X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/firewall/blobdiff_plain/e7de4e98fd2e8ff83dba6a6117b2d90266f1065e..b1a5b8b48fa727d122017cfc3a4b0a75e082ee62:/local.m4 diff --git a/local.m4 b/local.m4 index a50afd7..0618693 100644 --- a/local.m4 +++ b/local.m4 @@ -33,89 +33,9 @@ m4_divert(-1) ###-------------------------------------------------------------------------- ### Packet classification. -## IPv4 addressing. -## -## There are two small blocks of publicly routable IPv4 addresses, and a -## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN. -## The former are as follows. -## -## 62.49.204.144/28 -## House border network (dmz). We have all of these, but .145 -## is reserved for the router. -## -## 212.13.18.64/28 -## Jump colocated network (jump). .65--68 are used by Jump -## network infrastructure; we get the rest. -## -## The latter is the block 172.29.196.0/22. Currently the low half is -## unallocated (and may be returned to the G-RIN); the remaining addresses -## are allocated as follows. -## -## 172.29.198.0/24 Untrusted networks. -## .0/25 house wireless net -## .128/28 iodine (IP-over-DNS) network -## -## 172.29.199.0/24 Trusted networks. -## .0/25 house wired network -## .128/27 mobile VPN hosts -## .160/28 reserved, except .160/30 allocated for ITS -## .176/28 internal colocated network -## .192/27 house safe network -## .224/27 anycast services - -## IPv6 addressing. -## -## There are five blocks of publicly routable IPv6 addresses, though some of -## them aren't very interesting. The ranges are as follows. -## -## 2001:470:1f08:1b98::/64 -## Hurricane Electric tunnel network: only :1 (HE) and :2 -## (radius) are used. -## -## 2001:470:1f09:1b98::/64 -## House border network (dmz). -## -## 2001:470:9740::/48 -## Main house range. See below for allocation policy. -## -## 2001:ba8:0:1d9::/64 -## Jump border network (jump): :1 is the router (supplied by -## Jump); other addresses are ours. -## -## 2001:ba8:1d9::/48 -## Main colocated range. See below for allocation policy. -## -## Addresses in the /64 networks are simply allocated in ascending order. -## The /48s are split into /64s by appending a 16-bit network number. The -## top nibble of the network number classifies the network, as follows. -## -## 8xxx Untrusted -## 6xxx Virtual -## 4xxx Safe -## 0xxx Unsafe, trusted -## -## These have been chosen so that network properties can be deduced by -## inspecting bits of the network number: -## -## Bit 15 If set, the network is untrusted; otherwise it is trusted. -## Bit 14 If set, the network is safe; otherwise it is unsafe. -## -## Finally, the low-order nibbles identify the site. -## -## 0 No specific site: mobile VPN endpoints or anycast addresses. -## 1 House. -## 2 Jump colocation. -## -## Usually site-0 networks are allocated from the Jump range to improve -## expected performance from/to external sites which don't engage in our -## dynamic routing protocols. - ## Define the available network classes. m4_divert(42)m4_dnl -defnetclass untrusted untrusted trusted mcast -defnetclass trusted untrusted trusted safe noloop mcast -defnetclass safe trusted safe noloop mcast -defnetclass noloop trusted safe mcast +defnetclass untrusted untrusted mcast defnetclass link defnetclass mcast @@ -125,145 +45,12 @@ m4_divert(26)m4_dnl ###-------------------------------------------------------------------------- ### Network layout. -## House networks. -defnet dmz trusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - via unsafe untrusted -defnet unsafe trusted - addr 172.29.199.0/25 2001:470:9740:1::/64 - via househub -defnet safe safe - addr 172.29.199.192/27 2001:470:9740:4001::/64 - via househub -defnet untrusted untrusted - addr 172.29.198.0/25 2001:470:9740:8001::/64 - via househub - -defnet househub virtual - via housebdry dmz unsafe safe untrusted -defnet housebdry virtual - via househub hub - noxit dmz - -## House hosts. -defhost radius - hosttype router - iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth2 dmz unsafe safe untrusted vpn sgo colobdry - iface eth3 unsafe untrusted vpn default - iface ppp0 default - iface t6-he default - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost roadstar - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost jem - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost artist - hosttype router - iface eth0 dmz unsafe untrusted - iface eth1 dmz unsafe untrusted - iface eth3 unsafe untrusted -defhost vampire - hosttype router - iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry - iface eth0.7 unsafe untrusted vpn - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost ibanez - iface br-dmz dmz unsafe - iface br-unsafe unsafe -defhost orange - iface wlan0 untrusted - iface vpn-radius unsafe - -defhost gibson - hosttype client - iface eth0 unsafe - -## Colocated networks. -defnet jump trusted - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - via colohub -defnet colo trusted - addr 172.29.199.176/28 2001:ba8:1d9:2::/64 - via colohub -defnet colohub virtual - via colobdry jump colo -defnet colobdry virtual - via colohub hub - noxit jump -defnet iodine untrusted - addr 172.29.198.128/28 - via colohub +defnet default untrusted ## Colocated hosts. -defhost fender - iface br-jump jump colo - iface br-colo jump colo -defhost precision - hosttype router - iface eth0 jump colo vpn sgo - iface eth1 jump colo vpn sgo - iface vpn-mango binswood - iface vpn-radius housebdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost telecaster - iface eth0 jump colo - iface eth1 jump colo -defhost stratocaster - iface eth0 jump colo - iface eth1 jump colo defhost jaguar - iface eth0 jump -defhost jazz - hosttype router - iface eth0 jump colo vpn - iface eth1 jump colo vpn - iface dns0 iodine - iface vpn-+ vpn - -## Other networks. -defnet hub virtual - via housebdry colobdry -defnet sgo noloop - addr !172.29.198.0/23 - addr 10.0.0.0/8 - addr 172.16.0.0/12 - addr 192.168.0.0/16 - via househub colohub -defnet vpn safe - addr 172.29.199.128/27 2001:ba8:1d9:6000::/64 - via househub colohub - host crybaby 1 - host terror 2 - host orange 3 -defnet anycast trusted - addr 172.29.199.224/27 2001:ba8:1d9:0::/64 - via dmz unsafe safe untrusted jump colo vpn -defnet default untrusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - addr 2001:ba8:1d9::/48 #temporary - via dmz unsafe untrusted jump colo - -## Satellite networks. -defnet binswood noloop - addr 10.165.27.0/24 - via colohub - -defhost mango - hosttype router - iface eth0 binswood default - iface vpn-precision colo +defhost jaguar + iface eth0 default m4_divert(80)m4_dnl ###--------------------------------------------------------------------------