From: Mark Wooding Date: Thu, 26 Mar 2015 16:51:38 +0000 (+0000) Subject: Merge branch 'master' of git://git.distorted.org.uk/~mdw/firewall X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/firewall/commitdiff_plain/39efdaa33bf16dab8dd69ad7c173ae9d8c9cac8e Merge branch 'master' of git://git.distorted.org.uk/~mdw/firewall * 'master' of git://git.distorted.org.uk/~mdw/firewall: (29 commits) jaguar.m4, local.m4: Remove jaguar completely. jem.m4: External rsync service. radius.m4: Stop MSS clamping on egress now the external MTU is 1500. local.m4: Reinstate detailed filtering from scary networks. local.m4: Inbound restriction on untrusted is no longer experimental. local.m4: Protect the `untrusted' network from incoming requests. classify.m4: Fix some typos in the commentary. jazz.m4, numbers.m4: Expose the OpenPGP key server. local.m4: Proper configuration for groove. groove.m4: New host. artist.m4: Further Rygel hacking. artist.m4: Punch a hole for Rygel service to local (-ish) devices. local.m4: Boundary network addresses can legitimately transit the VPN. stratocaster.m4: Permit incoming finger. local.m4: Load connection tracking modules as standard. classify.m4: Forbid the v4-mapped and v4-compatible ranges. local.m4: Move VPN hosts to ...:1. telecaster.m4: Allow external DNS service. local.m4: Replacing IPv6 host routes with /112 networks. local.m4: Mention that the IPv6 VPN net is logically `safe'. ... Conflicts: artist.m4 fender.m4 groove.m4 jazz.m4 jem.m4 local.m4 local.mk radius.m4 stratocaster.m4 telecaster.m4 --- 39efdaa33bf16dab8dd69ad7c173ae9d8c9cac8e diff --cc local.m4 index 0618693,7cda718..37da67a --- a/local.m4 +++ b/local.m4 @@@ -45,13 -126,156 +45,20 @@@ m4_divert(26)m4_dn ###-------------------------------------------------------------------------- ### Network layout. -## House networks. -defnet dmz trusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - via unsafe untrusted -defnet unsafe trusted - addr 172.29.199.0/25 2001:470:9740:1::/64 - via househub -defnet safe safe - addr 172.29.199.192/27 2001:470:9740:4001::/64 - via househub -defnet untrusted untrusted - addr 172.29.198.0/25 2001:470:9740:8001::/64 - via househub - -defnet househub virtual - via housebdry dmz unsafe safe untrusted -defnet housebdry virtual - via househub hub - -## House hosts. -defhost radius - hosttype router - iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth2 dmz unsafe safe untrusted vpn sgo colobdry - iface eth3 unsafe untrusted vpn default - iface ppp0 default - iface t6-he default - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost roadstar - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost jem - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost artist - hosttype router - iface eth0 dmz unsafe untrusted - iface eth1 dmz unsafe untrusted - iface eth3 unsafe untrusted -defhost vampire - hosttype router - iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry - iface eth0.7 unsafe untrusted vpn - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost ibanez - iface br-dmz dmz unsafe - iface br-unsafe unsafe -defhost orange - iface wlan0 untrusted - iface vpn-radius unsafe -defhost groove - iface eth0 unsafe - iface wlan0 untrusted - iface vpn-radius unsafe - -defhost gibson - hosttype client - iface eth0 unsafe - -## Colocated networks. -defnet jump trusted - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - via colohub -defnet colo trusted - addr 172.29.199.176/28 2001:ba8:1d9:2::/64 - via colohub -defnet colohub virtual - via colobdry jump colo -defnet colobdry virtual - via colohub hub -defnet iodine untrusted - addr 172.29.198.128/28 - via colohub - -## Colocated hosts. -defhost fender - iface br-jump jump colo - iface br-colo jump colo -defhost precision - hosttype router - iface eth0 jump colo vpn sgo - iface eth1 jump colo vpn sgo - iface vpn-mango binswood - iface vpn-radius housebdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost telecaster - iface eth0 jump colo - iface eth1 jump colo -defhost stratocaster - iface eth0 jump colo - iface eth1 jump colo -defhost jazz - hosttype router - iface eth0 jump colo vpn - iface eth1 jump colo vpn - iface dns0 iodine - iface vpn-+ vpn - -## Other networks. -defnet hub virtual - via housebdry colobdry -defnet sgo noloop - addr !172.29.198.0/23 - addr 10.0.0.0/8 - addr 172.16.0.0/12 - addr 192.168.0.0/16 - via househub colohub -defnet vpn safe - addr 172.29.199.128/27 2001:ba8:1d9:6000::/64 - via househub colohub - host crybaby 1 ::1:1 - host terror 2 ::2:1 - host orange 3 ::3:1 - host haze 4 ::4:1 - host groove 5 ::5:1 -defnet anycast trusted - addr 172.29.199.224/27 2001:ba8:1d9:0::/64 - via dmz unsafe safe untrusted jump colo vpn -defnet default scary - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - addr 2001:ba8:1d9::/48 #temporary - via dmz unsafe untrusted jump colo - -## Satellite networks. -defnet binswood noloop - addr 10.165.27.0/24 - via colohub +defnet default untrusted - ## Colocated hosts. - defhost jaguar -defhost mango - hosttype router - iface eth0 binswood default - iface vpn-precision colo ++## Hosts. +defhost jaguar + iface eth0 default + m4_divert(80)m4_dnl + ###-------------------------------------------------------------------------- + ### Connection tracking helper modules. + + for i in ftp; do + modprobe nf_conntrack_$i + done + m4_divert(80)m4_dnl ###-------------------------------------------------------------------------- ### Special forwarding exemptions. @@@ -144,8 -368,19 +151,18 @@@ openports inboun ## Inspect inbound packets from untrusted sources. run ip46tables -A inbound -j forbidden -run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound + ## Allow responses from the scary outside world into the untrusted net, but + ## don't let untrusted things run services. + case $forward in + 1) + run ip46tables -A FORWARD -j ACCEPT \ - -m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \ ++ -m mark --mark $to_untrusted/$(( $MASK_FROM | $MASK_TO )) \ + -m state --state ESTABLISHED,RELATED + ;; + esac + ## Otherwise process as indicated by the mark. for i in $inchains; do run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT