Toller Commit
This commit is contained in:
parent
48c5bf9a79
commit
5864ead4b8
338
conf.conf
Normal file
338
conf.conf
Normal file
@ -0,0 +1,338 @@
|
||||
interfaces {
|
||||
ethernet eth0 {
|
||||
address 5.9.220.113/29
|
||||
description WAN
|
||||
}
|
||||
ethernet eth1 {
|
||||
address 172.16.7.1/24
|
||||
description "Freifunk WAN"
|
||||
}
|
||||
loopback lo {
|
||||
address 185.66.193.107/32
|
||||
}
|
||||
tunnel tun0 {
|
||||
address 100.64.6.25/31
|
||||
address 2a03:2260:0:30c::2/64
|
||||
description gre_bb_a_ak_ber
|
||||
encapsulation gre
|
||||
remote 185.66.195.0
|
||||
source-address 5.9.220.113
|
||||
}
|
||||
tunnel tun1 {
|
||||
address 100.64.6.31/31
|
||||
address 2a03:2260:0:30f::2/64
|
||||
description gre_bb_b_ak_ber
|
||||
encapsulation gre
|
||||
remote 185.66.195.1
|
||||
source-address 5.9.220.113
|
||||
}
|
||||
tunnel tun2 {
|
||||
address 100.64.6.29/31
|
||||
address 2a03:2260:0:30e::2/64
|
||||
description gre_bb_a_ix_dus
|
||||
encapsulation gre
|
||||
remote 185.66.193.0
|
||||
source-address 5.9.220.113
|
||||
}
|
||||
tunnel tun3 {
|
||||
address 100.64.6.35/31
|
||||
address 2a03:2260:0:311::2/64
|
||||
description gre_bb_b_ix_dus
|
||||
encapsulation gre
|
||||
remote 185.66.193.1
|
||||
source-address 5.9.220.113
|
||||
}
|
||||
tunnel tun4 {
|
||||
address 100.64.6.27/31
|
||||
address 2a03:2260:0:30d::2/64
|
||||
description gre_bb_a_fra3_f
|
||||
encapsulation gre
|
||||
remote 185.66.194.0
|
||||
source-address 5.9.220.113
|
||||
}
|
||||
tunnel tun5 {
|
||||
address 100.64.6.33/31
|
||||
address 2a03:2260:0:310::2/64
|
||||
description gre-bb-b.fra3.f
|
||||
encapsulation gre
|
||||
remote 185.66.194.1
|
||||
source-address 5.9.220.113
|
||||
}
|
||||
}
|
||||
nat {
|
||||
destination {
|
||||
rule 1 {
|
||||
description "Allow SSH to VPN-01 Port 2222"
|
||||
destination {
|
||||
address 185.66.193.107/32
|
||||
port 2222
|
||||
}
|
||||
inbound-interface any
|
||||
protocol tcp
|
||||
translation {
|
||||
address 172.16.7.2
|
||||
port 22
|
||||
}
|
||||
}
|
||||
rule 2 {
|
||||
description "Wireguard VPN-01 42001"
|
||||
destination {
|
||||
address 185.66.193.107
|
||||
port 42001
|
||||
}
|
||||
inbound-interface any
|
||||
protocol udp
|
||||
translation {
|
||||
address 172.16.7.2
|
||||
}
|
||||
}
|
||||
}
|
||||
source {
|
||||
rule 1 {
|
||||
outbound-interface any
|
||||
source {
|
||||
address 172.16.7.0/24
|
||||
}
|
||||
translation {
|
||||
address 185.66.193.107
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
policy {
|
||||
local-route {
|
||||
rule 10 {
|
||||
set {
|
||||
table 42
|
||||
}
|
||||
source 5.9.220.113
|
||||
}
|
||||
}
|
||||
prefix-list FFRL-IN {
|
||||
rule 10 {
|
||||
action permit
|
||||
prefix 0.0.0.0/0
|
||||
}
|
||||
}
|
||||
prefix-list FFRL-OUT {
|
||||
rule 10 {
|
||||
action permit
|
||||
prefix 185.66.193.107/32
|
||||
}
|
||||
}
|
||||
route-map FFRL-IN {
|
||||
rule 10 {
|
||||
action permit
|
||||
match {
|
||||
ip {
|
||||
address {
|
||||
prefix-list FFRL-IN
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
route-map FFRL-OUT {
|
||||
rule 10 {
|
||||
action permit
|
||||
match {
|
||||
ip {
|
||||
address {
|
||||
prefix-list FFRL-OUT
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
protocols {
|
||||
bgp {
|
||||
address-family {
|
||||
ipv4-unicast {
|
||||
network 185.66.193.107/32 {
|
||||
}
|
||||
}
|
||||
}
|
||||
neighbor 100.64.6.24 {
|
||||
address-family {
|
||||
ipv4-unicast {
|
||||
route-map {
|
||||
export FFRL-OUT
|
||||
import FFRL-IN
|
||||
}
|
||||
}
|
||||
}
|
||||
description ffrl_bb_a_ak_ber
|
||||
remote-as 201701
|
||||
update-source 100.64.6.25
|
||||
}
|
||||
neighbor 100.64.6.26 {
|
||||
address-family {
|
||||
ipv4-unicast {
|
||||
route-map {
|
||||
export FFRL-OUT
|
||||
import FFRL-IN
|
||||
}
|
||||
}
|
||||
}
|
||||
description ffrl_bb_a_fra3_fra
|
||||
remote-as 201701
|
||||
update-source 100.64.6.27
|
||||
}
|
||||
neighbor 100.64.6.28 {
|
||||
address-family {
|
||||
ipv4-unicast {
|
||||
route-map {
|
||||
export FFRL-OUT
|
||||
import FFRL-IN
|
||||
}
|
||||
}
|
||||
}
|
||||
description ffrl_bb_a_ix_dus
|
||||
remote-as 201701
|
||||
update-source 100.64.6.29
|
||||
}
|
||||
neighbor 100.64.6.30 {
|
||||
address-family {
|
||||
ipv4-unicast {
|
||||
route-map {
|
||||
export FFRL-OUT
|
||||
import FFRL-IN
|
||||
}
|
||||
}
|
||||
}
|
||||
description ffrl_bb_b_ak_ber
|
||||
remote-as 201701
|
||||
update-source 100.64.6.31
|
||||
}
|
||||
neighbor 100.64.6.32 {
|
||||
address-family {
|
||||
ipv4-unicast {
|
||||
route-map {
|
||||
export FFRL-OUT
|
||||
import FFRL-IN
|
||||
}
|
||||
}
|
||||
}
|
||||
description ffrl_bb_b_fra3_fra
|
||||
remote-as 201701
|
||||
update-source 100.64.6.33
|
||||
}
|
||||
neighbor 100.64.6.34 {
|
||||
address-family {
|
||||
ipv4-unicast {
|
||||
route-map {
|
||||
export FFRL-OUT
|
||||
import FFRL-IN
|
||||
}
|
||||
}
|
||||
}
|
||||
description ffrl_bb_b_ix_dus
|
||||
remote-as 201701
|
||||
update-source 100.64.6.35
|
||||
}
|
||||
parameters {
|
||||
router-id 10.188.255.7
|
||||
}
|
||||
system-as 65066
|
||||
}
|
||||
static {
|
||||
table 42 {
|
||||
route 0.0.0.0/0 {
|
||||
next-hop 5.9.220.112 {
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
service {
|
||||
dhcp-server {
|
||||
listen-address 172.16.7.1
|
||||
