[firewall] / local.m4

### -*-sh-*-
###
### Local firewall configuration
###
### (c) 2008 Mark Wooding
###

###----- Licensing notice ---------------------------------------------------
###
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software Foundation,
### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

###--------------------------------------------------------------------------
### Local configuration.

m4_divert(6)m4_dnl
## Default NTP servers.
defconf(ntp_servers,
	"158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232")

m4_divert(-1)
###--------------------------------------------------------------------------
### Packet classification.

## IPv4 addressing.
##
## There are two small blocks of publicly routable IPv4 addresses, and a
## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
## The former are as follows.
##
## 62.49.204.144/28
##		House border network (dmz).  We have all of these, but .145
##		is reserved for the router.
##
## 81.2.113.195, 81.187.238.128/28
##		House border network (aaisp).  We have all of these; the
##		loose address is for the router.
##
## 212.13.18.64/28
##		Jump colocated network (jump).  .65--68 are used by Jump
##		network infrastructure; we get the rest.
##
## The latter is the block 172.29.196.0/22.  Currently the low half is
## unallocated (and may be returned to the G-RIN); the remaining addresses
## are allocated as follows.
##
## 172.29.198.0/24  Untrusted networks.
##	.0/25		house wireless net
##	.128/28		iodine (IP-over-DNS) network
##	.160/27		untrusted virtual network
##
## 172.29.199.0/24  Trusted networks.
##	.0/25		house wired network
##	.128/27		mobile VPN hosts
##	.160/28		reserved, except .160/30 allocated for ITS
##	.176/28		internal colocated network
##	.192/27		house safe network
##	.224/27		anycast services

## IPv6 addressing.
##
## There are five blocks of publicly routable IPv6 addresses, though some of
## them aren't very interesting.  The ranges are as follows.
##
## 2001:470:1f08:1b98::/64
##		Hurricane Electric tunnel network: only :1 (HE) and :2
##		(radius) are used.
##
## 2001:470:1f09:1b98::/64
##		House border network (dmz).
##
## 2001:470:9740::/48
##		Main house range.  See below for allocation policy.
##
## 2001:8b0:c92::/48
##		Main house range (aaisp).  See below for allocation policy.
##		There is no explicit DMZ allocation (and no need for one).
##
## 2001:ba8:0:1d9::/64
##		Jump border network (jump): :1 is the router (supplied by
##		Jump); other addresses are ours.
##
## 2001:ba8:1d9::/48
##		Main colocated range.  See below for allocation policy.
##
## Addresses in the /64 networks are simply allocated in ascending order.
## The /48s are split into /64s by appending a 16-bit network number.  The
## top nibble of the network number classifies the network, as follows.
##
## axxx		Virtual, untrusted
## 8xxx		Untrusted
## 6xxx		Virtual, safe
## 4xxx		Safe
## 0xxx		Unsafe, trusted
##
## These have been chosen so that network properties can be deduced by
## inspecting bits of the network number:
##
## Bit 15	If set, the network is untrusted; otherwise it is trusted.
## Bit 14	If set, the network is safe; otherwise it is unsafe.
##
## Finally, the low-order nibbles identify the site.
##
## 0		No specific site: mobile VPN endpoints or anycast addresses.
## 1		House.
## 2		Jump colocation.
##
## Usually site-0 networks are allocated from the Jump range to improve
## expected performance from/to external sites which don't engage in our
## dynamic routing protocols.

## Define the available network classes.
m4_divert(42)m4_dnl
defnetclass scary	scary		trusted		    mcast
defnetclass untrusted	scary untrusted trusted		    mcast
defnetclass trusted	scary untrusted trusted safe noloop mcast
defnetclass safe			trusted safe noloop mcast
defnetclass noloop			trusted safe	    mcast

defnetclass link
defnetclass mcast
m4_divert(-1)

m4_divert(26)m4_dnl
###--------------------------------------------------------------------------
### Network layout.

