From: Mark Wooding Date: Mon, 11 May 2015 14:26:04 +0000 (+0100) Subject: Merge branch 'upstream' into tmp X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~mdw/git/firewall/commitdiff_plain/664fb931eebc051998e1a053c50a949405577676?hp=-c Merge branch 'upstream' into tmp * upstream: functions.m4 (ntpclient): Handle NTP servers with IPv6 addresses. local.m4: Allow IPv6 ping separately. telecaster.m4: External SMTP service for mailing lists. local.mk: Remove orange and mango. jem.m4, vampire.m4: Cull some external services. local.m4: gibson now uses explicit VLAN tagging. functions.m4: Only call `allow-non-init-frag' on fragments. Conflicts: local.m4 local.mk --- 664fb931eebc051998e1a053c50a949405577676 diff --combined local.m4 index f0702c3,aeda659..2450fd2 --- a/local.m4 +++ b/local.m4 @@@ -33,9 -33,90 +33,9 @@@ m4_divert(-1 ###-------------------------------------------------------------------------- ### Packet classification. -## IPv4 addressing. -## -## There are two small blocks of publicly routable IPv4 addresses, and a -## block of RFC1918 private-use addresses allocated from the Cambridge G-RIN. -## The former are as follows. -## -## 62.49.204.144/28 -## House border network (dmz). We have all of these, but .145 -## is reserved for the router. -## -## 212.13.18.64/28 -## Jump colocated network (jump). .65--68 are used by Jump -## network infrastructure; we get the rest. -## -## The latter is the block 172.29.196.0/22. Currently the low half is -## unallocated (and may be returned to the G-RIN); the remaining addresses -## are allocated as follows. -## -## 172.29.198.0/24 Untrusted networks. -## .0/25 house wireless net -## .128/28 iodine (IP-over-DNS) network -## -## 172.29.199.0/24 Trusted networks. -## .0/25 house wired network -## .128/27 mobile VPN hosts -## .160/28 reserved, except .160/30 allocated for ITS -## .176/28 internal colocated network -## .192/27 house safe network -## .224/27 anycast services - -## IPv6 addressing. -## -## There are five blocks of publicly routable IPv6 addresses, though some of -## them aren't very interesting. The ranges are as follows. -## -## 2001:470:1f08:1b98::/64 -## Hurricane Electric tunnel network: only :1 (HE) and :2 -## (radius) are used. -## -## 2001:470:1f09:1b98::/64 -## House border network (dmz). -## -## 2001:470:9740::/48 -## Main house range. See below for allocation policy. -## -## 2001:ba8:0:1d9::/64 -## Jump border network (jump): :1 is the router (supplied by -## Jump); other addresses are ours. -## -## 2001:ba8:1d9::/48 -## Main colocated range. See below for allocation policy. -## -## Addresses in the /64 networks are simply allocated in ascending order. -## The /48s are split into /64s by appending a 16-bit network number. The -## top nibble of the network number classifies the network, as follows. -## -## 8xxx Untrusted -## 6xxx Virtual, safe -## 4xxx Safe -## 0xxx Unsafe, trusted -## -## These have been chosen so that network properties can be deduced by -## inspecting bits of the network number: -## -## Bit 15 If set, the network is untrusted; otherwise it is trusted. -## Bit 14 If set, the network is safe; otherwise it is unsafe. -## -## Finally, the low-order nibbles identify the site. -## -## 0 No specific site: mobile VPN endpoints or anycast addresses. -## 1 House. -## 2 Jump colocation. -## -## Usually site-0 networks are allocated from the Jump range to improve -## expected performance from/to external sites which don't engage in our -## dynamic routing protocols. - ## Define the available network classes. m4_divert(42)m4_dnl -defnetclass scary scary trusted mcast -defnetclass untrusted scary untrusted trusted mcast -defnetclass trusted scary untrusted trusted safe noloop mcast -defnetclass safe trusted safe noloop mcast -defnetclass noloop trusted safe mcast +defnetclass untrusted untrusted mcast defnetclass link defnetclass mcast @@@ -45,11 -126,147 +45,11 @@@ m4_divert(26)m4_dn ###-------------------------------------------------------------------------- ### Network layout. -## House networks. -defnet dmz trusted - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - via unsafe untrusted -defnet unsafe trusted - addr 172.29.199.0/25 2001:470:9740:1::/64 - via househub -defnet safe safe - addr 172.29.199.192/27 2001:470:9740:4001::/64 - via househub -defnet untrusted untrusted - addr 172.29.198.0/25 2001:470:9740:8001::/64 - via