eggle.m4, local.m4, local.mk: Add new VPS `eggle'.

[firewall] / local.m4

diff --git a/local.m4 b/local.m4
index 23f12a7..b0a1770 100644 (file)
--- a/local.m4
+++ b/local.m4
@@ -27,7 +27,7 @@
 m4_divert(6)m4_dnl
 ## Default NTP servers.
 defconf(ntp_servers,
 m4_divert(6)m4_dnl
 ## Default NTP servers.
 defconf(ntp_servers,

-       "158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232")
+       "81.187.26.174 90.155.23.205 2001:8b0:0:23::205 185.73.44.6 2001:ba8:0:2c06::")

 
 m4_divert(-1)
 ###--------------------------------------------------------------------------
 
 m4_divert(-1)
 ###--------------------------------------------------------------------------


@@ -39,13 +39,9 @@ m4_divert(-1)
 ## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
 ## The former are as follows.
 ##
 ## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
 ## The former are as follows.
 ##

-## 62.49.204.144/28
-##             House border network (dmz).  We have all of these, but .145
-##             is reserved for the router.
-##
-## 212.13.18.64/28
-##             Jump colocated network (jump).  .65--68 are used by Jump
-##             network infrastructure; we get the rest.
+## 81.2.113.195, 81.187.238.128/28, 217.169.12.64/28
+##             House border network (dmz).  We have all of these; the loose
+##             address is for the router.

 ##
 ## The latter is the block 172.29.196.0/22.  Currently the low half is
 ## unallocated (and may be returned to the G-RIN); the remaining addresses
 ##
 ## The latter is the block 172.29.196.0/22.  Currently the low half is
 ## unallocated (and may be returned to the G-RIN); the remaining addresses


@@ -54,6 +50,8 @@ m4_divert(-1)
 ## 172.29.198.0/24  Untrusted networks.
 ##     .0/25           house wireless net
 ##     .128/28         iodine (IP-over-DNS) network
 ## 172.29.198.0/24  Untrusted networks.
 ##     .0/25           house wireless net
 ##     .128/28         iodine (IP-over-DNS) network

+##     .144/28         hippotat (IP-over-HTTP) network
+##     .160/27         untrusted virtual network

 ##
 ## 172.29.199.0/24  Trusted networks.
 ##     .0/25           house wired network
 ##
 ## 172.29.199.0/24  Trusted networks.
 ##     .0/25           house wired network


@@ -68,29 +66,17 @@ m4_divert(-1)
 ## There are five blocks of publicly routable IPv6 addresses, though some of
 ## them aren't very interesting.  The ranges are as follows.
 ##
 ## There are five blocks of publicly routable IPv6 addresses, though some of
 ## them aren't very interesting.  The ranges are as follows.
 ##

-## 2001:470:1f08:1b98::/64
-##             Hurricane Electric tunnel network: only :1 (HE) and :2
-##             (radius) are used.
-##
-## 2001:470:1f09:1b98::/64
-##             House border network (dmz).
-##
-## 2001:470:9740::/48
-##             Main house range.  See below for allocation policy.
-##
-## 2001:ba8:0:1d9::/64
-##             Jump border network (jump): :1 is the router (supplied by
-##             Jump); other addresses are ours.
-##
-## 2001:ba8:1d9::/48
-##             Main colocated range.  See below for allocation policy.
+## 2001:8b0:c92::/48
+##             Main house range (aaisp).  See below for allocation policy.
+##             There is no explicit DMZ allocation (and no need for one).

 ##
 ## Addresses in the /64 networks are simply allocated in ascending order.
 ## The /48s are split into /64s by appending a 16-bit network number.  The
 ## top nibble of the network number classifies the network, as follows.
 ##
 ##
 ## Addresses in the /64 networks are simply allocated in ascending order.
 ## The /48s are split into /64s by appending a 16-bit network number.  The
 ## top nibble of the network number classifies the network, as follows.
 ##

+## axxx                Virtual, untrusted

 ## 8xxx                Untrusted
 ## 8xxx                Untrusted

-## 6xxx                Virtual
+## 6xxx                Virtual, safe

 ## 4xxx                Safe
 ## 0xxx                Unsafe, trusted
 ##
 ## 4xxx                Safe
 ## 0xxx                Unsafe, trusted
 ##


@@ -104,18 +90,16 @@ m4_divert(-1)
 ##
 ## 0           No specific site: mobile VPN endpoints or anycast addresses.
 ## 1           House.
 ##
 ## 0           No specific site: mobile VPN endpoints or anycast addresses.
 ## 1           House.

-## 2           Jump colocation.
-##
-## Usually site-0 networks are allocated from the Jump range to improve
-## expected performance from/to external sites which don't engage in our
-## dynamic routing protocols.
+## fff         Local border network.

 
 ## Define the available network classes.
 m4_divert(42)m4_dnl
 
 ## Define the available network classes.
 m4_divert(42)m4_dnl

-defnetclass untrusted  untrusted trusted             mcast
-defnetclass trusted    untrusted trusted safe noloop mcast
-defnetclass safe                 trusted safe noloop mcast
-defnetclass noloop               trusted safe        mcast
+defnetclass scary      scary           trusted             vpnnat mcast
+defnetclass untrusted  scary untrusted trusted                    mcast
+defnetclass trusted    scary untrusted trusted safe noloop vpnnat mcast
+defnetclass safe                       trusted safe noloop vpnnat mcast
+defnetclass noloop                     trusted safe               mcast
+defnetclass vpnnat     scary           trusted safe               mcast

 
 defnetclass link
 defnetclass mcast
 
 defnetclass link
 defnetclass mcast


@@ -127,34 +111,33 @@ m4_divert(26)m4_dnl
 
 ## House networks.
 defnet dmz trusted
 
 ## House networks.
 defnet dmz trusted

-       addr 62.49.204.144/28 2001:470:1f09:1b98::/64
+       addr 81.2.113.195 81.187.238.128/28 217.169.12.64/28 2001:8b0:c92:fff::/64

        via unsafe untrusted
 defnet unsafe trusted
        via unsafe untrusted
 defnet unsafe trusted

-       addr 172.29.199.0/25 2001:470:9740:1::/64
+       addr 172.29.199.0/25 2001:8b0:c92:1::/64

        via househub
 defnet safe safe
        via househub
 defnet safe safe

-       addr 172.29.199.192/27 2001:470:9740:4001::/64
+       addr 172.29.199.192/27 2001:8b0:c92:4001::/64

        via househub
 defnet untrusted untrusted
        via househub
 defnet untrusted untrusted

-       addr 172.29.198.0/25 2001:470:9740:8001::/64
+       addr 172.29.198.0/25 2001:8b0:c92:8001::/64

        via househub
 
 defnet househub virtual
        via housebdry dmz unsafe safe untrusted
 defnet housebdry virtual
        via househub hub
        via househub
 
 defnet househub virtual
        via housebdry dmz unsafe safe untrusted
 defnet housebdry virtual
        via househub hub

-       noxit dmz

 
 ## House hosts.
 defhost radius
        hosttype router
 
 ## House hosts.
 defhost radius
        hosttype router

-       iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
-       iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
-       iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
-       iface eth3 untrusted vpn default
+       iface eth0 dmz unsafe safe untrusted vpn sgo default
+       iface eth1 dmz unsafe safe untrusted vpn sgo default
+       iface eth2 dmz unsafe safe untrusted vpn sgo
+       iface eth3 unsafe untrusted vpn default

        iface ppp0 default
        iface t6-he default
        iface ppp0 default
        iface t6-he default

-       iface vpn-precision colobdry vpn sgo
+       iface vpn-precision vpn sgo

        iface vpn-chiark sgo
        iface vpn-+ vpn
 defhost roadstar
        iface vpn-chiark sgo
        iface vpn-+ vpn
 defhost roadstar


@@ -163,18 +146,21 @@ defhost roadstar
 defhost jem
        iface eth0 dmz unsafe
        iface eth1 dmz unsafe
 defhost jem
        iface eth0 dmz unsafe
        iface eth1 dmz unsafe

+defhost universe
+       iface eth0 dmz unsafe
+       iface eth1 dmz unsafe

 defhost artist
        hosttype router
        iface eth0 dmz unsafe untrusted
        iface eth1 dmz unsafe untrusted
 defhost artist
        hosttype router
        iface eth0 dmz unsafe untrusted
        iface eth1 dmz unsafe untrusted

-       iface eth3 untrusted
+       iface eth3 unsafe untrusted

 defhost vampire
        hosttype router
 defhost vampire
        hosttype router

-       iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
-       iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
-       iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
-       iface eth0.7 untrusted
-       iface vpn-precision colobdry vpn sgo
+       iface eth0.4 dmz unsafe untrusted safe vpn sgo
+       iface eth0.5 dmz unsafe untrusted safe vpn sgo
+       iface eth0.6 dmz unsafe safe untrusted vpn sgo
+       iface eth0.7 unsafe untrusted vpn
+       iface vpn-precision vpn sgo

        iface vpn-chiark sgo
        iface vpn-+ vpn
 defhost ibanez
        iface vpn-chiark sgo
        iface vpn-+ vpn
 defhost ibanez


@@ -183,80 +169,109 @@ defhost ibanez
 defhost orange
        iface wlan0 untrusted
        iface vpn-radius unsafe
 defhost orange
        iface wlan0 untrusted
        iface vpn-radius unsafe

+defhost groove
+       iface eth0 unsafe
+       iface wlan0 untrusted
+       iface vpn-radius unsafe

 
 defhost gibson
        hosttype client
        iface eth0 unsafe
 
 
 defhost gibson
        hosttype client
        iface eth0 unsafe
 

-## Colocated networks.
-defnet jump trusted
-       addr 212.13.198.64/28 2001:ba8:0:1d9::/64
-       via colohub
-defnet colo trusted
-       addr 172.29.199.176/28 2001:ba8:1d9:2::/64
-       via colohub
-defnet colohub virtual
-       via colobdry jump colo
-defnet colobdry virtual
-       via colohub hub
-       noxit jump
-defnet iodine untrusted
-       addr 172.29.198.128/28
-       via colohub
-
-## Colocated hosts.
+## Formerly colocated hosts.

 defhost fender
 defhost fender

-       iface br-jump jump colo
-       iface br-colo jump colo
+       iface br-dmz dmz unsafe
+       iface br-unsafe dmz unsafe

 defhost precision
        hosttype router
 defhost precision
        hosttype router

-       iface eth0 jump colo vpn sgo
-       iface eth1 jump colo vpn sgo
+       iface eth0 dmz unsafe vpn sgo
+       iface eth1 dmz unsafe vpn sgo

        iface vpn-mango binswood
        iface vpn-mango binswood

-       iface vpn-radius housebdry vpn sgo

        iface vpn-chiark sgo
        iface vpn-chiark sgo

+       iface vpn-national upn
+       iface vpn-mdwdev upn
+       iface vpn-eggle upn

        iface vpn-+ vpn
 defhost telecaster
        iface vpn-+ vpn
 defhost telecaster

-       iface eth0 jump colo
-       iface eth1 jump colo
+       iface eth0 dmz unsafe vpn sgo
+       iface eth1 dmz unsafe vpn sgo

 defhost stratocaster
 defhost stratocaster

-       iface eth0 jump colo
-       iface eth1 jump colo
+       iface eth0 dmz unsafe vpn sgo
+       iface eth1 dmz unsafe vpn sgo

 defhost jazz
        hosttype router
 defhost jazz
        hosttype router

-       iface eth0 jump colo vpn
-       iface eth1 jump colo vpn
+       iface eth0 dmz unsafe vpn sgo
+       iface eth1 dmz unsafe vpn sgo

        iface dns0 iodine
        iface dns0 iodine

+       iface hippo-svc hippotat

        iface vpn-+ vpn
 
        iface vpn-+ vpn
 

+## Stunt connectivity networks.
+defnet iodine untrusted
+       addr 172.29.198.128/28
+       via colohub
+defnet hippotat untrusted
+       addr 172.29.198.144/28
+       via colohub
+
+

 ## Other networks.
 defnet hub virtual
 ## Other networks.
 defnet hub virtual

-       via housebdry colobdry
+       via housebdry

 defnet sgo noloop
        addr !172.29.198.0/23
 defnet sgo noloop
        addr !172.29.198.0/23

+       addr !10.165.27.0/24

        addr 10.0.0.0/8
        addr 172.16.0.0/12
        addr 192.168.0.0/16
        addr 10.0.0.0/8
        addr 172.16.0.0/12
        addr 192.168.0.0/16

-       via househub colohub
-defnet vpn safe
-       addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
-       via househub colohub
-       host crybaby 1
-       host terror 2
-       host orange 3
+       via househub
+defnet vpn trusted
+       addr 172.29.199.128/27 2001:8b0:c92:6000::/64
+       via househub
+       host crybaby 1 ::1:1
+       host terror 2 ::2:1
+       host orange 3 ::3:1
+       host haze 4 ::4:1
+       host spirit 9 ::9:1
+       host groove 10 ::10:1