## House networks.
defnet dmz trusted
	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
	addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92::/48
	via unsafe untrusted
defnet unsafe trusted
	addr 172.29.199.0/25 2001:470:9740:1::/64
	via househub
defnet safe safe
	addr 172.29.199.192/27 2001:470:9740:4001::/64
	via househub
defnet untrusted untrusted
	addr 172.29.198.0/25 2001:470:9740:8001::/64
	via househub

defnet househub virtual
	via housebdry dmz unsafe safe untrusted
defnet housebdry virtual
	via househub hub

## House hosts.
defhost radius
	hosttype router
	iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
	iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
	iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
	iface eth3 unsafe untrusted vpn default
	iface ppp0 default
	iface t6-he default
	iface vpn-precision colobdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-+ vpn
defhost roadstar
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost jem
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost universe
	iface eth0 dmz unsafe
	iface eth1 dmz unsafe
defhost artist
	hosttype router
	iface eth0 dmz unsafe untrusted
	iface eth1 dmz unsafe untrusted
	iface eth3 unsafe untrusted
defhost vampire
	hosttype router
	iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
	iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
	iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
	iface eth0.7 unsafe untrusted vpn
	iface vpn-precision colobdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-+ vpn
defhost ibanez
	iface br-dmz dmz unsafe
	iface br-unsafe unsafe
defhost orange
	iface wlan0 untrusted
	iface vpn-radius unsafe
defhost groove
	iface eth0 unsafe
	iface wlan0 untrusted
	iface vpn-radius unsafe

defhost gibson
	hosttype client
	iface eth0.5 unsafe

## Colocated networks.
defnet jump trusted
	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	via colohub
defnet colo trusted
	addr 172.29.199.176/28 2001:ba8:1d9:2::/64
	via colohub
defnet colohub virtual
	via colobdry jump colo
defnet colobdry virtual
	via colohub hub
defnet iodine untrusted
	addr 172.29.198.128/28
	via colohub

## Colocated hosts.
defhost fender
	iface br-jump jump colo
	iface br-colo jump colo
defhost precision
	hosttype router
	iface eth0 jump colo vpn sgo
	iface eth1 jump colo vpn sgo
	iface vpn-mango binswood
	iface vpn-radius housebdry vpn sgo
	iface vpn-chiark sgo
	iface vpn-national upn
	iface vpn-+ vpn
defhost telecaster
	iface eth0 jump colo
	iface eth1 jump colo
defhost stratocaster
	iface eth0 jump colo
	iface eth1 jump colo
defhost jazz
	hosttype router
	iface eth0 jump colo vpn
	iface eth1 jump colo vpn
	iface dns0 iodine
	iface vpn-+ vpn

## Other networks.
defnet hub virtual
	via housebdry colobdry
defnet sgo noloop
	addr !172.29.198.0/23
	addr 10.0.0.0/8
	addr 172.16.0.0/12
	addr 192.168.0.0/16
	via househub colohub
defnet vpn safe
	addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
	via househub colohub
	host crybaby 1 ::1:1
	host terror 2 ::2:1
	host orange 3 ::3:1
	host haze 4 ::4:1
	host groove 5 ::5:1
defnet anycast trusted
	addr 172.29.199.224/27 2001:ba8:1d9:0::/64
	via dmz unsafe safe untrusted jump colo vpn
defnet default scary
	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	addr 2001:ba8:1d9::/48 #temporary
	via dmz unsafe untrusted jump colo
defnet upn untrusted
	addr 172.29.198.160/27 2001:ba8:1d9:a000::/64
	via colohub
	host national 1 ::1:1

## Linode hosts.
defhost national
	iface eth0 default
	iface vpn-precision colohub

## Satellite networks.
defnet binswood noloop
	addr 10.165.27.0/24
	via colohub
defhost mango
	hosttype router
	iface eth0 binswood default
	iface vpn-precision colo

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Connection tracking helper modules.

for i in ftp; do
  modprobe nf_conntrack_$i
done

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Special forwarding exemptions.

case $forward in
  1)

    ## Only allow these packets if they're not fragmented.  (Don't trust safe
    ## hosts's fragment reassembly to be robust against malicious fragments.)
    ## There's a hideous bug in iptables 1.4.11.1 which botches the meaning
    ## of `! -f', so we do the negation using early return from a subchain.
    clearchain fwd-spec-nofrag
    run iptables -A fwd-spec-nofrag -j RETURN --fragment
    run ip6tables -A fwd-spec-nofrag -j RETURN \
	    -m ipv6header --soft --header frag
    run ip46tables -A FORWARD -j fwd-spec-nofrag

    ## Allow ping from safe/noloop to untrusted networks.
    run iptables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmp --icmp-type echo-request \
	    -m mark --mark $to_untrusted/$MASK_TO
    run iptables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmp --icmp-type echo-reply \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED
    run ip6tables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmpv6 --icmpv6-type echo-request \
	    -m mark --mark $to_untrusted/$MASK_TO
    run ip6tables -A fwd-spec-nofrag -j ACCEPT \
	    -p icmpv6 --icmpv6-type echo-reply \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED

    ## Allow SSH from safe/noloop to untrusted networks.
    run ip46tables -A fwd-spec-nofrag -j ACCEPT \
	    -p tcp --destination-port $port_ssh \
	    -m mark --mark $to_untrusted/$MASK_TO
    run ip46tables -A fwd-spec-nofrag -j ACCEPT \
	    -p tcp --source-port $port_ssh \
	    -m mark --mark $from_untrusted/$MASK_FROM \
	    -m state --state ESTABLISHED

    ;;
esac

m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
### Kill things we don't understand properly.
###
### I don't like having to do this, but since I don't know how to do proper
### multicast filtering, I'm just going to ban it from being forwarded.

errorchain poorly-understood REJECT

## Ban multicast destination addresses in forwarding.
case $forward in
  1)
    run iptables -A FORWARD -g poorly-understood \
	    -d 224.0.0.0/4
    run ip6tables -A FORWARD -g poorly-understood \
	    -d ff::/8
    ;;
esac

m4_divert(84)m4_dnl
###--------------------------------------------------------------------------
### Locally-bound packet inspection.

clearchain inbound

## Track connections.
commonrules inbound
conntrack inbound

## Allow incoming bootp.  Bootp won't be forwarded, so this is obviously a
## local request.
run iptables -A inbound -j ACCEPT \
	-s 0.0.0.0 -d 255.255.255.255 \
	-p udp --source-port $port_bootpc --destination-port $port_bootps
run iptables -A inbound -j ACCEPT \
	-s 172.29.198.0/23 \
	-p udp --source-port $port_bootpc --destination-port $port_bootps

## Allow incoming ping.  This is the only ICMP left.
run iptables -A inbound -j ACCEPT -p icmp
run ip6tables -A inbound -j ACCEPT -p icmpv6

m4_divert(88)m4_dnl
## Allow unusual things.
openports inbound

## Inspect inbound packets from untrusted sources.
run ip46tables -A inbound -j forbidden
run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound
run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound

## Allow responses from the scary outside world into the untrusted net, but
## don't let untrusted things run services.
case $forward in
  1)
    run ip46tables -A FORWARD -j ACCEPT \
	-m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \
	-m state --state ESTABLISHED,RELATED
    ;;
esac

## Otherwise process as indicated by the mark.
for i in $inchains; do
  run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
done

