CCCHH/ansible-infra
CCCHH/ansible-infra
4
2
Fork 1
Code Issues 4 Pull requests 1 Wiki Activity Actions

router killing turing
Some checks failed
/ Ansible Lint (push) Failing after 46s
Details

Browse source
This commit is contained in:
June 2025-09-21 02:16:51 +02:00
commit 23548107d5
Signed by: june
SSH key fingerprint: SHA256:o9EAq4Y9N9K0pBQeBTqhSDrND5E7oB+60ZNx0U1yPe0
8 changed files with 81 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

17
resources/chaosknoten/router/nftables/nftables.conf
View file

@ -7,12 +7,20 @@ define if_net1_v4_wan = "net1"
define if_net2_v6_wan = "net2"
define if_net0_2_v4_nat = "net0.2"
define if_net0_3_ci_runner = "net0.3"
define if_net0_4_v4_nat_legacy = "net0.4"
define if_net0_5_public = "net0.5"
# Interface Groups
define wan_ifs = { $if_net1_v4_wan,
$if_net2_v6_wan }
define lan_ifs = { $if_net0_2_v4_nat,
$if_net0_3_ci_runner }
$if_net0_3_ci_runner,
$if_net0_4_v4_nat_legacy,
$if_net0_5_public }
define v4_exposed_ifs = { $if_net0_5_public }
define v6_exposed_ifs = { $if_net0_2_v4_nat,
$if_net0_4_v4_nat_legacy,
$if_net0_5_public }
## Rules
@ -67,7 +75,10 @@ table inet forward {
ct state established,related accept
# Allow internet access.
meta nfproto ipv6 iifname $lan_ifs oifname $if_net2_v6_wan accept comment "allow v6 internet access"
meta nfproto ipv4 iifname $lan_ifs oifname $if_net1_v4_wan accept comment "allow v4 internet access"
iifname $lan_ifs oifname $wan_ifs accept comment "allow internet access"
# Allow access to exposed networks from internet.
meta nfproto ipv4 oifname $v4_exposed_ifs accept comment "allow v4 exposed network access"
meta nfproto ipv6 oifname $v6_exposed_ifs accept comment "allow v6 exposed network access"
}
}

3
resources/chaosknoten/router/systemd_networkd/00-net1.link
View file

@ -1,5 +1,6 @@
[Match]
MACAddress=BC:24:11:9A:FB:34
# Stolen from turing to make 212.12.48.122 work.
MACAddress=0E:A4:E3:97:16:92
Type=ether
[Link]

6
resources/chaosknoten/router/systemd_networkd/10-net0.4-v4_nat_legacy.netdev Normal file
View file

@ -0,0 +1,6 @@
[NetDev]
Name=net0.4
Kind=vlan
[VLAN]
Id=4

6
resources/chaosknoten/router/systemd_networkd/10-net0.5-public.netdev Normal file
View file

@ -0,0 +1,6 @@
[NetDev]
Name=net0.5
Kind=vlan
[VLAN]
Id=5

3
resources/chaosknoten/router/systemd_networkd/20-net0.network
View file

@ -7,6 +7,7 @@ RequiredForOnline=no
[Network]
VLAN=net0.2
VLAN=net0.3
VLAN=net0.4
VLAN=net0.5
LinkLocalAddressing=no

11
resources/chaosknoten/router/systemd_networkd/20-net1.network
View file

@ -5,10 +5,11 @@ Name=net1
DNS=212.12.50.158
IPForward=ipv4
IPv6AcceptRA=no
[Address]
# v4 taken from turing for routing public v4 range and turing-compat for v4-NAT-legacy network.
# Also just the v4 for other purposes as well.
Address=212.12.48.122/24
Address=212.12.48.123/24
[Route]
# v6 for turing-compat for v4-NAT-legacy network routed v6.
Address=2a00:14b0:4200:3000:122::1
Gateway=212.12.48.55
Gateway=2a00:14b0:4200:3000::1

23
resources/chaosknoten/router/systemd_networkd/21-net0.4-v4_nat_legacy.network Normal file
View file

@ -0,0 +1,23 @@
[Match]
Name=net0.4
Type=vlan
[Link]
RequiredForOnline=no
[Network]
Description=v4-NAT-legacy
# Masquerading done in nftables (nftables.conf).
IPv6SendRA=yes
[Address]
Address=172.31.17.129/25
[IPv6SendRA]
UplinkInterface=net1
[IPv6Prefix]
Prefix=2a00:14b0:f000:23::/64
Assign=true
Token=static:::1

22
resources/chaosknoten/router/systemd_networkd/21-net0.5-public.network Normal file
View file

@ -0,0 +1,22 @@
[Match]
Name=net0.5
Type=vlan
[Link]
RequiredForOnline=no
[Network]
Description=public
IPv6SendRA=yes
[Address]
Address=212.12.50.209/29
[IPv6SendRA]
UplinkInterface=net2
[IPv6Prefix]
Prefix=2a00:14b0:42:105::/64
Assign=true
Token=static:::1