househub - -defnet househub virtual - via housebdry dmz unsafe safe untrusted -defnet housebdry virtual - via househub hub - -## House hosts. -defhost radius - hosttype router - iface eth0 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth1 dmz unsafe safe untrusted vpn sgo colobdry default - iface eth2 dmz unsafe safe untrusted vpn sgo colobdry - iface eth3 unsafe untrusted vpn default - iface ppp0 default - iface t6-he default - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost roadstar - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost jem - iface eth0 dmz unsafe - iface eth1 dmz unsafe -defhost artist - hosttype router - iface eth0 dmz unsafe untrusted - iface eth1 dmz unsafe untrusted - iface eth3 unsafe untrusted -defhost vampire - hosttype router - iface eth0.4 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.5 dmz unsafe untrusted safe vpn sgo colobdry - iface eth0.6 dmz unsafe safe untrusted vpn sgo colobdry - iface eth0.7 unsafe untrusted vpn - iface vpn-precision colobdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost ibanez - iface br-dmz dmz unsafe - iface br-unsafe unsafe -defhost orange - iface wlan0 untrusted - iface vpn-radius unsafe -defhost groove - iface eth0 unsafe - iface wlan0 untrusted - iface vpn-radius unsafe - -defhost gibson - hosttype client - iface eth0.5 unsafe - -## Colocated networks. -defnet jump trusted - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - via colohub -defnet colo trusted - addr 172.29.199.176/28 2001:ba8:1d9:2::/64 - via colohub -defnet colohub virtual - via colobdry jump colo -defnet colobdry virtual - via colohub hub -defnet iodine untrusted - addr 172.29.198.128/28 - via colohub - -## Colocated hosts. -defhost fender - iface br-jump jump colo - iface br-colo jump colo -defhost precision - hosttype router - iface eth0 jump colo vpn sgo - iface eth1 jump colo vpn sgo - iface vpn-mango binswood - iface vpn-radius housebdry vpn sgo - iface vpn-chiark sgo - iface vpn-+ vpn -defhost telecaster - iface eth0 jump colo - iface eth1 jump colo -defhost stratocaster - iface eth0 jump colo - iface eth1 jump colo -defhost jazz - hosttype router - iface eth0 jump colo vpn - iface eth1 jump colo vpn - iface dns0 iodine - iface vpn-+ vpn +defnet default untrusted -## Other networks. -defnet hub virtual - via housebdry colobdry -defnet sgo noloop - addr !172.29.198.0/23 - addr 10.0.0.0/8 - addr 172.16.0.0/12 - addr 192.168.0.0/16 - via househub colohub -defnet vpn safe - addr 172.29.199.128/27 2001:ba8:1d9:6000::/64 - via househub colohub - host crybaby 1 ::1:1 - host terror 2 ::2:1 - host orange 3 ::3:1 - host haze 4 ::4:1 - host groove 5 ::5:1 -defnet anycast trusted - addr 172.29.199.224/27 2001:ba8:1d9:0::/64 - via dmz unsafe safe untrusted jump colo vpn -defnet default scary - addr 62.49.204.144/28 2001:470:1f09:1b98::/64 - addr 212.13.198.64/28 2001:ba8:0:1d9::/64 - addr 2001:ba8:1d9::/48 #temporary - via dmz unsafe untrusted jump colo - -## Satellite networks. -defnet binswood noloop - addr 10.165.27.0/24 - via colohub - -defhost mango - hosttype router - iface eth0 binswood default - iface vpn-precision colo +## Hosts. +defhost jaguar + iface eth0 default m4_divert(80)m4_dnl ###-------------------------------------------------------------------------- @@@ -143,7 -360,8 +143,8 @@@ run iptables -A inbound -j ACCEPT -p udp --source-port $port_bootpc --destination-port $port_bootps ## Allow incoming ping. This is the only ICMP left. - run ip46tables -A inbound -j ACCEPT -p icmp + run iptables -A inbound -j ACCEPT -p icmp + run ip6tables -A inbound -j ACCEPT -p icmpv6 m4_divert(88)m4_dnl ## Allow unusual things. @@@ -151,8 -369,19 +152,8 @@@ openports inboun ## Inspect inbound packets from untrusted sources. run ip46tables -A inbound -j forbidden -run ip46tables -A INPUT -m mark --mark $from_scary/$MASK_FROM -g inbound run ip46tables -A INPUT -m mark --mark $from_untrusted/$MASK_FROM -g inbound -## Allow responses from the scary outside world into the untrusted net, but -## don't let untrusted things run services. -case $forward in - 1) - run ip46tables -A FORWARD -j ACCEPT \ - -m mark --mark $(( $from_scary | $to_untrusted ))/$(( $MASK_FROM | $MASK_TO )) \ - -m state --state ESTABLISHED,RELATED - ;; -esac - ## Otherwise process as indicated by the mark. for i in $inchains; do run ip46tables -A $i -m mark ! --mark 0/$MASK_MASK -j ACCEPT