Updated efg.pm (mostly ipv6 rule additions/changes).

diff --git a/sources/efg.pm/c3d/firstboot/data/nftables.config b/sources/efg.pm/c3d/firstboot/data/nftables.config
index 1c3bd6d986ba95427c2921d78a2bbb03a9e17100..b3c425c80342e273da5918dd0b2d95178d9ed012 100644 (file)
--- a/sources/efg.pm/c3d/firstboot/data/nftables.config
+++ b/sources/efg.pm/c3d/firstboot/data/nftables.config
@@ -24,9 +24,9 @@ define LOOPBACK_IPV4 = 127.0.0.1
 # public addresses
 define PUBLIC_NET_IPV4       = 213.253.216.160
 define PUBLIC_GW_IPV4        = 213.253.216.161
-define PUBLIC_GW_IPV6        = 2001:1aa1:000a:0000:0000:0000:0000:0001
+define PUBLIC_GW_IPV6        = 2001:1aa4:0001:0000:0000:0000:0000:000e
 define PUBLIC_EFG_IPV4       = 213.253.216.162
-define PUBLIC_EFG_IPV6       = 2001:1aa1:000a:0000:000c:18ff:fe03:d8a2
+define PUBLIC_EFG_IPV6       = 2001:1aa4:0001:0000:0000:0000:0000:000f
 define PUBLIC_MX_IPV4        = 213.253.216.163
 define PUBLIC_NS_IPV4        = 213.253.216.164
 define PUBLIC_STORE_IPV4     = 213.253.216.165
@@ -43,7 +43,7 @@ define PUBLIC_BROADCAST_IPV4 = 213.253.216.175
 
 # efg address (perimeter network)
 define EFG_PERIMETER_IPV4 = 192.168.173.254
-define EFG_PERIMETER_IPV6 = 2001:1aa1:000a:00ad:000c:18ff:fe03:adfe
+define EFG_PERIMETER_IPV6 = 2001:1aa1:000a:7c0c:000c:18ff:fe03:adfe
 
 # transfer web server address (perimeter network)
 define XFR_PERIMETER_IPV4 = 192.168.173.251
@@ -52,16 +52,16 @@ define XFR_PERIMETER_IPV4 = 192.168.173.251
 define WS_PERIMETER_IPV4 = 192.168.173.249
 
 # perimeter name server address (perimeter network)
-define PNS_PERIMETER_IPV4 = 192.168.173.174
-define PNS_PERIMETER_IPV6 = 2001:1aa1:000a:00ad:000c:18ff:fe03:adae
+define PNS_PERIMETER_IPV4 = 192.168.173.223
+define PNS_PERIMETER_IPV6 = 2001:1aa1:000a:7c0c:000c:18ff:fe03:addf
 
 # external name server address (perimeter network)
-define ENS_PERIMETER_IPV4 = 192.168.173.64
-define ENS_PERIMETER_IPV6 = 2001:1aa1:000a:00ad:000c:18ff:fe03:ad40
+define ENS_PERIMETER_IPV4 = 192.168.173.147
+define ENS_PERIMETER_IPV6 = 2001:1aa1:000a:7c0c:000c:18ff:fe03:ad93
 
 # ifg address (perimeter network)
 define IFG_PERIMETER_IPV4 = 192.168.173.1
-define IFG_PERIMETER_IPV6 = 2001:1aa1:000a:00ad:000c:18ff:fe03:ad01
+define IFG_PERIMETER_IPV6 = 2001:1aa1:000a:7c0c:000c:18ff:fe03:ad01
 
 # dvredmine address (internal network)
 define DVREDMINE_INTERNAL_IPV4 = 10.228.62.193
@@ -72,18 +72,9 @@ define MINICRM_INTERNAL_IPV4 = 10.228.109.133
 # store address (internal network)
 define STORE_INTERNAL_IPV4 = 10.228.109.250
 
-# service address (internal network)
-define SVC_INTERNAL_IPV4 = 10.228.109.253
-
 # vpn address (internal network)
 define VPN_INTERNAL_IPV4 = 10.228.109.236
 
-# primary name server address (internal network)
-define PNS_INTERNAL_IPV4 = 10.228.109.174
-
-# internal name server address (internal network)
-define INS_INTERNAL_IPV4 = 10.228.109.104
-
 # netlock server address (internal network)
 define NETLOCK_INTERNAL_IPV4 = 10.228.32.197
 
@@ -99,11 +90,11 @@ define USR_IPV4_NET = 10.228.0.0/16
 define SR_IPV4_NET = 192.168.42.0/24
 define IN_IPV4_NET = 192.168.43.0/24
 define INTERNAL_IPV4_NETS = { $USR_IPV4_NET, $SR_IPV4_NET, $IN_IPV4_NET }
-define INTERNAL_IPV6_NET = 2001:1aa1:000a:0424::/64
+define INTERNAL_IPV6_NET = 2001:1aa1:000a:7dae::/64
 
 # perimeter network
 define PERIMETER_IPV4_NET = 192.168.173.0/24
-define PERIMETER_IPV6_NET = 2001:1aa1:000a:00ad::/64
+define PERIMETER_IPV6_NET = 2001:1aa1:000a:7c0c::/64
 
 # vpn client network
 define VPN_IPV4_NET = 172.24.232.0/24
@@ -230,11 +221,11 @@ add rule ip6 efg-filter input \
 # FILTER forward rules
 ################################
 
-#add rule ip6 efg-filter forward \
-#    ct state established, related \
-#    iifname $EXTERNAL_ACE_IF \
-#    oifname $PERIMETER_IF ip6 daddr $INTERNAL_IPV6_NET \
-#    counter accept comment "Established sessions (ACE)"
+add rule ip6 efg-filter forward \
+    ct state established, related \
+    iifname $EXTERNAL_IF \
+    oifname $PERIMETER_IF ip6 daddr $INTERNAL_IPV6_NET \
+    counter accept comment "Established sessions"
 
 add rule ip efg-filter forward \
     ct state established, related \
@@ -242,10 +233,10 @@ add rule ip efg-filter forward \
     oifname $PERIMETER_IF ip daddr $INTERNAL_IPV4_NETS \
     counter accept comment "Established sessions"
 
-#add rule ip6 efg-filter forward \
-#    iifname $PERIMETER_IF ip6 saddr $INTERNAL_IPV6_NET \
-#    oifname $EXTERNAL_ACE_IF \
-#    counter accept comment "Internet access (ACE)"
+add rule ip6 efg-filter forward \
+    iifname $PERIMETER_IF ip6 saddr $INTERNAL_IPV6_NET \
+    oifname $EXTERNAL_IF \
+    counter accept comment "Internet access"
 
 add rule ip efg-filter forward \
     iifname $PERIMETER_IF ip saddr $INTERNAL_IPV4_NETS \
@@ -278,44 +269,88 @@ add rule ip efg-filter forward \
     oifname $EXTERNAL_IF tcp dport 1024-65535 \
     counter accept comment "Outgoing http(s) replies"
 
+add rule ip6 efg-filter forward \
+    iifname $EXTERNAL_IF udp sport 1024-65535 \
+    oifname $PERIMETER_IF ip6 daddr $ENS_PERIMETER_IPV6 udp dport domain \
+    counter accept comment "Incoming DNS requests/notifications (udp)"
+
 add rule ip efg-filter forward \
     iifname $EXTERNAL_IF udp sport 1024-65535 \
     oifname $PERIMETER_IF ip daddr $ENS_PERIMETER_IPV4 udp dport domain \
     counter accept comment "Incoming DNS requests/notifications (udp)"
 
+add rule ip6 efg-filter forward \
+    ct state established, related \
+    iifname $PERIMETER_IF ip6 saddr $ENS_PERIMETER_IPV6 udp sport domain \
+    oifname $EXTERNAL_IF udp dport 1024-65535 \
+    counter accept comment "Outgoing DNS replies (udp)"
+
 add rule ip efg-filter forward \
     ct state established, related \
     iifname $PERIMETER_IF ip saddr $ENS_PERIMETER_IPV4 udp sport domain \
     oifname $EXTERNAL_IF udp dport 1024-65535 \
     counter accept comment "Outgoing DNS replies (udp)"
 
