radius.m4: Load NAT helpers (from d119795).

[firewall] / local.m4

diff --git a/local.m4 b/local.m4
index f373e3f..54d0c86 100644 (file)
--- a/local.m4
+++ b/local.m4
@@ -35,10 +35,12 @@ m4_divert(-1)
 
 ## Define the available network classes.
 m4_divert(42)m4_dnl
 
 ## Define the available network classes.
 m4_divert(42)m4_dnl

-defnetclass untrusted untrusted trusted
-defnetclass trusted untrusted trusted safe noloop
-defnetclass safe trusted safe noloop
-defnetclass noloop trusted safe
+defnetclass untrusted untrusted trusted mcast
+defnetclass trusted untrusted trusted safe noloop mcast
+defnetclass safe trusted safe noloop mcast
+defnetclass noloop trusted safe mcast
+defnetclass link
+defnetclass mcast

 m4_divert(-1)
 
 m4_divert(26)m4_dnl
 m4_divert(-1)
 
 m4_divert(26)m4_dnl


@@ -58,11 +60,6 @@ defnet safe safe
 defnet untrusted untrusted
        addr 172.29.198.0/25 2001:470:9740:8001::/64
        forwards househub
 defnet untrusted untrusted
        addr 172.29.198.0/25 2001:470:9740:8001::/64
        forwards househub

-defnet vpn safe
-       addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
-       forwards househub colohub
-       host crybaby 1
-       host terror 2

 defnet iodine untrusted
        addr 172.29.198.128/28
 
 defnet iodine untrusted
        addr 172.29.198.128/28
 


@@ -74,7 +71,7 @@ defnet housebdry virtual
 
 ## House hosts.
 defhost radius
 
 ## House hosts.
 defhost radius

-       router
+       hosttype router

        iface eth0 dmz unsafe safe
        iface eth1 dmz unsafe safe
        iface eth2 safe
        iface eth0 dmz unsafe safe
        iface eth1 dmz unsafe safe
        iface eth2 safe


@@ -89,19 +86,21 @@ defhost artist
        iface eth0 dmz unsafe
        iface eth1 dmz unsafe
 defhost vampire
        iface eth0 dmz unsafe
        iface eth1 dmz unsafe
 defhost vampire

-       router
+       hosttype router

        iface eth0.0 dmz unsafe safe
        iface eth0.1 dmz unsafe safe
        iface eth0.2 safe
        iface eth0.3 untrusted
        iface eth0.0 dmz unsafe safe
        iface eth0.1 dmz unsafe safe
        iface eth0.2 safe
        iface eth0.3 untrusted

-       iface dns0 dns
-       iface vpn-+ vpn
+       iface dns0 iodine

        iface vpn-precision colobdry vpn
        iface vpn-precision colobdry vpn

+       iface vpn-chiark sgo
+       iface vpn-+ vpn

 defhost ibanez
        iface br-dmz dmz unsafe
        iface br-unsafe unsafe
 
 defhost gibson
 defhost ibanez
        iface br-dmz dmz unsafe
        iface br-unsafe unsafe
 
 defhost gibson

+       hosttype client

        iface eth0 unsafe
 
 ## Colocated networks.
        iface eth0 unsafe
 
 ## Colocated networks.


@@ -122,11 +121,12 @@ defhost fender
        iface br-jump jump colo
        iface br-colo jump colo
 defhost precision
        iface br-jump jump colo
        iface br-colo jump colo
 defhost precision

-       router
+       hosttype router

        iface eth0 jump colo
        iface eth1 jump colo
        iface eth0 jump colo
        iface eth1 jump colo

-       iface vpn-+ vpn

        iface vpn-vampire housebdry vpn
        iface vpn-vampire housebdry vpn

+       iface vpn-chiark sgo
+       iface vpn-+ vpn

 defhost telecaster
        iface eth0 jump colo
        iface eth1 jump colo
 defhost telecaster
        iface eth0 jump colo
        iface eth1 jump colo


@@ -140,11 +140,25 @@ defhost jazz
 ## Other networks.
 defnet hub virtual
        forwards housebdry colobdry
 ## Other networks.
 defnet hub virtual
        forwards housebdry colobdry

+defnet sgo noloop
+       addr !172.29.198.0/23
+       addr 10.0.0.0/8
+       addr 172.16.0.0/12
+       addr 192.168.0.0/16
+       forwards househub colohub
+defnet vpn safe
+       addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
+       forwards househub colohub
+       host crybaby 1
+       host terror 2
+defnet anycast trusted
+       addr 172.29.199.224/27 2001:ba8:1d9:0::/64
+       forwards dmz unsafe safe untrusted jump colo vpn

 defnet default untrusted
        addr 62.49.204.144/28 2001:470:1f09:1b98::/64
        addr 212.13.198.64/28 2001:ba8:0:1d9::/64
        addr 2001:ba8:1d9::/48 #temporary
 defnet default untrusted
        addr 62.49.204.144/28 2001:470:1f09:1b98::/64
        addr 212.13.198.64/28 2001:ba8:0:1d9::/64
        addr 2001:ba8:1d9::/48 #temporary

-       forwards dmz untrusted unsafe jump colo
+       forwards dmz unsafe untrusted jump colo

 
 m4_divert(80)m4_dnl
 ###--------------------------------------------------------------------------
 
 m4_divert(80)m4_dnl
 ###--------------------------------------------------------------------------


@@ -161,7 +175,7 @@ case $forward in
     run iptables -A fwd-spec-nofrag -j RETURN --fragment
     run ip6tables -A fwd-spec-nofrag -j RETURN \
            -m ipv6header --soft --header frag
     run iptables -A fwd-spec-nofrag -j RETURN --fragment
     run ip6tables -A fwd-spec-nofrag -j RETURN \
            -m ipv6header --soft --header frag

-    run iptables -A FORWARD -j fwd-spec-nofrag
+    run ip46tables -A FORWARD -j fwd-spec-nofrag

 
     ## Allow ping from safe/noloop to untrusted networks.
     run iptables -A fwd-spec-nofrag -j ACCEPT \
 
     ## Allow ping from safe/noloop to untrusted networks.
     run iptables -A fwd-spec-nofrag -j ACCEPT \


@@ -236,22 +250,6 @@ run iptables -A inbound -j ACCEPT \
        -s 172.29.198.0/23 \
        -p udp --source-port $port_bootpc --destination-port $port_bootps
 
        -s 172.29.198.0/23 \
        -p udp --source-port $port_bootpc --destination-port $port_bootps
 

-## Incoming multicast on a network interface associated with a trusted
-## network is OK, since it must have originated there (or been forwarded, but
-## we don't do that yet).
-seen=:-:
-for net in $allnets; do
-  eval class=\$net_class_$net
-  case $class in trusted) ;; *) continue ;; esac
-  for iface in $(net_interfaces FWHOST $net); do
-    case "$seen" in *:$iface:*) continue ;; esac
-    seen=$seen$iface:
-    run iptables -A inbound -j ACCEPT \
-       -s 0.0.0.0 -d 224.0.0.0/24 \
-       -i $iface
-  done
-done
-

 ## Allow incoming ping.  This is the only ICMP left.
 run ip46tables -A inbound -j ACCEPT -p icmp
 
 ## Allow incoming ping.  This is the only ICMP left.
 run ip46tables -A inbound -j ACCEPT -p icmp