[firewall] / local.m4

### -*-sh-*-
###
### Local firewall configuration
###
### (c) 2008 Mark Wooding
###

###----- Licensing notice ---------------------------------------------------
###
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software Foundation,
### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

###--------------------------------------------------------------------------
### Local configuration.

m4_divert(6)m4_dnl
## Default NTP servers.
defconf(ntp_servers,
	"81.187.26.174 90.155.23.205 2001:8b0:0:23::205 185.73.44.6 2001:ba8:0:2c06::")

m4_divert(-1)
###--------------------------------------------------------------------------
### Packet classification.

## IPv4 addressing.
##
## There are two small blocks of publicly routable IPv4 addresses, and a
## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
## The former are as follows.
##
## 81.2.113.195, 81.187.238.128/28
##		House border network (dmz).  We have all of these; the loose
##		address is for the router.
##
## 212.13.18.64/28
##		Jump colocated network (jump).  .65--68 are used by Jump
##		network infrastructure; we get the rest.
##
## The latter is the block 172.29.196.0/22.  Currently the low half is
## unallocated (and may be returned to the G-RIN); the remaining addresses
## are allocated as follows.
##
## 172.29.198.0/24  Untrusted networks.
##	.0/25		house wireless net
##	.128/28		iodine (IP-over-DNS) network
##	.144/28		hippotat (IP-over-HTTP) network
##	.160/27		untrusted virtual network
##
## 172.29.199.0/24  Trusted networks.
##	.0/25		house wired network
##	.128/27		mobile VPN hosts
##	.160/28		reserved, except .160/30 allocated for ITS
##	.176/28		internal colocated network
##	.192/27		house safe network
##	.224/27		anycast services

## IPv6 addressing.
##
## There are five blocks of publicly routable IPv6 addresses, though some of
## them aren't very interesting.  The ranges are as follows.
##
## 2001:8b0:c92::/48
##		Main house range (aaisp).  See below for allocation policy.
##		There is no explicit DMZ allocation (and no need for one).
##
## 2001:ba8:0:1d9::/64
##		Jump border network (jump): :1 is the router (supplied by
##		Jump); other addresses are ours.
##
## 2001:ba8:1d9::/48
##		Main colocated range.  See below for allocation policy.
##
## Addresses in the /64 networks are simply allocated in ascending order.
## The /48s are split into /64s by appending a 16-bit network number.  The
## top nibble of the network number classifies the network, as follows.
##
## axxx		Virtual, untrusted
## 8xxx		Untrusted
## 6xxx		Virtual, safe
## 4xxx		Safe
## 0xxx		Unsafe, trusted
##
## These have been chosen so that network properties can be deduced by
## inspecting bits of the network number:
##
## Bit 15	If set, the network is untrusted; otherwise it is trusted.
## Bit 14	If set, the network is safe; otherwise it is unsafe.
##
## Finally, the low-order nibbles identify the site.
##
## 0		No specific site: mobile VPN endpoints or anycast addresses.
## 1		House.
## 2		Jump colocation.
## fff		Local border network.
##
## Usually site-0 networks are allocated from the Jump range to improve
## expected performance from/to external sites which don't engage in our
## dynamic routing protocols.

## Define the available network classes.
m4_divert(42)m4_dnl
defnetclass scary	scary		trusted		    vpnnat mcast
defnetclass untrusted	scary untrusted trusted			   mcast
defnetclass trusted	scary untrusted trusted safe noloop vpnnat mcast
defnetclass safe			trusted safe noloop vpnnat mcast
defnetclass noloop			trusted safe		   mcast
defnetclass vpnnat	scary		trusted safe		   mcast

defnetclass link
defnetclass mcast
m4_divert(-1)

m4_divert(26)m4_dnl
###--------------------------------------------------------------------------
### Network layout.

