m4_divert(6)m4_dnl
## Default NTP servers.
defconf(ntp_servers,
- "158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232")
+ "81.187.26.174 90.155.23.205 2001:8b0:0:23::205 185.73.44.6 2001:ba8:0:2c06::")
m4_divert(-1)
###--------------------------------------------------------------------------
### Packet classification.
+## IPv4 addressing.
+##
+## There are two small blocks of publicly routable IPv4 addresses, and a
+## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN.
+## The former are as follows.
+##
+## 81.2.113.195, 81.187.238.128/28, 217.169.12.64/28
+## House border network (dmz). We have all of these; the loose
+## address is for the router.
+##
+## The latter is the block 172.29.196.0/22. Currently the low half is
+## unallocated (and may be returned to the G-RIN); the remaining addresses
+## are allocated as follows.
+##
+## 172.29.198.0/24 Untrusted networks.
+## .0/25 house wireless net
+## .128/28 iodine (IP-over-DNS) network
+## .144/28 hippotat (IP-over-HTTP) network
+## .160/27 untrusted virtual network
+##
+## 172.29.199.0/24 Trusted networks.
+## .0/25 house wired network
+## .128/27 mobile VPN hosts
+## .160/28 reserved, except .160/30 allocated for ITS
+## .176/28 internal colocated network
+## .192/27 house safe network
+## .224/27 anycast services
+
+## IPv6 addressing.
+##
+## There are five blocks of publicly routable IPv6 addresses, though some of
+## them aren't very interesting. The ranges are as follows.
+##
+## 2001:8b0:c92::/48
+## Main house range (aaisp). See below for allocation policy.
+## There is no explicit DMZ allocation (and no need for one).
+##
+## Addresses in the /64 networks are simply allocated in ascending order.
+## The /48s are split into /64s by appending a 16-bit network number. The
+## top nibble of the network number classifies the network, as follows.
+##
+## axxx Virtual, untrusted
+## 8xxx Untrusted
+## 6xxx Virtual, safe
+## 4xxx Safe
+## 0xxx Unsafe, trusted
+##
+## These have been chosen so that network properties can be deduced by
+## inspecting bits of the network number:
+##
+## Bit 15 If set, the network is untrusted; otherwise it is trusted.
+## Bit 14 If set, the network is safe; otherwise it is unsafe.
+##
+## Finally, the low-order nibbles identify the site.
+##
+## 0 No specific site: mobile VPN endpoints or anycast addresses.
+## 1 House.
+## fff Local border network.
+
## Define the available network classes.
m4_divert(42)m4_dnl
-defnetclass untrusted untrusted trusted
-defnetclass trusted untrusted trusted safe noloop
-defnetclass safe trusted safe noloop
-defnetclass noloop trusted safe
+defnetclass scary scary trusted vpnnat mcast
+defnetclass untrusted scary untrusted trusted mcast
+defnetclass trusted scary untrusted trusted safe noloop vpnnat mcast
+defnetclass safe trusted safe noloop vpnnat mcast
+defnetclass noloop trusted safe mcast
+defnetclass vpnnat scary trusted safe mcast
+
+defnetclass link
+defnetclass mcast
m4_divert(-1)