m4_divert(-1)
###----- That's all, folks --------------------------------------------------
Commit	Line	Data
775bd287	1	### --sh--
bfdc045d MW	2	###
	3	### Local firewall configuration
	4	###
	5	### (c) 2008 Mark Wooding
	6	###
	7
	8	###----- Licensing notice ---------------------------------------------------
	9	###
	10	### This program is free software; you can redistribute it and/or modify
	11	### it under the terms of the GNU General Public License as published by
	12	### the Free Software Foundation; either version 2 of the License, or
	13	### (at your option) any later version.
	14	###
	15	### This program is distributed in the hope that it will be useful,
	16	### but WITHOUT ANY WARRANTY; without even the implied warranty of
	17	### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	18	### GNU General Public License for more details.
	19	###
	20	### You should have received a copy of the GNU General Public License
	21	### along with this program; if not, write to the Free Software Foundation,
	22	### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
	23
	24	###--------------------------------------------------------------------------
335b2afe MW	25	### Local configuration.
	26
	27	m4_divert(6)m4_dnl
	28	## Default NTP servers.
	29	defconf(ntp_servers,
	30	"158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232")
	31
	32	m4_divert(-1)
	33	###--------------------------------------------------------------------------
bfdc045d MW	34	### Packet classification.
bfdc045d MW	35
36e36cc7 MW	36	## IPv4 addressing.
	37	##
	38	## There are two small blocks of publicly routable IPv4 addresses, and a
	39	## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
	40	## The former are as follows.
	41	##
	42	## 62.49.204.144/28
	43	## House border network (dmz). We have all of these, but .145
	44	## is reserved for the router.
	45	##
f01cdc79 MW	46	## 81.2.113.195, 81.187.238.128/28
	47	## House border network (aaisp). We have all of these; the
	48	## loose address is for the router.
	49	##
36e36cc7 MW	50	## 212.13.18.64/28
	51	## Jump colocated network (jump). .65--68 are used by Jump
	52	## network infrastructure; we get the rest.
	53	##
	54	## The latter is the block 172.29.196.0/22. Currently the low half is
	55	## unallocated (and may be returned to the G-RIN); the remaining addresses
	56	## are allocated as follows.
	57	##
	58	## 172.29.198.0/24 Untrusted networks.
	59	## .0/25 house wireless net
	60	## .128/28 iodine (IP-over-DNS) network
42f784e2	61	## .160/27 untrusted virtual network
36e36cc7 MW	62	##
	63	## 172.29.199.0/24 Trusted networks.
	64	## .0/25 house wired network
	65	## .128/27 mobile VPN hosts
	66	## .160/28 reserved, except .160/30 allocated for ITS
	67	## .176/28 internal colocated network
	68	## .192/27 house safe network
	69	## .224/27 anycast services
	70
	71	## IPv6 addressing.
	72	##
	73	## There are five blocks of publicly routable IPv6 addresses, though some of
	74	## them aren't very interesting. The ranges are as follows.
	75	##
	76	## 2001:470:1f08:1b98::/64
	77	## Hurricane Electric tunnel network: only :1 (HE) and :2
	78	## (radius) are used.
	79	##
	80	## 2001:470:1f09:1b98::/64
	81	## House border network (dmz).
	82	##
	83	## 2001:470:9740::/48
	84	## Main house range. See below for allocation policy.
	85	##
f01cdc79 MW	86	## 2001:8b0:c92::/48
	87	## Main house range (aaisp). See below for allocation policy.
	88	## There is no explicit DMZ allocation (and no need for one).
	89	##
36e36cc7 MW	90	## 2001:ba8:0:1d9::/64
	91	## Jump border network (jump): :1 is the router (supplied by
	92	## Jump); other addresses are ours.
	93	##
	94	## 2001:ba8:1d9::/48
	95	## Main colocated range. See below for allocation policy.
	96	##
	97	## Addresses in the /64 networks are simply allocated in ascending order.
	98	## The /48s are split into /64s by appending a 16-bit network number. The
	99	## top nibble of the network number classifies the network, as follows.
	100	##
42f784e2	101	## axxx Virtual, untrusted
36e36cc7	102	## 8xxx Untrusted
2caaca79	103	## 6xxx Virtual, safe
36e36cc7 MW	104	## 4xxx Safe
	105	## 0xxx Unsafe, trusted
	106	##
	107	## These have been chosen so that network properties can be deduced by
	108	## inspecting bits of the network number:
	109	##
	110	## Bit 15 If set, the network is untrusted; otherwise it is trusted.
	111	## Bit 14 If set, the network is safe; otherwise it is unsafe.
	112	##
	113	## Finally, the low-order nibbles identify the site.
	114	##
	115	## 0 No specific site: mobile VPN endpoints or anycast addresses.
	116	## 1 House.
	117	## 2 Jump colocation.
	118	##
	119	## Usually site-0 networks are allocated from the Jump range to improve
	120	## expected performance from/to external sites which don't engage in our
	121	## dynamic routing protocols.
	122
bfdc045d MW	123	## Define the available network classes.
bfdc045d MW	124	m4_divert(42)m4_dnl
8670c87d	125	defnetclass scary scary trusted mcast
1b534b6a MW	126	defnetclass untrusted scary untrusted trusted mcast
	127	defnetclass trusted scary untrusted trusted safe noloop mcast
	128	defnetclass safe trusted safe noloop mcast
	129	defnetclass noloop trusted safe mcast
951e7943	130
44f95827 MW	131	defnetclass link
44f95827 MW	132	defnetclass mcast
a4d8cae3	133	m4_divert(-1)
bfdc045d	134
a4d8cae3	135	m4_divert(26)m4_dnl
bfdc045d MW	136	###--------------------------------------------------------------------------
	137	### Network layout.
	138
beb4f0ee MW	139	## House networks.
beb4f0ee MW	140	defnet dmz trusted
b9e891b5	141	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
f01cdc79	142	addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92::/48
17a45245	143	via unsafe untrusted
beb4f0ee	144	defnet unsafe trusted
b9e891b5	145	addr 172.29.199.0/25 2001:470:9740:1::/64
17a45245	146	via househub
beb4f0ee	147	defnet safe safe
216285e1	148	addr 172.29.199.192/27 2001:470:9740:4001::/64
17a45245	149	via househub
beb4f0ee	150	defnet untrusted untrusted
b9e891b5	151	addr 172.29.198.0/25 2001:470:9740:8001::/64
17a45245	152	via househub
bfdc045d	153
beb4f0ee	154	defnet househub virtual
17a45245	155	via housebdry dmz unsafe safe untrusted
beb4f0ee	156	defnet housebdry virtual
17a45245	157	via househub hub
beb4f0ee MW	158
	159	## House hosts.
	160	defhost radius
4eb9f4df	161	hosttype router
68f0829f MW	162	iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
68f0829f MW	163	iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
960a9996	164	iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
83cc1e6c	165	iface eth3 unsafe untrusted vpn default
8506ff83	166	iface ppp0 default
a7e48c06	167	iface t6-he default
68f0829f MW	168	iface vpn-precision colobdry vpn sgo
	169	iface vpn-chiark sgo
	170	iface vpn-+ vpn
beb4f0ee	171	defhost roadstar
ce6434f7 MW	172	iface eth0 dmz unsafe
ce6434f7 MW	173	iface eth1 dmz unsafe
beb4f0ee	174	defhost jem
ce6434f7 MW	175	iface eth0 dmz unsafe
ce6434f7 MW	176	iface eth1 dmz unsafe
97320b7d MW	177	defhost universe
	178	iface eth0 dmz unsafe
	179	iface eth1 dmz unsafe
beb4f0ee	180	defhost artist
564c6939	181	hosttype router
490003e4 MW	182	iface eth0 dmz unsafe untrusted
490003e4 MW	183	iface eth1 dmz unsafe untrusted
83cc1e6c	184	iface eth3 unsafe untrusted
beb4f0ee	185	defhost vampire
4eb9f4df	186	hosttype router
2b17ac87 MW	187	iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
	188	iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
	189	iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
83cc1e6c	190	iface eth0.7 unsafe untrusted vpn
68f0829f	191	iface vpn-precision colobdry vpn sgo
ebaa31a7 MW	192	iface vpn-chiark sgo
ebaa31a7 MW	193	iface vpn-+ vpn
beb4f0ee	194	defhost ibanez
06ff8082	195	iface br-dmz dmz unsafe
beb4f0ee	196	iface br-unsafe unsafe
6fd217ae MW	197	defhost orange
	198	iface wlan0 untrusted
	199	iface vpn-radius unsafe
49b81a66 MW	200	defhost groove
