Backed up some stuff the first

This commit is contained in:
famfo 2022-03-26 01:31:08 +01:00
parent 514a65cb34
commit 1806106b33
28 changed files with 3803 additions and 166 deletions

View file

@ -1,14 +1,26 @@
# RFC outlying the IP ranges used by the catgirls network
(Fuck the RFC, but I was bored)
---
### IP ranges used internally:
Peering with home networks:
| IP address | Range |
|----------------------------|----------------------------------------------------|
| 10.0.0.0/24 | 10.0.0.1 - 10.0.0.254 |
| fd42:deca:fbad::c0de:1/112 | fd42:deca:fbad::c0de:0 - fd42:deca:fbad::c0de:ffff |
| Purpose | IP address | Range |
|----------------------|----------------------------|----------------------------------------------------|
| Homenet peering IPv4 | 172.23.196.33/27 | 172.23.196.33 - 172.23.168.63 |
| Homenet peering IPv6 | fd42:deca:fbad::c0de:1/112 | fd42:deca:fbad::c0de:0 - fd42:deca:fbad::c0de:ffff |
| Homenet DNS IPv4 | 10.0.0.0/27 | 10.0.0.0 - 10.0.0.31 |
IPs assigned:
| Device | Local address | Dn42 IPv4 address | Dn42 IPv6 address |
|--------------|---------------|--------------------|------------------------|
| DNS server | 10.0.0.0 | - | - |
| famfo pc | 10.0.0.1 | 172.23.196.34 | fd42:deca:fbad::c0de:1 |
| lemon pc | 10.0.0.2 | 172.23.196.35 | fd42:deca:fbad::c0de:2 |
| famfo phone | 10.0.0.3 | 172.23.196.36 | fd42:deca:fbad::c0de:3 |
| famfo laptop | 10.0.0.4 | 172.23.196.37 | fd42:deca:fbad::c0de:4 |
| adam (univ) | 10.0.0.5 | 172.23.196.38 | fd42:deca:fbad::c0de:5 |
### IP ranges used externally
Dn42 addresses:
| Purpose | IP address | Range |
|--------------|----------------------------|-------------------------------------------|
| IPv6 peering | fd42:deca:fbad::1/112 | fd42:deca:fbad::1111:1 |

View file

@ -1,4 +1,4 @@
### thilo-alpine server config
- registry: [dn42 registry](https://git.dn42.dev/dn42/registry)
- registry at [dn42 registry](https://git.dn42.dev/dn42/registry)
- config: configuration for bird, dnsmasq and wireguard

View file

@ -5,41 +5,17 @@ define NETv4 = 172.23.196.32/27;
define NETv6 = fd42:deca:fbad::/48;
define NETSETv4 = 172.23.196.32/27;
define NETSETv6 = [fd42:deca:fbad::/48+];
define DN42_REGION = 41; # Europe
router id IPv4;
include "/etc/bird/config/functions.conf";
log "/tmp/bird.log" all;
roa4 table dn42_roa;
roa6 table dn42_roa_v6;
function is_self_net() {
return net ~ NETSETv4;
}
function is_valid_network() {
return net ~ [
172.20.0.0/14{21,29}, # dn42
172.20.0.0/24{28,32}, # dn42 Anycast
172.21.0.0/24{28,32}, # dn42 Anycast
172.22.0.0/24{28,32}, # dn42 Anycast
172.23.0.0/24{28,32}, # dn42 Anycast
172.31.0.0/16+, # ChaosVPN
10.100.0.0/14+, # ChaosVPN
10.127.0.0/16{16,32}, # neonetwork
10.0.0.0/8{15,24} # Freifunk.net
];
}
function is_self_net_v6() {
return net ~ NETSETv6;
}
function is_valid_network_v6() {
return net ~ [
fd00::/8{44,64} # ULA address space as per RFC 4193
];
}
protocol device {
scan time 10;
}
@ -70,24 +46,14 @@ protocol kernel {
protocol static {
roa4 { table dn42_roa; };
include "/etc/bird/dn42_roa_bird2_4.conf";
include "/etc/bird/roa/dn42_roa_bird2_4.conf";
};
protocol static {
roa6 { table dn42_roa_v6; };
include "/etc/bird/dn42_roa_bird2_6.conf";
include "/etc/bird/roa/dn42_roa_bird2_6.conf";
};
#protocol static {
# ipv4;
# route 172.20.53.97/32 via "wg0";
#}
#protocol static {
# ipv6;
# route fd80::ade0/124 via "wg0";
#}
protocol static {
route NETv4 reject;
ipv4 {
@ -104,34 +70,13 @@ protocol static {
};
}
template bgp dnpeers {
include "/etc/bird/config/community_filters.conf";
template bgp dn42_peer {
local as AS;
path metric 1;
ipv4 {
import filter {
if is_valid_network() && !is_self_net() then {
if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
reject;
} else accept;
} else reject;
};
export filter { if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; };
import limit 1000 action block;
};
ipv6 {
import filter {
if is_valid_network_v6() && !is_self_net_v6() then {
if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then {
print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
reject;
} else accept;
} else reject;
};
export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; };
import limit 1000 action block;
};
prefer older on;
enforce first as on;
advertise hostname on;
}
include "/etc/bird/peers/*";

View file

@ -0,0 +1,93 @@
# Stole from https://github.com/jlu5/ansible-dn42/tree/main/roles/config-bird2
# adapted for our general config (thanks jlu5 for sharing it)
#
# DN42 community filters. Based off https://dn42.net/howto/Bird-communities and tweaked
# for Bird 2
function update_latency(int link_latency) {
bgp_community.add((64511, link_latency));
if (64511, 9) ~ bgp_community then { bgp_community.delete([(64511, 1..8)]); return 9; }
else if (64511, 8) ~ bgp_community then { bgp_community.delete([(64511, 1..7)]); return 8; }
else if (64511, 7) ~ bgp_community then { bgp_community.delete([(64511, 1..6)]); return 7; }
else if (64511, 6) ~ bgp_community then { bgp_community.delete([(64511, 1..5)]); return 6; }
else if (64511, 5) ~ bgp_community then { bgp_community.delete([(64511, 1..4)]); return 5; }
else if (64511, 4) ~ bgp_community then { bgp_community.delete([(64511, 1..3)]); return 4; }
else if (64511, 3) ~ bgp_community then { bgp_community.delete([(64511, 1..2)]); return 3; }
else if (64511, 2) ~ bgp_community then { bgp_community.delete([(64511, 1..1)]); return 2; }
else return 1;
}
function update_bandwidth(int link_bandwidth) {
bgp_community.add((64511, link_bandwidth));
if (64511, 21) ~ bgp_community then { bgp_community.delete([(64511, 22..29)]); return 21; }
else if (64511, 22) ~ bgp_community then { bgp_community.delete([(64511, 23..29)]); return 22; }
else if (64511, 23) ~ bgp_community then { bgp_community.delete([(64511, 24..29)]); return 23; }
else if (64511, 24) ~ bgp_community then { bgp_community.delete([(64511, 25..29)]); return 24; }
else if (64511, 25) ~ bgp_community then { bgp_community.delete([(64511, 26..29)]); return 25; }
else if (64511, 26) ~ bgp_community then { bgp_community.delete([(64511, 27..29)]); return 26; }
else if (64511, 27) ~ bgp_community then { bgp_community.delete([(64511, 28..29)]); return 27; }
else if (64511, 28) ~ bgp_community then { bgp_community.delete([(64511, 29..29)]); return 28; }
else return 29;
}
function update_crypto(int link_crypto) {
bgp_community.add((64511, link_crypto));
if (64511, 31) ~ bgp_community then { bgp_community.delete([(64511, 32..34)]); return 31; }
else if (64511, 32) ~ bgp_community then { bgp_community.delete([(64511, 33..34)]); return 32; }
else if (64511, 33) ~ bgp_community then { bgp_community.delete([(64511, 34..34)]); return 33; }
else return 34;
}
function update_flags(int link_latency; int link_bandwidth; int link_crypto)
int dn42_latency;
int dn42_bandwidth;
int dn42_crypto;
{
dn42_latency = update_latency(link_latency);
dn42_bandwidth = update_bandwidth(link_bandwidth) - 20;
dn42_crypto = update_crypto(link_crypto) - 30;
# TODO: abstract this out into a config variable
if dn42_bandwidth > 4 then dn42_bandwidth = 4;
return true;
}
function dn42_import_filter(int link_latency; int link_bandwidth; int link_crypto) {
if net.type = NET_IP4 && is_valid_network() && !is_self_net() then {
if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then {
print "[dn42] ROA check failed for ", net, " - AS ", bgp_path.last;
reject;
}
} else if net.type = NET_IP6 && is_valid_network_v6() && !is_self_net_v6() then {
if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then {
print "[dn42] ROA check failed for ", net, " - AS ", bgp_path.last;
reject;
}
} else { # Invalid IP or unknown net type
reject;
}
update_flags(link_latency, link_bandwidth, link_crypto);
accept;
}
function dn42_export_filter(int link_latency; int link_bandwidth; int link_crypto) {
if (is_valid_network() || is_valid_network_v6()) then {
if source = RTS_STATIC || source = RTS_DEVICE then {
bgp_community.add((64511, DN42_REGION));
}
# Only export aggregated prefixes to peers
# TODO: implement
#if (is_self_net() && !is_self_net_aggr()) then {
# reject;
#}
# TODO: implement
#if (is_self_net_v6() && !is_self_net_aggr_v6()) then {
# reject;
#}
update_flags(link_latency, link_bandwidth, link_crypto);
accept;
}
reject;
}

View file

@ -0,0 +1,28 @@
function is_self_net() {
return net ~ NETSETv4;
}
function is_valid_network() {
return net ~ [
172.20.0.0/14{21,29}, # dn42
172.20.0.0/24{28,32}, # dn42 Anycast
172.21.0.0/24{28,32}, # dn42 Anycast
172.22.0.0/24{28,32}, # dn42 Anycast
172.23.0.0/24{28,32}, # dn42 Anycast
172.31.0.0/16+, # ChaosVPN
10.100.0.0/14+, # ChaosVPN
10.127.0.0/16{16,32}, # neonetwork
10.0.0.0/8{15,24} # Freifunk.net
];
}
function is_self_net_v6() {
return net ~ NETSETv6;
}
function is_valid_network_v6() {
return net ~ [
fd00::/8{44,64} # ULA address space as per RFC 4193
];
}

View file

@ -1,7 +1,14 @@
protocol bgp kioubit from dnpeers {
neighbor 172.20.53.97 as 4242423914;
}
protocol bgp kioubit_v6 from dnpeers {
protocol bgp kioubit from dn42_peer {
neighbor fe80::ade0%wg0 as 4242423914;
passive off;
ipv4 {
import where dn42_import_filter(1,24,33);
export where dn42_export_filter(1,24,33);
extended next hop on;
};
ipv6 {
import where dn42_import_filter(1,24,33);
export where dn42_export_filter(1,24,33);
};
}

View file

@ -0,0 +1,14 @@
protocol bgp tech9 from dn42_peer {
neighbor fe80::1588%wg1 as 4242421588;
passive off;
ipv4 {
import where dn42_import_filter(2,24,33);
export where dn42_export_filter(2,24,33);
extended next hop on;
};
ipv6 {
import where dn42_import_filter(2,24,33);
export where dn42_export_filter(2,24,33);
};
}

View file

@ -0,0 +1,14 @@
protocol bgp whojk from dn42_peer {
neighbor fe80::2717%wg2 as 4242422717;
passive off;
ipv4 {
import where dn42_import_filter(3,24,33);
export where dn42_export_filter(3,24,33);
extended next hop on;
};
ipv6 {
import where dn42_import_filter(3,24,33);
export where dn42_export_filter(3,24,33);
};
}

View file

@ -0,0 +1,14 @@
protocol bgp yuuta from dn42_peer {
neighbor fe80::2980%wg3 as 4242422980;
passive off;
ipv4 {
import where dn42_import_filter(2,24,33);
export where dn42_export_filter(2,24,33);
extended next hop on;
};
ipv6 {
import where dn42_import_filter(2,24,33);
export where dn42_export_filter(2,24,33);
};
}

File diff suppressed because it is too large Load diff

File diff suppressed because it is too large Load diff

View file

@ -108,7 +108,8 @@
#except-interface=
# Or which to listen on by address (remember to include 127.0.0.1 if
# you use this.)
#listen-address=
listen-address=127.0.0.1
listen-address=10.0.0.0
# If you want dnsmasq to provide only DNS service on an interface,
# configure it as shown above, and then use the following line to
# disable DHCP and TFTP on it.
@ -121,7 +122,7 @@
# want dnsmasq to really bind only the interfaces it is listening on,
# uncomment this option. About the only time you may need this is when
# running another nameserver on the same machine.
#bind-interfaces
bind-interfaces
# If you don't want dnsmasq to read /etc/hosts, uncomment the
# following line.
@ -678,6 +679,7 @@ conf-dir=/etc/dnsmasq.d/,*.conf
#dhcp-name-match=set:wpad-ignore,wpad
#dhcp-ignore-names=tag:wpad-ignore
server=/dn42/172.20.0.53
server=/frog/172.23.196.42
server=/20.172.in-addr.arpa/172.20.0.53
server=/21.172.in-addr.arpa/172.20.0.53
server=/22.172.in-addr.arpa/172.20.0.53

