EdgeOS-Config-Example.md
... ...
@@ -1,379 +0,0 @@
1
-# EdgeRouter Lite DN42 config example
2
-This is the config I (Felicitus) am running on an Ubiquiti EdgeRouter Lite (AS76197).
3
-
4
-## Features
5
-
6
-* dn42 DNS
7
-* "classic" OpenVPN P2P (including the common "comp-lzo" option)
8
-* BGP
9
-* Some traffic-shaping rules for my very slow 3mbit DSL uplink
10
-* 2 internal: One DN42 network (172.22.117.128/25 for me and my servers as well as a NAT 192.168.42.10/24 for my parents, so that they're save from dn42 - that network is NOT announced to dn42).
11
-* Firewall to protect my NAS server and monitoring
12
-
13
-## Upcoming
14
-
15
-* AICCU integration (SIXXS), probably not possible with the config, so ```apt-get install aiccu``` should do the trick
16
-* dn42 IPv6 routing (probably)
17
-
18
-Ask me if you want to know if I have implemented those items already.
19
-
20
-
21
-# Configuration
22
-
23
-```
24
-firewall {
25
- all-ping enable
26
- broadcast-ping disable
27
- conntrack-expect-table-size 4096
28
- conntrack-hash-size 4096
29
- conntrack-table-size 32768
30
- conntrack-tcp-loose enable
31
- ipv6-name ROUTER_V6 {
32
- default-action drop
33
- rule 1 {
34
- action drop
35
- destination {
36
- port 22
37
- }
38
- protocol tcp
39
- }
40
- }
41
- ipv6-name WAN_IN_V6 {
42
- default-action drop
43
- enable-default-log
44
- rule 3 {
45
- action drop
46
- destination {
47
- port 22
48
- }
49
- protocol tcp
50
- }
51
- }
52
- ipv6-receive-redirects disable
53
- ipv6-src-route disable
54
- ip-src-route disable
55
- log-martians enable
56
- name DN42 {
57
- default-action drop
58
- rule 100 {
59
- action drop
60
- destination {
61
- address 172.22.117.181
62
- }
63
- source {
64
- address !172.22.117.128/25
65
- }
66
- }
67
- rule 101 {
68
- action drop
69
- destination {
70
- address 172.22.117.182
71
- }
72
- source {
73
- address !172.22.117.128/25
74
- }
75
- }
76
- rule 102 {
77
- action drop
78
- destination {
79
- address 172.22.117.183
80
- }
81
- source {
82
- address !172.22.117.128/25
83
- }
84
- }
85
- }
86
- name ROUTER_V4 {
87
- default-action accept
88
- rule 2 {
89
- action accept
90
- protocol icmp
91
- }
92
- rule 10 {
93
- action drop
94
- destination {
95
- port 22
96
- }
97
- protocol tcp
98
- }
99
- }
100
- name WAN_IN_V4 {
101
- default-action drop
102
- enable-default-log
103
- rule 1 {
104
- action accept
105
- description "allow established connections"
106
- protocol all
107
- state {
108
- established enable
109
- related enable
110
- }
111
- }
112
- rule 2 {
113
- action drop
114
- state {
115
- invalid enable
116
- }
117
- }
118
- rule 3 {
119
- action drop
120
- destination {
121
- port 22
122
- }
123
- protocol tcp
124
- }
125
- }
126
- receive-redirects disable
127
- send-redirects enable
128
- source-validation disable
129
- syn-cookies enable
130
-}
131
-interfaces {
132
- ethernet eth0 {
133
- duplex auto
134
- firewall {
135
- in {
136
- name WAN_IN_V4
137
- }
138
- }
139
- pppoe 0 {
140
- default-route auto
141
- firewall {
142
- local {
143
- ipv6-name ROUTER_V6
144
- name ROUTER_V4
145
- }
146
- }
147
- mtu 1492
148
- name-server auto
149
- password 12345678
150
- traffic-policy {
151
- }
152
- user-id [email protected]
153
- }
154
- speed auto
155
- }
156