49b81a66 MW	201	iface eth0 unsafe
24ddb007 MW	202	iface wlan0 untrusted
24ddb007 MW	203	iface vpn-radius unsafe
beb4f0ee MW	204
beb4f0ee MW	205	defhost gibson
4eb9f4df	206	hosttype client
15e9eeff	207	iface eth0.5 unsafe
beb4f0ee MW	208
	209	## Colocated networks.
	210	defnet jump trusted
b9e891b5	211	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
17a45245	212	via colohub
beb4f0ee	213	defnet colo trusted
b9e891b5	214	addr 172.29.199.176/28 2001:ba8:1d9:2::/64
17a45245	215	via colohub
beb4f0ee	216	defnet colohub virtual
9853a66d	217	via colobdry jump colo
beb4f0ee	218	defnet colobdry virtual
17a45245	219	via colohub hub
148d527c MW	220	defnet iodine untrusted
148d527c MW	221	addr 172.29.198.128/28
17a45245	222	via colohub
beb4f0ee MW	223
	224	## Colocated hosts.
	225	defhost fender
ce6434f7 MW	226	iface br-jump jump colo
ce6434f7 MW	227	iface br-colo jump colo
beb4f0ee	228	defhost precision
4eb9f4df	229	hosttype router
560ae309 MW	230	iface eth0 jump colo vpn sgo
560ae309 MW	231	iface eth1 jump colo vpn sgo
1fd9cef9	232	iface vpn-mango binswood
68f0829f	233	iface vpn-radius housebdry vpn sgo
ebaa31a7	234	iface vpn-chiark sgo
38e85ca3	235	iface vpn-national upn
ebaa31a7	236	iface vpn-+ vpn
beb4f0ee	237	defhost telecaster
ce6434f7 MW	238	iface eth0 jump colo
ce6434f7 MW	239	iface eth1 jump colo
beb4f0ee	240	defhost stratocaster
ce6434f7 MW	241	iface eth0 jump colo
ce6434f7 MW	242	iface eth1 jump colo
beb4f0ee	243	defhost jazz
560ae309 MW	244	hosttype router
	245	iface eth0 jump colo vpn
	246	iface eth1 jump colo vpn
148d527c	247	iface dns0 iodine
560ae309	248	iface vpn-+ vpn
beb4f0ee MW	249
	250	## Other networks.
	251	defnet hub virtual
17a45245	252	via housebdry colobdry
ebaa31a7 MW	253	defnet sgo noloop
	254	addr !172.29.198.0/23
	255	addr 10.0.0.0/8
	256	addr 172.16.0.0/12
	257	addr 192.168.0.0/16
17a45245	258	via househub colohub
7dff2754 MW	259	defnet vpn safe
7dff2754 MW	260	addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
17a45245	261	via househub colohub
eec061c0 MW	262	host crybaby 1 ::1:1
	263	host terror 2 ::2:1
	264	host orange 3 ::3:1
a28edce0	265	host haze 4 ::4:1
24ddb007	266	host groove 5 ::5:1
c68b8ecc MW	267	defnet anycast trusted
c68b8ecc MW	268	addr 172.29.199.224/27 2001:ba8:1d9:0::/64
17a45245	269	via dmz unsafe safe untrusted jump colo vpn
1b534b6a	270	defnet default scary
b9e891b5 MW	271	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
	272	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
	273	addr 2001:ba8:1d9::/48 #temporary
17a45245	274	via dmz unsafe untrusted jump colo
42f784e2 MW	275	defnet upn untrusted
	276	addr 172.29.198.160/27 2001:ba8:1d9:a000::/64
	277	via colohub
38e85ca3 MW	278	host national 1 ::1:1
	279
	280	## Linode hosts.
	281	defhost national
	282	iface eth0 default
	283	iface vpn-precision colohub
1ee6211d	284
1fd9cef9 MW	285	## Satellite networks.
	286	defnet binswood noloop
	287	addr 10.165.27.0/24
	288	via colohub
31c0a107 MW	289	defhost mango
	290	hosttype router
	291	iface eth0 binswood default
	292	iface vpn-precision colo
	293
a4d8cae3	294	m4_divert(80)m4_dnl
bfdc045d	295	###--------------------------------------------------------------------------
5c5fcd73 MW	296	### Connection tracking helper modules.
	297
	298	for i in ftp; do
	299	modprobe nf_conntrack_$i
	300	done
	301
	302	m4_divert(80)m4_dnl
	303	###--------------------------------------------------------------------------
bfdc045d MW	304	### Special forwarding exemptions.
bfdc045d MW	305
78af294c MW	306	case $forward in
	307	1)
	308
	309	## Only allow these packets if they're not fragmented. (Don't trust safe
	310	## hosts's fragment reassembly to be robust against malicious fragments.)
	311	## There's a hideous bug in iptables 1.4.11.1 which botches the meaning
	312	## of `! -f', so we do the negation using early return from a subchain.
	313	clearchain fwd-spec-nofrag
	314	run iptables -A fwd-spec-nofrag -j RETURN --fragment