m4_divert(26)m4_dnl
## House networks.
defnet dmz trusted
- addr 62.49.204.144/28
- forwards unsafe untrusted
+ addr 81.2.113.195 81.187.238.128/28 217.169.12.64/28 2001:8b0:c92:fff::/64
+ via unsafe untrusted
defnet unsafe trusted
- addr 172.29.199.0/25
- forwards househub
+ addr 172.29.199.0/25 2001:8b0:c92:1::/64
+ via househub
defnet safe safe
- addr 172.29.199.192/28
- forwards househub
+ addr 172.29.199.192/27 2001:8b0:c92:4001::/64
+ via househub
defnet untrusted untrusted
- addr 172.29.198.0/25
- forwards househub
-defnet vpn safe
- addr 172.29.199.128/27
- forwards househub colohub
- host crybaby 1
- host terror 2
-defnet iodine untrusted
- addr 172.29.198.128/28
+ addr 172.29.198.0/25 2001:8b0:c92:8001::/64
+ via househub
defnet househub virtual
- forwards housebdry dmz unsafe safe untrusted
+ via housebdry dmz unsafe safe untrusted
defnet housebdry virtual
- forwards househub hub
- noxit dmz
+ via househub hub
## House hosts.
defhost radius
- router
- iface eth0 dmz unsafe safe
- iface eth1 dmz unsafe safe
- iface eth2 safe
- iface eth3 untrusted
+ hosttype router
+ iface eth0 dmz unsafe safe untrusted vpn sgo default
+ iface eth1 dmz unsafe safe untrusted vpn sgo default
+ iface eth2 dmz unsafe safe untrusted vpn sgo
+ iface eth3 unsafe untrusted vpn default
+ iface ppp0 default
+ iface t6-he default
+ iface vpn-precision vpn sgo
+ iface vpn-chiark sgo
+ iface vpn-+ vpn
defhost roadstar
iface eth0 dmz unsafe
iface eth1 dmz unsafe
defhost jem
iface eth0 dmz unsafe
iface eth1 dmz unsafe
-defhost artist
+defhost universe
iface eth0 dmz unsafe
iface eth1 dmz unsafe
+defhost artist
+ hosttype router
+ iface eth0 dmz unsafe untrusted
+ iface eth1 dmz unsafe untrusted
+ iface eth3 unsafe untrusted
defhost vampire
- router
- iface eth0.0 dmz unsafe safe
- iface eth0.1 dmz unsafe safe
- iface eth0.2 safe
- iface eth0.3 untrusted
- iface dns0 dns
+ hosttype router
+ iface eth0.4 dmz unsafe untrusted safe vpn sgo
+ iface eth0.5 dmz unsafe untrusted safe vpn sgo
+ iface eth0.6 dmz unsafe safe untrusted vpn sgo
+ iface eth0.7 unsafe untrusted vpn
+ iface vpn-precision vpn sgo
+ iface vpn-chiark sgo
iface vpn-+ vpn
- iface vpn-precision colobdry vpn
defhost ibanez
iface br-dmz dmz unsafe
iface br-unsafe unsafe
+defhost orange
+ iface wlan0 untrusted
+ iface vpn-radius unsafe
+defhost groove
+ iface eth0 unsafe
+ iface wlan0 untrusted
+ iface vpn-radius unsafe
defhost gibson
+ hosttype client
iface eth0 unsafe
-## Colocated networks.
-defnet jump trusted
- addr 212.13.198.64/28
- forwards colohub
-defnet colo trusted
- addr 172.29.199.176/28
- forwards colohub
-defnet colohub virtual
- forwards colobdry jump colo
-defnet colobdry virtual
- forwards colohub hub
- noxit jump
-
-## Colocated hosts.
+## Formerly colocated hosts.
defhost fender
- iface br-jump jump colo
- iface br-colo jump colo
+ iface br-dmz dmz unsafe
+ iface br-unsafe dmz unsafe
defhost precision
- router
- iface eth0 jump colo
- iface eth1 jump colo
+ hosttype router
+ iface eth0 dmz unsafe vpn sgo
+ iface eth1 dmz unsafe vpn sgo
+ iface vpn-mango binswood
+ iface vpn-chiark sgo
+ iface vpn-national upn
+ iface vpn-mdwdev upn
+ iface vpn-eggle upn
iface vpn-+ vpn
- iface vpn-vampire housebdry vpn
defhost telecaster
- iface eth0 jump colo
- iface eth1 jump colo
+ iface eth0 dmz unsafe vpn sgo
+ iface eth1 dmz unsafe vpn sgo
defhost stratocaster
- iface eth0 jump colo
- iface eth1 jump colo
+ iface eth0 dmz unsafe vpn sgo
+ iface eth1 dmz unsafe vpn sgo
defhost jazz
- iface eth0 jump colo
- iface eth1 jump colo
+ hosttype router
+ iface eth0 dmz unsafe vpn sgo
+ iface eth1 dmz unsafe vpn sgo
+ iface dns0 iodine
+ iface hippo-svc hippotat
+ iface vpn-+ vpn
+
+## Stunt connectivity networks.
+defnet iodine untrusted
+ addr 172.29.198.128/28
+ via colohub
+defnet hippotat untrusted
+ addr 172.29.198.144/28
+ via colohub
+
## Other networks.
defnet hub virtual
- forwards housebdry colobdry
-defnet default untrusted
- addr 62.49.204.144/28
- addr 212.13.198.64/28
- forwards dmz untrusted unsafe jump colo
+ via housebdry
+defnet sgo noloop
+ addr !172.29.198.0/23
+ addr !10.165.27.0/24
+ addr 10.0.0.0/8
+ addr 172.16.0.0/12
+ addr 192.168.0.0/16
+ via househub
+defnet vpn trusted
+ addr 172.29.199.128/27 2001:8b0:c92:6000::/64
+ via househub
+ host crybaby 1 ::1:1
+ host terror 2 ::2:1
+ host orange 3 ::3:1
+ host haze 4 ::4:1
+ host spirit 9 ::9:1
+ host groove 10 ::10:1
+defnet anycast trusted
+ addr 172.29.199.224/27 2001:8b0:c92:0::/64
+ via dmz unsafe safe untrusted vpn nvpn
+defnet default scary
+ addr 81.2.113.195 81.187.238.128/28 217.169.12.64/28 \
+ 2001:8b0:c92::/48
+ via dmz unsafe untrusted
+defnet upn untrusted
+ addr 172.29.198.160/27 2001:8b0:c92:a000::/64
+ via househub
+ host national 1 ::1:1
+ host mdwdev 2 ::2:1
+ host eggle 3 ::3:1
+
+## VPS hosts.
+defhost eggle
+ iface eth0 default
+ iface vpn-precision househub
+defhost national
+ iface eth0 default
+ iface vpn-precision househub
+
+## Satellite networks.
+defnet binswood vpnnat
+ addr 10.165.27.0/24
+ via househub
+defhost mango
+ hosttype router
+ iface eth0 binswood default
+ iface vpn-precision dmz default
+
+m4_divert(80)m4_dnl
+###--------------------------------------------------------------------------
+### Connection tracking helper modules.