 defnet anycast trusted
 defnet anycast trusted

-       addr 172.29.199.224/27 2001:ba8:1d9:0::/64
-       via dmz unsafe safe untrusted jump colo vpn
-defnet default untrusted
-       addr 62.49.204.144/28 2001:470:1f09:1b98::/64
-       addr 212.13.198.64/28 2001:ba8:0:1d9::/64
-       addr 2001:ba8:1d9::/48 #temporary
-       via dmz unsafe untrusted jump colo
+       addr 172.29.199.224/27 2001:8b0:c92:0::/64
+       via dmz unsafe safe untrusted vpn nvpn
+defnet default scary
+       addr 81.2.113.195 81.187.238.128/28 217.169.12.64/28 \
+               2001:8b0:c92::/48
+       via dmz unsafe untrusted
+defnet upn untrusted
+       addr 172.29.198.160/27 2001:8b0:c92:a000::/64
+       via househub
+       host national 1 ::1:1
+       host mdwdev 2 ::2:1
+       host eggle 3 ::3:1
+
+## VPS hosts.
+defhost eggle
+       iface eth0 default
+       iface vpn-precision househub
+defhost national
+       iface eth0 default
+       iface vpn-precision househub

 
 ## Satellite networks.
 
 ## Satellite networks.

-defnet binswood noloop
+defnet binswood vpnnat

        addr 10.165.27.0/24
        addr 10.165.27.0/24

-       via colohub
+       via househub
+defhost mango
+       hosttype router
+       iface eth0 binswood default
+       iface vpn-precision dmz default
+
+m4_divert(80)m4_dnl
+###--------------------------------------------------------------------------
+### Connection tracking helper modules.
+
+for i in ftp; do
+  modprobe nf_conntrack_$i
+done

 
 m4_divert(80)m4_dnl
 ###--------------------------------------------------------------------------
 
 m4_divert(80)m4_dnl
 ###--------------------------------------------------------------------------


@@ -322,11 +337,29 @@ case $forward in
     ;;
 esac
 
     ;;
 esac
 

+m4_divert(82)m4_dnl
+###--------------------------------------------------------------------------
+### Check for source routing.
+
+clearchain check-srcroute
+
+run iptables -A check-srcroute -g forbidden \
+    -m ipv4options --any --flags lsrr,ssrr
+run ip6tables -A check-srcroute -g forbidden \
+    -m rt
+
+for c in INPUT FORWARD; do
+  for m in $from_scary $from_untrusted; do
+    run ip46tables -A $c -m mark --mark $m/$MASK_FROM -j check-srcroute
+  done
+done
+

 m4_divert(84)m4_dnl
 ###--------------------------------------------------------------------------
 ### Locally-bound packet inspection.
 
 clearchain inbound
 m4_divert(84)m4_dnl
 ###--------------------------------------------------------------------------
 ### Locally-bound packet inspection.
 
 clearchain inbound

+clearchain inbound-untrusted

 
 ## Track connections.
 commonrules inbound
 
 ## Track connections.
 commonrules inbound


@@ -342,16 +375,31 @@ run iptables -A inbound -j ACCEPT \
        -p udp --source-port $port_bootpc --destination-port $port_bootps
 
 ## Allow incoming ping.  This is the only ICMP left.
        -p udp --source-port $port_bootpc --destination-port $port_bootps
 
 ## Allow incoming ping.  This is the only ICMP left.

-run ip46tables -A inbound -j ACCEPT -p icmp
+run iptables -A inbound -j ACCEPT -p icmp
+run ip6tables -A inbound -j ACCEPT -p icmpv6

 
 m4_divert(88)m4_dnl
 ## Allow unusual things.
 openports inbound
 
 ## Inspect inbound packets from untrusted sources.
 
 m4_divert(88)m4_dnl
 ## Allow unusual things.
 openports inbound
 
 ## Inspect inbound packets from untrusted sources.

-run ip46tables -A inbound -j forbidden
+run iptables -A inbound -s 172.29.198.0/24 -g inbound-untrusted
+run ip6tables -A inbound -s 2001:8b0:c92:8000::/49 -g inbound-untrusted
+run ip46tables -A inbound-untrusted -g forbidden
+run ip46tables -A inbound -g forbidden
+run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound

 run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
 
 run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
 

+## Allow responses from the scary outside world into the untrusted net, but
+## don't let untrusted things run services.
+case $forward in
+  1)
+    run ip46tables -A FORWARD -j ACCEPT \
+       -m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \
+       -m state --state ESTABLISHED,RELATED
+    ;;
+esac
+

 ## Otherwise process as indicated by the mark.
 for i in $inchains; do
   run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
 ## Otherwise process as indicated by the mark.
 for i in $inchains; do
   run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT