X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/6fd217ae2465d315d507e1a58a53d4afa53bde25..49b81a663c69fd67ec8cf8739602b5dbe287486e:/local.m4

diff --git a/local.m4 b/local.m4
index ed99b00..288769c 100644
--- a/local.m4
+++ b/local.m4
@@ -90,7 +90,7 @@ m4_divert(-1)
 ## top nibble of the network number classifies the network, as follows.
 ##
 ## 8xxx		Untrusted
-## 6xxx		Virtual
+## 6xxx		Virtual, safe
 ## 4xxx		Safe
 ## 0xxx		Unsafe, trusted
 ##
@@ -112,10 +112,11 @@ m4_divert(-1)
 
 ## Define the available network classes.
 m4_divert(42)m4_dnl
-defnetclass untrusted untrusted trusted mcast
-defnetclass trusted untrusted trusted safe noloop mcast
-defnetclass safe trusted safe noloop mcast
-defnetclass noloop trusted safe mcast
+defnetclass untrusted	untrusted trusted	      mcast
+defnetclass trusted	untrusted trusted safe noloop mcast
+defnetclass safe	          trusted safe noloop mcast
+defnetclass noloop		  trusted safe	      mcast
+
 defnetclass link
 defnetclass mcast
 m4_divert(-1)
@@ -127,22 +128,21 @@ m4_divert(26)m4_dnl
 ## House networks.
 defnet dmz trusted
 	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
-	forwards unsafe untrusted
+	via unsafe untrusted
 defnet unsafe trusted
 	addr 172.29.199.0/25 2001:470:9740:1::/64
-	forwards househub
+	via househub
 defnet safe safe
 	addr 172.29.199.192/27 2001:470:9740:4001::/64
-	forwards househub
+	via househub
 defnet untrusted untrusted
 	addr 172.29.198.0/25 2001:470:9740:8001::/64
-	forwards househub
+	via househub
 
 defnet househub virtual
-	forwards housebdry dmz unsafe safe untrusted
+	via housebdry dmz unsafe safe untrusted
 defnet housebdry virtual
-	forwards househub hub
-	noxit dmz
+	via househub hub
 
 ## House hosts.
 defhost radius
@@ -150,7 +150,7 @@ defhost radius
 	iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
 	iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
 	iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
-	iface eth3 untrusted vpn default
+	iface eth3 unsafe untrusted vpn default
 	iface ppp0 default
 	iface t6-he default
 	iface vpn-precision colobdry vpn sgo
@@ -166,13 +166,13 @@ defhost artist
 	hosttype router
 	iface eth0 dmz unsafe untrusted
 	iface eth1 dmz unsafe untrusted
-	iface eth3 untrusted
+	iface eth3 unsafe untrusted
 defhost vampire
 	hosttype router
 	iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
 	iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
 	iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
-	iface eth0.7 untrusted
+	iface eth0.7 unsafe untrusted vpn
 	iface vpn-precision colobdry vpn sgo
 	iface vpn-chiark sgo
 	iface vpn-+ vpn
@@ -182,6 +182,8 @@ defhost ibanez
 defhost orange
 	iface wlan0 untrusted
 	iface vpn-radius unsafe
+defhost groove
+	iface eth0 unsafe
 
 defhost gibson
 	hosttype client
@@ -190,18 +192,17 @@ defhost gibson
 ## Colocated networks.
 defnet jump trusted
 	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
-	forwards colohub
+	via colohub
 defnet colo trusted
 	addr 172.29.199.176/28 2001:ba8:1d9:2::/64
-	forwards colohub
+	via colohub
 defnet colohub virtual
-	forwards colobdry jump colo iodine
+	via colobdry jump colo
 defnet colobdry virtual
-	forwards colohub hub
-	noxit jump
+	via colohub hub
 defnet iodine untrusted
 	addr 172.29.198.128/28
-	forwards colohub
+	via colohub
 
 ## Colocated hosts.
 defhost fender
@@ -211,6 +212,7 @@ defhost precision
 	hosttype router
 	iface eth0 jump colo vpn sgo
 	iface eth1 jump colo vpn sgo
+	iface vpn-mango binswood
 	iface vpn-radius housebdry vpn sgo
 	iface vpn-chiark sgo
 	iface vpn-+ vpn
@@ -220,6 +222,8 @@ defhost telecaster
 defhost stratocaster
 	iface eth0 jump colo
 	iface eth1 jump colo
+defhost jaguar
+	iface eth0 jump
 defhost jazz
 	hosttype router
 	iface eth0 jump colo vpn
@@ -229,27 +233,46 @@ defhost jazz
 
 ## Other networks.
 defnet hub virtual
-	forwards housebdry colobdry
+	via housebdry colobdry
 defnet sgo noloop
 	addr !172.29.198.0/23
 	addr 10.0.0.0/8
 	addr 172.16.0.0/12
 	addr 192.168.0.0/16
-	forwards househub colohub
+	via househub colohub
 defnet vpn safe
 	addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
-	forwards househub colohub
-	host crybaby 1
-	host terror 2
-	host orange 3
+	via househub colohub
+	host crybaby 1 ::1:1
+	host terror 2 ::2:1
+	host orange 3 ::3:1
+	host haze 4 ::4:1
 defnet anycast trusted
 	addr 172.29.199.224/27 2001:ba8:1d9:0::/64
-	forwards dmz unsafe safe untrusted jump colo vpn
+	via dmz unsafe safe untrusted jump colo vpn
 defnet default untrusted
 	addr 62.49.204.144/28 2001:470:1f09:1b98::/64
 	addr 212.13.198.64/28 2001:ba8:0:1d9::/64
 	addr 2001:ba8:1d9::/48 #temporary
-	forwards dmz unsafe untrusted jump colo
+	via dmz unsafe untrusted jump colo
+
+## Satellite networks.
+defnet binswood noloop
+	addr 10.165.27.0/24
+	via colohub
+
+defhost mango
+	hosttype router
+	iface eth0 binswood default
+	iface vpn-precision colo
+
+m4_divert(80)m4_dnl
+###--------------------------------------------------------------------------
+### Connection tracking helper modules.
+
+for i in ftp; do
+  modprobe nf_conntrack_$i
+done
 
 m4_divert(80)m4_dnl
 ###--------------------------------------------------------------------------