From 473d7aa05a512df75c15380d5c9db5aa3e2c8917 Mon Sep 17 00:00:00 2001 From: Gregor Michels Date: Wed, 18 Jan 2023 00:35:25 +0100 Subject: [PATCH] sax-rgs-gw-core01: add laundering client network v4 works, v6 is still a work in progress launder: * v4 through mullvad * v6 through mowoe --- password-store/wg/wg4/core.mowoe.com.pub.gpg | Bin 0 -> 1681 bytes password-store/wg/wg4/sax-rgs-gw-core01.gpg | Bin 0 -> 1677 bytes password-store/wg/wg5/mullvad.pub.gpg | Bin 0 -> 1645 bytes password-store/wg/wg5/sax-rgs-gw-core01.gpg | Bin 0 -> 1645 bytes .../sax-rgs-gw-core01/etc/config/dhcp | 16 ++++++ .../sax-rgs-gw-core01/etc/config/firewall | 36 ++++++++++++++ .../sax-rgs-gw-core01/etc/config/network | 46 ++++++++++++++++++ .../sax-rgs-gw-core01/etc/iproute2/rt_tables | 13 +++++ 8 files changed, 111 insertions(+) create mode 100644 password-store/wg/wg4/core.mowoe.com.pub.gpg create mode 100644 password-store/wg/wg4/sax-rgs-gw-core01.gpg create mode 100644 password-store/wg/wg5/mullvad.pub.gpg create mode 100644 password-store/wg/wg5/sax-rgs-gw-core01.gpg create mode 100644 templates/gateways/sax-rgs-gw-core01/etc/iproute2/rt_tables diff --git a/password-store/wg/wg4/core.mowoe.com.pub.gpg b/password-store/wg/wg4/core.mowoe.com.pub.gpg new file mode 100644 index 0000000000000000000000000000000000000000..19ec1e0fb946b2165503cf4b021b8c578183e553 GIT binary patch literal 1681 zcmV;C25$L<0gMAuv2e?Nuf@Ru3;$Z8j&1N%W^Ltk!@`S}dEX$~mq{=3w4u}1M_Bg{ z;LXLZD>E!WH-fyx-@f8wR~{lz8z0jmi^Q>PF0gh_XBV`mud;GWW5CW|H*u<$EL>t? z-=+#_DxQ2)+PqaA{x2AtDVmV}MsNmt=co`vPNHsi5D`MC62d=ODH8@nN9j>N0Nrme zOG9xotL);c-N-A@SMw9Ohv_ND-m_Yiqo`UKi$kxy2}}oi`gRM-z>IQ)woo3Z`Hhg1 zVeLR6ZlP5?r>?Zw3|Qv~PI?O(t%O9$A+y{$V<&*))Y>kjVD=Nw2;gl9J3dLLn5}0> zl{(7tpEN?KQ4uJcr2sMyXS!2E{t6&XERVM{QhAir?ISKu?vADwFQ%)=K!-wbDO&0pWtiePrwCA!BY_%v~S?dyA739H5C?`kRFU30LiWrCOo_Ol92CJIP2-b88bzIVx76q*zDl|km>pLrMg7xgwY$^gu#gsW z!4V%cIJIOfakxP*0DgOud^x}AC>n9Jyo(?mxNm+VzWAtoA+4J%rMoWC{*`HBaKrqw zw2ynQHuGA76bBYe1K0v~F!OvMrIGVZt{y1oEQe1}Z_;+zl&FRzL%}RS5UUJue9!Kn zPLFR~aaOc5^Kq7CFM&;!CQ>?>2OzpASG{)Z`9l20?AS$X`SnXuf97p7pB(>UJI#0> z@CDKmDq;jb7sSPyvT4D`9>C8?20usE64nzw>3Bh>esixeF2t0Mh#u(%Iv+Fq7+`h^ zy@m9H@8U`pV7U$7S+$s&*iwJf1hnpHN}(|1aC0Y17D7n-;`sQeX9m9j3~i)4mTe2l z^A>A7fJ%-8-EDSn^E-M@@t`^ju*?nd?ZEwQt`cce>La5qbB!