Merge branch 'master' of git://git.distorted.org.uk/~mdw/firewall

* 'master' of git://git.distorted.org.uk/~mdw/firewall: (29 commits)
  jaguar.m4, local.m4: Remove jaguar completely.
  jem.m4: External rsync service.
  radius.m4: Stop MSS clamping on egress now the external MTU is 1500.
  local.m4: Reinstate detailed filtering from scary networks.
  local.m4: Inbound restriction on untrusted is no longer experimental.
  local.m4: Protect the `untrusted' network from incoming requests.
  classify.m4: Fix some typos in the commentary.
  jazz.m4, numbers.m4: Expose the OpenPGP key server.
  local.m4: Proper configuration for groove.
  groove.m4: New host.
  artist.m4: Further Rygel hacking.
  artist.m4: Punch a hole for Rygel service to local (-ish) devices.
  local.m4: Boundary network addresses can legitimately transit the VPN.
  stratocaster.m4: Permit incoming finger.
  local.m4: Load connection tracking modules as standard.
  classify.m4: Forbid the v4-mapped and v4-compatible ranges.
  local.m4: Move VPN hosts to ...:1.
  telecaster.m4: Allow external DNS service.
  local.m4: Replacing IPv6 host routes with /112 networks.
  local.m4: Mention that the IPv6 VPN net is logically `safe'.
  ...

Conflicts:
	artist.m4
	fender.m4
	groove.m4
	jazz.m4
	jem.m4
	local.m4
	local.mk
	radius.m4
	stratocaster.m4
	telecaster.m4

diff --cc local.m4
index 0618693042f11b421401b9ecf303a873b27401a4,7cda7181938c4fbdd71ffc82e1f2eb107d6a8bd9..37da67a788048cb3a48d5969601d8f1ebc7cbf79
--- 1/local.m4
--- 2/local.m4
+++ b/local.m4
@@@ -45,13 -126,156 +45,20 @@@ m4_divert(26)m4_dn
  ###--------------------------------------------------------------------------
  ### Network layout.
  