View file

@ -0,0 +1,6 @@
#!/bin/sh
curl -sfo /etc/bird/roa/dn42_roa_bird2_6.conf https://dn42.burble.com/roa/dn42_roa_bird2_6.conf
curl -sfo /etc/bird/roa/dn42_roa_bird2_4.conf https://dn42.burble.com/roa/dn42_roa_bird2_4.conf
birdc configure

View file

@ -1,25 +1,17 @@
# DN42 peer: Kioubit
[Interface]
PrivateKey = <Private Key>
ListenPort = 51420
PrivateKey = <PrivateKey>
Table = off
Address = fe80::ade1/64
PostUp = ip a add dev %i 192.168.219.209/32 peer 172.20.53.97/32
PostUp = ip a add dev %i 172.23.196.32/32
PostUp = ip a add dev %i fd42:deca:fbad::1/128 peer fe80::ade0/64
PostUp = ip a add dev %i fe80::ade1/64 peer fe80::ade0/64
PostUp = ip a add dev %i 172.23.192.42/32 # ns1.catgirls.dn42
PostUp = ip a add dev %i 172.23.196.42/32 # ns1.catgirls.dn42
PostUp = ip a add dev %i fd42:deca:fbad::1111:1/128 # ns1.catgirls.dn42
PostUp = sysctl -w net.ipv4.ip_forward=1
PostUp = sysctl -w net.ipv4.conf.%i.rp_filter=0
PostUp = sysctl -w net.ipv6.conf.%i.autoconf=0
[Peer]
Endpoint = de2.g-load.eu:21411
PublicKey = <Public Key>
AllowedIPs = fd00::/8, fe80::/64, 172.16.0.0/12, 192.168.219.0/24
PublicKey = <PublicKey>
AllowedIPs = fd00::/8, fe80::/64, 172.16.0.0/12, 192.168.219.209/27

View file

@ -0,0 +1,16 @@
# DN42 peer: tech9
[Interface]
PrivateKey = <PrivateKey>
Table = off
Address = fe80::100/64
PostUp = ip a add dev %i 172.23.196.32/32 peer 172.20.16.141/32
PostUp = ip a add dev %i fd42:deca:fbad::1/128 peer fe80::1588/64
[Peer]
Endpoint = de-fra02.dn42.tech9.io:50301
PublicKey = <PublicKey>
AllowedIPs = fd00::/8, fe80::/64, 172.16.0.0/12

View file

@ -0,0 +1,18 @@
# DN42 peer: whojk
[Interface]
ListenPort = 51421
PrivateKey = <PrivateKey>
Table = off
PostUp = ip a add dev %i 172.23.196.32/32 peer 169.254.42.66/24
PostUp = ip a add dev %i fe80::aaaa/64 peer fe80::2717/64
PostUp = sysctl -w net.ipv4.conf.%i.rp_filter=0
PostUp = sysctl -w net.ipv6.conf.%i.autoconf=0
[Peer]
Endpoint = nl.vm.whojk.com:23406
PublicKey = <PublicKey>
AllowedIPs = fd00::/8, fe80::/10, 172.16.0.0/12, 169.254.0.0/16

View file

@ -0,0 +1,16 @@
[Interface]
PrivateKey = <PrivateKey>
Table = off
PostUp = ip a add dev %i 172.23.196.32/32 peer 172.23.105.4/32
PostUp = ip a add dev %i fe80::1411/64
PostUp = sysctl -w net.ipv4.conf.%i.rp_filter=0
PostUp = sysctl -w net.ipv6.conf.%i.autoconf=0
[Peer]
Endpoint = fra1.de.dn42.yuuta.moe:21411
PresharedKey = <PresharedKey>
PublicKey = <PublicKey>
AllowedIPs = fd00::/8, fe80::/10, 172.16.0.0/12

View file

@ -0,0 +1,34 @@
# DN42 server
[Interface]
PrivateKey = <PrivateKey>
ListenPort = 51420
Address = 10.0.0.0/24
Address = fd42:deca:fbad::c0de:0/112
Address = 172.23.196.33/27
# famfo pc
[Peer]
PublicKey = <PublicKey>
AllowedIPs = 172.23.196.34/32, fd42:deca:fbad::c0de:1/128, 10.0.0.1/32
# lemon pc
[Peer]
PublicKey = <PublicKey>
AllowedIPs = 172.23.196.35/32, fd42:deca:fbad::c0de:2/128, 10.0.0.2/32
# famfo phone
[Peer]
PublicKey = <PublicKey>
AllowedIPs = 172.23.196.36/32, fd42:deca:fbad::c0de:3/128, 10.0.0.3/32
# famfo laptop
[Peer]
PublicKey = <PublicKey>
AllowedIPs = 172.23.196.37/32, fd42:deca:fbad::c0de:4/128, 10.0.0.4/32
# adam (univ)
[Peer]
PublicKey = <PublicKey>
AllowedIPs = 172.23.196.38/32, fd42:deca:fbad::c0de:5/128, 10.0.0.5/32

View file

@ -1,7 +0,0 @@
aut-num: AS4242421411
as-name: AS-C4TG1RL5-DN42
admin-c: C4TG1RL5-DN42
tech-c: C4TG1RL5-DN42
mnt-by: C4TG1RL5-MNT
org: ORG-C4TG1RL5
source: DN42

View file

@ -1,8 +0,0 @@
domain: catgirls.dn42
admin-c: C4TG1RL5-DN42
tech-c: C4TG1RL5-DN42
mnt-by: C4TG1RL5-MNT
org: ORG-C4TG1RL5
nserver: ns1.catgirls.dn42 172.23.196.42
nserver: ns1.catgirls.dn42 fd42:deca:fbad::1111:1
source: DN42

View file

@ -1,14 +0,0 @@
inet6num: fd42:deca:fbad:0000:0000:0000:0000:0000 - fd42:deca:fbad:ffff:ffff:ffff:ffff:ffff
cidr: fd42:deca:fbad::/48
netname: C4TG1RL5-NETWORK
descr: Catgirls! - DECAF BAD
country: DE
country: PL
country: US
admin-c: C4TG1RL5-DN42
tech-c: C4TG1RL5-DN42
mnt-by: C4TG1RL5-MNT
org: ORG-C4TG1RL5
status: ASSIGNED
nserver: ns1.catgirls.dn42
source: DN42

View file

@ -1,15 +0,0 @@
inetnum: 172.23.196.32 - 172.23.196.63
cidr: 172.23.196.32/27
netname: C4TG1RL5-NETWORK-IPV4
descr: Catgirls - legacy net
country: DE
country: PL
country: US
admin-c: C4TG1RL5-DN42
tech-c: C4TG1RL5-DN42
mnt-by: C4TG1RL5-MNT
org: ORG-C4TG1RL5
status: ASSIGNED
nserver: ns1.catgirls.dn42
source: DN42

View file

@ -1,6 +0,0 @@
mntner: C4TG1RL5-MNT
admin-c: C4TG1RL5-DN42
tech-c: C4TG1RL5-DN42
mnt-by: C4TG1RL5-MNT
source: DN42
auth: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJC7iwY7M820vt5RXrCQt0VPufulyVCTuTzO5oSpWM0R catgirls@dn42

View file

@ -1,6 +0,0 @@
organisation: ORG-C4TG1RL5
org-name: C4TG1RL5_UN1T3D
admin-c: C4TG1RL5-DN42
tech-c: C4TG1RL5-DN42
mnt-by: C4TG1RL5-MNT
source: DN42

View file

@ -1,7 +0,0 @@
person: C4TG1RL5-DN42
e-mail: lemon@lemonsh.moe
contact: xmpp:famfo@famfo.xyz
contact: xmpp:lemon@lemonsh.moe
nic-hdl: C4TG1RL5-DN42
mnt-by: C4TG1RL5-MNT
source: DN42

View file

@ -1,4 +0,0 @@
route: 172.23.196.32/27
origin: AS4242421411
mnt-by: C4TG1RL5-MNT
source: DN42

View file

@ -1,5 +0,0 @@
route6: fd42:deca:fbad::/48
origin: AS4242421411
max-length: 48
mnt-by: C4TG1RL5-MNT
source: DN42

View file

@ -1 +0,0 @@
La2frWnmVRoNj2Gs/n2IMwPGYDzLl6q4uP5OJKkHEnM=