From f5c3343e4ede753f39c8ea5ca8b71a3b544f189f Mon Sep 17 00:00:00 2001 From: Mark Wooding Date: Fri, 1 Jul 2016 22:14:46 +0100 Subject: [PATCH] Makefile, distorted.lisp, hosts.lisp: Finish renumbering for A&A switchover. * Abolish the Hurricane Electric IPv6 range now that we have native IPv6. I'm not going to try to do multihoming here. Therefore, the A&A range takes over all of the house internal networks as well as the border. * Rearrange how the gateway addresses work. It turns out that I have to allocate a little gateway network for the PPP terminating router: otherwise, it uses the wrong default source address for the PPP interface. --- Makefile | 7 +++-- distorted.lisp | 82 +++++++++++++++------------------------------------------- hosts.lisp | 60 +++++++++++++++--------------------------- 3 files changed, 45 insertions(+), 104 deletions(-) diff --git a/Makefile b/Makefile index 6c4427f..69d62e6 100644 --- a/Makefile +++ b/Makefile @@ -67,15 +67,14 @@ distorted_inside_NETS = any unsafe colo vpn upn distorted_all_ZONES += distorted.org.uk -distorted_all_ZONES += 144-159.204.49.62.in-addr.arpa +distorted_all_ZONES += 195.113.2.81.in-addr.arpa +distorted_all_ZONES += 128-143.238.187.81.in-addr.arpa distorted_all_ZONES += 64-79.198.13.212.in-addr.arpa distorted_all_ZONES += 199.29.172.in-addr.arpa -distorted_all_ZONES += 8.9.b.1.9.0.f.1.0.7.4.0.1.0.0.2.ip6.arpa -distorted_all_ZONES += 0.4.7.9.0.7.4.0.1.0.0.2.ip6.arpa - distorted_all_ZONES += 9.d.1.0.0.0.0.0.8.a.b.0.1.0.0.2.ip6.arpa +distorted_all_ZONES += 2.9.c.0.0.b.8.0.1.0.0.2.ip6.arpa distorted_all_ZONES += 9.d.1.0.8.a.b.0.1.0.0.2.ip6.arpa distorted_outside_NSDIFF = -sradius.dmz.distorted.org.uk diff --git a/distorted.lisp b/distorted.lisp index 4b17c24..7c9c41e 100644 --- a/distorted.lisp +++ b/distorted.lisp @@ -91,12 +91,10 @@ (dns0 :anycast ((any dns0.any) (jump precision.jump) (colo precision.colo) - (aaisp radius.aaisp) (dmz radius.dmz) (unsafe radius.unsafe))) (dns1 :anycast ((any dns1.any) (jump telecaster.jump) - (aaisp vampire.aaisp) (dmz vampire.dmz) (unsafe vampire.unsafe) (colo telecaster.colo))) @@ -104,19 +102,16 @@ (ntp0 :anycast ((any ntp0.any) (jump fender.jump) - (aaisp ibanez.aaisp) (dmz ibanez.dmz) (unsafe ibanez.unsafe) (colo fender.colo))) (ntp1 :anycast ((any ntp1.any) - (aaisp vampire.aaisp) (dmz vampire.dmz) (unsafe vampire.unsafe))) (ntp :cname ntp0) (www-cache :anycast ((any www-cache.any) (jump telecaster.jump) - (aaisp roadstar.aaisp) (dmz roadstar.dmz) (unsafe roadstar.unsafe) (colo telecaster.colo))) @@ -125,16 +120,13 @@ (_kerberos :txt "DISTORTED.ORG.UK") (krb0 :anycast ((any krb0.any) (jump precision.jump) - (aaisp radius.aaisp) (dmz radius.dmz) (unsafe radius.unsafe) (colo precision.colo))) (krb1 :anycast ((any krb1.any) - (aaisp vampire.aaisp) (dmz vampire.dmz) (unsafe vampire.unsafe))) (krb-master (unsafe :svc radius.unsafe) - (aaisp :svc radius.aaisp) (dmz :svc radius.dmz)) :srv (((:kerberos :protocol :udp) krb0 @@ -173,11 +165,8 @@ (cabal :svc stratocaster.colo :sshfp "stratocaster") ;; Local services. - ((rawk pifi) (unsafe :svc artist.unsafe) - (aaisp :svc artist.aaisp) - (dmz :svc artist.dmz)) - (mirror (aasip :svc roadstar.aaisp :sshfp "roadstar") - (dmz :svc roadstar.dmz :sshfp "roadstar") + ((rawk pifi) (unsafe :svc artist.unsafe) (dmz :svc artist.dmz)) + (mirror (dmz :svc roadstar.dmz :sshfp "roadstar") (unsafe :svc roadstar.unsafe :sshfp "roadstar")) ;; Internal services. @@ -187,7 +176,6 @@ (anon (colo :svc jazz.colo) (unsafe :svc vampire.unsafe) (jump :addr anon.jump) - (aaisp :addr anon.aaisp) (dmz :addr anon.dmz)) ;; Fancy connectivity. @@ -233,12 +221,9 @@ (richmond (jump :svc richmond.jump)) ;; Entry is via little router box. - (aaisp :net aaisp) (dmz :net dmz) - (guvnor (dmz :addr guvnor.dmz) - (aaisp :addr guvnor.aaisp)) - (nat (dmz :addr nat.dmz) - (aaisp :addr nat.aaisp)) + (guvnor (dmz :addr guvnor.dmz)) + (nat (dmz :addr nat.dmz)) ;; Wireless gateway. (wireless :net wireless) @@ -258,45 +243,36 @@ (safe :net safe) (untrusted :net untrusted) (vampire :abbrev v - (unsafe :abbrev vu) (aaisp :abbrev va) (dmz :abbrev vd) - (vpn :abbrev vv) (safe :abbrev vs) (untrusted :abbrev vx)) + (unsafe :abbrev vu) (dmz :abbrev vd) (vpn :abbrev vv) + (safe :abbrev vs) (untrusted :abbrev vx)) (vampire (unsafe :addr vampire.unsafe :sshfp "vampire") - (aaisp :addr vampire.aaisp :sshfp "vampire") (dmz :addr vampire.dmz :sshfp "vampire") (vpn :addr vampire.vpn :sshfp "vampire") (safe :addr vampire.safe :sshfp "vampire") (untrusted :addr vampire.untrusted :sshfp "vampire")) - (ibanez :abbrev i (unsafe :abbrev iu) (aaisp :abbrev ia) (dmz :abbrev id)) + (ibanez :abbrev i (unsafe :abbrev iu) (dmz :abbrev id)) (ibanez (unsafe :addr ibanez.unsafe :sshfp "ibanez") - (aaisp :addr ibanez.aaisp :sshfp "ibanez") (dmz :addr ibanez.dmz :sshfp "ibanez")) (radius :abbrev r - (unsafe :abbrev ru) (aaisp :abbrev ra) (dmz :abbrev rd) - (vpn :abbrev rv) (safe :abbrev rs) (untrusted :abbrev rx)) + (unsafe :abbrev ru) (dmz :abbrev rd) (vpn :abbrev rv) + (safe :abbrev rs) (untrusted :abbrev rx)) (radius (unsafe :addr radius.unsafe :sshfp "radius") - (aaisp :addr radius.aaisp :sshfp "radius") (dmz :addr radius.dmz :sshfp "radius") (vpn :addr radius.vpn :sshfp "radius") (safe :addr radius.safe :sshfp "radius") (untrusted :addr radius.untrusted :sshfp "radius")) - (roadstar :abbrev rg (unsafe :abbrev rgu) - (aaisp :abbrev rga) (dmz :abbrev rgd)) + (roadstar :abbrev rg (unsafe :abbrev rgu) (dmz :abbrev rgd)) (roadstar (unsafe :addr roadstar.unsafe :sshfp "roadstar") - (aaisp :addr roadstar.aaisp :sshfp "roadstar") (dmz :addr roadstar.dmz :sshfp "roadstar")) - (jem :abbrev j (unsafe :abbrev ju) (aaisp :abbrev ja) (dmz :abbrev jd)) + (jem :abbrev j (unsafe :abbrev ju) (dmz :abbrev jd)) (jem (unsafe :addr jem.unsafe :sshfp "jem") - (aaisp :addr jem.aaisp :sshfp "jem") (dmz :addr jem.dmz :sshfp "jem")) - (universe :abbrev u (unsafe :abbrev uu) (aaisp :abbrev ua) (dmz :abbrev ud)) + (universe :abbrev u (unsafe :abbrev uu) (dmz :abbrev ud)) (universe (unsafe :addr universe.unsafe :sshfp "universe") - (aaisp :addr universe.aaisp :sshfp "universe") (dmz :addr universe.dmz :sshfp "universe")) (artist :abbrev a - (unsafe :abbrev au) (aaisp :abbrev aa) (dmz :abbrev ad) - (untrusted :abbrev ax)) + (unsafe :abbrev au) (dmz :abbrev ad) (untrusted :abbrev ax)) (artist (unsafe :addr artist.unsafe :sshfp "artist") - (aaisp :addr artist.aaisp :sshfp "artist") (dmz :addr artist.dmz :sshfp "artist") (untrusted :addr artist.untrusted :sshfp "artist")) (groove :abbrev gr) @@ -394,40 +370,31 @@ vampire.distorted.org.uk.)) :multi (((dhcp safe) :family :ipv4 :suffix "199.29.172.dhcp") :cname *)) -(defrevzone (dmz :family :ipv6) +(defzone dhcp.199.29.172.in-addr.arpa :ns (radius.distorted.org.uk. precision.distorted.org.uk. telecaster.distorted.org.uk. - vampire.distorted.org.uk.) - :reverse dmz) - -(defrevzone (dmz :family :ipv4) - (144-159 :ns (radius.distorted.org.uk. - precision.distorted.org.uk. - telecaster.distorted.org.uk. - vampire.distorted.org.uk.)) - :multi ((dmz :suffix "144-159") :cname *)) + vampire.distorted.org.uk.)) -(defzone 144-159.204.49.62.in-addr.arpa +(defrevzone untrusted :ns (radius.distorted.org.uk. precision.distorted.org.uk. telecaster.distorted.org.uk. - vampire.distorted.org.uk.) - :reverse ((((:ipv4 dmz))))) + vampire.distorted.org.uk.)) (defzone 128-143.238.187.81.in-addr.arpa :ns (radius.distorted.org.uk. precision.distorted.org.uk. telecaster.distorted.org.uk. vampire.distorted.org.uk.) - :reverse ((((:ipv4 aaisp))))) + :reverse ((((:ipv4 dmz))))) (defzone 195.113.2.81.in-addr.arpa :ns (radius.distorted.org.uk. precision.distorted.org.uk. telecaster.distorted.org.uk. vampire.distorted.org.uk.) - :reverse ((((:ipv4 aaisp-gw))))) + :reverse ((((:ipv4 gw))))) (defrevzone (jump :family :ipv6) :ns (radius.distorted.org.uk. @@ -450,19 +417,12 @@ vampire.distorted.org.uk.) :reverse ((((:ipv4 jump))))) -(defrevzone distorted.org.uk-he - :ns (radius.distorted.org.uk. - precision.distorted.org.uk. - telecaster.distorted.org.uk. - vampire.distorted.org.uk.) - :reverse distorted.org.uk-he) - -(defrevzone (aaisp :family :ipv6) +(defrevzone (distorted.org.uk-aaisp :family :ipv6) :ns (radius.distorted.org.uk. precision.distorted.org.uk. telecaster.distorted.org.uk. vampire.distorted.org.uk.) - :reverse ((((:ipv6 aaisp))))) + :reverse ((((:ipv6 distorted.org.uk-aaisp))))) (defrevzone distorted.org.uk-jump :ns (radius.distorted.org.uk. diff --git a/hosts.lisp b/hosts.lisp index c19979f..a969fe8 100644 --- a/hosts.lisp +++ b/hosts.lisp @@ -34,13 +34,14 @@ (safe "192/27") (any "224/27"))) -;; Externally routable DMZ from Demon. -(defnet dmz "62.49.204.144/28") - ;; Externally routable DMZ from Andrews and Arnold. -(defnet aaisp-gw "81.2.113.195") -(defnet aaisp "81.187.238.128/28") -(defnet aaisp "2001:8b0:c92/48") +(defnet gw "81.2.113.195") +(defnet dmz "81.187.238.128/28") +(defnet distorted.org.uk-aaisp "2001:8b0:c92/48" + (unsafe "1/64") + (dmz "fff/64") + (safe "4001/64") + (untrusted "8001/64")) ;; Externally routed colo range. (defnet jump "212.13.198.66/28") @@ -51,40 +52,21 @@ (vpn "6000/64") (upn "a000/64")) -;; Hurricane Electric IPv6-inIPv4 tunnel. -(defnet he-tunnel "2001:470:1f08:1b98/64") -(defnet dmz "2001:470:1f09:1b98/64") -(defnet distorted.org.uk-he "2001:470:9740/48" - (unsafe "1/64") - (safe "4001/64") - (untrusted "8001/64")) - ;;;-------------------------------------------------------------------------- ;;; Host allocations ;; External addresses. -(defhost guvnor.dmz ((:ipv4 dmz 1))) -(defhost radius.dmz (dmz 2)) -(defhost roadstar.dmz (dmz 3)) -(defhost jem.dmz (dmz 4)) -(defhost artist.dmz (dmz 5)) -(defhost vampire.dmz (dmz 6)) -(defhost universe.dmz (dmz 7)) +(defhost guvnor.dmz ((:ipv4 gw 0) (:ipv6 dmz "::1:1"))) +(defhost radius.dmz (dmz 1)) +(defhost roadstar.dmz (dmz 2)) +(defhost jem.dmz (dmz 3)) +(defhost artist.dmz (dmz 4)) +(defhost vampire.dmz (dmz 5)) +(defhost universe.dmz (dmz 6)) (defhost ibanez.dmz (dmz 9)) (defhost anon.dmz (dmz 12)) (defhost nat.dmz ((:ipv4 dmz 14))) -(defhost guvnor.aaisp (aaisp-gw 0)) -(defhost radius.aaisp (aaisp 1)) -(defhost roadstar.aaisp (aaisp 2)) -(defhost jem.aaisp (aaisp 3)) -(defhost artist.aaisp (aaisp 4)) -(defhost vampire.aaisp (aaisp 5)) -(defhost universe.aaisp (aaisp 6)) -(defhost ibanez.aaisp (aaisp 9)) -(defhost anon.aaisp (aaisp 12)) -(defhost nat.aaisp ((:ipv4 aaisp 14))) - ;; Colocated addresses. (defhost gate.jump ((:ipv6 jump 2))) (defhost fender.jump (jump 5)) @@ -112,13 +94,13 @@ (defhost groove.unsafe (unsafe 17)) ;; Client hosts, with IPv6 addresses. -(defhost gibson.unsafe ((:ipv6 "2001:470:9740:1:e269:95ff:fe63:bb4"))) -(defhost crybaby.unsafe ((:ipv6 "2001:470:9740:1:216:eaff:fec2:4cb8"))) -(defhost lespaul.unsafe ((:ipv6 "2001:470:9740:1:a00:27ff:fef5:aaef"))) -(defhost haze.unsafe ((:ipv6 "2001:470:9740:1:5056:a8ff:fe01:5654"))) -(defhost gretsch.unsafe ((:ipv6 "2001:470:9740:1:3a2c:4aff:fe6d:e768"))) -(defhost invader.safe ((:ipv6 "2001:470:9740:4001:a00:27ff:fe94:a5d7"))) -(defhost marauder.safe ((:ipv6 "2001:470:9740:4001:a00:27ff:fe6a:7846"))) +(defhost gibson.unsafe ((:ipv6 unsafe "e269:95ff:fe63:bb4"))) +(defhost crybaby.unsafe ((:ipv6 unsafe "216:eaff:fec2:4cb8"))) +(defhost lespaul.unsafe ((:ipv6 unsafe "a00:27ff:fef5:aaef"))) +(defhost haze.unsafe ((:ipv6 unsafe "5056:a8ff:fe01:5654"))) +(defhost gretsch.unsafe ((:ipv6 unsafe "3a2c:4aff:fe6d:e768"))) +(defhost invader.safe ((:ipv6 safe "a00:27ff:fe94:a5d7"))) +(defhost marauder.safe ((:ipv6 safe "a00:27ff:fe6a:7846"))) ;; Safe network. (defhost radius.safe (safe 1)) -- 2.11.0