## House networks.
defnet dmz trusted
	addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92:fff::/64
	via unsafe untrusted
defnet unsafe trusted
	addr 172.29.199.0/25 2001:8b0:c92:1::/64
	via househub
defnet safe safe
	addr 172.29.199.192/27 2001:8b0:c92:4001::/64
	via househub
defnet untrusted untrusted
	addr 172.29.198.0/25 2001:8b0:c92:8001::/64
	via househub

defnet househub virtual
	via housebdry dmz unsafe safe untrusted
defnet housebdry virtual
	via househub hub

## House hosts.
defhost radius
	hosttype router
	iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
	iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
	iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
	iface eth3 unsafe untrusted vpn default
	iface ppp0 default
	iface t6-he default
	iface vpn-precision colobdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-+ vpn
defhost roadstar
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost jem
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost universe
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost artist
	hosttype router
	iface eth0 dmz unsafe untrusted
	iface eth1 dmz unsafe untrusted
	iface eth3 unsafe untrusted
defhost vampire
	hosttype router
	iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
	iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
	iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
	iface eth0.7 unsafe untrusted vpn
	iface vpn-precision colobdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-+ vpn
defhost ibanez
	iface br-dmz dmz unsafe
	iface br-unsafe unsafe
defhost orange
	iface wlan0 untrusted
	iface vpn-radius unsafe
defhost groove
	iface eth0 unsafe
	iface wlan0 untrusted
	iface vpn-radius unsafe

defhost gibson
	hosttype client
	iface eth0 unsafe

## Colocated networks.
defnet jump trusted
	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	via colohub
defnet colo trusted
	addr 172.29.199.176/28 2001:ba8:1d9:2::/64
	via colohub
defnet colohub virtual
	via colobdry jump colo
defnet colobdry virtual
	via colohub hub
defnet iodine untrusted
	addr 172.29.198.128/28
	via colohub
defnet hippotat untrusted
	addr 172.29.198.144/28
	via colohub

## Colocated hosts.
defhost fender
	iface br-jump jump colo
	iface br-colo jump colo
defhost precision
	hosttype router
	iface eth0 jump colo vpn sgo
	iface eth1 jump colo vpn sgo
	iface vpn-mango binswood
	iface vpn-radius housebdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-national upn
	iface vpn-mdwdev upn
	iface vpn-+ vpn
defhost telecaster
	iface eth0 jump colo
	iface eth1 jump colo
defhost stratocaster
	iface eth0 jump colo
	iface eth1 jump colo
defhost jazz
	hosttype router
	iface eth0 jump colo vpn
	iface eth1 jump colo vpn
	iface dns0 iodine
	iface hippo-svc hippotat
	iface vpn-+ vpn

## Other networks.
defnet hub virtual
	via housebdry colobdry
defnet sgo noloop
	addr !172.29.198.0/23
	addr !10.165.27.0/24
	addr 10.0.0.0/8
	addr 172.16.0.0/12
	addr 192.168.0.0/16
	via househub colohub
defnet vpn trusted
	addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
	via househub colohub
	host crybaby 1 ::1:1
	host terror 2 ::2:1
	host orange 3 ::3:1
	host haze 4 ::4:1
	host spirit 9 ::9:1
	host groove 10 ::10:1
defnet anycast trusted
	addr 172.29.199.224/27 2001:ba8:1d9:0::/64
	via dmz unsafe safe untrusted jump colo vpn
defnet default scary
	addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92::/48
	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	addr 2001:ba8:1d9::/48 #temporary
	via dmz unsafe untrusted jump colo
defnet upn untrusted
	addr 172.29.198.160/27 2001:ba8:1d9:a000::/64
	via colohub
	host national 1 ::1:1
	host mdwdev 2 ::2:1

## Linode hosts.
defhost national
	iface eth0 default
	iface vpn-precision colohub

## Satellite networks.
defnet binswood vpnnat
	addr 10.165.27.0/24
	via colohub
defhost mango
	hosttype router
	iface eth0 binswood default
	iface vpn-precision colo default

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Connection tracking helper modules.

for i in ftp; do
  modprobe nf_conntrack_$i
done

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Special forwarding exemptions.

case $forward in
  1)

    ## Only allow these packets if they're not fragmented.  (Don't trust safe
    ## hosts's fragment reassembly to be robust against malicious fragments.)
    ## There's a hideous bug in iptables 1.4.11.1 which botches the meaning
    ## of `! -f', so we do the negation using early return from a subchain.
    clearchain fwd-spec-nofrag
    run iptables -A fwd-spec-nofrag -j RETURN --fragment
    run ip6tables -A fwd-spec-nofrag -j RETURN \
	    -m ipv6header --soft --header frag
    run ip46tables -A FORWARD -j fwd-spec-nofrag

    ## Allow ping from safe/noloop to untrusted networks.
    run iptables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmp --icmp-type echo-request \
	    -m mark --mark $to_untrusted/$MASK_TO
    run iptables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmp --icmp-type echo-reply \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED
    run ip6tables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmpv6 --icmpv6-type echo-request \
	    -m mark --mark $to_untrusted/$MASK_TO
    run ip6tables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmpv6 --icmpv6-type echo-reply \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED

    ## Allow SSH from safe/noloop to untrusted networks.
    run ip46tables -A fwd-spec-nofrag -j ACCEPT \
	    -p tcp --destination-port $port_ssh \
	    -m mark --mark $to_untrusted/$MASK_TO
    run ip46tables -A fwd-spec-nofrag -j ACCEPT \
	    -p tcp --source-port $port_ssh \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED

    ;;
esac

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Kill things we don't understand properly.
###
### I don't like having to do this, but since I don't know how to do proper
### multicast filtering, I'm just going to ban it from being forwarded.

errorchain poorly-understood REJECT

## Ban multicast destination addresses in forwarding.
case $forward in
  1)
    run iptables -A FORWARD -g poorly-understood \
	    -d 224.0.0.0/4
    run ip6tables -A FORWARD -g poorly-understood \
	    -d ff::/8
    ;;
esac

m4_divert(82)m4_dnl
###--------------------------------------------------------------------------
### Check for source routing.

clearchain check-srcroute

run iptables -A check-srcroute -g forbidden \
    -m ipv4options --any --flags lsrr,ssrr
run ip6tables -A check-srcroute -g forbidden \
    -m rt

for c in INPUT FORWARD; do
  for m in $from_scary $from_untrusted; do
    run ip46tables -A $c -m mark --mark $m/$MASK_FROM -j check-srcroute
  done
done

m4_divert(84)m4_dnl
###--------------------------------------------------------------------------
### Locally-bound packet inspection.

clearchain inbound
clearchain inbound-untrusted

## Track connections.
commonrules inbound
conntrack inbound

## Allow incoming bootp.  Bootp won't be forwarded, so this is obviously a
## local request.
run iptables -A inbound -j ACCEPT \
	-s 0.0.0.0 -d 255.255.255.255 \
	-p udp --source-port $port_bootpc --destination-port $port_bootps
run iptables -A inbound -j ACCEPT \
	-s 172.29.198.0/23 \
	-p udp --source-port $port_bootpc --destination-port $port_bootps

## Allow incoming ping.  This is the only ICMP left.
run iptables -A inbound -j ACCEPT -p icmp
run ip6tables -A inbound -j ACCEPT -p icmpv6

m4_divert(88)m4_dnl
## Allow unusual things.
openports inbound

## Inspect inbound packets from untrusted sources.
run iptables -A inbound -s 172.29.198.0/24 -g inbound-untrusted
run ip6tables -A inbound -s 2001:8b0:c92:8000::/49 -g inbound-untrusted
run ip6tables -A inbound -s 2001:ba8:1d9:8000::/49 -g inbound-untrusted
run ip46tables -A inbound-untrusted -g forbidden
run ip46tables -A inbound -g forbidden
run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound
run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound

## Allow responses from the scary outside world into the untrusted net, but
## don't let untrusted things run services.
case $forward in
  1)
    run ip46tables -A FORWARD -j ACCEPT \
	-m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \
	-m state --state ESTABLISHED,RELATED
    ;;
esac