- ethernet eth1 {
157
- address 172.22.117.254/25
158
- duplex auto
159
- speed auto
160
- traffic-policy {
161
- }
162
- }
163
- ethernet eth2 {
164
- address 192.168.42.1/24
165
- duplex auto
166
- speed auto
167
- }
168
- loopback lo {
169
- }
170
- openvpn vtun0 {
171
- local-address 172.22.117.254 {
172
- subnet-mask 255.255.255.128
173
- }
174
- local-port 33121
175
- mode site-to-site
176
- openvpn-option --comp-lzo
177
- protocol udp
178
- remote-address 172.22.117.1
179
- remote-host 5.9.33.163
180
- remote-port 33121
181
- shared-secret-key-file /config/auth/felihome.key
182
- }
183
-}
184
-policy {
185
- prefix-list vpn-in {
186
- rule 10 {
187
- action permit
188
- ge 22
189
- le 28
190
- prefix 172.22.0.0/15
191
- }
192
- }
193
-}
194
-protocols {
195
- bgp 76197 {
196
- neighbor 172.22.117.1 {
197
- description feli-server
198
- peer-group dn42
199
- remote-as 64717
200
- }
201
- network 172.22.117.128/25 {
202
- }
203
- peer-group dn42 {
204
- soft-reconfiguration {
205
- inbound
206
- }
207
- }
208
- }
209
-}
210
-service {
211
- dhcp-server {
212
- disabled false
213
- dynamic-dns-update {
214
- enable true
215
- }
216
- shared-network-name int {
217
- authoritative disable
218
- subnet 172.22.117.128/25 {
219
- default-router 172.22.117.254
220
- dns-server 172.22.117.254
221
- domain-name feli-home.felicitus.org
222
- lease 86400
223
- start 172.22.117.129 {
224
- stop 172.22.117.150
225
- }
226
- static-mapping monitoring {
227
- ip-address 172.22.117.183
228
- mac-address 52:54:00:20:df:46
229
- }
230
- static-mapping nas {
231
- ip-address 172.22.117.181
232
- mac-address e8:39:35:ee:22:7b
233
- }
234
- }
235
- }
236
- shared-network-name nat {
237
- authoritative disable
238
- subnet 192.168.42.0/24 {
239
- default-router 192.168.42.1
240
- dns-server 8.8.8.8
241
- dns-server 8.8.4.4
242
- lease 86400
243
- start 192.168.42.10 {
244
- stop 192.168.42.100
245
- }
246
- }
247
- }
248
- }
249
- dns {
250
- forwarding {
251
- cache-size 150
252
- listen-on eth1
253
- listen-on eth2
254
- name-server 8.8.8.8
255
- name-server 8.8.4.4
256
- options server=/dn42/172.22.0.53
257
- options server=/22.172.in-addr.arpa/172.22.0.53
258
- options server=/23.172.in-addr.arpa/172.22.0.53
259
- options rebind-domain-ok=/dn42/
260
- }
261
- }
262
- nat {
263
- rule 6000 {
264
- outbound-interface pppoe0
265
- type masquerade
266
- }
267
- rule 7000 {
268
- outbound-interface eth2
269
- type masquerade
270
- }
271
- }
272
- ssh {
273
- port 22
274
- protocol-version v2
275
- }
276
- upnp {
277
- listen-on eth1 {
278
- outbound-interface pppoe0
279
- }
280
- listen-on eth2 {
281
- outbound-interface pppoe0
282
- }
283
- }
284
-}
285
-system {
286
- host-name ubnt
287
- login {
288
- user felicitus {
289
- authentication {
290
- encrypted-password errnope
291
- plaintext-password ""
292
- public-keys [email protected] {
293
- key AAAAB3NzaC1yc2EAAAADAQABAAABAQDPTSLjSY/Be1XJ/klAwLiM1pKSvmbdcOgtgDB6nPcHkgX6JZu7g/Kejfuk4qIKL8GYYUQt7DlGY6n2u5rChWE/6KZJzXcUwS3pXk4LZ5KydWp7ihfvyRtUOBgKkRa1zQv+6KCH9WyR++ArwVTP8KSkrmDe6k7NWAjZqOuIJHG/AbEyTBapTJYjObZ0AM7wlwcB+oRM1BfZCP0Y+PIP2eGJS7Pyb32pITNKk3JuFXgAvbj5OeRrwtpZ9S+/7wIpaUVODPzrVmbC7vOXu/2KJ9aY2BmxUsxRbrvWMmWNiuE0YPt/7lUroK4pH3md3lWRcGUS/uYvhug7yG1yB81nyI15
294