^@ilU6~?p|bn@+b^e*fzQUgJIzNW-ZHMhQSdm}?nf{av4<08)d zRrcjX9eZs>5V~sR6d!%N)q7QF>1TGh{D05nF z_*y30txpa_HS_AgBz|b*Ss4$*URh%V-7{fh)DAqtOU(O#qt5zuRO{d}&`-UP2;SrB z-1L|T%l&=}vr7dL20xsa0-?Bu$@fzuk{?oE7Q0epp)!G($OVcK1eaJ9RnQ;Q1+~ZA zhDty~KpPDZ=c|zqrZB!o7k!daIMWf8!RLtgBUKIkM{PT@OO3tD8#;cryT#-Cl3K$@ z=_g@lCA8(YJv3UB7>nMAXSkT}nij$a_Yod|Jw8r59>*X%^Jd?@5G6~!BqXIl zRvl_*o20@*zQ^wbX17OisP1jH1KnTWjzFvW4!vqZ&Bt^Y*ISl;&qp`rBZMnWC1GtK z507~-DR<@NihA;sP5WN{;t4YcqHaLJ4nZ-W;(YE8`>9q+*8`j(t_bKA-6K-51qSN89WJw2YN!AB)F=SVZo{V0p^WRz&-lXNN_^{(_WMMn_-WAo#-&DV=mgRuEVKzpD z8GmTd`VI5J)}*S1*0M=(B4&4K7>h3?X{#|-)UJQLYMh?Sm>d9tGik!mf2jJq? z^gya%w~t0)dlGEjMxNAMSl4O-=H%`L8VtB_S5vkVG@F5~02RcpNwL}?$ZFqbIgST3-q9w)@oHQ*>mjolkb z`l`n3@;c%!g+k=EuQ{!IehI+dzKenuXduz!5YJ?EtAkDB9r=lKNXu;@prk-~Q6o&( zmKjrZ=v0(z7e%Y~4%DhsHAD2fXD43|S4wTQyb#$m&uSxz%qTkEDO{p_KOXHs>lfaa z^eP!55kJAkH)zIakbW{JSt{jZOOiu^*3cJFmAK(GdzaJuze{9B2*EN znNMzcoYKBnYFvC{Lt;jPw8Z_S530eTCf;nFZ#nrcl^P()mr`A*QwZ(#opJobH-ugT z472IsUB_Hf5&;K5MH9|k4Agrs2m1iIARCL{C-*?U9)N17f1kL7Yn-aj zw+ild2|c$#^PczK&ZLr)&_o#Ib$QBT@5_c;5w0&i(dhz8yzJHjD}@3K1E0ZPC02X0 z!T}HeM%!gK(HnaFb%2+r?)E00VP(Y)JK+qKOmqo(VvPjE_-jhYStxR{0JS&$5G!d= zP4NJtBJcpRKX0u)U@g~-3s9H8V3U!69ecSV&S10vd;lm#%Szwq`#01~_4g*OQbh#! z=u|l-9Ba;CmvlsSCX%7V+1rEz2bi9uV}Ks~+~a`Jmb(!v*&6(uliW0W=PEEW^~h-Y z16<$(JYO1&3A6XO5l{m4B!-^1{|za7rh1HB&Jo&C%&#Ffj+p4%PoE5v$Oe4*9egqW z)ob%uW=HHxf7)5jx7#U0@zy$ZWs6I8UgWOE-bV^+CCTjm3yWgnS4#Ib+`f$eACita z&;FE?f9c?!e80-p!HH|GzCe`R^4E?L-!evLt=-E ziMwP`Z5y-vw^e>I2x!c;kAZ0iBM**`v$_@ucK5l6}|1szcfbNFFCBI$q?j{ zHm!Z>`|js XO`nQ;Dv-It67xu+t0~R3LveDrX*xB0dKNwZH^( zo6&zX$`bOuMbmn5@1N6S1wc2AGj5C$rsBEIRX#joSn9!&f2r+9P5=Yo1<=2pO8&h#=T2p+s*2GXzZ&cCyX&v7Gtdvrh zu$li`>uS`Hg%{aRT!HSF@63X&WR~&82;iS)G}eeyoePjnQ>4G_wBZWl3D8F5>ma-na#KloB z9;%K>+%wM6Zd$e%HIdKC-OB=&#gy*vTnPL1@P(&X_w!$ICg+B0Ddi^9Ct-_Y4?c6% z8FNa%p!)fHck;&PH6y#h1+`P(K?d*IiFzKIZALhrl-m_pFyo+XQju>C_qZTS{gJ?- zxj2O~<+VjS0Nc`oGX?5vu+fJZ>}sk;JpGTSqT9^Od%eW8ntDk}@)?B!3C^26^?TFqDk6-_d(DiEcb7KU_Kr-wb=?}o(BWk?Ec@LN) z1?}4ouf^YOo-Xz~+4C*spv@dP4{l$S4MpO@Ewm+)E7ajQsyt6c$rUQR8nf_n`$pU3oqHb%W8VOk)t-xwS$;-Vo8)EDT1ND;u&!p5@PxF0BMht|&e-%eo zr|hQitHaqt&BT>GVb6(N${wxvxeeShb*L~?drE%opZ+Y;Hdmg$J@cEljj`05ar~fR z5Xa_A5iyi!