## Otherwise process as indicated by the mark.
for i in $inchains; do
  run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
done

m4_divert(-1)
###----- That's all, folks --------------------------------------------------
Commit	Line	Data
775bd287	1	### --sh--
bfdc045d MW	2	###
	3	### Local firewall configuration
	4	###
	5	### (c) 2008 Mark Wooding
	6	###
	7
	8	###----- Licensing notice ---------------------------------------------------
	9	###
	10	### This program is free software; you can redistribute it and/or modify
	11	### it under the terms of the GNU General Public License as published by
	12	### the Free Software Foundation; either version 2 of the License, or
	13	### (at your option) any later version.
	14	###
	15	### This program is distributed in the hope that it will be useful,
	16	### but WITHOUT ANY WARRANTY; without even the implied warranty of
	17	### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	18	### GNU General Public License for more details.
	19	###
	20	### You should have received a copy of the GNU General Public License
	21	### along with this program; if not, write to the Free Software Foundation,
	22	### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	23
	24	###--------------------------------------------------------------------------
335b2afe MW	25	### Local configuration.
	26
	27	m4_divert(6)m4_dnl
	28	## Default NTP servers.
	29	defconf(ntp_servers,
c8d1a00b	30	"81.187.26.174 90.155.23.205 2001:8b0:0:23::205 185.73.44.6 2001:ba8:0:2c06::")
335b2afe MW	31
	32	m4_divert(-1)
	33	###--------------------------------------------------------------------------
bfdc045d MW	34	### Packet classification.
bfdc045d MW	35
36e36cc7 MW	36	## IPv4 addressing.
	37	##
	38	## There are two small blocks of publicly routable IPv4 addresses, and a
	39	## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
	40	## The former are as follows.
	41	##
f01cdc79	42	## 81.2.113.195, 81.187.238.128/28
295959ea MW	43	## House border network (dmz). We have all of these; the loose
295959ea MW	44	## address is for the router.
f01cdc79	45	##
36e36cc7 MW	46	## 212.13.18.64/28
	47	## Jump colocated network (jump). .65--68 are used by Jump
	48	## network infrastructure; we get the rest.
	49	##
	50	## The latter is the block 172.29.196.0/22. Currently the low half is
	51	## unallocated (and may be returned to the G-RIN); the remaining addresses
	52	## are allocated as follows.
	53	##
	54	## 172.29.198.0/24 Untrusted networks.
	55	## .0/25 house wireless net
	56	## .128/28 iodine (IP-over-DNS) network
d0409c90	57	## .144/28 hippotat (IP-over-HTTP) network
42f784e2	58	## .160/27 untrusted virtual network
36e36cc7 MW	59	##
	60	## 172.29.199.0/24 Trusted networks.
	61	## .0/25 house wired network
	62	## .128/27 mobile VPN hosts
	63	## .160/28 reserved, except .160/30 allocated for ITS
	64	## .176/28 internal colocated network
	65	## .192/27 house safe network
	66	## .224/27 anycast services
	67
	68	## IPv6 addressing.
	69	##
	70	## There are five blocks of publicly routable IPv6 addresses, though some of
	71	## them aren't very interesting. The ranges are as follows.
	72	##
f01cdc79 MW	73	## 2001:8b0:c92::/48
	74	## Main house range (aaisp). See below for allocation policy.
	75	## There is no explicit DMZ allocation (and no need for one).
	76	##
36e36cc7 MW	77	## 2001:ba8:0:1d9::/64
	78	## Jump border network (jump): :1 is the router (supplied by
	79	## Jump); other addresses are ours.
	80	##
	81	## 2001:ba8:1d9::/48
	82	## Main colocated range. See below for allocation policy.
	83	##
	84	## Addresses in the /64 networks are simply allocated in ascending order.
	85	## The /48s are split into /64s by appending a 16-bit network number. The
	86	## top nibble of the network number classifies the network, as follows.
	87	##
42f784e2	88	## axxx Virtual, untrusted
36e36cc7	89	## 8xxx Untrusted
2caaca79	90	## 6xxx Virtual, safe
36e36cc7 MW	91	## 4xxx Safe
	92	## 0xxx Unsafe, trusted
	93	##
	94	## These have been chosen so that network properties can be deduced by
	95	## inspecting bits of the network number:
	96	##
	97	## Bit 15 If set, the network is untrusted; otherwise it is trusted.
	98	## Bit 14 If set, the network is safe; otherwise it is unsafe.
	99	##
	100	## Finally, the low-order nibbles identify the site.
	101	##
	102	## 0 No specific site: mobile VPN endpoints or anycast addresses.
	103	## 1 House.
	104	## 2 Jump colocation.
295959ea	105	## fff Local border network.
36e36cc7 MW	106	##
	107	## Usually site-0 networks are allocated from the Jump range to improve
	108	## expected performance from/to external sites which don't engage in our
	109	## dynamic routing protocols.
	110
bfdc045d MW	111	## Define the available network classes.
bfdc045d MW	112	m4_divert(42)m4_dnl
1b101247 MW	113	defnetclass scary scary trusted vpnnat mcast
	114	defnetclass untrusted scary untrusted trusted mcast
	115	defnetclass trusted scary untrusted trusted safe noloop vpnnat mcast
	116	defnetclass safe trusted safe noloop vpnnat mcast
	117	defnetclass noloop trusted safe mcast
	118	defnetclass vpnnat scary trusted safe mcast
951e7943	119
44f95827 MW	120	defnetclass link
44f95827 MW	121	defnetclass mcast
a4d8cae3	122	m4_divert(-1)
bfdc045d	123
a4d8cae3	124	m4_divert(26)m4_dnl
bfdc045d MW	125	###--------------------------------------------------------------------------
	126	### Network layout.
	127
beb4f0ee MW	128	## House networks.
beb4f0ee MW	129	defnet dmz trusted
295959ea	130	addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92:fff::/64
17a45245	131	via unsafe untrusted
beb4f0ee	132	defnet unsafe trusted
295959ea	133	addr 172.29.199.0/25 2001:8b0:c92:1::/64
17a45245	134	via househub
beb4f0ee	135	defnet safe safe
295959ea	136	addr 172.29.199.192/27 2001:8b0:c92:4001::/64
17a45245	137	via househub
beb4f0ee	138	defnet untrusted untrusted
295959ea	139	addr 172.29.198.0/25 2001:8b0:c92:8001::/64
17a45245	140	via househub
bfdc045d	141
beb4f0ee	142	defnet househub virtual
17a45245	143	via housebdry dmz unsafe safe untrusted
beb4f0ee	144	defnet housebdry virtual
17a45245	145	via househub hub
beb4f0ee MW	146
	147	## House hosts.
	148	defhost radius
4eb9f4df	149	hosttype router
68f0829f MW	150	iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
68f0829f MW	151	iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
960a9996	152	iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
83cc1e6c	153	iface eth3 unsafe untrusted vpn default
8506ff83	154	iface ppp0 default
a7e48c06	155	iface t6-he default
68f0829f MW	156	iface vpn-precision colobdry vpn sgo
	157	iface vpn-chiark sgo
	158	iface vpn-+ vpn
beb4f0ee	159	defhost roadstar
ce6434f7 MW	160	iface eth0 dmz unsafe
ce6434f7 MW	161	iface eth1 dmz unsafe
beb4f0ee	162	defhost jem