- type ssh-rsa
295
- }
296
- }
297
- level admin
298
- }
299
- }
300
- name-server 172.22.117.254
301
- ntp {
302
- server 0.ubnt.pool.ntp.org {
303
- }
304
- server 1.ubnt.pool.ntp.org {
305
- }
306
- server 2.ubnt.pool.ntp.org {
307
- }
308
- server 3.ubnt.pool.ntp.org {
309
- }
310
- }
311
- syslog {
312
- global {
313
- facility all {
314
- level notice
315
- }
316
- facility protocols {
317
- level debug
318
- }
319
- }
320
- }
321
- time-zone UTC
322
-}
323
-traffic-policy {
324
- shaper client-up-s {
325
- bandwidth 30kbit
326
- class 20 {
327
- bandwidth 100%
328
- burst 6k
329
- match TCPACK {
330
- ip {
331
- protocol tcp
332
- }
333
- mark 225
334
- }
335
- priority 5
336
- queue-limit 65
337
- queue-type fair-queue
338
- }
339
- class 30 {
340
- bandwidth 5%
341
- burst 15k
342
- ceiling 20%
343
- match ssh {
344
- ip {
345
- destination {
346
- port 22
347
- }
348
- dscp lowdelay
349
- protocol tcp
350
- }
351
- }
352
- match ssh-ipv6 {
353
- ipv6 {
354
- destination {
355
- port 22
356
- }
357
- protocol tcp
358
- }
359
- }
360
- priority 6
361
- queue-limit 10
362
- queue-type fair-queue
363
- }
364
- default {
365
- bandwidth 95%
366
- burst 15k
367
- ceiling 100%
368
- priority 2
369
- queue-limit 13
370
- queue-type fair-queue
371
- }
372
- }
373
-}
374
-
375
-
376
-/* Warning: Do not remove the following line. */
377
-/* === vyatta-config-version: "config-management@1:dhcp-relay@1:dhcp-server@4:firewall@4:ipsec@3:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
378
-/* Release version: v1.3.0.4605130.131011.1754 */
379
-```
... ...
\ No newline at end of file
howto/EdgeOS-Config-Example.md
... ...
@@ -0,0 +1,379 @@
1
+# EdgeRouter Lite DN42 config example
2
+This is the config I (Felicitus) am running on an Ubiquiti EdgeRouter Lite (AS76197).
3
+
4
+## Features
5
+
6
+* dn42 DNS
7
+* "classic" OpenVPN P2P (including the common "comp-lzo" option)
8
+* BGP
9
+* Some traffic-shaping rules for my very slow 3mbit DSL uplink
10
+* 2 internal: One DN42 network (172.22.117.128/25 for me and my servers as well as a NAT 192.168.42.10/24 for my parents, so that they're save from dn42 - that network is NOT announced to dn42).
11
+* Firewall to protect my NAS server and monitoring
12
+
13
+## Upcoming
14
+
15
+* AICCU integration (SIXXS), probably not possible with the config, so ```apt-get install aiccu``` should do the trick
16
+* dn42 IPv6 routing (probably)
17
+
18
+Ask me if you want to know if I have implemented those items already.
19
+
20
+
21
+# Configuration
22
+
23
+```
24
+firewall {
25
+ all-ping enable
26
+ broadcast-ping disable
27
+ conntrack-expect-table-size 4096
28
+ conntrack-hash-size 4096
29
+ conntrack-table-size 32768
30
+ conntrack-tcp-loose enable
31
+ ipv6-name ROUTER_V6 {
32
+ default-action drop
33
+ rule 1 {
34
+ action drop
35
+ destination {
36
+ port 22
37
+ }
38
+ protocol tcp
39
+ }
40
+ }
41
+ ipv6-name WAN_IN_V6 {
42
+ default-action drop
43
+ enable-default-log
44
+ rule 3 {
45
+ action drop
46
+ destination {
47
+ port 22
48
+ }
49
+ protocol tcp
50
+ }
51
+ }
52
+ ipv6-receive-redirects disable
53
+ ipv6-src-route disable
54
+ ip-src-route disable
55
+ log-martians enable
56
+ name DN42 {
57
+ default-action drop
58
+ rule 100 {
59
+ action drop
60
+ destination {
