Backup LXC config for moving to my server

LXC/config/bird/bird.conf

@@ -1,16 +1,38 @@
 define AS = 4242421411; 
+define IPv4 = 172.23.196.32;
 define IPv6 = fd42:deca:fbad::1;
+define NETv4 = 172.23.196.32/27;
 define NETv6 = fd42:deca:fbad::/48;
+define NETSETv4 = 172.23.196.32/27;
 define NETSETv6 = [fd42:deca:fbad::/48+];
 
 log "/var/log/bird.log" all;
+roa4 table dn42_roa;
 roa6 table dn42_roa_v6;
 
 function is_self_net() {
-  return net ~ NETSETv6;
+    return net ~ NETSETv4;
 }
 
 function is_valid_network() {
+    return net ~ [
+    	172.20.0.0/14{21,29}, # dn42
+    	172.20.0.0/24{28,32}, # dn42 Anycast
+    	172.21.0.0/24{28,32}, # dn42 Anycast
+    	172.22.0.0/24{28,32}, # dn42 Anycast
+    	172.23.0.0/24{28,32}, # dn42 Anycast
+    	172.31.0.0/16+,       # ChaosVPN
+    	10.100.0.0/14+,       # ChaosVPN
+    	10.127.0.0/16{16,32}, # neonetwork
+    	10.0.0.0/8{15,24}     # Freifunk.net
+    ];
+}
+
+function is_self_net_v6() {
+    return net ~ NETSETv6;
+}
+
+function is_valid_network_v6() {
     return net ~ [
         fd00::/8{44,64} # ULA address space as per RFC 4193
     ];
@@ -20,6 +42,18 @@ protocol device {
     scan time 10;
 }
 
+protocol kernel {
+    scan time 20;
+    ipv4 {
+        import none;
+        export filter {
+            if source = RTS_STATIC then reject;
+            krt_prefsrc = IPv4;
+            accept;
+        };
+    };
+}
+
 protocol kernel {
     scan time 20;
     ipv6 {
@@ -32,16 +66,34 @@ protocol kernel {
     };
 };
 
+protocol static {
+    roa4 { table dn42_roa; };
+    include "/etc/bird/dn42_roa_bird2_4.conf";
+};
+
 protocol static {
     roa6 { table dn42_roa_v6; };
     include "/etc/bird/dn42_roa_bird2_6.conf";
 };
 
+protocol static {
+    ipv4;
+    route 172.20.53.97/32 via "wg0";
+}
+
 protocol static {
     ipv6;
     route fd80::ade0/124 via "wg0";
 }
 
+protocol static {
+    route NETv4 reject;
+    ipv4 {
+        import all;
+        export none;
+    };
+}
+
 protocol static {
     route NETv6 reject;
     ipv6 {
@@ -53,16 +105,29 @@ protocol static {
 template bgp dnpeers {
     local as AS;
     path metric 1;
-    ipv6 {   
+    
+    ipv4 {
         import filter {
             if is_valid_network() && !is_self_net() then {
+            	if (roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID) then {
+              	    print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
+        	    reject;
+        	} else accept;
+            } else reject;
+        };
+        export filter { if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; };
+        import limit 1000 action block;
+    };
+    ipv6 {   
+        import filter {
+            if is_valid_network_v6() && !is_self_net_v6() then {
                 if (roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID) then {
                     print "[dn42] ROA check failed for ", net, " ASN ", bgp_path.last;
                     reject;
                 } else accept;
             } else reject;
         };
-        export filter { if is_valid_network() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; };
+        export filter { if is_valid_network_v6() && source ~ [RTS_STATIC, RTS_BGP] then accept; else reject; };
         import limit 1000 action block; 
     };
 }

LXC/config/bird/bird/peers/kioubit.conf

@@ -0,0 +1,7 @@
+protocol bgp kioubit from dnpeers {
+    neighbor 172.20.53.97 as 4242423914;
+}
+
+protocol bgp kioubit_v6 from dnpeers {
+    neighbor fe80::ade0%wg0 as 4242423914;
+}

LXC/config/bird/peers/kioubit.conf

@@ -1,3 +0,0 @@
-protocol bgp kioubit_v6 from dnpeers {
-        neighbor fe80::ade0%wg0 as 4242423914;
-}

LXC/config/wg_template.conf

@@ -1,12 +0,0 @@
-[Interface]
-PrivateKey = <Wireguard private key>
-ListenPort = 20103
-Adress = <link-local>
-PostUp = /sbin/ip a add dev %i <Our dn42 IP> peer <Peer dn42 IP>
-Table = off
-
-[Peer]
-Endpoint = <Peer IP:Port>
-PublicKey = <Peer public Wireguard key>
-AllowedIPs = 172.16.0.0/12, 10.0.0.0/8, fd00::/8. fe80::/10
-

LXC/config/wireguard/wg0.conf

@@ -2,16 +2,24 @@
 
 [Interface]
 FwMark = 42
-PrivateKey = <private key>
+PrivateKey = 
 ListenPort = 20103
 Table = off
+
+#Address = 192.168.219.209/27
 Address = fe80::ade1/48
-PostUp = ip a add dev %i fd42:deca:fbad::1/128 peer fe80::ade0/48
-PostUp = ip a add dev %i fd42:deca:fbad::1111:1/48
-PostUp = ip a add dev %i fd42:deca:fbad::1111:2/48
+
+#PostUp = ip a add dev %i 172.23.196.32/32 peer 172.20.53.97/32
+#PostUp = ip a add dev %i 172.23.196.42/32
+PostUp = ip a add dev %i fd42:deca:fbad::1/128 peer fe80::ade0/128
+PostUp = ip a add dev %i fd42:deca:fbad::1111:1/128
+
+#PostUp = sysctl -w net.ipv4.ip_forward=1
+#PostUp = sysctl -w net.ipv4.conf.default.rp_filter=0
 PostUp = sysctl -w net.ipv6.conf.%i.autoconf=0
 
 [Peer]
 Endpoint = de2.g-load.eu:21411
 PublicKey = B1xSG/XTJRLd+GrWDsB06BqnIq8Xud93YVh/LYYYtUY=
-AllowedIPs = fd00::/8, fe80::/10
+AllowedIPs = fd00::/8, fe80::/10, 10.0.0.0/8, 172.16.0.0/12
+

LXC/config/wireguard/wg0_4.conf

@@ -0,0 +1,19 @@
+# DN42 peer: Kioubit
+
+[Interface]
+FwMark = 42
+PrivateKey = 
+ListenPort = 20103
+Table = off
+
+Address = 192.168.219.209/27
+
+PostUp = ip a add dev %i 172.23.196.32/32 peer 172.20.53.97/32
+PostUp = ip a add dev %i 172.23.196.42/32
+
+PostUp = sysctl -w net.ipv4.conf.default.rp_filter=0
+
+[Peer]
+Endpoint = de2.g-load.eu:21411
+PublicKey = B1xSG/XTJRLd+GrWDsB06BqnIq8Xud93YVh/LYYYtUY=
+AllowedIPs = 172.16.0.0/12, 192.168.219.0/24