+add rule ip6 efg-filter forward \
+    iifname $EXTERNAL_IF tcp sport 1024-65535 \
+    oifname $PERIMETER_IF ip6 daddr $ENS_PERIMETER_IPV6 tcp dport domain \
+    counter accept comment "Incoming DNS requests (tcp)"
+
 add rule ip efg-filter forward \
     iifname $EXTERNAL_IF tcp sport 1024-65535 \
     oifname $PERIMETER_IF ip daddr $ENS_PERIMETER_IPV4 tcp dport domain \
     counter accept comment "Incoming DNS requests (tcp)"
 
+add rule ip6 efg-filter forward \
+    ct state established, related \
+    iifname $PERIMETER_IF ip6 saddr $ENS_PERIMETER_IPV6 tcp sport domain \
+    oifname $EXTERNAL_IF tcp dport 1024-65535 \
+    counter accept comment "Outgoing DNS replies (tcp)"
+
 add rule ip efg-filter forward \
     ct state established, related \
     iifname $PERIMETER_IF ip saddr $ENS_PERIMETER_IPV4 tcp sport domain \
     oifname $EXTERNAL_IF tcp dport 1024-65535 \
     counter accept comment "Outgoing DNS replies (tcp)"
 
+add rule ip6 efg-filter forward \
+    iifname $PERIMETER_IF ip6 saddr { $ENS_PERIMETER_IPV6, $PNS_PERIMETER_IPV6 } udp sport 1024-65535 \
+    oifname $EXTERNAL_IF udp dport domain \
+    counter accept comment "Outgoing DNS requests/notifications (udp)"
+
 add rule ip efg-filter forward \
     iifname $PERIMETER_IF ip saddr { $ENS_PERIMETER_IPV4, $PNS_PERIMETER_IPV4 } udp sport 1024-65535 \
     oifname $EXTERNAL_IF udp dport domain \
     counter accept comment "Outgoing DNS requests/notifications (udp)"
 
+add rule ip6 efg-filter forward \
+    ct state established, related \
+    iifname $EXTERNAL_IF udp sport domain \
+    oifname $PERIMETER_IF ip6 daddr { $ENS_PERIMETER_IPV6, $PNS_PERIMETER_IPV6 } udp dport 1024-65535 \
+    counter accept comment "Incoming DNS replies (udp)"
+
 add rule ip efg-filter forward \
     ct state established, related \
     iifname $EXTERNAL_IF udp sport domain \
     oifname $PERIMETER_IF ip daddr { $ENS_PERIMETER_IPV4, $PNS_PERIMETER_IPV4 } udp dport 1024-65535 \
     counter accept comment "Incoming DNS replies (udp)"
 
+add rule ip6 efg-filter forward \
+    iifname $PERIMETER_IF ip6 saddr { $ENS_PERIMETER_IPV6, $PNS_PERIMETER_IPV6 } tcp sport 1024-65535 \
+    oifname $EXTERNAL_IF tcp dport domain \
+    counter accept comment "Outgoing DNS requests (tcp)"
+
 add rule ip efg-filter forward \
     iifname $PERIMETER_IF ip saddr { $ENS_PERIMETER_IPV4, $PNS_PERIMETER_IPV4 } tcp sport 1024-65535 \
     oifname $EXTERNAL_IF tcp dport domain \
     counter accept comment "Outgoing DNS requests (tcp)"
 
+add rule ip6 efg-filter forward \
+    ct state established, related \
+    iifname $EXTERNAL_IF tcp sport domain \
+    oifname $PERIMETER_IF ip6 daddr { $ENS_PERIMETER_IPV6, $PNS_PERIMETER_IPV6 } tcp dport 1024-65535 \
+    counter accept comment "Incoming DNS replies (tcp)"
+
 add rule ip efg-filter forward \
     ct state established, related \
     iifname $EXTERNAL_IF tcp sport domain \