61
+ address 172.22.117.181
62
+ }
63
+ source {
64
+ address !172.22.117.128/25
65
+ }
66
+ }
67
+ rule 101 {
68
+ action drop
69
+ destination {
70
+ address 172.22.117.182
71
+ }
72
+ source {
73
+ address !172.22.117.128/25
74
+ }
75
+ }
76
+ rule 102 {
77
+ action drop
78
+ destination {
79
+ address 172.22.117.183
80
+ }
81
+ source {
82
+ address !172.22.117.128/25
83
+ }
84
+ }
85
+ }
86
+ name ROUTER_V4 {
87
+ default-action accept
88
+ rule 2 {
89
+ action accept
90
+ protocol icmp
91
+ }
92
+ rule 10 {
93
+ action drop
94
+ destination {
95
+ port 22
96
+ }
97
+ protocol tcp
98
+ }
99
+ }
100
+ name WAN_IN_V4 {
101
+ default-action drop
102
+ enable-default-log
103
+ rule 1 {
104
+ action accept
105
+ description "allow established connections"
106
+ protocol all
107
+ state {
108
+ established enable
109
+ related enable
110
+ }
111
+ }
112
+ rule 2 {
113
+ action drop
114
+ state {
115
+ invalid enable
116
+ }
117
+ }
118
+ rule 3 {
119
+ action drop
120
+ destination {
121
+ port 22
122
+ }
123
+ protocol tcp
124
+ }
125
+ }
126
+ receive-redirects disable
127
+ send-redirects enable
128
+ source-validation disable
129
+ syn-cookies enable
130
+}
131
+interfaces {
132
+ ethernet eth0 {
133
+ duplex auto
134
+ firewall {
135
+ in {
136
+ name WAN_IN_V4
137
+ }
138
+ }
139
+ pppoe 0 {
140
+ default-route auto
141
+ firewall {
142
+ local {
143
+ ipv6-name ROUTER_V6
144
+ name ROUTER_V4
145
+ }
146
+ }
147
+ mtu 1492
148
+ name-server auto
149
+ password 12345678
150
+ traffic-policy {
151
+ }
152
+ user-id [email protected]
153
+ }
154
+ speed auto
155
+ }
156
+ ethernet eth1 {
157
+ address 172.22.117.254/25
158
+ duplex auto
159
+ speed auto
160
+ traffic-policy {
161
+ }
162
+ }
163
+ ethernet eth2 {
164
+ address 192.168.42.1/24
165
+ duplex auto
166
+ speed auto
167
+ }
168
+ loopback lo {
169
+ }
170
+ openvpn vtun0 {
171
+ local-address 172.22.117.254 {
172
+ subnet-mask 255.255.255.128
173
+ }
174
+ local-port 33121
175
+ mode site-to-site
176
+ openvpn-option --comp-lzo
177
+ protocol udp
178
+ remote-address 172.22.117.1
179
+ remote-host 5.9.33.163
180
+ remote-port 33121
181
+ shared-secret-key-file /config/auth/felihome.key
182
+ }
183
+}
184
+policy {
185
+ prefix-list vpn-in {
186
+ rule 10 {
187
+ action permit
188
+ ge 22
189
+ le 28
190
+ prefix 172.22.0.0/15
191
+ }
192
+ }
193
+}
194
+protocols {
195
+ bgp 76197 {
196
+ neighbor 172.22.117.1 {
197
+ description feli-server
198
+ peer-group dn42
199
+ remote-as 64717
200
+ }
201
+ network 172.22.117.128/25 {
202
+ }
203
+ peer-group dn42 {
204
+ soft-reconfiguration {
205
+ inbound
206
+ }
207
+ }
208
+ }
209
+}
210
+service {
211
+ dhcp-server {
212
+ disabled false
213
+ dynamic-dns-update {
214
+ enable true
215
+ }
216
+ shared-network-name int {
217
+ authoritative disable
218
+ subnet 172.22.117.128/25 {
219
+ default-router 172.22.117.254
220
+ dns-server 172.22.117.254
221
+ domain-name feli-home.felicitus.org
222
+ lease 86400
223
+ start 172.22.117.129 {
224
+ stop 172.22.117.150
225
+ }
226
+ static-mapping monitoring {
227
+ ip-address 172.22.117.183
228
+ mac-address 52:54:00:20:df:46
229
+ }
230
+ static-mapping nas {
231
+ ip-address 172.22.117.181
232
+ mac-address e8:39:35:ee:22:7b
233
+ }
234
+ }
235