`<9A5llN3+1jI`b_W0%YwEe_Q0T24&NJD>;~!bjAoU_ed?;GR;s;%U`#cHn)hKcsBdtk-3Jp|&dMH`twZ0qk^x*f<=gD_1i8zMgWSuJ=X_4=o-SQYSuiWPlR| z+o=?A_kv?eoO2dyXJc=ys%2y+ivd#JQyxCFjYVisT7maNoFiYwy~Ci#0!L>;U4&i( z472IsUB_Hf5&;K5Tl!kb|2#j}YfT#OKip?tOiX$|+E|`1^~M>38TGYU8GZ?t3<(Fa)3^JgHH88U1E0ZPC02X0 z!T}HdH3a6@iSUGjFgyJxcTBf2gwOdaEumA6k&wT3AI#p%{X1&S#E_?8vF9hApQZ^% zSwcJH`}Uas3o$R*F&2j8Ojpm3Hu+21Mk@uuh@=Y6r&MmH>ega017K2aO{jqn-gK8O~^d;^jeu|n5?dy zTE#+0Xkr0krcy4Z^SPB2s0%cOjBl;xykVB5E)P;S4|$S#!unV6CKVZknQXQ$7Q!7S z=TKapPH8RigaEzJXube$ii*~Xe}mdom?3%1QmrxESV^uT*Px8>&vx)5;Z`T^zHK=e z6-*DKD3GlmuQQB7g<()n(nc9<#pzs1MC=wSsV^|V4`>l(3GEuaOirnbIfBP1s)1_J zsz~MHQ9bF63tp511CdyMuQ6?pfhHAb*o0~um{NFm^Ew?v2GITz_lI|T3$t={If{x= zwn~|PhIL&!yV}e;iZp*Iqw&Y!V%zjk&_#3RXuzf^k#WU6RhT+|`+=+^Cd$g`P5U8A z9yj)^1tB%>svuio0r^IZh)d3iKuak(1LpJ#Yw%@T%<_HpOT;;N8!y@qbgwqW`n r%I>ZJ=0BseN-jFVJ5j(^FjFDd*pC>UwA?%7*INa*0Y!%^{;IPviC#3z literal 0 HcmV?d00001 diff --git a/password-store/wg/wg5/sax-rgs-gw-core01.gpg b/password-store/wg/wg5/sax-rgs-gw-core01.gpg new file mode 100644 index 0000000000000000000000000000000000000000..727efe8992689777691bfebde3bd3fcc19a2fd10 GIT binary patch literal 1645 zcmV-z29o)O0gMAuv2e?Nuf@Ru3;@3(4l~LYPd~F1_L)}BW2b#J~J_ij~Xfw?At-fHyV9%164^75QGM`C=5I3(tu3fB*FrWbYhTc%vPFvB~^+ct|o za01vs?BuVd;VLzYMnxq@d!cd)>>L(yfsamv=ETEXol?K$%t+t~E;W1*Lq~6MG4u-l zr;aBxB9B`rC2{6j+k$$N|CuW9JqUl@M*CI3R86I}=ue4VOM)b|_9^Ei1!O?3Inyo~2CdK9yF6cW_Uc zGHf^Hz#C78+IJ_N4?=UdErAT%u7Z(UT#t#+s_E^9)q^-~W)pBii1}i;+hZ2!T-$Ig z@$F^qX8&fZbO7$%P+l1i)}NZvq*)f!ptE@a2HfgsX!)>PJE@>Y38Cg<@IRiu(I0AQ zj*lj^V3A{m_Z1@RosJT3MpO;(Iz`~xa)!t6s-h2mEZO}ePRrs^50jz(_a%x=^)2ds zs?oRFh@i?&zoO?Kj|{C7ZT&NgrYGiVi~JyUW5h~Gsohzskvma72l0f!f{7-reg$V7 zu#^p3p1ha-Ltj?I&LI3`;kel=b+HTn;sC8K1P$EZvLw!`Md;N0{NFzw!mxv($JmPm&YwaiM+l%k+901Ww*_L*UM1=wj1E0ZPC02X0 z!T}HfgB-JcOU5J8F$#F#YHqo?CpY|lh9=gEcxQzcvSQMvNm zvkoukUqL%0xC^(f6X2G3!`n(kEOu)o+7w<*mnkvPX?4m%@+R;spk+?UqZnf-R7d#L%ud#&%|{HJ@-@B}Wj%bt4GS?sw6pdl zLf=48gMNC$_ML6JyW8GPBhycv+jypSBEpu z%W*&dc-N;ElU}01;K;Mn8BB@XvU}uErP^o+2lp`2-2FQ>(V7ys&Nmf_ij%nr%I?mD z4&AVs=E~*Ro7s=J%ieAz;J(C|a@%O{U}G#~`hO4G?d8E)gR$B)!UhUH)vhP`AAn`= zS!rSQ6&0IHqf7fqsXZa(&i{lBCryr@8@tcfXQ$_O9{A`NRc2Ip3gz&|_xfsEO>q_H zi*Y>x!