diff --git a/sources/efg.pm/c3d/firstboot/scripts/01_setupnetworking.sh b/sources/efg.pm/c3d/firstboot/scripts/01_setupnetworking.sh
index 894b42c624e94c4bcd72b7e4973d5ddddf717e08..689c2fab0a1f1d1366b6256766b4984b5561680c 100755 (executable)
--- a/sources/efg.pm/c3d/firstboot/scripts/01_setupnetworking.sh
+++ b/sources/efg.pm/c3d/firstboot/scripts/01_setupnetworking.sh
@@ -73,17 +73,17 @@ nmcli connection add \
     connection.interface-name $CONNECTION_DEVICE_PM \
     connection.type 802-3-ethernet \
     ipv4.addresses "192.168.173.254/24" \
-    ipv4.dns "192.168.173.174" \
-    ipv4.dns-search "pm.user.hu" \
+    ipv4.dns "192.168.173.223" \
+    ipv4.dns-search "pm.useribm.hu" \
     ipv4.method "manual" \
     ipv4.routes "10.228.0.0/16 192.168.173.1, \
                  192.168.42.0/24 192.168.173.1, \
                  192.168.43.0/24 192.168.173.1" \
-    ipv6.addresses "2001:1aa1:000a:00ad:000c:18ff:fe03:adfe/64" \
-    ipv6.dns "2001:1aa1:000a:00ad:000c:18ff:fe03:adae" \
+    ipv6.addresses "2001:1aa1:000a:7c0c:000c:18ff:fe03:adfe/64" \
+    ipv6.dns "2001:1aa1:000a:7c0c:000c:18ff:fe03:addf" \
     ipv6.dns-search "pm.useribm.hu" \
     ipv6.method "manual" \
-    ipv6.routes "2001:1aa1:000a:0424::/64 2001:1aa1:000a:00ad:000c:18ff:fe03:ad01" \
+    ipv6.routes "2001:1aa1:000a:7dae::/64 2001:1aa1:000a:7c0c:000c:18ff:fe03:ad01" \
     save yes
 
 nmcli connection add \
@@ -98,8 +98,8 @@ nmcli connection add \
     ipv4.gateway "213.253.216.161" \
     ipv4.method "manual" \
     ipv4.route-metric 100 \
-    ipv6.addresses "2001:1aa1:000a:0000:000c:18ff:fe03:d8a2/64" \
-    ipv6.gateway "2001:1aa1:000a::1" \
+    ipv6.addresses "2001:1aa1:000a:ba2e:000c:18ff:fe03:adfe, 2001:1aa4:0001:0000:0000:0000:0000:000f/127" \
+    ipv6.gateway "2001:1aa4:0001:0000:0000:0000:0000:000e" \
     ipv6.method "manual" \
     ipv6.route-metric 100 \
     save yes

diff --git a/sources/efg.pm/c3d/postinstall/install-data/etc/radvd.conf b/sources/efg.pm/c3d/postinstall/install-data/etc/radvd.conf
index 9ace658fe95ef7804cd801f59ee5d2c1a4ffd39c..7fff6206612fa178ff9cfe303363cbec6df55c66 100644 (file)
--- a/sources/efg.pm/c3d/postinstall/install-data/etc/radvd.conf
+++ b/sources/efg.pm/c3d/postinstall/install-data/etc/radvd.conf
@@ -2,32 +2,20 @@ interface eth0
 {
         AdvSendAdvert on;
 
-        prefix 2001:1aa1:000a:00ad::/64
+        prefix ::/64
         {
                 AdvOnLink on;
                 AdvAutonomous on;
         };
-
-        route ::/0
-        {
-        };
 };
 
 interface eth1
 {
         AdvSendAdvert on;
 
-        prefix 2001:1aa1:000a:0000::/64
+        prefix 2001:1aa1:000a:ba2e::/64
         {
                 AdvOnLink on;
                 AdvAutonomous on;
         };
-
-        route 2001:1aa1:000a:00ad::/64
-        {
-        };
-
-        route 2001:1aa1:000a:0424::/64
-        {
-        };
 };

diff --git a/sources/efg.pm/c3d/postinstall/install-data/usr/local/bin/setuprouting.sh b/sources/efg.pm/c3d/postinstall/install-data/usr/local/bin/setuprouting.sh
index c0b82615aee7d0ece674334b0b81b2eeb46f1559..593169be07c093f21a2155f0a33ebae98febc9ac 100755 (executable)
--- a/sources/efg.pm/c3d/postinstall/install-data/usr/local/bin/setuprouting.sh
+++ b/sources/efg.pm/c3d/postinstall/install-data/usr/local/bin/setuprouting.sh
@@ -1,6 +1,7 @@
 #!/bin/sh
 
 
+exit 0
 # the mail server, the nameservers and the vpn server and everything
 # from the perimeter network are routed via ACE
 ip rule add priority 64  from 10.228.92.159/32 lookup 30