From: Mark Wooding Date: Thu, 26 Mar 2015 16:51:38 +0000 (+0000) Subject: Merge branch 'master' of git://git.distorted.org.uk/~mdw/firewall X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/firewall/commitdiff_plain/39efdaa33bf16dab8dd69ad7c173ae9d8c9cac8e?ds=inline;hp=-c Merge branch 'master' of git://git.distorted.org.uk/~mdw/firewall * 'master' of git://git.distorted.org.uk/~mdw/firewall: (29 commits) jaguar.m4, local.m4: Remove jaguar completely. jem.m4: External rsync service. radius.m4: Stop MSS clamping on egress now the external MTU is 1500. local.m4: Reinstate detailed filtering from scary networks. local.m4: Inbound restriction on untrusted is no longer experimental. local.m4: Protect the `untrusted' network from incoming requests. classify.m4: Fix some typos in the commentary. jazz.m4, numbers.m4: Expose the OpenPGP key server. local.m4: Proper configuration for groove. groove.m4: New host. artist.m4: Further Rygel hacking. artist.m4: Punch a hole for Rygel service to local (-ish) devices. local.m4: Boundary network addresses can legitimately transit the VPN. stratocaster.m4: Permit incoming finger. local.m4: Load connection tracking modules as standard. classify.m4: Forbid the v4-mapped and v4-compatible ranges. local.m4: Move VPN hosts to ...:1. telecaster.m4: Allow external DNS service. local.m4: Replacing IPv6 host routes with /112 networks. local.m4: Mention that the IPv6 VPN net is logically `safe'. ... Conflicts: artist.m4 fender.m4 groove.m4 jazz.m4 jem.m4 local.m4 local.mk radius.m4 stratocaster.m4 telecaster.m4 --- 39efdaa33bf16dab8dd69ad7c173ae9d8c9cac8e diff --combined local.m4 index 0618693,7cda718..37da67a --- a/local.m4 +++ b/local.m4 @@@ -33,9 -33,90 +33,9 @@@ m4_divert(-1 ###-------------------------------------------------------------------------- ### Packet classification. -## IPv4 addressing. -## -## There are two small blocks of publicly routable IPv4 addresses, and a -## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN. -## The former are as follows. -## -## 62.49.204.144/28 -## House border network (dmz). We have all of these, but .145 -## is reserved for the router. -## -## 212.13.18.64/28 -## Jump colocated network (jump). .65--68 are used by Jump -## network infrastructure; we get the rest. -## -## The latter is the block 172.29.196.0/22. Currently the low half is -## unallocated (and may be returned to the G-RIN); the remaining addresses -## are allocated as follows. -## -## 172.29.198.0/24 Untrusted networks. -## .0/25 house wireless net -## .128/28 iodine (IP-over-DNS) network -## -## 172.29.199.0/24 Trusted networks. -## .0/25 house wired network -## .128/27 mobile VPN hosts -## .160/28 reserved, except .160/30 allocated for ITS -## .176/28 internal colocated network -## .192/27 house safe network -## .224/27 anycast services - -## IPv6 addressing. -## -## There are five blocks of publicly routable IPv6 addresses, though some of -## them aren't very interesting. The ranges are as follows. -## -## 2001:470:1f08:1b98::/64 -## Hurricane Electric tunnel network: only :1 (HE) and :2 -## (radius) are used. -## -## 2001:470:1f09:1b98::/64 -## House border network (dmz). -## -## 2001:470:9740::/48 -## Main house range. See below for allocation policy. -## -## 2001:ba8:0:1d9::/64 -## Jump border network (jump): :1 is the router (supplied by -## Jump); other addresses are ours. -## -## 2001:ba8:1d9::/48 -## Main colocated range. See below for allocation policy. -## -## Addresses in the /64 networks are simply allocated in ascending order. -## The /48s are split into /64s by appending a 16-bit network number. The -## top nibble of the network number classifies the network, as follows. -## -## 8xxx Untrusted -## 6xxx Virtual, safe -## 4xxx Safe -## 0xxx Unsafe, trusted -## -## These have been chosen so that network properties can be deduced by -## inspecting bits of the network number: -## -## Bit 15 If set, the network is untrusted; otherwise it is trusted. -## Bit 14 If set, the network is safe; otherwise it is unsafe. -## -## Finally, the low-order nibbles identify the site. -## -## 0 No specific site: mobile VPN endpoints or anycast addresses. -## 1 House. -## 2 Jump colocation. -## -## Usually site-0 networks are allocated from the Jump range to improve -## expected performance from/to external sites which don't engage in our -## dynamic routing protocols. - ## Define the available network classes. m4_divert(42)m4_dnl -defnetclass scary scary trusted mcast -defnetclass untrusted scary untrusted trusted mcast -defnetclass trusted scary untrusted trusted safe noloop mcast -defnetclass safe trusted safe noloop mcast -defnetclass noloop trusted safe mcast +defnetclass untrusted untrusted mcast defnetclass link defnetclass mcast @@@ -45,13 -126,156 +45,20 @@@ m4_divert(26)m4_dn ###-------------------------------------------------------------------------- ### Network layout. -## House networks. -defnet dmz trusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - via unsafe untrusted -defnet