Router2

Server

Virtuelle Maschine auf KVM

512MB RAM 10GB HD 1 vCPU

Betriebssystem

VyOS

Netzwerkkonfiguration

firewall {

   all-ping enable
   broadcast-ping disable
   config-trap disable
   ipv6-name tun2_in {
       default-action reject
       rule 1 {
           action accept
           protocol icmpv6
       }
       rule 2 {
           action accept
           protocol all
           state {
               established enable
               related enable
           }
       }
       rule 3 {
           action accept
           destination {
               address 2001:470:1f0b:563::15
               port 80
           }
           protocol tcp
           state {
               new enable
           }
       }
       rule 4 {
           action accept
           destination {
               address 2001:470:1f0b:563::15
               port 443
           }
           protocol tcp
           state {
               new enable
           }
       }
   }
   ipv6-receive-redirects disable
   ipv6-src-route disable
   ip-src-route disable
   log-martians enable
   receive-redirects disable
   send-redirects enable
   source-validation disable
   syn-cookies enable
   twa-hazards-protection disable

} interfaces {

   ethernet eth0 {
       address 10.12.3.1/29
       duplex auto
       hw-id 52:54:00:64:19:ea
   }
   ethernet eth1 {
       address 172.16.10.1/24
       address 2001:470:1f0b:563::1/64
       hw-id 52:54:00:c1:6f:c2
       ipv6 {
           dup-addr-detect-transmits 1
       }
       speed auto
   }
   loopback lo {
       address 78.47.239.0/32
       address 78.47.239.1/32
       address 78.47.239.2/32
       address 78.47.239.3/32
       address 78.47.239.4/32
       address 78.47.239.5/32
       address 78.47.239.6/32
       address 78.47.239.7/32
   }
   openvpn vtun0 {
       mode server
       openvpn-option duplicate-cn
       protocol tcp-passive
       server {
           push-route 172.16.10.0/24
           subnet 172.16.11.0/25
       }
       tls {
           ca-cert-file /config/auth/ca.crt
           cert-file /config/auth/server.crt
           dh-file /config/auth/dh2048.pem
           key-file /config/auth/server.key
       }
   }
   tunnel tun2 {
       address 2001:470:1f0a:563::2/64
       description "HE.NET IPv6 Tunnel"
       encapsulation sit
       firewall {
           in {
               ipv6-name tun2_in
           }
       }
       local-ip 78.47.239.0
       multicast disable
       remote-ip 216.66.80.30
   }
   wireguard wg0 {
       address 172.16.12.1/24
       peer michael {
           allowed-ips 192.168.188.0/24
           allowed-ips 172.16.12.2/32
           allowed-ips 192.168.198.0/24
           pubkey 0G3hmNjYbE9/fcbqZGF+LG5r/uaZ5r1CJFyEkrEOSQc=
       }
       peer njk {
           allowed-ips 192.168.0.0/24
           allowed-ips 172.16.12.3/32
           pubkey ugz2GJdirFGMCcI6pdTdEjca19LWIY3rzO+xwplbGzo=
       }
       port 51280
       private-key wg-key
   }