+
+for i in ftp; do
+ modprobe nf_conntrack_$i
+done
m4_divert(80)m4_dnl
###--------------------------------------------------------------------------
run iptables -A fwd-spec-nofrag -j RETURN --fragment
run ip6tables -A fwd-spec-nofrag -j RETURN \
-m ipv6header --soft --header frag
- run iptables -A FORWARD -j fwd-spec-nofrag
+ run ip46tables -A FORWARD -j fwd-spec-nofrag
## Allow ping from safe/noloop to untrusted networks.
run iptables -A fwd-spec-nofrag -j ACCEPT \
-m mark --mark $from_untrusted/$MASK_FROM \
-m state --state ESTABLISHED
run ip6tables -A fwd-spec-nofrag -j ACCEPT \
- -p ipv6-icmp --icmpv6-type echo-request \
+ -p icmpv6 --icmpv6-type echo-request \
-m mark --mark $to_untrusted/$MASK_TO
run ip6tables -A fwd-spec-nofrag -j ACCEPT \
- -p ipv6-icmp --icmpv6-type echo-reply \
+ -p icmpv6 --icmpv6-type echo-reply \
-m mark --mark $from_untrusted/$MASK_FROM \
-m state --state ESTABLISHED
## Allow SSH from safe/noloop to untrusted networks.
- run iptables -A fwd-spec-nofrag -j ACCEPT \
+ run ip46tables -A fwd-spec-nofrag -j ACCEPT \
-p tcp --destination-port $port_ssh \
-m mark --mark $to_untrusted/$MASK_TO
- run iptables -A fwd-spec-nofrag -j ACCEPT \
- -p tcp --source-port $port_ssh \
- -m mark --mark $from_untrusted/$MASK_FROM \
- -m state --state ESTABLISHED
- run ip6tables -A fwd-spec-nofrag -j ACCEPT \
- -p tcp --destination-port $port_ssh \
- -m mark --mark $to_untrusted/$MASK_TO
- run ip6tables -A fwd-spec-nofrag -j ACCEPT \
+ run ip46tables -A fwd-spec-nofrag -j ACCEPT \
-p tcp --source-port $port_ssh \
-m mark --mark $from_untrusted/$MASK_FROM \
-m state --state ESTABLISHED
;;
esac
+m4_divert(82)m4_dnl
+###--------------------------------------------------------------------------
+### Check for source routing.
+
+clearchain check-srcroute
+
+run iptables -A check-srcroute -g forbidden \
+ -m ipv4options --any --flags lsrr,ssrr
+run ip6tables -A check-srcroute -g forbidden \
+ -m rt
+
+for c in INPUT FORWARD; do
+ for m in $from_scary $from_untrusted; do
+ run ip46tables -A $c -m mark --mark $m/$MASK_FROM -j check-srcroute
+ done
+done
+
m4_divert(84)m4_dnl
###--------------------------------------------------------------------------
### Locally-bound packet inspection.
clearchain inbound
+clearchain inbound-untrusted
## Track connections.
commonrules inbound
-s 172.29.198.0/23 \
-p udp --source-port $port_bootpc --destination-port $port_bootps
-## Incoming multicast on a network interface associated with a trusted
-## network is OK, since it must have originated there (or been forwarded, but
-## we don't do that yet).
-seen=:-:
-for net in $allnets; do
- eval class=\$net_class_$net
- case $class in trusted) ;; *) continue ;; esac
- for iface in $(net_interfaces FWHOST $net); do
- case "$seen" in *:$iface:*) continue ;; esac
- seen=$seen$iface:
- run iptables -A inbound -j ACCEPT \
- -s 0.0.0.0 -d 224.0.0.0/24 \
- -i $iface
- done
-done
-
## Allow incoming ping. This is the only ICMP left.
-run ip46tables -A inbound -j ACCEPT -p icmp
+run iptables -A inbound -j ACCEPT -p icmp
+run ip6tables -A inbound -j ACCEPT -p icmpv6
m4_divert(88)m4_dnl
## Allow unusual things.
openports inbound
## Inspect inbound packets from untrusted sources.
-run ip46tables -A inbound -j forbidden
+run iptables -A inbound -s 172.29.198.0/24 -g inbound-untrusted
+run ip6tables -A inbound -s 2001:8b0:c92:8000::/49 -g inbound-untrusted
+run ip46tables -A inbound-untrusted -g forbidden
+run ip46tables -A inbound -g forbidden
+run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound
run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
-## Otherwise process as indicated by the mark.
-run ip46tables -A INPUT -m mark ! --mark 0/$MASK_MASK -j ACCEPT
+## Allow responses from the scary outside world into the untrusted net, but
+## don't let untrusted things run services.
case $forward in
1)
- run ip46tables -A FORWARD -m mark ! --mark 0/$MASK_MASK -j ACCEPT
+ run ip46tables -A FORWARD -j ACCEPT \
+ -m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \
+ -m state --state ESTABLISHED,RELATED
;;
esac
+## Otherwise process as indicated by the mark.
+for i in $inchains; do
+ run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT
+done
+
m4_divert(-1)
###----- That's all, folks --------------------------------------------------
~mdw / firewall / blobdiff