unsafe trusted - addr 172.29.199.0/25 2001:470:9740:1::/64 - via househub -defnet safe safe - addr 172.29.199.192/27 2001:470:9740:4001::/64 - via househub -defnet untrusted untrusted - addr 172.29.198.0/25 2001:470:9740:8001::/64 - via househub - -defnet househub virtual - via housebdry dmz unsafe safe untrusted -defnet housebdry virtual - via househub hub - -## House hosts. -defhost radius - hosttype router - iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth2 dmz unsafe safe untrusted vpn sgo colobdry - iface eth3 unsafe untrusted vpn default - iface ppp0 default - iface t6-he default - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost roadstar - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost jem - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost artist - hosttype router - iface eth0 dmz unsafe untrusted - iface eth1 dmz unsafe untrusted - iface eth3 unsafe untrusted -defhost vampire - hosttype router - iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry - iface eth0.7 unsafe untrusted vpn - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost ibanez - iface br-dmz dmz unsafe - iface br-unsafe unsafe -defhost orange - iface wlan0 untrusted - iface vpn-radius unsafe -defhost groove - iface eth0 unsafe - iface wlan0 untrusted - iface vpn-radius unsafe - -defhost gibson - hosttype client - iface eth0 unsafe - -## Colocated networks. -defnet jump trusted - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - via colohub -defnet colo trusted - addr 172.29.199.176/28 2001:ba8:1d9:2::/64 - via colohub -defnet colohub virtual - via colobdry jump colo -defnet colobdry virtual - via colohub hub -defnet iodine untrusted - addr 172.29.198.128/28 - via colohub - -## Colocated hosts. -defhost fender - iface br-jump jump colo - iface br-colo jump colo -defhost precision - hosttype router - iface eth0 jump colo vpn sgo - iface eth1 jump colo vpn sgo - iface vpn-mango binswood - iface vpn-radius housebdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost telecaster - iface eth0 jump colo - iface eth1 jump colo -defhost stratocaster - iface eth0 jump colo - iface eth1 jump colo -defhost jazz - hosttype router - iface eth0 jump colo vpn - iface eth1 jump colo vpn - iface dns0 iodine - iface vpn-+ vpn - -## Other networks. -defnet hub virtual - via housebdry colobdry -defnet sgo noloop - addr !172.29.198.0/23 - addr 10.0.0.0/8 - addr 172.16.0.0/12 - addr 192.168.0.0/16 - via househub colohub -defnet vpn safe - addr 172.29.199.128/27 2001:ba8:1d9:6000::/64 - via househub colohub - host crybaby 1 ::1:1 - host terror 2 ::2:1 - host orange 3 ::3:1 - host haze 4 ::4:1 - host groove 5 ::5:1 -defnet anycast trusted - addr 172.29.199.224/27 2001:ba8:1d9:0::/64 - via dmz unsafe safe untrusted jump colo vpn -defnet default scary - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - addr 2001:ba8:1d9::/48 #temporary - via dmz unsafe untrusted jump colo - -## Satellite networks. -defnet binswood noloop - addr 10.165.27.0/24 - via colohub +defnet default untrusted - ## Colocated hosts. - defhost jaguar -defhost mango - hosttype router - iface eth0 binswood default - iface vpn-precision colo ++## Hosts. +defhost jaguar + iface eth0 default + m4_divert(80)m4_dnl + ###-------------------------------------------------------------------------- + ### Connection tracking helper modules. + + for i in ftp; do + modprobe nf_conntrack_$i + done + m4_divert(80)m4_dnl ###-------------------------------------------------------------------------- ### Special forwarding exemptions. @@@ -144,8 -368,19 +151,18 @@@ openports inboun ## Inspect inbound packets from untrusted sources. run ip46tables -A inbound -j forbidden -run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound + ## Allow responses from the scary outside world into the untrusted net, but + ## don't let untrusted things run services. + case $forward in + 1) + run ip46tables -A FORWARD -j ACCEPT \ - -m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \ ++ -m mark --mark $to_untrusted/$(( $MASK_FROM | $MASK_TO )) \ + -m state --state ESTABLISHED,RELATED + ;; + esac + ## Otherwise process as indicated by the mark. for i in $inchains; do run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT diff --combined numbers.m4 index 149afd4,aeffdd1..547dce1 --- a/numbers.m4 +++ b/numbers.m4 @@@ -40,6 -40,7 +40,7 @@@ defport ident 11 defport netbios_ns 137 defport netbios_dgm 138 defport netbios_ssn 139 + defport imap 143 defport https 443 defport microsoft_ds 445 defport syslog 514 # UDP only! @@@ -49,6 -50,7 +50,7 @@@ defport ipmi 62 defport rsync 873 defport imaps 993 defport h323 1720 + defport ssquid 3127 defport squid 3128 defport icp 3130 defport tripe 4070 @@@ -59,11 -61,10 +61,12 @@@ defport postgresql 543 defport gnutella_svc 6346 defport mpd 6600 defport irc 6667 +defport althttp0 8000 +defport althttp1 8080 defport tor_public 9001 defport tor_directory 9030 defport git 9418 + defport pgp_keys 11371 defport i2p 16911 defport disorder 23599 defport udpkey 59274