.2025 23:53] – [ROA updaten] Linus Lüssing | infrastruktur:host:dobby-setup [15.02.2025 01:32] (aktuell) – [Netfilter Firewall] Linus Lüssing | ||
|---|---|---|---|
| Zeile 106: | Zeile 106: | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| - | nft add rule inet filter forward counter reject | + | nft add rule inet filter forward counter reject |
| </ | </ | ||
| Zeile 132: | Zeile 132: | ||
| ===== OPNSense Firewall fw01.nobreakspace.org ===== | ===== OPNSense Firewall fw01.nobreakspace.org ===== | ||
| - | * [x]: announce fd20: | + | |
| * https:// | * https:// | ||
| * dort `fd69: | * dort `fd69: | ||
| - | * [x]: dobby alias | + | |
| * https:// | * https:// | ||
| * Firewall-> | * Firewall-> | ||
| Zeile 144: | Zeile 144: | ||
| * Content: 172.23.208.8, | * Content: 172.23.208.8, | ||
| * Description: | * Description: | ||
| - | * [x]: statisches DHCPv4 mapping (optional, eigentlich stat. IPs): | + | |
| * https:// | * https:// | ||
| * MAC address: BC: | * MAC address: BC: | ||
| * IP address: 172.23.208.8 | * IP address: 172.23.208.8 | ||
| * Hostname: dobby | * Hostname: dobby | ||
| - | * [x]: IPv4 port forwarding: | + | |
| * https:// | * https:// | ||
| * Description: | * Description: | ||
| Zeile 157: | Zeile 157: | ||
| * Protocol: UDP | * Protocol: UDP | ||
| * Destination port range: 2300-2399 | * Destination port range: 2300-2399 | ||
| - | * [x]: IPv6 incoming erlauben: | + | |
| * https:// | * https:// | ||
| * Firewall-> | * Firewall-> | ||
| Zeile 173: | Zeile 173: | ||
| * Destination port range: from: any, to: any | * Destination port range: from: any, to: any | ||
| * Gateway: default | * Gateway: default | ||
| - | * [x]: Variante A) statische Routen zu dobby hinzufügen | + | |
| * ~~Routing: General:~~ | * ~~Routing: General:~~ | ||
| * ~~Enable: yes~~ | * ~~Enable: yes~~ | ||
| Zeile 215: | Zeile 215: | ||
| * Gateway: dobby_dn42_ipv4 | * Gateway: dobby_dn42_ipv4 | ||
| * Description: | * Description: | ||
| - | * [ ]: Variante B) full BGP import von dobby, export Filter auf dobby (-> Routing: BGP) | + | |
| - | + | * [x]: DNS hinzufügen: | |
| + | * Services: Unbound DNS: Advanced: | ||
| + | * Private Domains: add " | ||
| + | * Services: Unbound DNS: Query Forwarding -> Custom forwarding, add: | ||
| + | * Enabled: yes | ||
| + | * Domain: dn42 | ||
| + | * Address: fd42: | ||
| + | * Description: | ||
| ===== Bird2 ===== | ===== Bird2 ===== | ||
| Zeile 400: | Zeile 406: | ||
| export filter { if is_valid_network() && source ~ [RTS_STATIC, | export filter { if is_valid_network() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| Zeile 413: | Zeile 419: | ||
| }; | }; | ||
| export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| } | } | ||
| Zeile 526: | Zeile 532: | ||
| neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| } | } | ||
| + | EOF | ||
| </ | </ | ||
| + | |||
| + | Oder alternativ/ | ||
| + | |||
| + | < | ||
| + | $ cat << EOF > / | ||
| + | protocol bgp dn42_${PEERNAME}_v6 from dnpeers { | ||
| + | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| + | | ||
| + | ipv4 { | ||
| + | extended next hop on; | ||
| + | }; | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | Dann hat man lustige Routen wie diese: | ||
| + | |||
| + | < | ||
| + | $ ip -4 route show prot bird via inet6 fe80::b | ||
| + | 10.26.0.0/ | ||
| + | 10.29.0.0/ | ||
| + | 10.37.0.0/ | ||
| + | 10.56.0.0/ | ||
| + | 10.60.128.0/ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Und man benötigt keine IPv4 Adress Absprachen für den Wireguard Tunnel, für dn42-${PEERNAME}-wg.network. | ||
infrastruktur/host/dobby-setup.1738626801.txt.gz · Zuletzt geändert: 03.02.2025 23:53 von Linus Lüssing