} nat {

   destination {
       rule 2 {
           description mail2
           destination {
               address 78.47.239.3
               port 443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 443
           }
       }
       rule 3 {
           description "owncloud http"
           destination {
               address 78.47.239.1
               port 80
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.3
               port 80
           }
       }
       rule 4 {
           description "owncloud https"
           destination {
               address 78.47.239.1
               port 443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.3
               port 443
           }
       }
       rule 5 {
           destination {
               address 78.47.239.5
               port 80
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 80
           }
       }
       rule 6 {
           destination {
               address 78.47.239.5
               port 22222
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 22
           }
       }
       rule 7 {
           destination {
               address 78.47.239.5
               port 443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 443
           }
       }
       rule 8 {
           destination {
               address 78.47.239.5
               port 9443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 9443
           }
       }
       rule 9 {
           destination {
               address 78.47.239.5
               port 8443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 8443
           }
       }
       rule 10 {
           destination {
               address 78.47.239.5
               port 20
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 20
           }
       }
       rule 11 {
           destination {
               address 78.47.239.5
               port 21
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 21
           }
       }
       rule 12 {
           destination {
               address 78.47.239.5
               port 12000-13000
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.6
               port 12000-13000
           }
       }
       rule 13 {
           destination {
               address 78.47.239.2
               port 80
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.5
               port 80
           }
       }
       rule 14 {
           destination {
               address 78.47.239.2
               port 443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.5
               port 443
           }
       }
       rule 15 {
           destination {
               address 78.47.239.2
               port 6922
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.5
               port 22
           }
       }
       rule 16 {
           description mail2
           destination {
               address 78.47.239.3
               port 993
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 993
           }
       }
       rule 17 {
           description mail2
           destination {
               address 78.47.239.3
               port 587
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 587
           }
       }
       rule 25 {
           destination {
               address 78.47.239.7
               port 443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.11
               port 443
           }
       }
       rule 26 {
           destination {
               address 78.47.239.3
               port 7080
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 80
           }
       }
       rule 27 {
           destination {
               address 78.47.239.6
               port 80
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.20
               port 80
           }
       }
       rule 28 {
           destination {
               address 78.47.239.6
               port 443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.20
               port 443
           }
       }
       rule 29 {
           destination {
               address 78.47.239.0
               port 80
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.13
               port 80
           }
       }
       rule 30 {
           destination {
               address 78.47.239.0
               port 443
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.13
               port 443
           }
       }
       rule 31 {
           destination {
               address 78.47.239.0
               port 2223
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.13
               port 22
           }
       }
       rule 32 {
           description mail2
           destination {
               address 78.47.239.3
               port 80
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 80
           }
       }
       rule 33 {
           description "crm http"
           destination {
               address 78.47.239.7
               port 80
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.11
               port 80
           }
       }
       rule 34 {
           description mail2
           destination {
               address 78.47.239.3
               port 25
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 25
           }
       }
       rule 35 {
           description mail2
           destination {
               address 78.47.239.3
               port 143
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 143
           }
       }
       rule 36 {
           description mail2
           destination {
               address 78.47.239.3
               port 465
           }
           inbound-interface eth0
           protocol tcp
           translation {
               address 172.16.10.22
               port 465
           }
       }
   }
   source {
       rule 110 {
           outbound-interface eth0
           source {
               address 172.16.10.22/32
           }
           translation {
               address 78.47.239.3
           }
       }
       rule 200 {
           outbound-interface eth0
           source {
               address 172.16.10.0/24
           }
           translation {
               address 78.47.239.1
           }
       }
       rule 201 {
           outbound-interface eth0
           source {
               address 172.16.11.128/25
           }
           translation {
               address 78.47.239.1
           }
       }
   }

} protocols {

   static {
       route 0.0.0.0/0 {
           next-hop 10.12.3.2 {
           }
       }
       route 172.16.41.0/24 {
           next-hop 172.16.91.2 {
           }
       }
       route 172.16.42.0/24 {
           next-hop 172.16.43.9 {
           }
       }
       route 192.168.0.0/16 {
           interface wg0 {
           }
       }
       route6 ::/0 {
           next-hop 2001:470:1f0a:563::1 {
           }
       }
   }

} service {

   dns {
       forwarding {
           allow-from 172.16.0.0/12
           cache-size 150
           listen-address 172.16.10.1
           name-server 8.8.8.8
       }
   }
   router-advert {
       interface eth1 {
           prefix 2001:470:1f0b:563::/64 {
           }
       }
   }
   snmp {
       community aquapool {
           authorization ro
           network 172.16.10.0/24
       }
       listen-address 172.16.10.1 {
           port 161
       }
   }
   ssh {
       disable-password-authentication
       listen-address 78.47.239.0
       port 22
   }

} system {

   config-management {
       commit-revisions 20
   }
   console {
       device ttyS0 {
           speed 9600
       }
   }
   host-name router.aquapool.de
   login {
       user falk {
           authentication {
               encrypted-password $1$voX2XI/s$4LcZVA.PZRcHJlS2T7Q5w/
               plaintext-password ""
               public-keys fstern@nb-stern {
                   key AAAAB3NzaC1yc2EAAAABIwAAAQEAzAMO7qr+wTBJy5koRY/1QMbK/GyEttp1DE0VimrqCG7yF3kyMPhMj0Pc2pLBEFbsh9Boec54hGUBnT4+1xC6I5sHxbxnkWpImTyF1KnNDAwh4qYHZby3iJu08xLgsG1XCaeoX8vyzyrXU0n2iH6TjRycgi63jYz+F4vcYKn9tT3ijciFdxMHz82kCpbCa+AfqUex902MB2PhFu2ymKJHQSdT2PmIUqmeEdSPBcmGyhFtTBgpGc+9ZjEFZd34Y0kgXbYNYSnG7lycLY9tWKq379uL3gBBNScuKMJHldjC7KVe8lkvHY563OZ9Y0OvdBXRGKL06+Xl9ZHIRqXa4tC/FQ==
                   type ssh-rsa
               }
           }
       }
       user mg {
           authentication {
               public-keys mg {
                   key AAAAB3NzaC1yc2EAAAADAQABAAACAQC8nakviS7pW6x8Guw0/+qqngJNJfqZdjfsZEDfDtaHMPmGlUAo30kWMXQdzBT8B0WgPBjy66vqKPoZJTQ9d0XGElMcaR1lEWS6eRB7ND4sEHO3wNCFL74rwetu4I2nzpIZxJ4ctXhrXS34RVPS0YksiVltoRBVAORETqesgiuQIQtBzZCtKxymD6BjbX/lkE5YPoyszahkKFSVbHeRbiIS0yPpAu6LaJ0Lmpk+o3Fi8xB4Ouc9VL3yqbtb7yVnF4HRzeF3W56ntkAjeEkl8ZW2Hs+pRQSdh/NEsqs2vX0f+FA6RRGYy5SRQonyUVhNPYP8O8BRM71CLXJFOSZ+c4mTy1aLgbRTuf6ipETpdhvcXnKN4Bx1Ph7uOhkvQFOmtEo7DJCvTQG5VkNKkmHFxrGlpHXyJsjbBf4WKog8fNzxSWBcKr6Z7mc0a5pplXILjgRWO0BZUHk9I7ZuXP9ZBe5/LtNENjyFgXtjeNhyyZNTtNl5RVeXsvJYPHn23+W9++lZeIXrZDUF5iHhcD2v8aRWzIBGNKZw6pNONG2S7MumfeCJnkJl2piS1xaEgPo2es/g9p9jHTC/vRUPzGiACSq+8KrBPSIqookK8XdK4w7kPzoizLnTmd8CbXih5qFsJOTuAlVdyzeAzqVh3zOakUxzRQLrfe7IHEQN2HOYMObtUQ==
                   type ssh-rsa
               }
           }
       }
       user njk {
           authentication {
               encrypted-password $1$QmEAxU4/$AZZjjd2fA9QxQxbN1yrQt/
               plaintext-password ""
               public-keys me@njk {
                   key AAAAB3NzaC1yc2EAAAABIwAAAQEAvLKBzTArq91swhxmS8UDCaEIhX1CDD35aeubyUnU3WSM8rguHTxbDjY4XWfPGO38uABmt5GEk1DqNcqOXG9XwSH523jxaG/2KsJpuBHBngM2rxZmR7LL9Gxy4GNPNuRsVk8R9iqJU7DD4N+g1WJZC/mM3so12YjKE+dfPGJhimUt0wWYqkU6fBX7COZb0p56g02AO5ovVmDQTfqJ9qSXLumWnvt0eGN8us4g/+cNO9RqJBMj+hsXfkbi6bnYVy6fhHVan9B4tLllzSCfxli5Q+NfzIu5rpIR63TiheSQNlvPEqrVs44OkOPLFhBX8McSUlWebwofbPhck+DLrBwz1Q==
                   type ssh-rsa
               }
           }
       }
   }
   name-server 213.133.100.100
   ntp {
       server 0.pool.ntp.org {
       }
       server 0.vyatta.pool.ntp.org {
       }
       server 1.pool.ntp.org {
       }
       server 1.vyatta.pool.ntp.org {
       }
       server 2.pool.ntp.org {
       }
       server 2.vyatta.pool.ntp.org {
       }
   }
   static-host-mapping {
       host-name app1.aquapool.de {
           inet 172.16.10.7
       }
       host-name crm.aquapool.de {
           alias wiki.aquapool.de
           alias wiki2.aquapool.de
           inet 172.16.10.11
       }
       host-name db1.aquapool.de {
           inet 172.16.10.8
       }
       host-name mail2.aquapool.de {
           alias mail.aquapool.de
           inet 172.16.10.22
       }
       host-name om.aquapool.de {
           inet 172.16.10.14
       }
       host-name owncloud.aquapool.de {
           alias cloud.aquapool.de
           inet 172.16.10.3
       }
       host-name service.aquapool.de {
           inet 172.16.10.12
       }
       host-name web3.aquapool.de {
           alias aquacaetum.aquapool.de
           inet 172.16.10.6
       }
       host-name web4.aquapool.de {
           alias www.aquapool.de
           inet 172.16.10.5
       }
   }
   syslog {
       global {
           facility all {
               level notice
           }
           facility protocols {
               level debug
           }
       }
   }
   time-zone GMT