 -## House networks.
 -defnet dmz trusted
 -      addr 62.49.204.144/28 2001:470:1f09:1b98::/64
 -      via unsafe untrusted
 -defnet unsafe trusted
 -      addr 172.29.199.0/25 2001:470:9740:1::/64
 -      via househub
 -defnet safe safe
 -      addr 172.29.199.192/27 2001:470:9740:4001::/64
 -      via househub
 -defnet untrusted untrusted
 -      addr 172.29.198.0/25 2001:470:9740:8001::/64
 -      via househub
 -
 -defnet househub virtual
 -      via housebdry dmz unsafe safe untrusted
 -defnet housebdry virtual
 -      via househub hub
 -
 -## House hosts.
 -defhost radius
 -      hosttype router
 -      iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default
 -      iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default
 -      iface eth2 dmz unsafe safe untrusted vpn sgo colobdry
 -      iface eth3 unsafe untrusted vpn default
 -      iface ppp0 default
 -      iface t6-he default
 -      iface vpn-precision colobdry vpn sgo
 -      iface vpn-chiark sgo
 -      iface vpn-+ vpn
 -defhost roadstar
 -      iface eth0 dmz unsafe
 -      iface eth1 dmz unsafe
 -defhost jem
 -      iface eth0 dmz unsafe
 -      iface eth1 dmz unsafe
 -defhost artist
 -      hosttype router
 -      iface eth0 dmz unsafe untrusted
 -      iface eth1 dmz unsafe untrusted
 -      iface eth3 unsafe untrusted
 -defhost vampire
 -      hosttype router
 -      iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry
 -      iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry
 -      iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry
 -      iface eth0.7 unsafe untrusted vpn
 -      iface vpn-precision colobdry vpn sgo
 -      iface vpn-chiark sgo
 -      iface vpn-+ vpn
 -defhost ibanez
 -      iface br-dmz dmz unsafe
 -      iface br-unsafe unsafe
 -defhost orange
 -      iface wlan0 untrusted
 -      iface vpn-radius unsafe
 -defhost groove
 -      iface eth0 unsafe
 -      iface wlan0 untrusted
 -      iface vpn-radius unsafe
 -
 -defhost gibson
 -      hosttype client
 -      iface eth0 unsafe
 -
 -## Colocated networks.
 -defnet jump trusted
 -      addr 212.13.198.64/28 2001:ba8:0:1d9::/64
 -      via colohub
 -defnet colo trusted
 -      addr 172.29.199.176/28 2001:ba8:1d9:2::/64
 -      via colohub
 -defnet colohub virtual
 -      via colobdry jump colo
 -defnet colobdry virtual
 -      via colohub hub
 -defnet iodine untrusted
 -      addr 172.29.198.128/28
 -      via colohub
 -
 -## Colocated hosts.
 -defhost fender
 -      iface br-jump jump colo
 -      iface br-colo jump colo
 -defhost precision
 -      hosttype router
 -      iface eth0 jump colo vpn sgo
 -      iface eth1 jump colo vpn sgo
 -      iface vpn-mango binswood
 -      iface vpn-radius housebdry vpn sgo
 -      iface vpn-chiark sgo
 -      iface vpn-+ vpn
 -defhost telecaster
 -      iface eth0 jump colo
 -      iface eth1 jump colo
 -defhost stratocaster
 -      iface eth0 jump colo
 -      iface eth1 jump colo
 -defhost jazz
 -      hosttype router
 -      iface eth0 jump colo vpn
 -      iface eth1 jump colo vpn
 -      iface dns0 iodine
 -      iface vpn-+ vpn
 -
 -## Other networks.
 -defnet hub virtual
 -      via housebdry colobdry
 -defnet sgo noloop
 -      addr !172.29.198.0/23
 -      addr 10.0.0.0/8
 -      addr 172.16.0.0/12
 -      addr 192.168.0.0/16
 -      via househub colohub
 -defnet vpn safe
 -      addr 172.29.199.128/27 2001:ba8:1d9:6000::/64
 -      via househub colohub
 -      host crybaby 1 ::1:1
 -      host terror 2 ::2:1
 -      host orange 3 ::3:1
 -      host haze 4 ::4:1
 -      host groove 5 ::5:1
 -defnet anycast trusted
 -      addr 172.29.199.224/27 2001:ba8:1d9:0::/64
 -      via dmz unsafe safe untrusted jump colo vpn
 -defnet default scary
 -      addr 62.49.204.144/28 2001:470:1f09:1b98::/64
 -      addr 212.13.198.64/28 2001:ba8:0:1d9::/64
 -      addr 2001:ba8:1d9::/48 #temporary
 -      via dmz unsafe untrusted jump colo
 -
 -## Satellite networks.
 -defnet binswood noloop
 -      addr 10.165.27.0/24
 -      via colohub
 +defnet default untrusted
  
- ## Colocated hosts.
- defhost jaguar
 -defhost mango
 -      hosttype router
 -      iface eth0 binswood default
 -      iface vpn-precision colo
++## Hosts.
 +defhost jaguar
 +      iface eth0 default
  
+ m4_divert(80)m4_dnl
+ ###--------------------------------------------------------------------------
+ ### Connection tracking helper modules.
+ 
+ for i in ftp; do
+   modprobe nf_conntrack_$i
+ done
+ 
  m4_divert(80)m4_dnl
  ###--------------------------------------------------------------------------
  ### Special forwarding exemptions.
@@@ -144,8 -368,19 +151,18 @@@ openports inboun
  
  ## Inspect inbound packets from untrusted sources.
  run ip46tables -A inbound -j forbidden
 -run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound
  run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound
  
 -      -m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \
+ ## Allow responses from the scary outside world into the untrusted net, but
+ ## don't let untrusted things run services.
+ case $forward in
+   1)
+     run ip46tables -A FORWARD -j ACCEPT \
++      -m mark --mark $to_untrusted/$(( $MASK_FROM | $MASK_TO )) \
+       -m state --state ESTABLISHED,RELATED
+     ;;
+ esac
+ 
  ## Otherwise process as indicated by the mark.
  for i in $inchains; do
    run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT

diff --cc numbers.m4
Simple merge