ce6434f7 MW	163	iface eth0 dmz unsafe
ce6434f7 MW	164	iface eth1 dmz unsafe
97320b7d MW	165	defhost universe
	166	iface eth0 dmz unsafe
	167	iface eth1 dmz unsafe
beb4f0ee	168	defhost artist
564c6939	169	hosttype router
490003e4 MW	170	iface eth0 dmz unsafe untrusted
490003e4 MW	171	iface eth1 dmz unsafe untrusted
83cc1e6c	172	iface eth3 unsafe untrusted
beb4f0ee	173	defhost vampire
4eb9f4df	174	hosttype router
2b17ac87 MW	175	iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
	176	iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
	177	iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
83cc1e6c	178	iface eth0.7 unsafe untrusted vpn
68f0829f	179	iface vpn-precision colobdry vpn sgo
ebaa31a7 MW	180	iface vpn-chiark sgo
ebaa31a7 MW	181	iface vpn-+ vpn
beb4f0ee	182	defhost ibanez
06ff8082	183	iface br-dmz dmz unsafe
beb4f0ee	184	iface br-unsafe unsafe
6fd217ae MW	185	defhost orange
	186	iface wlan0 untrusted
	187	iface vpn-radius unsafe
49b81a66 MW	188	defhost groove
49b81a66 MW	189	iface eth0 unsafe
24ddb007 MW	190	iface wlan0 untrusted
24ddb007 MW	191	iface vpn-radius unsafe
beb4f0ee MW	192
beb4f0ee MW	193	defhost gibson
4eb9f4df	194	hosttype client
d8e50664	195	iface eth0 unsafe
beb4f0ee MW	196
	197	## Colocated networks.
	198	defnet jump trusted
b9e891b5	199	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
17a45245	200	via colohub
beb4f0ee	201	defnet colo trusted
b9e891b5	202	addr 172.29.199.176/28 2001:ba8:1d9:2::/64
17a45245	203	via colohub
beb4f0ee	204	defnet colohub virtual
9853a66d	205	via colobdry jump colo
beb4f0ee	206	defnet colobdry virtual
17a45245	207	via colohub hub
148d527c MW	208	defnet iodine untrusted
148d527c MW	209	addr 172.29.198.128/28
17a45245	210	via colohub
d0409c90 MW	211	defnet hippotat untrusted
	212	addr 172.29.198.144/28
	213	via colohub
beb4f0ee MW	214
	215	## Colocated hosts.
	216	defhost fender
ce6434f7 MW	217	iface br-jump jump colo
ce6434f7 MW	218	iface br-colo jump colo
beb4f0ee	219	defhost precision
4eb9f4df	220	hosttype router
560ae309 MW	221	iface eth0 jump colo vpn sgo
560ae309 MW	222	iface eth1 jump colo vpn sgo
1fd9cef9	223	iface vpn-mango binswood
68f0829f	224	iface vpn-radius housebdry vpn sgo
ebaa31a7	225	iface vpn-chiark sgo
38e85ca3	226	iface vpn-national upn
175f1d48	227	iface vpn-mdwdev upn
ebaa31a7	228	iface vpn-+ vpn
beb4f0ee	229	defhost telecaster
ce6434f7 MW	230	iface eth0 jump colo
ce6434f7 MW	231	iface eth1 jump colo
beb4f0ee	232	defhost stratocaster
ce6434f7 MW	233	iface eth0 jump colo
ce6434f7 MW	234	iface eth1 jump colo
beb4f0ee	235	defhost jazz
560ae309 MW	236	hosttype router
	237	iface eth0 jump colo vpn
	238	iface eth1 jump colo vpn
148d527c	239	iface dns0 iodine
d0409c90	240	iface hippo-svc hippotat
560ae309	241	iface vpn-+ vpn
beb4f0ee MW	242
	243	## Other networks.
	244	defnet hub virtual
17a45245	245	via housebdry colobdry
ebaa31a7 MW	246	defnet sgo noloop
ebaa31a7 MW	247	addr !172.29.198.0/23
1b101247	248	addr !10.165.27.0/24
ebaa31a7 MW	249	addr 10.0.0.0/8
	250	addr 172.16.0.0/12
	251	addr 192.168.0.0/16
17a45245	252	via househub colohub
57644f26	253	defnet vpn trusted
7dff2754	254	addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
17a45245	255	via househub colohub
eec061c0 MW	256	host crybaby 1 ::1:1
	257	host terror 2 ::2:1
	258	host orange 3 ::3:1
a28edce0	259	host haze 4 ::4:1
ea2e5ed4	260	host spirit 9 ::9:1
194c72b5	261	host groove 10 ::10:1
c68b8ecc MW	262	defnet anycast trusted
c68b8ecc MW	263	addr 172.29.199.224/27 2001:ba8:1d9:0::/64
17a45245	264	via dmz unsafe safe untrusted jump colo vpn
1b534b6a	265	defnet default scary
295959ea	266	addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92::/48
b9e891b5 MW	267	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
b9e891b5 MW	268	addr 2001:ba8:1d9::/48 #temporary
17a45245	269	via dmz unsafe untrusted jump colo
42f784e2 MW	270	defnet upn untrusted
	271	addr 172.29.198.160/27 2001:ba8:1d9:a000::/64
	272	via colohub
38e85ca3	273	host national 1 ::1:1
175f1d48	274	host mdwdev 2 ::2:1
38e85ca3 MW	275
	276	## Linode hosts.
	277	defhost national
	278	iface eth0 default
	279	iface vpn-precision colohub
1ee6211d	280
1fd9cef9	281	## Satellite networks.
1b101247	282	defnet binswood vpnnat
1fd9cef9 MW	283	addr 10.165.27.0/24
1fd9cef9 MW	284	via colohub
31c0a107 MW	285	defhost mango
	286	hosttype router
	287	iface eth0 binswood default
1b101247	288	iface vpn-precision colo default
31c0a107	289
a4d8cae3	290	m4_divert(80)m4_dnl
bfdc045d	291	###--------------------------------------------------------------------------
5c5fcd73 MW	292	### Connection tracking helper modules.
	293
	294	for i in ftp; do
	295	modprobe nf_conntrack_$i
	296	done
	297
	298	m4_divert(80)m4_dnl
	299	###--------------------------------------------------------------------------
bfdc045d MW	300	### Special forwarding exemptions.
bfdc045d MW	301
78af294c MW	302	case $forward in
	303	1)
	304
	305	## Only allow these packets if they're not fragmented. (Don't trust safe
	306	## hosts's fragment reassembly to be robust against malicious fragments.)
	307	## There's a hideous bug in iptables 1.4.11.1 which botches the meaning
	308	## of `! -f', so we do the negation using early return from a subchain.
	309	clearchain fwd-spec-nofrag
	310	run iptables -A fwd-spec-nofrag -j RETURN --fragment
	311	run ip6tables -A fwd-spec-nofrag -j RETURN \
	312	-m ipv6header --soft --header frag
87bf1592	313	run ip46tables -A FORWARD -j fwd-spec-nofrag
78af294c MW	314
	315	## Allow ping from safe/noloop to untrusted networks.
	316	run iptables -A fwd-spec-nofrag -j ACCEPT \
	317	-p icmp --icmp-type echo-request \
	318	-m mark --mark $to_untrusted/$MASK_TO
	319	run iptables -A fwd-spec-nofrag -j ACCEPT \
	320	-p icmp --icmp-type echo-reply \
	321	-m mark --mark $from_untrusted/$MASK_FROM \
	322	-m state --state ESTABLISHED
	323	run ip6tables -A fwd-spec-nofrag -j ACCEPT \
8b021091	324	-p icmpv6 --icmpv6-type echo-request \
78af294c MW	325	-m mark --mark $to_untrusted/$MASK_TO
78af294c MW	326	run ip6tables -A fwd-spec-nofrag -j ACCEPT \
8b021091	327	-p icmpv6 --icmpv6-type echo-reply \
78af294c MW	328	-m mark --mark $from_untrusted/$MASK_FROM \
	329	-m state --state ESTABLISHED
	330
	331	## Allow SSH from safe/noloop to untrusted networks.
cbbd5e39	332	run ip46tables -A fwd-spec-nofrag -j ACCEPT \
78af294c MW	333	-p tcp --destination-port $port_ssh \
78af294c MW	334	-m mark --mark $to_untrusted/$MASK_TO
cbbd5e39	335	run ip46tables -A fwd-spec-nofrag -j ACCEPT \
78af294c MW	336	-p tcp --source-port $port_ssh \
	337	-m mark --mark $from_untrusted/$MASK_FROM \
	338	-m state --state ESTABLISHED
	339
	340	;;
	341	esac
	342
a4d8cae3	343	m4_divert(80)m4_dnl
ade2c052 MW	344	###--------------------------------------------------------------------------
	345	### Kill things we don't understand properly.
	346	###
	347	### I don't like having to do this, but since I don't know how to do proper
	348	### multicast filtering, I'm just going to ban it from being forwarded.
	349
	350	errorchain poorly-understood REJECT
	351
	352	## Ban multicast destination addresses in forwarding.
78af294c MW	353	case $forward in
	354	1)
	355	run iptables -A FORWARD -g poorly-understood \
	356	-d 224.0.0.0/4
	357	run ip6tables -A FORWARD -g poorly-understood \
	358	-d ff::/8
	359	;;
	360	esac
ade2c052	361
7377aca7 MW	362	m4_divert(82)m4_dnl
	363	###--------------------------------------------------------------------------
	364	### Check for source routing.
	365
	366	clearchain check-srcroute
	367
	368	run iptables -A check-srcroute -g forbidden \
	369	-m ipv4options --any --flags lsrr,ssrr
	370	run ip6tables -A check-srcroute -g forbidden \
	371	-m rt
	372
	373	for c in INPUT FORWARD; do
	374	for m in $from_scary $from_untrusted; do
	375	run ip46tables -A $c -m mark --mark $m/$MASK_FROM -j check-srcroute
	376	done
	377	done
	378
a4d8cae3	379	m4_divert(84)m4_dnl
bfdc045d MW	380	###--------------------------------------------------------------------------
	381	### Locally-bound packet inspection.
	382
	383	clearchain inbound
94ce6e76	384	clearchain inbound-untrusted
bfdc045d MW	385
bfdc045d MW	386	## Track connections.
ecdca131	387	commonrules inbound
bfdc045d MW	388	conntrack inbound
	389
	390	## Allow incoming bootp. Bootp won't be forwarded, so this is obviously a
	391	## local request.
	392	run iptables -A inbound -j ACCEPT \
	393	-s 0.0.0.0 -d 255.255.255.255 \
	394	-p udp --source-port $port_bootpc --destination-port $port_bootps
	395	run iptables -A inbound -j ACCEPT \
	396	-s 172.29.198.0/23 \
	397	-p udp --source-port $port_bootpc --destination-port $port_bootps
	398
	399	## Allow incoming ping. This is the only ICMP left.
8bd7e0fe MW	400	run iptables -A inbound -j ACCEPT -p icmp
8bd7e0fe MW	401	run ip6tables -A inbound -j ACCEPT -p icmpv6
bfdc045d MW	402
	403	m4_divert(88)m4_dnl
	404	## Allow unusual things.
	405	openports inbound
	406
	407	## Inspect inbound packets from untrusted sources.
8a3660c1	408	run iptables -A inbound -s 172.29.198.0/24 -g inbound-untrusted
94ce6e76 MW	409	run ip6tables -A inbound -s 2001:8b0:c92:8000::/49 -g inbound-untrusted
	410	run ip6tables -A inbound -s 2001:ba8:1d9:8000::/49 -g inbound-untrusted
	411	run ip46tables -A inbound-untrusted -g forbidden
994ac8d0	412	run ip46tables -A inbound -g forbidden
4f8c1989	413	run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound
0291d6d5	414	run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
bfdc045d	415
1b534b6a	416	## Allow responses from the scary outside world into the untrusted net, but
43e20546	417	## don't let untrusted things run services.
1b534b6a MW	418	case $forward in
	419	1)
	420	run ip46tables -A FORWARD -j ACCEPT \
	421	-m mark --mark $(( $from_scary \| $to_untrusted ))/$(( $MASK_FROM \| $MASK_TO )) \
	422	-m state --state ESTABLISHED,RELATED
	423	;;
	424	esac
	425
bfdc045d	426	## Otherwise process as indicated by the mark.
f0033e07 MW	427	for i in $inchains; do
	428	run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
	429	done
bfdc045d MW	430
	431	m4_divert(-1)
	432	###----- That's all, folks --------------------------------------------------