shared-network-name freifunk {
|
||||
subnet 172.16.7.0/24 {
|
||||
default-router 172.16.7.1
|
||||
name-server 1.1.1.1
|
||||
name-server 1.0.0.1
|
||||
range dhcp {
|
||||
start 172.16.7.10
|
||||
stop 172.16.7.200
|
||||
}
|
||||
static-mapping vpn-01 {
|
||||
ip-address 172.16.7.2
|
||||
mac-address 36:f3:82:18:9b:03
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
ntp {
|
||||
allow-client {
|
||||
address 0.0.0.0/0
|
||||
address ::/0
|
||||
}
|
||||
server time1.vyos.net {
|
||||
}
|
||||
server time2.vyos.net {
|
||||
}
|
||||
server time3.vyos.net {
|
||||
}
|
||||
}
|
||||
ssh {
|
||||
port 22
|
||||
}
|
||||
}
|
||||
system {
|
||||
config-management {
|
||||
commit-revisions 100
|
||||
}
|
||||
conntrack {
|
||||
modules {
|
||||
ftp
|
||||
h323
|
||||
nfs
|
||||
pptp
|
||||
sip
|
||||
sqlnet
|
||||
tftp
|
||||
}
|
||||
}
|
||||
console {
|
||||
device ttyS0 {
|
||||
speed 115200
|
||||
}
|
||||
}
|
||||
host-name 7.fftdf.de
|
||||
login {
|
||||
banner {
|
||||
post-login "Welcome to the core Freifunk Router for Troisdorf!\n\nEnjoy it while you are here!\n"
|
||||
}
|
||||
user vyos {
|
||||
authentication {
|
||||
encrypted-password $6$WJiQoTPHLN8qj3s2$3vPtbSA48u8axMRDuOTaH4Hzg6kUuUJ8rkNuuSBacLfJ3YKRhDu5q4hxyhYr22n9F7E5NtovDM3A1.Ahpralf0
|
||||
plaintext-password ""
|
||||
public-keys nils {
|
||||
key AAAAB3NzaC1yc2EAAAADAQABAAACAQCvwA3/NDj7Oo28Q1XdRIgOp//35gFVvsDa1dnMkgRDqJYvlIDbRiQ+UIcgu5YhstPb8BAxfvqjRP4rnMKc7v69T2Lp+HOMx+1sOYrznEe2hC5lPr4+U1u4Fzqhq/keSoItifmdTgrE+01Zc5jMBosUIm79TDgEMuEGcYVJIyAzDv9ez4u+Bz/HubRO+qT/+UmOICEg9m/C+fiH/ZAJHi90dMsj7RF5YXrRHXTAdiecurwGAZx2Adug1fFTvzB1pqBUHje1PFtEI+LheYklpNtiJo8NQ2KDEiavSxBibJrywzQHaddf0bkeAhmiNY8PRoMpMNeiu94DyNFWgdm7bLzdzrN/o5U7MlnJlcn8D1tLtdp0ngTxaN6VIywI8mQ/Ukxz8p2Ce49vu6osz4CvYhKx4mrvOSmqg9VjKcL6/rIwK7y5CWgIrddktxrSpUHXkzoQSefgZ5Bnu3CNp0GixWV5JTHnFxCulJAGi3TTqx7IvsJ8gpuKkeGnIgnDhFbqVOKeEEnR13tTCJ7MgPQ+VHREQ68u73a5TfDxJd/ggnG4tQ67HOcqxwa74+X1lv7YiJ3AvbrR7FFPNM3o5N8ZmZWhBLDaUHrjElHkZdB/V2l2bCblWhD0INCYoskuK1dFGdf3gQQeKOivGzKtzI0xNKutrxfvarkikxCEV3Exj889rQ==
|
||||
type ssh-rsa
|
||||
}
|
||||
public-keys stefan {
|
||||
key AAAAB3NzaC1yc2EAAAADAQABAAABAQDM0d9uUUdkK80fYEAz+IwxbhQO2qsr87Q4uxxwqQCvjVWryL+IuKMBJJGroWDMz2d9UJcIXEYdMz4436U0DoPJuoXe5iDsVvum3Vz3276My+tqx1bZWCktPa8Isft7mO/wfELNjRNQduUiwh2y712s7/3GQI+5Rs/65HuLHTnpLKrlfptqmsmYw+IUFDzGwBLJ6sqP90ywjKkperPCAH3IWcTsQwnW3EJFPToMg6BrQslZlxx/z+co3e6jCWzUuuIRP9jp4SmNVfYaVGb1cOFdL1p1P0qWHBHdGUnXHZ+c773VKVSj+spUBxKGqNC1EhRCYTsPDLVrYrhKl2BRLcgB
|
||||
type ssh-rsa
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
syslog {
|
||||
global {
|
||||
facility all {
|
||||
level info
|
||||
}
|
||||
facility protocols {
|
||||
level debug
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// Warning: Do not remove the following line.
|
||||
// vyos-config-version: "bgp@3:broadcast-relay@1:cluster@1:config-management@1:conntrack@3:conntrack-sync@2:container@1:dhcp-relay@2:dhcp-server@6:dhcpv6-server@1:dns-forwarding@3:firewall@9:flow-accounting@1:https@4:ids@1:interfaces@26:ipoe-server@1:ipsec@11:isis@2:l2tp@4:lldp@1:mdns@1:monitoring@1:nat@5:nat66@1:ntp@2:openconnect@2:ospf@1:policy@5:pppoe-server@6:pptp@2:qos@2:quagga@10:rpki@1:salt@1:snmp@3:ssh@2:sstp@4:system@25:vrf@3:vrrp@3:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2"
|
||||
// Release version: 1.4-rolling-202302041536
|
||||
3
host_vars/router4.yml
Normal file
3
host_vars/router4.yml
Normal file
@ -0,0 +1,3 @@
|
||||
wan_address: 5.9.220.113/29
|
||||
local_address: 172.16.7.1/24
|
||||
ffrl_address: 185.66.193.107/32
|
||||
@ -1,25 +0,0 @@
|
||||
wireguard_unmanaged_peers:
|
||||
vpn1-testing:
|
||||
public_key: zaxk4sSdmg/NBnjdLaslBA6sljpeW0RPWX00tKq2bnI=
|
||||
allowed_ips: 10.255.1.2/32, 10.1.0.0/16, fd80:3ea2:e399:203a::2/128, 2a03:2260:121:7001::/64
|
||||
persistent_keepalive: 25
|
||||
vpn2-lindenstr-sh07:
|
||||
public_key: 8wsck5Ek7cQ+YbktuUzB2xBAzzeH/ou2QOR4Ou5B6zs=
|
||||
allowed_ips: 10.255.1.3/32, 10.2.0.0/16, fd80:3ea2:e399:203a::3/128, 2a03:2260:121:7002::/64
|
||||
persistent_keepalive: 25
|
||||
# vpn2-stefan:
|
||||
# public_key: NvJKN6xorzvwL7NhMoY2bEwpDVTl9Ob/1gx9g8tHfic=
|
||||
# allowed_ips: 10.255.1.3/32, 10.2.0.0/16
|
||||
# persistent_keepalive: 25
|
||||
# vpn3-empty:
|
||||
# public_key: pwD87EgTk8fGctR1Cz6/DfwGuzTg8VO2YC2CM58Sdlw=
|
||||
# allowed_ips: 10.255.1.2/32, 10.1.0.0/16
|
||||
# persistent_keepalive: 25
|
||||
# vpn4-empty:
|
||||
# public_key: N54OfQCIQGbPltC4sq/1gvV/2UXFKcQAti9ORNvlFxA=
|
||||
# allowed_ips: 10.255.1.2/32, 10.1.0.0/16
|
||||
# persistent_keepalive: 25
|
||||
# vpn5-empty:
|
||||
# public_key: sKi7h1W89XEe9tzxbXbev3oHBoS0VOLXFFLvwQZ+wAM=
|
||||
# allowed_ips: 10.255.1.2/32, 10.1.0.0/16
|
||||
# persistent_keepalive: 25
|
||||
41
host_vars/troisdorf7/vars.yml
Normal file
41
host_vars/troisdorf7/vars.yml
Normal file
@ -0,0 +1,41 @@
|
||||
###
|
||||
### Ansible
|
||||
###
|
||||
ansible_host: 185.66.193.107
|
||||
ansible_port: 2222
|
||||
ansible_ssh_user: root
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
|
||||
###
|
||||
### Vars
|
||||
###
|
||||
internal_network: "10.255.1.0/24"
|
||||
|
||||
###
|
||||
### Wireguard
|
||||
###
|
||||
|
||||
wireguard_address: "10.255.1.1/24, fd80:3ea2:e399:203a::1/64"
|
||||
wireguard_port: 42001
|
||||
|
||||
wireguard_unmanaged_peers:
|
||||
vpn1-testing:
|
||||
public_key: dEqGBiASx0gY1T/m4chRkeWhF+4XmzmjLKLXXbe+rmg=
|
||||
allowed_ips: 10.255.1.2/32, 10.1.0.0/16, fd80:3ea2:e399:203a::2/128
|
||||
persistent_keepalive: 25
|
||||
vpn2-lindenstr-h07:
|
||||
public_key: VglVuinIYJOE3UNZxhFRCHwD7WtiVg83u/cp3modw0k=
|
||||
allowed_ips: 10.255.1.3/32, 10.2.0.0/16, fd80:3ea2:e399:203a::3/128
|
||||
persistent_keepalive: 25
|
||||
vpn3-lindenstr-h01:
|
||||
public_key: jWTWrLtxb19TkThXLmUs+kqelo27zb9XfcDQFPGVWxs=
|
||||
allowed_ips: 10.255.1.4/32, 10.3.0.0/16, fd80:3ea2:e399:203a::4/128
|
||||
persistent_keepalive: 25
|
||||
vpn4-nils:
|
||||
public_key: Z9kn/JvtCcTs2ok8z7Ci3E+dy6Hb/lnUNre4X8xWCjg=
|
||||
allowed_ips: 10.255.1.5/32, 10.4.0.0/16, fd80:3ea2:e399:203a::5/128
|
||||
persistent_keepalive: 25
|
||||
vpn5-stefan:
|
||||
public_key: UHaYitx18sO71Ssk2SVUgdjLaAILbCthCmosU+Fs5Es=
|
||||
allowed_ips: 10.255.1.6/32, 10.5.0.0/16, fd80:3ea2:e399:203a::6/128
|
||||
persistent_keepalive: 25
|
||||
9
host_vars/troisdorf7/vault.yml
Normal file
9
host_vars/troisdorf7/vault.yml
Normal file
@ -0,0 +1,9 @@
|
||||
$ANSIBLE_VAULT;1.1;AES256
|
||||
31653333646534336164323064616261666365636438363761663837663635613333386165313962
|
||||
3732656532643062333235366564333633623937353335650a343334393265316131313935363337
|
||||
61323339356237646631303039646132663161623739393130383338383339373063373566666330
|
||||
3463346562336166340a313562613835386431613636303637626133346433393630623837646236
|
||||
66633239393134336539346430343965383339653061633463653864653834633862353861663432
|
||||
39633663663833373264623138376431353437623765643530373266643539616231376162663831
|
||||
33643334323861653564333739376561306462316561336531656663396134336635666639343433
|
||||
38613630313731343736
|
||||
30
hosts.yml
30
hosts.yml
@ -5,32 +5,14 @@
|
||||
######################
|
||||
all:
|
||||
children:
|
||||
router:
|
||||
children:
|
||||
ffrl-uplink:
|
||||
hosts:
|
||||
r4.fftdf.de:
|
||||
supernodes:
|
||||
children:
|
||||
vpn-offloader:
|
||||
hosts:
|
||||
# tdf7
|
||||
troisdorf7:
|
||||
#TDF (alt)
|
||||
#ansible_host: 93.241.53.100
|
||||
ansible_host: 5.9.220.113
|
||||
ansible_user: root
|
||||
ansible_python_interpreter: /usr/bin/python3
|
||||
ffrl_ipv4: 185.66.193.107
|
||||
ffrl_ipv6: 2a03:2260:121:7000::107
|
||||
ffrl_ipv6_net: "2a03:2260:121:7000::"
|
||||
ffrl_router_id: 10.188.255.7
|
||||
gre_bb_a_ak_ber_ipv4: 100.64.6.25
|
||||
gre_bb_b_ak_ber_ipv4: 100.64.6.31
|
||||
gre_bb_a_ix_dus_ipv4: 100.64.6.29
|
||||
gre_bb_b_ix_dus_ipv4: 100.64.6.35
|
||||
gre_bb_a_fra3_f_ipv4: 100.64.6.27
|
||||
gre_bb_b_fra3_f_ipv4: 100.64.6.33
|
||||
gre_bb_a_ak_ber_ipv6: 2a03:2260:0:30c::2
|
||||
gre_bb_b_ak_ber_ipv6: 2a03:2260:0:30f::2
|
||||
gre_bb_a_ix_dus_ipv6: 2a03:2260:0:30e::2
|
||||
gre_bb_b_ix_dus_ipv6: 2a03:2260:0:311::2
|
||||
gre_bb_a_fra3_f_ipv6: 2a03:2260:0:30d::2
|
||||
gre_bb_b_fra3_f_ipv6: 2a03:2260:0:310::2
|
||||
wireguard_address: "10.255.1.1/24, fd80:3ea2:e399:203a::1/64"
|
||||
wireguard_port: 42001
|
||||
|
||||
@ -52,23 +52,16 @@ sudo dpkg -i e50-v2-v1.0.20211208-v1.0.20210914.deb
|
||||
set firewall name WAN_LOCAL rule 20 destination port 51821
|
||||
set firewall group network-group LAN-VPN description 'Networks on LAN destined to go out VPN by default'
|
||||
set firewall group network-group LAN-VPN network 10.1.0.0/16
|
||||
set firewall group ipv6-network-group IPv6-VPN ipv6-network 2a03:2260:121:7001::/64
|
||||
set firewall group network-group RFC1918 network 10.0.0.0/8
|
||||
set firewall group network-group RFC1918 network 172.16.0.0/12
|
||||
set firewall group network-group RFC1918 network 192.168.0.0/16
|
||||
set firewall group network-group RFC1918 network 169.254.0.0/16
|
||||
set protocols static table 2 route 0.0.0.0/0 next-hop 10.255.1.1
|
||||
set protocols static table 2 route6 ::/0 next-hop fd80:3ea2:e399:203a::1
|
||||
set firewall modify VPN_TDF7 rule 100 action modify
|
||||
set firewall modify VPN_TDF7 rule 100 description 'Route traffic from group LAN-VPN through VPN-TDF7 table'
|
||||
set firewall modify VPN_TDF7 rule 100 modify table 2
|
||||
set firewall modify VPN_TDF7 rule 100 source group network-group LAN-VPN
|
||||
set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 action modify
|
||||
set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 description 'Route traffic from group IPv6-VPN through IPv6-VPN-TDF7 table'
|
||||
set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 modify table 2
|
||||
set firewall ipv6-modify IPv6-VPN_TDF7 rule 100 source group ipv6-network-group IPv6-VPN
|
||||
set interfaces switch switch0 firewall in modify VPN_TDF7
|
||||
set interfaces switch switch0 firewall in modify IPv6-VPN_TDF7
|
||||
## NAT einrichten
|
||||
set service nat rule 5010 description 'masquerade for VPN'
|
||||
set service nat rule 5010 outbound-interface wg0
|
||||
|
||||
@ -1,15 +0,0 @@
|
||||
- name: Copy Bird Config
|
||||
ansible.builtin.template:
|
||||
src: bird.conf.j2
|
||||
dest: /etc/bird/bird.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Copy Bird6 Config
|
||||
ansible.builtin.template:
|
||||
src: bird6.conf.j2
|
||||
dest: /etc/bird/bird6.conf
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
@ -1,93 +0,0 @@
|
||||
/*
|
||||
* This is an example configuration file.
|
||||
*/
|
||||
|
||||
# Yes, even shell-like comments work...
|
||||
|
||||
# Configure logging
|
||||
#log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
|
||||
#log stderr all;
|
||||
#log "tmp" all;
|
||||
#log syslog all;
|
||||
|
||||
#debug protocols all;
|
||||
|
||||
# Override router ID
|
||||
router id {{ ffrl_router_id }};
|
||||
|
||||
|
||||
protocol direct {
|
||||
interface "*";
|
||||
};
|
||||
|
||||
protocol kernel {
|
||||
device routes;
|
||||
import all;
|
||||
export all;
|
||||
kernel table 42;
|
||||
};
|
||||
|
||||
protocol device {
|
||||
scan time 8;
|
||||
};
|
||||
|
||||
function is_default() {
|
||||
return (net ~ [0.0.0.0/0]);
|
||||
};
|
||||
|
||||
# own network
|
||||
function is_self_net() {
|
||||
return (net ~ [ 10.188.0.0/16+ ]);
|
||||
}
|
||||
|
||||
# freifunk ip ranges in general
|
||||
function is_freifunk() {
|
||||
return net ~ [ 10.0.0.0/8+,
|
||||
104.0.0.0/8+
|
||||
];
|
||||
}
|
||||
|
||||
filter hostroute {
|
||||
if net ~ {{ ffrl_ipv4 }}/32 then accept;
|
||||
reject;
|
||||
};
|
||||
|
||||
# Uplink über ff Rheinland
|
||||
template bgp uplink {
|
||||
local as 65066;
|
||||
import where is_default();
|
||||
export filter hostroute;
|
||||
next hop self;
|
||||
multihop 64;
|
||||
default bgp_local_pref 200;
|
||||
};
|
||||
|
||||
protocol bgp ffrl_bb_a_ak_ber from uplink {
|
||||
source address 100.64.6.25;
|
||||
neighbor 100.64.6.24 as 201701;
|
||||
};
|
||||
|
||||
protocol bgp ffrl_bb_b_ak_ber from uplink {
|
||||
source address 100.64.6.31;
|
||||
neighbor 100.64.6.30 as 201701;
|
||||
};
|
||||
|
||||
protocol bgp ffrl_bb_a_ix_dus from uplink {
|
||||
source address 100.64.6.29;
|
||||
neighbor 100.64.6.28 as 201701;
|
||||
};
|
||||
|
||||
protocol bgp ffrl_bb_b_ix_dus from uplink {
|
||||
source address 100.64.6.35;
|
||||
neighbor 100.64.6.34 as 201701;
|
||||
};
|
||||
|
||||
protocol bgp ffrl_bb_a_fra3_fra from uplink {
|
||||
source address 100.64.6.27;
|
||||
neighbor 100.64.6.26 as 201701;
|
||||
};
|
||||
|
||||
protocol bgp ffrl_bb_b_fra3_fra from uplink {
|
||||
source address 100.64.6.33;
|
||||
neighbor 100.64.6.32 as 201701;
|
||||
};
|
||||
@ -1,89 +0,0 @@
|
||||
# Configure logging
|
||||
#log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
|
||||
#log stderr all;
|
||||
#log "tmp" all;
|
||||
#log syslog all;
|
||||
|
||||
#debug protocols all;
|
||||
|
||||
# Override router ID
|
||||
router id {{ ffrl_router_id }};
|
||||
|
||||
protocol direct {
|
||||
interface "bat0", "gre-*", "lo"; # Restrict network interfaces it works with
|
||||
|
||||
}
|
||||
|
||||
|
||||
protocol kernel {
|
||||
device routes;
|
||||
import all;
|
||||
export all; # Default is export none
|
||||
kernel table 42; # Kernel table to synchronize with (default: main)
|
||||
}
|
||||
|
||||
protocol device {
|
||||
scan time 10; # Scan interfaces every 10 seconds
|
||||
}
|
||||
|
||||
function is_default() {
|
||||
return (net ~ [::/0]);
|
||||
}
|
||||
|
||||
# own networks
|
||||
function is_self_net() {
|
||||
return net ~ [ fda0:747e:ab29:7405::/64+ ];
|
||||
}
|
||||
|
||||
# freifunk ip ranges in general
|
||||
function is_freifunk() {
|
||||
return net ~ [ fc00::/7{48,64},
|
||||
2001:bf7::/32+];
|
||||
}
|
||||
|
||||
filter hostroute {
|
||||
if net ~ {{ ffrl_ipv6_net }}/52 then accept;
|
||||
reject;
|
||||
}
|
||||
|
||||
|
||||
|
||||
# Uplink zum FF Rheinland
|
||||
template bgp uplink {
|
||||
local as 65066;
|
||||
import where is_default();
|
||||
export filter hostroute;
|
||||
gateway recursive;
|
||||
}
|
||||
|
||||
|
||||
protocol bgp ffrl_bb_a_ak_ber from uplink {
|
||||
source address 2a03:2260:0:30c::2;
|
||||
neighbor 2a03:2260:0:30c::1 as 201701;
|
||||
}
|
||||
|
||||
protocol bgp ffrl_bb_b_ak_ber from uplink {
|
||||
source address 2a03:2260:0:30f::2;
|
||||
neighbor 2a03:2260:0:30f::1 as 201701;
|
||||
}
|
||||
|
||||
|
||||
protocol bgp ffrl_bb_a_ix_dus from uplink {
|
||||
source address 2a03:2260:0:30e::2;
|
||||
neighbor 2a03:2260:0:30e::1 as 201701;
|
||||
}
|
||||
|
||||
protocol bgp ffrl_bb_b_ix_dus from uplink {
|
||||
source address 2a03:2260:0:311::2;
|
||||
neighbor 2a03:2260:0:311::1 as 201701;
|
||||
}
|
||||
|
||||
protocol bgp ffrl_bb_a_fra3_fra from uplink {
|
||||
source address 2a03:2260:0:30d::2;
|
||||
neighbor 2a03:2260:0:30d::1 as 201701;
|
||||
}
|
||||
|
||||
protocol bgp ffrl_bb_b_fra3_fra from uplink {
|
||||
source address 2a03:2260:0:310::2;
|
||||
neighbor 2a03:2260:0:310::1 as 201701;
|
||||
}
|
||||
@ -1,20 +0,0 @@
|
||||
- name: Cop Network Config
|
||||
ansible.builtin.template:
|
||||
src: 01-ffrl-gre.yaml.j2
|
||||
dest: /etc/netplan/01-ffrl-gre.yaml
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
register: networkconfig
|
||||
|
||||
- name: Netplan Apply
|
||||
ansible.builtin.shell: netplan apply
|
||||
when: networkconfig.changed
|
||||
|
||||
- name: Add Table 42 after netplan Apply
|
||||
ansible.builtin.shell: /bin/ip rule add fwmark 0x4 table 42
|
||||
when: networkconfig.changed
|
||||
|
||||
- name: Add Table 42v6 after netplan Apply
|
||||
ansible.builtin.shell: /bin/ip -6 rule add fwmark 0x4 table 42
|
||||
when: networkconfig.changed
|
||||
@ -1,62 +0,0 @@
|
||||
network:
|
||||
tunnels:
|
||||
gre-bb-a.ak.ber:
|
||||
mode: gre
|
||||
local: {{ ansible_host }}
|
||||
remote: 185.66.195.0
|
||||
mtu: 1400
|
||||
addresses:
|
||||
- {{ gre_bb_a_ak_ber_ipv4 }}/31
|
||||
- {{ gre_bb_a_ak_ber_ipv6 }}/64
|
||||
- fe80::200:5efe:2e04:9c72/64
|
||||
gre-bb-b.ak.ber:
|
||||
mode: gre
|
||||
local: {{ ansible_host }}
|
||||
remote: 185.66.195.1
|
||||
mtu: 1400
|
||||
addresses:
|
||||
- {{ gre_bb_b_ak_ber_ipv4 }}/31
|
||||
- {{ gre_bb_b_ak_ber_ipv6 }}/64
|
||||
- fe80::200:5efe:2e04:9c72/64
|
||||
gre-bb-a.ix.dus:
|
||||
mode: gre
|
||||
local: {{ ansible_host }}
|
||||
remote: 185.66.193.0
|
||||
mtu: 1400
|
||||
addresses:
|
||||
- {{ gre_bb_a_ix_dus_ipv4 }}/31
|
||||
- {{ gre_bb_a_ix_dus_ipv6 }}/64
|
||||
- fe80::200:5efe:2e04:9c72/64
|
||||
gre-bb-b.ix.dus:
|
||||
mode: gre
|
||||
local: {{ ansible_host }}
|
||||
remote: 185.66.193.1
|
||||
mtu: 1400
|
||||
addresses:
|
||||
- {{ gre_bb_b_ix_dus_ipv4 }}/31
|
||||
- {{ gre_bb_b_ix_dus_ipv6}}/64
|
||||
- fe80::200:5efe:2e04:9c72/64
|
||||
gre-bb-a.fra3.f:
|
||||
mode: gre
|
||||
local: {{ ansible_host }}
|
||||
remote: 185.66.194.0
|
||||
mtu: 1400
|
||||
addresses:
|
||||
- {{ gre_bb_a_fra3_f_ipv4 }}/31
|
||||
- {{ gre_bb_a_fra3_f_ipv6 }}/64
|
||||
- fe80::200:5efe:2e04:9c72/64
|
||||
gre-bb-b.fra3.f:
|
||||
mode: gre
|
||||
local: {{ ansible_host }}
|
||||
remote: 185.66.194.1
|
||||
mtu: 1400
|
||||
addresses:
|
||||
- {{ gre_bb_b_fra3_f_ipv4 }}/31
|
||||
- {{ gre_bb_b_fra3_f_ipv6 }}/64
|
||||
- fe80::200:5efe:2e04:9c72/64
|
||||
ethernets:
|
||||
lo:
|
||||
addresses:
|
||||
- {{ ffrl_ipv4 }}/32
|
||||
- {{ ffrl_ipv6 }}/52
|
||||
- 127.0.0.1/8
|
||||
@ -1,17 +1,18 @@
|
||||
- name: Install all Packages
|
||||
apt: name={{ item }} state=latest update_cache=yes
|
||||
with_items:
|
||||
- curl
|
||||
- nano
|
||||
- vim
|
||||
- htop
|
||||
- bird
|
||||
- screen
|
||||
- iproute2
|
||||
- iptables
|
||||
- cron
|
||||
- qemu-guest-agent
|
||||
- iputils-ping
|
||||
- iw
|
||||
- speedtest-cli
|
||||
- telnet
|
||||
ansible.builtin.apt:
|
||||
name:
|
||||
- curl
|
||||
- nano
|
||||
- vim
|
||||
- htop
|
||||
- screen
|
||||
- iproute2
|
||||
- iptables
|
||||
- cron
|
||||
- qemu-guest-agent
|
||||
- iputils-ping
|
||||
- iw
|
||||
- speedtest-cli
|
||||
- telnet
|
||||
state: latest
|
||||
update_cache: yes
|
||||
26
roles/01-system-set-networking/tasks/main.yml
Normal file
26
roles/01-system-set-networking/tasks/main.yml
Normal file
@ -0,0 +1,26 @@
|
||||
---
|
||||
- name: Set NAT MASQUERADE
|
||||
ansible.builtin.iptables:
|
||||
chain: POSTROUTING
|
||||
table: nat
|
||||
source: "{{ internal_network }}"
|
||||
jump: MASQUERADE
|
||||
|
||||
- ansible.posix.sysctl:
|
||||
name: kernel.panic
|
||||
value: '1'
|
||||
sysctl_file: /etc/sysctl.conf
|
||||
|
||||
- ansible.posix.sysctl:
|
||||
name: net.ipv4.ip_forward
|
||||
value: '1'
|
||||
sysctl_set: true
|
||||
state: present
|
||||
reload: true
|
||||
|
||||
- ansible.posix.sysctl:
|
||||
name: net.ipv6.conf.all.forwarding
|
||||
value: '1'
|
||||
sysctl_set: true
|
||||
state: present
|
||||
reload: true
|
||||
@ -1,16 +0,0 @@
|
||||
- name: Ensures Freifunk Folder exists
|
||||
file: path=/opt/freifunk state=directory
|
||||
|
||||
- name: Copy Reboot Script
|
||||
ansible.builtin.template:
|
||||
src: sn_startup.sh.j2
|
||||
dest: /opt/freifunk/sn_startup.sh
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0775'
|
||||
|
||||
- name: Cron Job to run after boot
|
||||
ansible.builtin.cron:
|
||||
name: "Set Freifunk Routes"
|
||||
special_time: reboot
|
||||
job: /opt/freifunk/sn_startup.sh
|
||||
@ -1,58 +0,0 @@
|
||||
#!/bin/sh
|
||||
# Version 1.91
|
||||
|
||||
sleep 5
|
||||
|
||||
# Activate IP forwarding
|
||||
/sbin/sysctl -w net.ipv6.conf.all.forwarding=1
|
||||
/sbin/sysctl -w net.ipv4.ip_forward=1
|
||||
|
||||
# restart when kernel panic
|
||||
/sbin/sysctl kernel.panic=1
|
||||
|
||||
# Routing table 42
|
||||
/bin/grep 42 /etc/iproute2/rt_tables || /bin/echo 42 ffrl >> /etc/iproute2/rt_tables
|
||||
|
||||
# Set table for traffice with mark 4
|
||||
/bin/ip rule add fwmark 0x4 table 42
|
||||
/bin/ip -6 rule add fwmark 0x4 table 42
|
||||
|
||||
# Set mark 4 to Freifunk traffic
|
||||
/sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 ! -d 10.0.0.0/8 -j MARK --set-mark 4
|
||||
/sbin/ip6tables -t mangle -A PREROUTING -s 2a03:2260:121::/48 ! -d 2a03:2260:121::/48 -j MARK --set-mark 4
|
||||
|
||||
# All from FF IPv4 via routing table 42
|
||||
/bin/ip rule add from {{ ffrl_ipv4 }}/32 lookup 42
|
||||
/bin/ip -6 rule add from {{ ffrl_ipv6_net }}/52 lookup 42
|
||||
|
||||
# Add NAT Rules manualy
|
||||
iptables -t nat -D POSTROUTING -o gre-bb-a.ak.ber -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t nat -D POSTROUTING -o gre-bb-b.ak.ber -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t nat -D POSTROUTING -o gre-bb-a.fra3.f -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t nat -D POSTROUTING -o gre-bb-b.fra3.f -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t nat -D POSTROUTING -o gre-bb-a.ix.dus -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t nat -D POSTROUTING -o gre-bb-b.ix.dus -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
sleep 30
|
||||
iptables -t nat -A POSTROUTING -o gre-bb-a.ak.ber -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-a.ak.ber -j TCPMSS --set-mss 1312
|
||||
ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-a.ak.ber -j TCPMSS --set-mss 1312
|
||||
|
||||
iptables -t nat -A POSTROUTING -o gre-bb-a.fra3.f -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-a.fra3.f -j TCPMSS --set-mss 1312
|
||||
ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-a.fra3.f -j TCPMSS --set-mss 1312
|
||||
|
||||
iptables -t nat -A POSTROUTING -o gre-bb-a.ix.dus -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-a.ix.dus -j TCPMSS --set-mss 1312
|
||||
ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-a.ix.dus -j TCPMSS --set-mss 1312
|
||||
|
||||
iptables -t nat -A POSTROUTING -o gre-bb-b.ak.ber -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-b.ak.ber -j TCPMSS --set-mss 1312
|
||||
ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-b.ak.ber -j TCPMSS --set-mss 1312
|
||||
|
||||
iptables -t nat -A POSTROUTING -o gre-bb-b.fra3.f -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-b.fra3.f -j TCPMSS --set-mss 1312
|
||||
ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-b.fra3.f -j TCPMSS --set-mss 1312
|
||||
|
||||
iptables -t nat -A POSTROUTING -o gre-bb-b.ix.dus -j SNAT --to-source {{ ffrl_ipv4 }}
|
||||
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-b.ix.dus -j TCPMSS --set-mss 1312
|
||||
ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-bb-b.ix.dus -j TCPMSS --set-mss 1312
|
||||
@ -1,4 +0,0 @@
|
||||
- name: Install OpenVPN
|
||||
apt: name={{ item }} state=latest update_cache=yes
|
||||
with_items:
|
||||
- openvpn
|
||||
26
roles/21-install-oitc/tasks/main.yml
Normal file
26
roles/21-install-oitc/tasks/main.yml
Normal file
@ -0,0 +1,26 @@
|
||||
- name: Repo Key Import
|
||||
ansible.builtin.shell: curl https://packages.openitcockpit.io/repokey.txt | sudo apt-key add
|
||||
|
||||
- name: Add specified repository into sources list
|
||||
ansible.builtin.apt_repository:
|
||||
repo: deb https://packages.openitcockpit.io/openitcockpit-agent/deb/stable deb main
|
||||
state: present
|
||||
|
||||
|
||||
- name: Install Wireguard
|
||||
apt: name={{ item }} state=latest update_cache=yes
|
||||
with_items:
|
||||
- openitcockpit-agent
|
||||
|
||||
- name: Copy Config File
|
||||
ansible.builtin.template:
|
||||
src: oitc.ini.j2
|
||||
dest: /etc/openitcockpit-agent/config.ini
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0775'
|
||||
|
||||
- name: Restart service httpd, in all cases
|
||||
ansible.builtin.service:
|
||||
name: openitcockpit-agent
|
||||
state: restarted
|
||||
177
roles/21-install-oitc/templates/oitc.ini.j2
Normal file
177
roles/21-install-oitc/templates/oitc.ini.j2
Normal file
@ -0,0 +1,177 @@
|
||||
[default]
|
||||
#
|
||||
# This is the configuration file for the openITCOCKPIT Monitoring Agent 3.x
|
||||
# Notice: Empty values will not been ignored! If you want to disable an option like proxy comment it out!
|
||||
|
||||
#########################
|
||||
# Web Server #
|
||||
#########################
|
||||
|
||||
# Bind address of the build-in web server
|
||||
# Use 0.0.0.0 to bind on all interfaces
|
||||
address = 0.0.0.0
|
||||
|
||||
# Port of the Agents build-in web server
|
||||
# Default port is 3333
|
||||
port = 3333
|
||||
|
||||
#########################
|
||||
# Security Settings #
|
||||
#########################
|
||||
|
||||
# Try to enable auto ssl mode for webserver
|
||||
try-autossl = True
|
||||
|
||||
# File paths used to store autossl related files (default: /etc/openitcockpit-agent/):
|
||||
# Leave this blank to use the default values
|
||||
# Example: /etc/openitcockpit-agent/agent.csr
|
||||
#autossl-csr-file =
|
||||
|
||||
# Example: /etc/openitcockpit-agent/agent.crt
|
||||
#autossl-crt-file =
|
||||
|
||||
# Example: /etc/openitcockpit-agent/agent.key
|
||||
#autossl-key-file =
|
||||
|
||||
# Example: /etc/openitcockpit-agent/server_ca.crt
|
||||
#autossl-ca-file =
|
||||
|
||||
# If a certificate file is given, the agent will only be accessible through HTTPS
|
||||
# Instead of messing around with self-signed certificates we recommend to use the autossl feature.
|
||||
# Example: /etc/ssl/certs/ssl-cert-snakeoil.pem
|
||||
#certfile = /etc/ssl/certs/ssl-cert-snakeoil.pem
|
||||
|
||||
# Private key file of the given TLS certificate
|
||||
# Example: /etc/ssl/private/ssl-cert-snakeoil.key
|
||||
#keyfile = /etc/ssl/private/ssl-cert-snakeoil.key
|
||||
|
||||
# Enable remote read and write access to the current agent configuration (this file) and
|
||||
# the customchecks config
|
||||
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
# ! WARNING: This could lead to remote code execution !
|
||||
# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
|
||||
config-update-mode = False
|
||||
|
||||
# Enable HTTP Basic Authentication
|
||||
# Example: auth = user:password
|
||||
#auth = user:password
|
||||
|
||||
#########################
|
||||
# Checks #
|
||||
#########################
|
||||
|
||||
# Determines in seconds how often the agent will schedule all internal checks
|
||||
interval = 30
|
||||
|
||||
# Remote Plugin Execution
|
||||
# Path to config will where custom checks can be defined
|
||||
# Comment to use the default value
|
||||
#
|
||||
# Linux: /etc/openitcockpit-agent/customchecks.ini
|
||||
# Windows: C:\Program Files\it-novum\openitcockpit-agent\customchecks.ini
|
||||
# macOS: /Applications/openitcockpit-agent/customchecks.ini
|
||||
#customchecks = /etc/openitcockpit-agent/customchecks.ini
|
||||
|
||||
#########################
|
||||
# Enable/Disable checks #
|
||||
#########################
|
||||
|
||||
# Enable CPU monitoring
|
||||
cpustats = True
|
||||
|
||||
# Enable memory monitoring
|
||||
memory = True
|
||||
|
||||
# Enable Swap monitoring
|
||||
swap = True
|
||||
|
||||
# Enable monitoring of running processes
|
||||
processstats = True
|
||||
|
||||
# Enable monitoring of network interfaces
|
||||
netstats = True
|
||||
|
||||
# Enable monitoring of the traffic (I/O) of network interfaces
|
||||
netio = True
|
||||
|
||||
# Enable disk usage monitoring
|
||||
diskstats = True
|
||||
|
||||
# Enable monitoring of disk I/O
|
||||
diskio = True
|
||||
|
||||
# Enable monitoring of Systemd Services (Linux only)
|
||||
systemdservices = True
|
||||
|
||||
# Enable monitoring of Launchd Services (macOS only)
|
||||
launchdservices = True
|
||||
|
||||
# Enable monitoring of Windows Services (Windows only)
|
||||
winservices = True
|
||||
|
||||
# Enable monitoring of Windows Event Log records (Windows only)
|
||||
wineventlog = False
|
||||
|
||||
# Determines how the openITCOCKPIT Monitoring Agent should query the Windows Event Log.
|
||||
# Since Version 3.0.9 WMI (Windows Management Instrumentation) will be used by default
|
||||
# As alternative the Agent could use the PowerShell Get-EventLog cmdlet.
|
||||
# The WMI method will maybe memory leak on Windows Server 2016. The PowerShell workaround
|
||||
# on the other hand could lead to blue screens (OA-40).
|
||||
wineventlog-method = WMI
|
||||
#wineventlog-method = PowerShell
|
||||
|
||||
# Define comma separated windows event log log types
|
||||
# Event Logs containing spaces DO NOT need to be quoted: Security,Sophos Cloud AD Sync,Application
|
||||
wineventlog-logtypes = System,Application,Security
|
||||
|
||||
# Enable monitoring of temperature and battery sensors
|
||||
sensorstats = True
|
||||
|
||||
# Enable support to monitor Docker containers
|
||||
# Known issues: Error response from daemon: client version 1.41 is too new. Maximum supported API version is 1.40
|
||||
# Workaround: export DOCKER_API_VERSION=1.40
|
||||
dockerstats = False
|
||||
|
||||
# Check KVMs through libvirt
|
||||
# This requires to complie the openITCOCKPIT Monitoring Agent by yourself.
|
||||
# Please see the Wiki for instructions: https://github.com/it-novum/openitcockpit-agent-go/wiki/Build-binary
|
||||
libvirt = True
|
||||
|
||||
# Enable logged in users check
|
||||
userstats = True
|
||||
|
||||
#########################
|
||||
# Push mode #
|
||||
#########################
|
||||
|
||||
# By default openITCOCKPIT will pull check results from the openITCOCKPIT Agent.
|
||||
# In a cloud environments or behind a NAT network it could become handy
|
||||
# if the openITCOCKPIT Monitoring Agent will push the results to your openITCOCKPIT Server
|
||||
[oitc]
|
||||
|
||||
# Enable Push Mode
|
||||
enabled = False
|
||||
|
||||
# This option disables the webserver of the openITCOCKPIT Monitoring Agent when running in PUSH mode.
|
||||
# When you also want to enable the Webserver even if the agent is running in PUSH mode we highly recommend
|
||||
# to enable HTTP Basic Authentication and to use the certfile and keyfile options to enable HTTPS
|
||||
enable-webserver = False
|
||||
|
||||
# Address of your openITCOCKPIT Server where the Agent will push the results to
|
||||
# Example: https://demo.openitcockpit.io
|
||||
url =
|
||||
|
||||
# Enable this option when your openITCOCKPIT server uses valid TLS certificates
|
||||
# like from Let's Encrypt
|
||||
verify-server-certificate = False
|
||||
|
||||
# Timeout in seconds for the HTTP push client
|
||||
timeout = 10
|
||||
|
||||
# API-Key of your openITCOCKPIT Server
|
||||
apikey =
|
||||
|
||||
# Address of HTTP/HTTPS Proxy if required.
|
||||
# Comment to disable
|
||||
# Example: http://10.10.1.10:3128
|
||||
#proxy = http://10.10.1.10:3128
|
||||
7
roles/40-vyos-system/tasks/main.yml
Normal file
7
roles/40-vyos-system/tasks/main.yml
Normal file
@ -0,0 +1,7 @@
|
||||
---
|
||||
- name: Set Vyos Hostname
|
||||
vyos.vyos.vyos_hostname:
|
||||
config:
|
||||
hostname: "{{ inventory_hostname }}"
|
||||
state: merged
|
||||
|
||||
14
roles/41-vyos-interfaces/tasks/main.yml
Normal file
14
roles/41-vyos-interfaces/tasks/main.yml
Normal file
@ -0,0 +1,14 @@
|
||||
---
|
||||
- name: Create Local Interfaces
|
||||
vyos.vyos.vyos_l3_interfaces:
|
||||
config:
|
||||
- name: eth0
|
||||
ipv4:
|
||||
- address: "{{ wan_address }}"
|
||||
- name: eth1
|
||||
ipv4:
|
||||
- address: "{{ local_address }}"
|
||||
- name: lo
|
||||
- address: "{{ ffrl_address }}"
|
||||
state: merged
|
||||
|
||||
@ -1,16 +1,14 @@
|
||||
# ansible-playbook -i hosts.yml -u root system-setup.yml
|
||||
# ansible-playbook -i hosts.yml system-setup.yml
|
||||
- name: System preperation
|
||||
hosts: supernodes
|
||||
roles:
|
||||
- 00-system-set-hostname
|
||||
- 00-create-sudo-user
|
||||
- 00-system-set-network
|
||||
- 00-system-set-bird
|
||||
- 01-system-set-networking
|
||||
- 01-system-install-packages
|
||||
- 11-create-cronjob
|
||||
|
||||
- name: System preperation
|
||||
hosts: vpn-offloader
|
||||
roles:
|
||||
# - 20-install-openvpn
|
||||
- 21-install-wireguard
|
||||
- 21-install-wireguard
|
||||
- 21-install-oitc
|
||||
17
update_wg.yml
Normal file
17
update_wg.yml
Normal file
@ -0,0 +1,17 @@
|
||||
# ansible-playbook -i hosts.yml -u root system-setup.yml
|
||||
- name: System preperation
|
||||
hosts: supernodes
|
||||
roles:
|
||||
- 00-system-set-hostname
|
||||
- 00-create-sudo-user
|
||||
- 00-system-set-network
|
||||
- 00-system-set-bird
|
||||
- 01-system-install-packages
|
||||
- 11-create-cronjob
|
||||
|
||||
- name: System preperation
|
||||
hosts: vpn-offloader
|
||||
roles:
|
||||
# - 20-install-openvpn
|
||||
- 21-install-wireguard
|
||||
- 21-install-oitc
|
||||
72
vpn01.md
Normal file
72
vpn01.md
Normal file
@ -0,0 +1,72 @@
|
||||
vpn02
|
||||
# Supernode mit direkter VPN Ausleitung
|
||||
|
||||
Ausleitung über das FFRL Backbone.
|
||||
Supernode Config:
|
||||
- GRE-Tunnel zum FFRL Backbone
|
||||
- VPN per Wireguard
|
||||
- NAT auf VPN Routern
|
||||
|
||||
## Adressbereiche:
|
||||
|
||||
Supernode: 10.255.1.1/32
|
||||
|
||||
VPN01: 10.255.1.2/32, Client: 10.1.0.0/16
|
||||
VPN02: 10.255.1.3/32, Client: 10.2.0.0/16
|
||||
VPN03: 10.255.1.4/32, Client: 10.3.0.0/16
|
||||
etc.
|
||||
|
||||
|
||||
## ER-X Stock Firmware Config:
|
||||
> Vor der Installation:
|
||||
> - eth0 als DHCP Client
|
||||
> - eth1-4 auf den Switch
|
||||
> - Switch mit DHCP Server einrichten. Adressbereich aus Tabelle beachten!
|
||||
|
||||
## Install Wireguard
|
||||
cd /tmp
|
||||
curl -OL https://github.com/WireGuard/wireguard-vyatta-ubnt/releases/download/1.0.20211208-1/e50-v2-v1.0.20211208-v1.0.20210914.deb
|
||||
sudo dpkg -i e50-v2-v1.0.20211208-v1.0.20210914.deb
|
||||
|
||||
## Generate Keys
|
||||
cd /config/auth
|
||||
wg genkey | tee /config/auth/wg.key | wg pubkey > wg.public
|
||||
cat wg.public
|
||||
cat wg.key
|
||||
|
||||
## Config ER-X
|
||||
configure
|
||||
## Wireguard
|
||||
set interfaces wireguard wg0 address 10.255.1.2/24
|
||||
set interfaces wireguard wg0 address fd80:3ea2:e399:203a::2/64
|
||||
set interfaces wireguard wg0 listen-port 51822
|
||||
set interfaces wireguard wg0 route-allowed-ips false
|
||||
set interfaces wireguard wg0 persistent-keepalive 25
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= endpoint 7.fftdf.de:42001
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips 0.0.0.0/0
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips ::0/0
|
||||
set interfaces wireguard wg0 private-key /config/auth/wg.key
|
||||
## Firewall for Wireguard
|
||||
set firewall name WAN_LOCAL rule 20 action accept
|
||||
set firewall name WAN_LOCAL rule 20 protocol udp
|
||||
set firewall name WAN_LOCAL rule 20 description 'WireGuard'
|
||||
set firewall name WAN_LOCAL rule 20 destination port 51821
|
||||
set firewall group network-group LAN-VPN description 'Networks on LAN destined to go out VPN by default'
|
||||
set firewall group network-group LAN-VPN network 10.1.0.0/16
|
||||
set firewall group network-group RFC1918 network 10.0.0.0/8
|
||||
set firewall group network-group RFC1918 network 172.16.0.0/12
|
||||
set firewall group network-group RFC1918 network 192.168.0.0/16
|
||||
set firewall group network-group RFC1918 network 169.254.0.0/16
|
||||
set protocols static table 2 route 0.0.0.0/0 next-hop 10.255.1.1
|
||||
set firewall modify VPN_TDF7 rule 100 action modify
|
||||
set firewall modify VPN_TDF7 rule 100 description 'Route traffic from group LAN-VPN through VPN-TDF7 table'
|
||||
set firewall modify VPN_TDF7 rule 100 modify table 2
|
||||
set firewall modify VPN_TDF7 rule 100 source group network-group LAN-VPN
|
||||
set interfaces switch switch0 firewall in modify VPN_TDF7
|
||||
## NAT einrichten
|
||||
set service nat rule 5010 description 'masquerade for VPN'
|
||||
set service nat rule 5010 outbound-interface wg0
|
||||
set service nat rule 5010 type masquerade
|
||||
set service nat rule 5010 protocol all
|
||||
## Speichern
|
||||
commit ; save
|
||||
72
vpn02.md
Normal file
72
vpn02.md
Normal file
@ -0,0 +1,72 @@
|
||||
vpn02
|
||||
# Supernode mit direkter VPN Ausleitung
|
||||
|
||||
Ausleitung über das FFRL Backbone.
|
||||
Supernode Config:
|
||||
- GRE-Tunnel zum FFRL Backbone
|
||||
- VPN per Wireguard
|
||||
- NAT auf VPN Routern
|
||||
|
||||
## Adressbereiche:
|
||||
|
||||
Supernode: 10.255.1.1/32
|
||||
|
||||
VPN01: 10.255.1.2/32, Client: 10.1.0.0/16
|
||||
VPN02: 10.255.1.3/32, Client: 10.2.0.0/16
|
||||
VPN03: 10.255.1.4/32, Client: 10.3.0.0/16
|
||||
etc.
|
||||
|
||||
|
||||
## ER-X Stock Firmware Config:
|
||||
> Vor der Installation:
|
||||
> - eth0 als DHCP Client
|
||||
> - eth1-4 auf den Switch
|
||||
> - Switch mit DHCP Server einrichten. Adressbereich aus Tabelle beachten!
|
||||
|
||||
## Install Wireguard
|
||||
cd /tmp
|
||||
curl -OL https://github.com/WireGuard/wireguard-vyatta-ubnt/releases/download/1.0.20211208-1/e50-v2-v1.0.20211208-v1.0.20210914.deb
|
||||
sudo dpkg -i e50-v2-v1.0.20211208-v1.0.20210914.deb
|
||||
|
||||
## Generate Keys
|
||||
cd /config/auth
|
||||
wg genkey | tee /config/auth/wg.key | wg pubkey > wg.public
|
||||
cat wg.public
|
||||
cat wg.key
|
||||
|
||||
## Config ER-X
|
||||
configure
|
||||
## Wireguard
|
||||
set interfaces wireguard wg0 address 10.255.1.3/24
|
||||
set interfaces wireguard wg0 address fd80:3ea2:e399:203a::3/64
|
||||
set interfaces wireguard wg0 listen-port 51821
|
||||
set interfaces wireguard wg0 route-allowed-ips false
|
||||
set interfaces wireguard wg0 persistent-keepalive 25
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= endpoint 7.fftdf.de:42001
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips 0.0.0.0/0
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips ::0/0
|
||||
set interfaces wireguard wg0 private-key /config/auth/wg.key
|
||||
## Firewall for Wireguard
|
||||
set firewall name WAN_LOCAL rule 20 action accept
|
||||
set firewall name WAN_LOCAL rule 20 protocol udp
|
||||
set firewall name WAN_LOCAL rule 20 description 'WireGuard'
|
||||
set firewall name WAN_LOCAL rule 20 destination port 51821
|
||||
set firewall group network-group LAN-VPN description 'Networks on LAN destined to go out VPN by default'
|
||||
set firewall group network-group LAN-VPN network 10.2.0.0/16
|
||||
set firewall group network-group RFC1918 network 10.0.0.0/8
|
||||
set firewall group network-group RFC1918 network 172.16.0.0/12
|
||||
set firewall group network-group RFC1918 network 192.168.0.0/16
|
||||
set firewall group network-group RFC1918 network 169.254.0.0/16
|
||||
set protocols static table 2 route 0.0.0.0/0 next-hop 10.255.1.1
|
||||
set firewall modify VPN_TDF7 rule 100 action modify
|
||||
set firewall modify VPN_TDF7 rule 100 description 'Route traffic from group LAN-VPN through VPN-TDF7 table'
|
||||
set firewall modify VPN_TDF7 rule 100 modify table 2
|
||||
set firewall modify VPN_TDF7 rule 100 source group network-group LAN-VPN
|
||||
set interfaces switch switch0 firewall in modify VPN_TDF7
|
||||
## NAT einrichten
|
||||
set service nat rule 5010 description 'masquerade for VPN'
|
||||
set service nat rule 5010 outbound-interface wg0
|
||||
set service nat rule 5010 type masquerade
|
||||
set service nat rule 5010 protocol all
|
||||
## Speichern
|
||||
commit ; save
|
||||
72
vpn03.md
Normal file
72
vpn03.md
Normal file
@ -0,0 +1,72 @@
|
||||
vpn03
|
||||
# Supernode mit direkter VPN Ausleitung
|
||||
|
||||
Ausleitung über das FFRL Backbone.
|
||||
Supernode Config:
|
||||
- GRE-Tunnel zum FFRL Backbone
|
||||
- VPN per Wireguard
|
||||
- NAT auf VPN Routern
|
||||
|
||||
## Adressbereiche:
|
||||
|
||||
Supernode: 10.255.1.1/32
|
||||
|
||||
VPN01: 10.255.1.2/32, Client: 10.1.0.0/16
|
||||
VPN02: 10.255.1.3/32, Client: 10.2.0.0/16
|
||||
VPN03: 10.255.1.4/32, Client: 10.3.0.0/16
|
||||
etc.
|
||||
|
||||
|
||||
## ER-X Stock Firmware Config:
|
||||
> Vor der Installation:
|
||||
> - eth0 als DHCP Client
|
||||
> - eth1-4 auf den Switch
|
||||
> - Switch mit DHCP Server einrichten. Adressbereich aus Tabelle beachten!
|
||||
|
||||
## Install Wireguard
|
||||
cd /tmp
|
||||
curl -OL https://github.com/WireGuard/wireguard-vyatta-ubnt/releases/download/1.0.20211208-1/e50-v2-v1.0.20211208-v1.0.20210914.deb
|
||||
sudo dpkg -i e50-v2-v1.0.20211208-v1.0.20210914.deb
|
||||
|
||||
## Generate Keys
|
||||
cd /config/auth
|
||||
wg genkey | tee /config/auth/wg.key | wg pubkey > wg.public
|
||||
cat wg.public
|
||||
cat wg.key
|
||||
|
||||
## Config ER-X
|
||||
configure
|
||||
## Wireguard
|
||||
set interfaces wireguard wg0 address 10.255.1.4/24
|
||||
set interfaces wireguard wg0 address fd80:3ea2:e399:203a::4/64
|
||||
set interfaces wireguard wg0 listen-port 51821
|
||||
set interfaces wireguard wg0 route-allowed-ips false
|
||||
set interfaces wireguard wg0 persistent-keepalive 25
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= endpoint 7.fftdf.de:42001
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips 0.0.0.0/0
|
||||
set interfaces wireguard wg0 peer 5B/YTaDPVWVApUyHshJp899iXXlBy8rBqJUpYvKo+1s= allowed-ips ::0/0
|
||||
set interfaces wireguard wg0 private-key /config/auth/wg.key
|
||||
## Firewall for Wireguard
|
||||
set firewall name WAN_LOCAL rule 20 action accept
|
||||
set firewall name WAN_LOCAL rule 20 protocol udp
|
||||
set firewall name WAN_LOCAL rule 20 description 'WireGuard'
|
||||
set firewall name WAN_LOCAL rule 20 destination port 51821
|
||||
set firewall group network-group LAN-VPN description 'Networks on LAN destined to go out VPN by default'
|
||||
set firewall group network-group LAN-VPN network 10.3.0.0/16
|
||||
set firewall group network-group RFC1918 network 10.0.0.0/8
|
||||
set firewall group network-group RFC1918 network 172.16.0.0/12
|
||||
set firewall group network-group RFC1918 network 192.168.0.0/16
|
||||
set firewall group network-group RFC1918 network 169.254.0.0/16
|
||||
set protocols static table 2 route 0.0.0.0/0 next-hop 10.255.1.1
|
||||
set firewall modify VPN_TDF7 rule 100 action modify
|
||||
set firewall modify VPN_TDF7 rule 100 description 'Route traffic from group LAN-VPN through VPN-TDF7 table'
|
||||
set firewall modify VPN_TDF7 rule 100 modify table 2
|
||||
set firewall modify VPN_TDF7 rule 100 source group network-group LAN-VPN
|
||||
set interfaces switch switch0 firewall in modify VPN_TDF7
|
||||
## NAT einrichten
|
||||
set service nat rule 5010 description 'masquerade for VPN'
|
||||
set service nat rule 5010 outbound-interface wg0
|
||||
set service nat rule 5010 type masquerade
|
||||
set service nat rule 5010 protocol all
|
||||
## Speichern
|
||||
commit ; save
|
||||
Loading…
Reference in New Issue
Block a user