#+bpYNA2p(|~B1R>+-~i%{ z9_pw%E>eAZ52^1X{W%E83HwVJ54)y*DA@sqkF^8+KiRhiS4df*s!n@jj)-<<4IpFK_s&@(p~|+ zFB_h>s;DTqg}~wpaAYNld3ieF04^KpZugpvK0JDOWdVVe}x7 literal 0 HcmV?d00001 diff --git a/templates/gateways/sax-rgs-gw-core01/etc/config/dhcp b/templates/gateways/sax-rgs-gw-core01/etc/config/dhcp index 7cb176a..922ba79 100644 --- a/templates/gateways/sax-rgs-gw-core01/etc/config/dhcp +++ b/templates/gateways/sax-rgs-gw-core01/etc/config/dhcp @@ -30,6 +30,22 @@ config dhcp 'mgmt' list ra_flags 'managed-config' list ra_flags 'other-config' +config dhcp 'clients' + option interface 'clients' + # from: 10.86.4.2 + # to: 10.86.7.254 + # start: 2 + # limit: 1020 + option start '2' + option limit '1020' + option leasetime '12h' + option dhcpv4 'server' + option dhcpv6 'server' + option ra 'server' + option ra_slaac '1' + list ra_flags 'managed-config' + list ra_flags 'other-config' + config dhcp 'backoffice' option interface 'backoffice' option start '100' diff --git a/templates/gateways/sax-rgs-gw-core01/etc/config/firewall b/templates/gateways/sax-rgs-gw-core01/etc/config/firewall index 2d82ed3..dc51b8d 100644 --- a/templates/gateways/sax-rgs-gw-core01/etc/config/firewall +++ b/templates/gateways/sax-rgs-gw-core01/etc/config/firewall @@ -13,6 +13,13 @@ config zone option output ACCEPT option forward REJECT +config zone + option name clients + list network clients + option input REJECT + option output ACCEPT + option forward REJECT + config zone option name backoffice list network 'backoffice' @@ -20,6 +27,20 @@ config zone option output ACCEPT option forward REJECT +config zone + option name launder + list network wg4 + list network wg5 + option input REJECT + option output ACCEPT + option forward REJECT + option masq 1 + option mtu_fix 1 + +config forwarding + option src clients + option dest launder + config zone option name backbone list network wg3 @@ -27,6 +48,21 @@ config zone option output ACCEPT option forward REJECT + config rule + option name CLIENTS_Allow-DHCP + option src clients + option proto udp + option dest_port 67-68 + option target ACCEPT + option family ipv4 + +config rule + option name CLIENTS_Allow-DNS + option src clients + option proto udp + option dest_port 53 + option target ACCEPT + config rule option name From-BACKBONE-Allow-OSPF option src backbone diff --git a/templates/gateways/sax-rgs-gw-core01/etc/config/network