+ }
236
+ shared-network-name nat {
237
+ authoritative disable
238
+ subnet 192.168.42.0/24 {
239
+ default-router 192.168.42.1
240
+ dns-server 8.8.8.8
241
+ dns-server 8.8.4.4
242
+ lease 86400
243
+ start 192.168.42.10 {
244
+ stop 192.168.42.100
245
+ }
246
+ }
247
+ }
248
+ }
249
+ dns {
250
+ forwarding {
251
+ cache-size 150
252
+ listen-on eth1
253
+ listen-on eth2
254
+ name-server 8.8.8.8
255
+ name-server 8.8.4.4
256
+ options server=/dn42/172.22.0.53
257
+ options server=/22.172.in-addr.arpa/172.22.0.53
258
+ options server=/23.172.in-addr.arpa/172.22.0.53
259
+ options rebind-domain-ok=/dn42/
260
+ }
261
+ }
262
+ nat {
263
+ rule 6000 {
264
+ outbound-interface pppoe0
265
+ type masquerade
266
+ }
267
+ rule 7000 {
268
+ outbound-interface eth2
269
+ type masquerade
270
+ }
271
+ }
272
+ ssh {
273
+ port 22
274
+ protocol-version v2
275
+ }
276
+ upnp {
277
+ listen-on eth1 {
278
+ outbound-interface pppoe0
279
+ }
280
+ listen-on eth2 {
281
+ outbound-interface pppoe0
282
+ }
283
+ }
284
+}
285
+system {
286
+ host-name ubnt
287
+ login {
288
+ user felicitus {
289
+ authentication {
290
+ encrypted-password errnope
291
+ plaintext-password ""
292
+ public-keys [email protected] {
293
+ key AAAAB3NzaC1yc2EAAAADAQABAAABAQDPTSLjSY/Be1XJ/klAwLiM1pKSvmbdcOgtgDB6nPcHkgX6JZu7g/Kejfuk4qIKL8GYYUQt7DlGY6n2u5rChWE/6KZJzXcUwS3pXk4LZ5KydWp7ihfvyRtUOBgKkRa1zQv+6KCH9WyR++ArwVTP8KSkrmDe6k7NWAjZqOuIJHG/AbEyTBapTJYjObZ0AM7wlwcB+oRM1BfZCP0Y+PIP2eGJS7Pyb32pITNKk3JuFXgAvbj5OeRrwtpZ9S+/7wIpaUVODPzrVmbC7vOXu/2KJ9aY2BmxUsxRbrvWMmWNiuE0YPt/7lUroK4pH3md3lWRcGUS/uYvhug7yG1yB81nyI15
294
+ type ssh-rsa
295
+ }
296
+ }
297
+ level admin
298
+ }
299
+ }
300
+ name-server 172.22.117.254
301
+ ntp {
302
+ server 0.ubnt.pool.ntp.org {
303
+ }
304
+ server 1.ubnt.pool.ntp.org {
305
+ }
306
+ server 2.ubnt.pool.ntp.org {
307
+ }
308
+ server 3.ubnt.pool.ntp.org {
309
+ }
310
+ }
311
+ syslog {
312
+ global {
313
+ facility all {
314
+ level notice
315
+ }
316
+ facility protocols {
317
+ level debug
318
+ }
319
+ }
320
+ }
321
+ time-zone UTC
322
+}
323
+traffic-policy {
324
+ shaper client-up-s {
325
+ bandwidth 30kbit
326
+ class 20 {
327
+ bandwidth 100%
328
+ burst 6k
329
+ match TCPACK {
330
+ ip {
331
+ protocol tcp
332
+ }
333
+ mark 225
334
+ }
335
+ priority 5
336
+ queue-limit 65
337
+ queue-type fair-queue
338
+ }
339
+ class 30 {
340
+ bandwidth 5%
341
+ burst 15k
342
+ ceiling 20%
343
+ match ssh {
344
+ ip {
345
+ destination {
346
+ port 22
347
+ }
348
+ dscp lowdelay
349
+ protocol tcp
350
+ }
351
+ }
352
+ match ssh-ipv6 {
353
+ ipv6 {
354
+ destination {
355
+ port 22
356
+ }
357
+ protocol tcp
358
+ }
359
+ }
360
+ priority 6
361
+ queue-limit 10
362
+ queue-type fair-queue
363
+ }
364
+ default {
365
+ bandwidth 95%
366
+ burst 15k
367
+ ceiling 100%
368
+ priority 2
369
+ queue-limit 13
370
+ queue-type fair-queue
371
+ }
372
+ }
373
+}
374
+
375
+
376
+/* Warning: Do not remove the following line. */
377
+/* === vyatta-config-version: "config-management@1:dhcp-relay@1:dhcp-server@4:firewall@4:ipsec@3:nat@3:qos@1:quagga@2:system@4:ubnt-pptp@1:ubnt-util@1:vrrp@1:webgui@1:webproxy@1:zone-policy@1" === */
378
+/* Release version: v1.3.0.4605130.131011.1754 */
379
+```
... ...
\ No newline at end of file