infrastruktur:host:dobby-setup
Unterschiede
Hier werden die Unterschiede zwischen zwei Versionen der Seite angezeigt.
| Beide Seiten, vorherige ÜberarbeitungVorherige ÜberarbeitungNächste Überarbeitung | Vorherige Überarbeitung | ||
| infrastruktur:host:dobby-setup [03.02.2025 23:59] – [OPNSense Firewall fw01.nobreakspace.org] Linus Lüssing | infrastruktur:host:dobby-setup [15.02.2025 01:32] (aktuell) – [Netfilter Firewall] Linus Lüssing | ||
|---|---|---|---|
| Zeile 106: | Zeile 106: | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| nft add rule inet filter forward iifname " | nft add rule inet filter forward iifname " | ||
| - | nft add rule inet filter forward counter reject | + | nft add rule inet filter forward counter reject |
| </ | </ | ||
| Zeile 216: | Zeile 216: | ||
| * Description: | * Description: | ||
| * [ ]: Variante B) full BGP import von dobby, export Filter auf dobby (-> Routing: BGP) | * [ ]: Variante B) full BGP import von dobby, export Filter auf dobby (-> Routing: BGP) | ||
| - | * [ ]: DNS hinzufügen: | + | * [x]: DNS hinzufügen: |
| + | * Services: Unbound DNS: Advanced: | ||
| + | * Private Domains: add " | ||
| + | * Services: Unbound DNS: Query Forwarding -> Custom forwarding, add: | ||
| + | * Enabled: yes | ||
| + | * Domain: dn42 | ||
| + | * Address: fd42: | ||
| + | * Description: | ||
| ===== Bird2 ===== | ===== Bird2 ===== | ||
| Zeile 399: | Zeile 406: | ||
| export filter { if is_valid_network() && source ~ [RTS_STATIC, | export filter { if is_valid_network() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| Zeile 412: | Zeile 419: | ||
| }; | }; | ||
| export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, | ||
| - | import limit 1000 action block; | + | import limit 9000 action block; |
| }; | }; | ||
| } | } | ||
| Zeile 525: | Zeile 532: | ||
| neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| } | } | ||
| + | EOF | ||
| </ | </ | ||
| + | |||
| + | Oder alternativ/ | ||
| + | |||
| + | < | ||
| + | $ cat << EOF > / | ||
| + | protocol bgp dn42_${PEERNAME}_v6 from dnpeers { | ||
| + | neighbor ${PEERIP6}%dn42_${PEERNAME}_wg as ${PEERASN}; | ||
| + | | ||
| + | ipv4 { | ||
| + | extended next hop on; | ||
| + | }; | ||
| + | } | ||
| + | EOF | ||
| + | </ | ||
| + | |||
| + | Dann hat man lustige Routen wie diese: | ||
| + | |||
| + | < | ||
| + | $ ip -4 route show prot bird via inet6 fe80::b | ||
| + | 10.26.0.0/ | ||
| + | 10.29.0.0/ | ||
| + | 10.37.0.0/ | ||
| + | 10.56.0.0/ | ||
| + | 10.60.128.0/ | ||
| + | ... | ||
| + | </ | ||
| + | |||
| + | Und man benötigt keine IPv4 Adress Absprachen für den Wireguard Tunnel, für dn42-${PEERNAME}-wg.network. | ||
infrastruktur/host/dobby-setup.1738627144.txt.gz · Zuletzt geändert: 03.02.2025 23:59 von Linus Lüssing