b/templates/gateways/sax-rgs-gw-core01/etc/config/network index 99bce33..13a2916 100644 --- a/templates/gateways/sax-rgs-gw-core01/etc/config/network +++ b/templates/gateways/sax-rgs-gw-core01/etc/config/network @@ -71,6 +71,12 @@ config interface 'wan6' option device 'switch.3' option proto 'dhcpv6' +config interface 'clients' + option device 'switch.2' + option proto 'static' + option ipaddr '10.86.4.1' + option netmask '255.255.252.0' + config interface 'backoffice' option device 'switch.8' option proto 'static' @@ -93,3 +99,43 @@ config wireguard_wg3 'eap_adp_jump01' option route_allowed_ips '0' option persistent_keepalive 15 list allowed_ips '0.0.0.0/0' + +config interface 'wg4' + option proto 'wireguard' + option private_key "{{ lookup('passwordstore', 'wg/wg4/sax-rgs-gw-core01') }}" + list addresses 'fe80:2131:27:189::2/64' + option disabled '0' + +# routes 2a0e:8f02:f000:2e61::1/64 to the link-local of wg4 +config wireguard_wg4 'core_mowoe_com' + option public_key "{{ lookup('passwordstore', 'wg/wg4/core.mowoe.com.pub') }}" + option endpoint_host 'core.mowoe.com' + option endpoint_port '51821' + option route_allowed_ips '0' + option persistent_keepalive 15 + list allowed_ips '::/0' + +config interface 'wg5' + option ip4table 'launder' + option proto 'wireguard' + option private_key "{{ lookup('passwordstore', 'wg/wg5/sax-rgs-gw-core01') }}" + list addresses '10.67.171.28' + option disabled '0' + +config wireguard_wg5 'mullvad' + option public_key "{{ lookup('passwordstore', 'wg/wg5/mullvad.pub') }}" + option endpoint_host '146.70.117.162' + option endpoint_port '51820' + option route_allowed_ips '1' + option persistent_keepalive 15 + list allowed_ips '0.0.0.0/0' + +config rule + option in 'clients' + option lookup 'launder' + option priority 50 + +config rule + option in 'clients' + option action prohibit + option priority 51 diff --git a/templates/gateways/sax-rgs-gw-core01/etc/iproute2/rt_tables b/templates/gateways/sax-rgs-gw-core01/etc/iproute2/rt_tables new file mode 100644 index 0000000..cb61684 --- /dev/null +++ b/templates/gateways/sax-rgs-gw-core01/etc/iproute2/rt_tables @@ -0,0 +1,13 @@ +# +# reserved values +# +128 prelocal +255 local +254 main +253 default +0 unspec +20 launder +# +# local +# +#1 inr.ruhep