	315	run ip6tables -A fwd-spec-nofrag -j RETURN \
	316	-m ipv6header --soft --header frag
87bf1592	317	run ip46tables -A FORWARD -j fwd-spec-nofrag
78af294c MW	318
	319	## Allow ping from safe/noloop to untrusted networks.
	320	run iptables -A fwd-spec-nofrag -j ACCEPT \
	321	-p icmp --icmp-type echo-request \
	322	-m mark --mark $to_untrusted/$MASK_TO
	323	run iptables -A fwd-spec-nofrag -j ACCEPT \
	324	-p icmp --icmp-type echo-reply \
	325	-m mark --mark $from_untrusted/$MASK_FROM \
	326	-m state --state ESTABLISHED
	327	run ip6tables -A fwd-spec-nofrag -j ACCEPT \
8b021091	328	-p icmpv6 --icmpv6-type echo-request \
78af294c MW	329	-m mark --mark $to_untrusted/$MASK_TO
78af294c MW	330	run ip6tables -A fwd-spec-nofrag -j ACCEPT \
8b021091	331	-p icmpv6 --icmpv6-type echo-reply \
78af294c MW	332	-m mark --mark $from_untrusted/$MASK_FROM \
	333	-m state --state ESTABLISHED
	334
	335	## Allow SSH from safe/noloop to untrusted networks.
cbbd5e39	336	run ip46tables -A fwd-spec-nofrag -j ACCEPT \
78af294c MW	337	-p tcp --destination-port $port_ssh \
78af294c MW	338	-m mark --mark $to_untrusted/$MASK_TO
cbbd5e39	339	run ip46tables -A fwd-spec-nofrag -j ACCEPT \
78af294c MW	340	-p tcp --source-port $port_ssh \
	341	-m mark --mark $from_untrusted/$MASK_FROM \
	342	-m state --state ESTABLISHED
	343
	344	;;
	345	esac
	346
a4d8cae3	347	m4_divert(80)m4_dnl
ade2c052 MW	348	###--------------------------------------------------------------------------
	349	### Kill things we don't understand properly.
	350	###
	351	### I don't like having to do this, but since I don't know how to do proper
	352	### multicast filtering, I'm just going to ban it from being forwarded.
	353
	354	errorchain poorly-understood REJECT
	355
	356	## Ban multicast destination addresses in forwarding.
78af294c MW	357	case $forward in
	358	1)
	359	run iptables -A FORWARD -g poorly-understood \
	360	-d 224.0.0.0/4
	361	run ip6tables -A FORWARD -g poorly-understood \
	362	-d ff::/8
	363	;;
	364	esac
ade2c052	365
a4d8cae3	366	m4_divert(84)m4_dnl
bfdc045d MW	367	###--------------------------------------------------------------------------
	368	### Locally-bound packet inspection.
	369
	370	clearchain inbound
	371
	372	## Track connections.
ecdca131	373	commonrules inbound
bfdc045d MW	374	conntrack inbound
	375
	376	## Allow incoming bootp. Bootp won't be forwarded, so this is obviously a
	377	## local request.
	378	run iptables -A inbound -j ACCEPT \
	379	-s 0.0.0.0 -d 255.255.255.255 \
	380	-p udp --source-port $port_bootpc --destination-port $port_bootps
	381	run iptables -A inbound -j ACCEPT \
	382	-s 172.29.198.0/23 \
	383	-p udp --source-port $port_bootpc --destination-port $port_bootps
	384
	385	## Allow incoming ping. This is the only ICMP left.
8bd7e0fe MW	386	run iptables -A inbound -j ACCEPT -p icmp
8bd7e0fe MW	387	run ip6tables -A inbound -j ACCEPT -p icmpv6
bfdc045d MW	388
	389	m4_divert(88)m4_dnl
	390	## Allow unusual things.
	391	openports inbound
	392
	393	## Inspect inbound packets from untrusted sources.
0291d6d5	394	run ip46tables -A inbound -j forbidden
4f8c1989	395	run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound
0291d6d5	396	run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
bfdc045d	397
1b534b6a	398	## Allow responses from the scary outside world into the untrusted net, but
43e20546	399	## don't let untrusted things run services.
1b534b6a MW	400	case $forward in
	401	1)
	402	run ip46tables -A FORWARD -j ACCEPT \
	403	-m mark --mark $(( $from_scary \| $to_untrusted ))/$(( $MASK_FROM \| $MASK_TO )) \
	404	-m state --state ESTABLISHED,RELATED
	405	;;
	406	esac
	407
bfdc045d	408	## Otherwise process as indicated by the mark.
f0033e07 MW	409	for i in $inchains; do
	410	run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
	411	done
bfdc045d MW	412
	413	m4_divert(-1)
	414	###----- That's all, folks --------------------------------------------------