X-Git-Url: https://git.distorted.org.uk/~mdw/firewall/blobdiff_plain/f01cdc79f93706687fab5a412f0f5b504e5f4431..c8d1a00b58e6621d5929d8938ca893ed995fb6fa:/local.m4 diff --git a/local.m4 b/local.m4 index b0a4e4c..760391a 100644 --- a/local.m4 +++ b/local.m4 @@ -27,7 +27,7 @@ m4_divert(6)m4_dnl ## Default NTP servers. defconf(ntp_servers, - "158.152.1.76 158.152.1.204 194.159.253.2 195.173.57.232") + "81.187.26.174 90.155.23.205 2001:8b0:0:23::205 185.73.44.6 2001:ba8:0:2c06::") m4_divert(-1) ###-------------------------------------------------------------------------- @@ -39,13 +39,9 @@ m4_divert(-1) ## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN. ## The former are as follows. ## -## 62.49.204.144/28 -## House border network (dmz). We have all of these, but .145 -## is reserved for the router. -## ## 81.2.113.195, 81.187.238.128/28 -## House border network (aaisp). We have all of these; the -## loose address is for the router. +## House border network (dmz). We have all of these; the loose +## address is for the router. ## ## 212.13.18.64/28 ## Jump colocated network (jump). .65--68 are used by Jump @@ -58,6 +54,7 @@ m4_divert(-1) ## 172.29.198.0/24 Untrusted networks. ## .0/25 house wireless net ## .128/28 iodine (IP-over-DNS) network +## .144/28 hippotat (IP-over-HTTP) network ## .160/27 untrusted virtual network ## ## 172.29.199.0/24 Trusted networks. @@ -73,16 +70,6 @@ m4_divert(-1) ## There are five blocks of publicly routable IPv6 addresses, though some of ## them aren't very interesting. The ranges are as follows. ## -## 2001:470:1f08:1b98::/64 -## Hurricane Electric tunnel network: only :1 (HE) and :2 -## (radius) are used. -## -## 2001:470:1f09:1b98::/64 -## House border network (dmz). -## -## 2001:470:9740::/48 -## Main house range. See below for allocation policy. -## ## 2001:8b0:c92::/48 ## Main house range (aaisp). See below for allocation policy. ## There is no explicit DMZ allocation (and no need for one). @@ -115,6 +102,7 @@ m4_divert(-1) ## 0 No specific site: mobile VPN endpoints or anycast addresses. ## 1 House. ## 2 Jump colocation. +## fff Local border network. ## ## Usually site-0 networks are allocated from the Jump range to improve ## expected performance from/to external sites which don't engage in our @@ -122,11 +110,12 @@ m4_divert(-1) ## Define the available network classes. m4_divert(42)m4_dnl -defnetclass scary scary trusted mcast -defnetclass untrusted scary untrusted trusted mcast -defnetclass trusted scary untrusted trusted safe noloop mcast -defnetclass safe trusted safe noloop mcast -defnetclass noloop trusted safe mcast +defnetclass scary scary trusted vpnnat mcast +defnetclass untrusted scary untrusted trusted mcast +defnetclass trusted scary untrusted trusted safe noloop vpnnat mcast +defnetclass safe trusted safe noloop vpnnat mcast +defnetclass noloop trusted safe mcast +defnetclass vpnnat scary trusted safe mcast defnetclass link defnetclass mcast @@ -138,17 +127,16 @@ m4_divert(26)m4_dnl ## House networks. defnet dmz trusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92::/48 + addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92:fff::/64 via unsafe untrusted defnet unsafe trusted - addr 172.29.199.0/25 2001:470:9740:1::/64 + addr 172.29.199.0/25 2001:8b0:c92:1::/64 via househub defnet safe safe - addr 172.29.199.192/27 2001:470:9740:4001::/64 + addr 172.29.199.192/27 2001:8b0:c92:4001::/64 via househub defnet untrusted untrusted - addr 172.29.198.0/25 2001:470:9740:8001::/64 + addr 172.29.198.0/25 2001:8b0:c92:8001::/64 via househub defnet househub virtual @@ -204,7 +192,7 @@ defhost groove defhost gibson hosttype client - iface eth0.5 unsafe + iface eth0 unsafe ## Colocated networks. defnet jump trusted @@ -220,6 +208,9 @@ defnet colobdry virtual defnet iodine untrusted addr 172.29.198.128/28 via colohub +defnet hippotat untrusted + addr 172.29.198.144/28 + via colohub ## Colocated hosts. defhost fender @@ -245,6 +236,7 @@ defhost jazz iface eth0 jump colo vpn iface eth1 jump colo vpn iface dns0 iodine + iface hippo-svc hippotat iface vpn-+ vpn ## Other networks. @@ -252,11 +244,12 @@ defnet hub virtual via housebdry colobdry defnet sgo noloop addr !172.29.198.0/23 + addr !10.165.27.0/24 addr 10.0.0.0/8 addr 172.16.0.0/12 addr 192.168.0.0/16 via househub colohub -defnet vpn safe +defnet vpn trusted addr 172.29.199.128/27 2001:ba8:1d9:6000::/64 via househub colohub host crybaby 1 ::1:1 @@ -264,11 +257,12 @@ defnet vpn safe host orange 3 ::3:1 host haze 4 ::4:1 host groove 5 ::5:1 + host spirit 9 ::9:1 defnet anycast trusted addr 172.29.199.224/27 2001:ba8:1d9:0::/64 via dmz unsafe safe untrusted jump colo vpn defnet default scary - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 + addr 81.2.113.195 81.187.238.128/28 2001:8b0:c92::/48 addr 212.13.198.64/28 2001:ba8:0:1d9::/64 addr 2001:ba8:1d9::/48 #temporary via dmz unsafe untrusted jump colo @@ -283,13 +277,13 @@ defhost national iface vpn-precision colohub ## Satellite networks. -defnet binswood noloop +defnet binswood vpnnat addr 10.165.27.0/24 via colohub defhost mango hosttype router iface eth0 binswood default - iface vpn-precision colo + iface vpn-precision colo default m4_divert(80)m4_dnl ###-------------------------------------------------------------------------- @@ -363,6 +357,23 @@ case $forward in ;; esac +m4_divert(82)m4_dnl +###-------------------------------------------------------------------------- +### Check for source routing. + +clearchain check-srcroute + +run iptables -A check-srcroute -g forbidden \ + -m ipv4options --any --flags lsrr,ssrr +run ip6tables -A check-srcroute -g forbidden \ + -m rt + +for c in INPUT FORWARD; do + for m in $from_scary $from_untrusted; do + run ip46tables -A $c -m mark --mark $m/$MASK_FROM -j check-srcroute + done +done + m4_divert(84)m4_dnl ###-------------------------------------------------------------------------- ### Locally-bound packet inspection. @@ -391,7 +402,7 @@ m4_divert(88)m4_dnl openports inbound ## Inspect inbound packets from untrusted sources. -run ip46tables -A inbound -j forbidden +run ip46tables -A inbound -g forbidden run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound