Merge pull request #9 from Freifunk-Troisdorf/rojoka-patch-1

Changes logrotate, sn_startup > interfaces, house keeping

files/interfaces-troisdorf5

@@ -15,6 +15,12 @@ iface lo inet6 loopback
 # The primary network interface
 allow-hotplug eth0
 iface eth0 inet dhcp
+        post-up iptables -P OUTPUT ACCEPT
+        post-up iptables -A OUTPUT -o eth0 -d 10.0.0.0/8 -j DROP
+        post-up iptables -A OUTPUT -o eth0 -d 172.16.0.0/12 -j DROP
+        post-up iptables -A OUTPUT -o eth0 -d 169.254.0.0/16 -j DROP
+        post-up iptables -A OUTPUT -o eth0 -d 192.168.0.0/16 -j DROP
+        post-up iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 allow-hotplug eth1
 iface eth1 inet6 static
         address 2a01:4f8:172:f4b::5
@@ -29,8 +35,16 @@ auto gre-bb-a.ak.ber
 iface gre-bb-a.ak.ber inet static
         address 100.64.2.151
         netmask 255.255.255.254
+<<<<<<< HEAD
+        pre-up ip tunnel add $IFACE mode gre local 5.9.76.198 remote 185.66.195.0 ttl 255
+        post-up iptables -t nat -A POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
+        post-up iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+        post-up ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+=======
         pre-up ip tunnel add $IFACE mode gre local 138.201.54.123 remote 185.66.195.0 ttl 255
+>>>>>>> origin/master
         post-up ip link set $IFACE mtu 1400
+        post-down iptables -t nat -D POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
         post-down ip tunnel del $IFACE
 
 iface gre-bb-a.ak.ber inet6 static
@@ -42,8 +56,16 @@ auto gre-bb-b.ak.ber
 iface gre-bb-b.ak.ber inet static
         address 100.64.2.153
         netmask 255.255.255.254
+<<<<<<< HEAD
+        pre-up ip tunnel add $IFACE mode gre local 5.9.76.198 remote 185.66.195.1 ttl 255
+        post-up iptables -t nat -A POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
+        post-up iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+        post-up ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+=======
         pre-up ip tunnel add $IFACE mode gre local 138.201.54.123 remote 185.66.195.1 ttl 255
+>>>>>>> origin/master
         post-up ip link set $IFACE mtu 1400
+        post-down iptables -t nat -D POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
         post-down ip tunnel del $IFACE
 
 iface gre-bb-b.ak.ber inet6 static
@@ -56,8 +78,16 @@ auto gre-bb-a.ix.dus
 iface gre-bb-a.ix.dus inet static
         address 100.64.2.155
         netmask 255.255.255.254
+<<<<<<< HEAD
+        pre-up ip tunnel add $IFACE mode gre local 5.9.76.198 remote 185.66.193.0 ttl 255
+        post-up iptables -t nat -A POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
+        post-up iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+        post-up ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+=======
         pre-up ip tunnel add $IFACE mode gre local 138.201.54.123 remote 185.66.193.0 ttl 255
+>>>>>>> origin/master
         post-up ip link set $IFACE mtu 1400
+        post-down iptables -t nat -D POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
         post-down ip tunnel del $IFACE
 
 iface gre-bb-a.ix.dus inet6 static
@@ -70,8 +100,16 @@ auto gre-bb-b.ix.dus
 iface gre-bb-b.ix.dus inet static
         address 100.64.2.157
         netmask 255.255.255.254
+<<<<<<< HEAD
+        pre-up ip tunnel add $IFACE mode gre local 5.9.76.198 remote 185.66.193.1 ttl 255
+        post-up iptables -t nat -A POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
+        post-up iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+        post-up ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $IFACE -j TCPMSS --set-mss 1312
+=======
         pre-up ip tunnel add $IFACE mode gre local 138.201.54.123 remote 185.66.193.1 ttl 255
+>>>>>>> origin/master
         post-up ip link set $IFACE mtu 1400
+        post-down iptables -t nat -D POSTROUTING -o $IFACE -j SNAT --to-source 185.66.193.105
         post-down ip tunnel del $IFACE
 
 iface gre-bb-b.ix.dus inet6 static

files/logrotate.conf

@@ -5,7 +5,7 @@ daily
 
 # keep 4 weeks worth of backlogs
 #rotate 4
-rotate 0
+rotate 1
 
 # create new (empty) log files after rotating old ones
 create

files/sn_startup.exit.sh.j2

@@ -3,12 +3,6 @@
 
 curl -X POST --data-urlencode 'payload={"text": "{{ sn_hostname }} is rebooted", "channel": "#technik", "username": "{{ sn_hostname }}", "icon_emoji": ":floppy_disk:"}' https://hooks.slack.com/services/{{ slack_token }}
 
-# Block RFC1918 and APIPA destination via WAN
-/sbin/iptables -P OUTPUT ACCEPT
-for i in 10.0.0.0/8 172.16.0.0/12 169.254.0.0/16 192.168.0.0/16; do
-/sbin/iptables -A OUTPUT -o eth0 -d $i -j DROP
-done
-
 # Activate IP forwarding
 /sbin/sysctl -w net.ipv6.conf.all.forwarding=1
 /sbin/sysctl -w net.ipv4.ip_forward=1
@@ -27,16 +21,6 @@ done
 /sbin/iptables -t mangle -A PREROUTING -s 10.0.0.0/8 ! -d 10.0.0.0/8 -j MARK --set-mark 4
 /sbin/ip6tables -t mangle -A PREROUTING -s 2a03:2260:121::/64 ! -d 2a03:2260:121::/64 -j MARK --set-mark 4
 
-# NAT on eth0
-/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-
-# NAT on GRE Freifunk interface
-/sbin/iptables -t nat -A POSTROUTING -o gre-+ -j SNAT --to-source {{ sn_ffrl_IPv4 }}
-
-# MTU
-/sbin/iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-+ -j TCPMSS --set-mss 1312
-/sbin/ip6tables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o gre-+ -j TCPMSS --set-mss 1312
-
 # All from FF IPv4 via routing table 42
 /bin/ip rule add from {{ sn_ffrl_IPv4 }}/32 lookup 42
 /bin/ip -6 rule add from  2a03:2260:121::/64 lookup 42

install.sn.yml

@@ -9,7 +9,11 @@
   user: root
   gather_facts: False
   vars:
+<<<<<<< HEAD
+    snversion: master_v3.0.7
+=======
     snversion: master_v3.0.8
+>>>>>>> master
     batmanversion: v2015.2
     common_required_packages:
       - git
@@ -255,10 +259,6 @@
       template: src=./files/named.conf.options.j2 dest=/etc/bind/named.conf.options owner=root group=bind mode=644
     - name: Copy radvd config template
       template: src=./files/radvd.conf.j2 dest=/etc/radvd.conf owner=radvd group=root mode=0444
-    - name: Alfed message
-      template: src=./files/alfred.sh.j2 dest=/opt/freifunk/alfred.sh owner=root group=root mode=0544
-    - name: Add cron job with alfred info script
-      cron: name=alfred_info job="/opt/freifunk/alfred.sh > /dev/null 2>&1" user="root"
     - name: Interface configuration with ffrl gre tunnel
       copy: src=./files/interfaces-{{ sn_hostname }} dest=/etc/network/interfaces owner=root group=root mode=0544
       when: sn_exit is defined