}

// Warning: Do not remove the following line. // vyos-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack@2:conntrack-sync@1:dhcp-relay@2:dhcp-server@5:dhcpv6-server@1:dns-forwarding@3:firewall@5:https@2:interfaces@19:ipoe-server@1:ipsec@5:l2tp@3:lldp@1:mdns@1:nat@5:nat66@1:ntp@1:pppoe-server@5:pptp@2:qos@1:quagga@8:rpki@1:salt@1:snmp@2:ssh@2:sstp@3:system@20:vrrp@2:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2:zone-policy@1" // Release version: 1.4-rolling-202102130218

Software

pptpd für den VPN Zugriff von außen dnsmasq für die Interne DNS Auflösung

 

DNSMASQ

/etc/dnsmasq.conf

expand-hosts
domain=aquapool.de
dhcp-range=172.16.42.240,172.16.42.250,12h
 
dhcp-authoritative

PPTPD Konfiguration

/etc/pptpd.conf

option /etc/ppp/pptpd-options
logwtmp
localip 172.16.42.200
remoteip 172.16.42.201-204

/etc/ppp/pptpd-options

name pptpd
auth
ms-dns 172.16.42.1
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
proxyarp
nodefaultroute
noipx
lock
nobsdcomp 

iptables

Regeln werden in der /etc/rc.local per iptables-restore < /etc/iptables geladen. Nach dem Ändern sollte man die Config mit iptables-save > /etc/iptables sichern.

/etc/iptables

# Generated by iptables-save v1.4.2 on Fri Oct 16 19:20:26 2009
*nat
:PREROUTING ACCEPT [21106:1397562]
:POSTROUTING ACCEPT [15861:956541]
:OUTPUT ACCEPT [5148:352497]
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.42.12:80 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.42.12:443 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 9443 -j DNAT --to-destination 172.16.42.12:9443 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 20 -j DNAT --to-destination 172.16.42.12:20 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 21 -j DNAT --to-destination 172.16.42.12:21 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 12000:13000 -j DNAT --to-destination 172.16.42.12 
-A PREROUTING -d 188.40.111.106/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.42.10:80 
-A PREROUTING -d 188.40.111.106/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.42.10:443 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.42.20:80 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.42.20:443 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 7676 -j DNAT --to-destination 172.16.42.14:7676 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 3820 -j DNAT --to-destination 172.16.42.14:3820 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 3700 -j DNAT --to-destination 172.16.42.14:3700 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 3920 -j DNAT --to-destination 172.16.42.14:3920 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 3820 -j DNAT --to-destination 172.16.42.14:3820 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 3700 -j DNAT --to-destination 172.16.42.14:3700 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 3920 -j DNAT --to-destination 172.16.42.14:3920 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 55820 -j DNAT --to-destination 172.16.42.14:55820 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 80 -j SNAT --to-source 188.40.111.105:80 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 443 -j SNAT --to-source 188.40.111.105:443 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 9443 -j SNAT --to-source 188.40.111.105:9443 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 20 -j SNAT --to-source 188.40.111.105:20 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 21 -j SNAT --to-source 188.40.111.105:21 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 12000:13000 -j SNAT --to-source 188.40.111.105 
-A POSTROUTING -s 172.16.42.10/32 -p tcp -m tcp --sport 80 -j SNAT --to-source 188.40.111.106:80 
-A POSTROUTING -s 172.16.42.10/32 -p tcp -m tcp --sport 443 -j SNAT --to-source 188.40.111.106:443 
-A POSTROUTING -s 172.16.42.20/32 -p tcp -m tcp --sport 80 -j SNAT --to-source 188.40.111.111:80 
-A POSTROUTING -s 172.16.42.20/32 -p tcp -m tcp --sport 443 -j SNAT --to-source 188.40.111.111:443 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 3920 -j SNAT --to-source 188.40.111.105:3920 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 3700 -j SNAT --to-source 188.40.111.105:3700 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 3820 -j SNAT --to-source 188.40.111.105:3820 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 7676 -j SNAT --to-source 188.40.111.111:7676 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 55820 -j SNAT --to-source 188.40.111.111:55820 
-A POSTROUTING -s 172.16.42.0/24 -j MASQUERADE 
COMMIT
# Completed on Fri Oct 16 19:20:26 2009
# Generated by iptables-save v1.4.2 on Fri Oct 16 19:20:26 2009
*filter
:INPUT ACCEPT [299013:88950782]
:FORWARD ACCEPT [1124189:768413642]
:OUTPUT ACCEPT [368819:339895642]
COMMIT
# Completed on Fri Oct 16 19:20:26 2009

Sonstiges

Hat einen GRE Tunnel zu DS3000 mail damit die internen Rechner vom Bacula erreicht werden können.