X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/42f784e269e56ef394744bd64eb8f411f4acbcf6..HEAD:/local.m4 diff --git a/local.m4 b/local.m4 index e456e77..b0a1770 100644 --- a/local.m4 +++ b/local.m4 @@ -27,7 +27,7 @@ m4_divert(6)m4_dnl ## Default NTP servers. defconf(ntp_servers, - "158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232") + "81.187.26.174 90.155.23.205 2001:8b0:0:23::205 185.73.44.6 2001:ba8:0:2c06::") m4_divert(-1) ###-------------------------------------------------------------------------- @@ -39,13 +39,9 @@ m4_divert(-1) ## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN. ## The former are as follows. ## -## 62.49.204.144/28 -## House border network (dmz). We have all of these, but .145 -## is reserved for the router. -## -## 212.13.18.64/28 -## Jump colocated network (jump). .65--68 are used by Jump -## network infrastructure; we get the rest. +## 81.2.113.195, 81.187.238.128/28, 217.169.12.64/28 +## House border network (dmz). We have all of these; the loose +## address is for the router. ## ## The latter is the block 172.29.196.0/22. Currently the low half is ## unallocated (and may be returned to the G-RIN); the remaining addresses @@ -54,6 +50,7 @@ m4_divert(-1) ## 172.29.198.0/24 Untrusted networks. ## .0/25 house wireless net ## .128/28 iodine (IP-over-DNS) network +## .144/28 hippotat (IP-over-HTTP) network ## .160/27 untrusted virtual network ## ## 172.29.199.0/24 Trusted networks. @@ -69,22 +66,9 @@ m4_divert(-1) ## There are five blocks of publicly routable IPv6 addresses, though some of ## them aren't very interesting. The ranges are as follows. ## -## 2001:470:1f08:1b98::/64 -## Hurricane Electric tunnel network: only :1 (HE) and :2 -## (radius) are used. -## -## 2001:470:1f09:1b98::/64 -## House border network (dmz). -## -## 2001:470:9740::/48 -## Main house range. See below for allocation policy. -## -## 2001:ba8:0:1d9::/64 -## Jump border network (jump): :1 is the router (supplied by -## Jump); other addresses are ours. -## -## 2001:ba8:1d9::/48 -## Main colocated range. See below for allocation policy. +## 2001:8b0:c92::/48 +## Main house range (aaisp). See below for allocation policy. +## There is no explicit DMZ allocation (and no need for one). ## ## Addresses in the /64 networks are simply allocated in ascending order. ## The /48s are split into /64s by appending a 16-bit network number. The @@ -106,19 +90,16 @@ m4_divert(-1) ## ## 0 No specific site: mobile VPN endpoints or anycast addresses. ## 1 House. -## 2 Jump colocation. -## -## Usually site-0 networks are allocated from the Jump range to improve -## expected performance from/to external sites which don't engage in our -## dynamic routing protocols. +## fff Local border network. ## Define the available network classes. m4_divert(42)m4_dnl -defnetclass scary scary trusted mcast -defnetclass untrusted scary untrusted trusted mcast -defnetclass trusted scary untrusted trusted safe noloop mcast -defnetclass safe trusted safe noloop mcast -defnetclass noloop trusted safe mcast +defnetclass scary scary trusted vpnnat mcast +defnetclass untrusted scary untrusted trusted mcast +defnetclass trusted scary untrusted trusted safe noloop vpnnat mcast +defnetclass safe trusted safe noloop vpnnat mcast +defnetclass noloop trusted safe mcast +defnetclass vpnnat scary trusted safe mcast defnetclass link defnetclass mcast @@ -130,16 +111,16 @@ m4_divert(26)m4_dnl ## House networks. defnet dmz trusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 + addr 81.2.113.195 81.187.238.128/28 217.169.12.64/28 2001:8b0:c92:fff::/64 via unsafe untrusted defnet unsafe trusted - addr 172.29.199.0/25 2001:470:9740:1::/64 + addr 172.29.199.0/25 2001:8b0:c92:1::/64 via househub defnet safe safe - addr 172.29.199.192/27 2001:470:9740:4001::/64 + addr 172.29.199.192/27 2001:8b0:c92:4001::/64 via househub defnet untrusted untrusted - addr 172.29.198.0/25 2001:470:9740:8001::/64 + addr 172.29.198.0/25 2001:8b0:c92:8001::/64 via househub defnet househub virtual @@ -150,13 +131,13 @@ defnet housebdry virtual ## House hosts. defhost radius hosttype router - iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth2 dmz unsafe safe untrusted vpn sgo colobdry + iface eth0 dmz unsafe safe untrusted vpn sgo default + iface eth1 dmz unsafe safe untrusted vpn sgo default + iface eth2 dmz unsafe safe untrusted vpn sgo iface eth3 unsafe untrusted vpn default iface ppp0 default iface t6-he default - iface vpn-precision colobdry vpn sgo + iface vpn-precision vpn sgo iface vpn-chiark sgo iface vpn-+ vpn defhost roadstar @@ -165,6 +146,9 @@ defhost roadstar defhost jem iface eth0 dmz unsafe iface eth1 dmz unsafe +defhost universe + iface eth0 dmz unsafe + iface eth1 dmz unsafe defhost artist hosttype router iface eth0 dmz unsafe untrusted @@ -172,11 +156,11 @@ defhost artist iface eth3 unsafe untrusted defhost vampire hosttype router - iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry + iface eth0.4 dmz unsafe untrusted safe vpn sgo + iface eth0.5 dmz unsafe untrusted safe vpn sgo + iface eth0.6 dmz unsafe safe untrusted vpn sgo iface eth0.7 unsafe untrusted vpn - iface vpn-precision colobdry vpn sgo + iface vpn-precision vpn sgo iface vpn-chiark sgo iface vpn-+ vpn defhost ibanez @@ -192,85 +176,94 @@ defhost groove defhost gibson hosttype client - iface eth0.5 unsafe - -## Colocated networks. -defnet jump trusted - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - via colohub -defnet colo trusted - addr 172.29.199.176/28 2001:ba8:1d9:2::/64 - via colohub -defnet colohub virtual - via colobdry jump colo -defnet colobdry virtual - via colohub hub -defnet iodine untrusted - addr 172.29.198.128/28 - via colohub + iface eth0 unsafe -## Colocated hosts. +## Formerly colocated hosts. defhost fender - iface br-jump jump colo - iface br-colo jump colo + iface br-dmz dmz unsafe + iface br-unsafe dmz unsafe defhost precision hosttype router - iface eth0 jump colo vpn sgo - iface eth1 jump colo vpn sgo + iface eth0 dmz unsafe vpn sgo + iface eth1 dmz unsafe vpn sgo iface vpn-mango binswood - iface vpn-radius housebdry vpn sgo iface vpn-chiark sgo + iface vpn-national upn + iface vpn-mdwdev upn + iface vpn-eggle upn iface vpn-+ vpn defhost telecaster - iface eth0 jump colo - iface eth1 jump colo + iface eth0 dmz unsafe vpn sgo + iface eth1 dmz unsafe vpn sgo defhost stratocaster - iface eth0 jump colo - iface eth1 jump colo + iface eth0 dmz unsafe vpn sgo + iface eth1 dmz unsafe vpn sgo defhost jazz hosttype router - iface eth0 jump colo vpn - iface eth1 jump colo vpn + iface eth0 dmz unsafe vpn sgo + iface eth1 dmz unsafe vpn sgo iface dns0 iodine + iface hippo-svc hippotat iface vpn-+ vpn +## Stunt connectivity networks. +defnet iodine untrusted + addr 172.29.198.128/28 + via colohub +defnet hippotat untrusted + addr 172.29.198.144/28 + via colohub + + ## Other networks. defnet hub virtual - via housebdry colobdry + via housebdry defnet sgo noloop addr !172.29.198.0/23 + addr !10.165.27.0/24 addr 10.0.0.0/8 addr 172.16.0.0/12 addr 192.168.0.0/16 - via househub colohub -defnet vpn safe - addr 172.29.199.128/27 2001:ba8:1d9:6000::/64 - via househub colohub + via househub +defnet vpn trusted + addr 172.29.199.128/27 2001:8b0:c92:6000::/64 + via househub host crybaby 1 ::1:1 host terror 2 ::2:1 host orange 3 ::3:1 host haze 4 ::4:1 - host groove 5 ::5:1 + host spirit 9 ::9:1 + host groove 10 ::10:1 defnet anycast trusted - addr 172.29.199.224/27 2001:ba8:1d9:0::/64 - via dmz unsafe safe untrusted jump colo vpn + addr 172.29.199.224/27 2001:8b0:c92:0::/64 + via dmz unsafe safe untrusted vpn nvpn defnet default scary - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - addr 2001:ba8:1d9::/48 #temporary - via dmz unsafe untrusted jump colo + addr 81.2.113.195 81.187.238.128/28 217.169.12.64/28 \ + 2001:8b0:c92::/48 + via dmz unsafe untrusted defnet upn untrusted - addr 172.29.198.160/27 2001:ba8:1d9:a000::/64 - via colohub + addr 172.29.198.160/27 2001:8b0:c92:a000::/64 + via househub + host national 1 ::1:1 + host mdwdev 2 ::2:1 + host eggle 3 ::3:1 + +## VPS hosts. +defhost eggle + iface eth0 default + iface vpn-precision househub +defhost national + iface eth0 default + iface vpn-precision househub ## Satellite networks. -defnet binswood noloop +defnet binswood vpnnat addr 10.165.27.0/24 - via colohub + via househub defhost mango hosttype router iface eth0 binswood default - iface vpn-precision colo + iface vpn-precision dmz default m4_divert(80)m4_dnl ###-------------------------------------------------------------------------- @@ -344,11 +337,29 @@ case $forward in ;; esac +m4_divert(82)m4_dnl +###-------------------------------------------------------------------------- +### Check for source routing. + +clearchain check-srcroute + +run iptables -A check-srcroute -g forbidden \ + -m ipv4options --any --flags lsrr,ssrr +run ip6tables -A check-srcroute -g forbidden \ + -m rt + +for c in INPUT FORWARD; do + for m in $from_scary $from_untrusted; do + run ip46tables -A $c -m mark --mark $m/$MASK_FROM -j check-srcroute + done +done + m4_divert(84)m4_dnl ###-------------------------------------------------------------------------- ### Locally-bound packet inspection. clearchain inbound +clearchain inbound-untrusted ## Track connections. commonrules inbound @@ -372,7 +383,10 @@ m4_divert(88)m4_dnl openports inbound ## Inspect inbound packets from untrusted sources. -run ip46tables -A inbound -j forbidden +run iptables -A inbound -s 172.29.198.0/24 -g inbound-untrusted +run ip6tables -A inbound -s 2001:8b0:c92:8000::/49 -g inbound-untrusted +run ip46tables -A inbound-untrusted -g forbidden +run ip46tables -A inbound -g forbidden run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound