Router2: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
Markierung: wikieditor |
Markierung: wikieditor |
||
| Zeile 718: | Zeile 718: | ||
lock | lock | ||
nobsdcomp | nobsdcomp | ||
</pre> | </pre> | ||
Version vom 3. April 2023, 11:38 Uhr
Server
Virtuelle Maschine auf KVM
512MB RAM 10GB HD 1 vCPU
Betriebssystem
VyOS
Netzwerkkonfiguration
firewall {
all-ping enable
broadcast-ping disable
config-trap disable
ipv6-name tun2_in {
default-action reject
rule 1 {
action accept
protocol icmpv6
}
rule 2 {
action accept
protocol all
state {
established enable
related enable
}
}
rule 3 {
action accept
destination {
address 2001:470:1f0b:563::15
port 80
}
protocol tcp
state {
new enable
}
}
rule 4 {
action accept
destination {
address 2001:470:1f0b:563::15
port 443
}
protocol tcp
state {
new enable
}
}
}
ipv6-receive-redirects disable
ipv6-src-route disable
ip-src-route disable
log-martians enable
receive-redirects disable
send-redirects enable
source-validation disable
syn-cookies enable
twa-hazards-protection disable
}
interfaces {
ethernet eth0 {
address 10.12.3.1/29
duplex auto
hw-id 52:54:00:64:19:ea
}
ethernet eth1 {
address 172.16.10.1/24
address 2001:470:1f0b:563::1/64
hw-id 52:54:00:c1:6f:c2
ipv6 {
dup-addr-detect-transmits 1
}
speed auto
}
loopback lo {
address 78.47.239.0/32
address 78.47.239.1/32
address 78.47.239.2/32
address 78.47.239.3/32
address 78.47.239.4/32
address 78.47.239.5/32
address 78.47.239.6/32
address 78.47.239.7/32
}
openvpn vtun0 {
mode server
openvpn-option duplicate-cn
protocol tcp-passive
server {
push-route 172.16.10.0/24
subnet 172.16.11.0/25
}
tls {
ca-cert-file /config/auth/ca.crt
cert-file /config/auth/server.crt
dh-file /config/auth/dh2048.pem
key-file /config/auth/server.key
}
}
tunnel tun2 {
address 2001:470:1f0a:563::2/64
description "HE.NET IPv6 Tunnel"
encapsulation sit
firewall {
in {
ipv6-name tun2_in
}
}
local-ip 78.47.239.0
multicast disable
remote-ip 216.66.80.30
}
wireguard wg0 {
address 172.16.12.1/24
peer michael {
allowed-ips 192.168.188.0/24
allowed-ips 172.16.12.2/32
allowed-ips 192.168.198.0/24
pubkey 0G3hmNjYbE9/fcbqZGF+LG5r/uaZ5r1CJFyEkrEOSQc=
}
peer njk {
allowed-ips 192.168.0.0/24
allowed-ips 172.16.12.3/32
pubkey ugz2GJdirFGMCcI6pdTdEjca19LWIY3rzO+xwplbGzo=
}
port 51280
private-key wg-key
}
}
nat {
destination {
rule 2 {
description mail2
destination {
address 78.47.239.3
port 443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 443
}
}
rule 3 {
description "owncloud http"
destination {
address 78.47.239.1
port 80
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.3
port 80
}
}
rule 4 {
description "owncloud https"
destination {
address 78.47.239.1
port 443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.3
port 443
}
}
rule 5 {
destination {
address 78.47.239.5
port 80
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 80
}
}
rule 6 {
destination {
address 78.47.239.5
port 22222
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 22
}
}
rule 7 {
destination {
address 78.47.239.5
port 443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 443
}
}
rule 8 {
destination {
address 78.47.239.5
port 9443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 9443
}
}
rule 9 {
destination {
address 78.47.239.5
port 8443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 8443
}
}
rule 10 {
destination {
address 78.47.239.5
port 20
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 20
}
}
rule 11 {
destination {
address 78.47.239.5
port 21
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 21
}
}
rule 12 {
destination {
address 78.47.239.5
port 12000-13000
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.6
port 12000-13000
}
}
rule 13 {
destination {
address 78.47.239.2
port 80
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.5
port 80
}
}
rule 14 {
destination {
address 78.47.239.2
port 443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.5
port 443
}
}
rule 15 {
destination {
address 78.47.239.2
port 6922
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.5
port 22
}
}
rule 16 {
description mail2
destination {
address 78.47.239.3
port 993
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 993
}
}
rule 17 {
description mail2
destination {
address 78.47.239.3
port 587
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 587
}
}
rule 25 {
destination {
address 78.47.239.7
port 443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.11
port 443
}
}
rule 26 {
destination {
address 78.47.239.3
port 7080
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 80
}
}
rule 27 {
destination {
address 78.47.239.6
port 80
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.20
port 80
}
}
rule 28 {
destination {
address 78.47.239.6
port 443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.20
port 443
}
}
rule 29 {
destination {
address 78.47.239.0
port 80
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.13
port 80
}
}
rule 30 {
destination {
address 78.47.239.0
port 443
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.13
port 443
}
}
rule 31 {
destination {
address 78.47.239.0
port 2223
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.13
port 22
}
}
rule 32 {
description mail2
destination {
address 78.47.239.3
port 80
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 80
}
}
rule 33 {
description "crm http"
destination {
address 78.47.239.7
port 80
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.11
port 80
}
}
rule 34 {
description mail2
destination {
address 78.47.239.3
port 25
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 25
}
}
rule 35 {
description mail2
destination {
address 78.47.239.3
port 143
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 143
}
}
rule 36 {
description mail2
destination {
address 78.47.239.3
port 465
}
inbound-interface eth0
protocol tcp
translation {
address 172.16.10.22
port 465
}
}
}
source {
rule 110 {
outbound-interface eth0
source {
address 172.16.10.22/32
}
translation {
address 78.47.239.3
}
}
rule 200 {
outbound-interface eth0
source {
address 172.16.10.0/24
}
translation {
address 78.47.239.1
}
}
rule 201 {
outbound-interface eth0
source {
address 172.16.11.128/25
}
translation {
address 78.47.239.1
}
}
}
}
protocols {
static {
route 0.0.0.0/0 {
next-hop 10.12.3.2 {
}
}
route 172.16.41.0/24 {
next-hop 172.16.91.2 {
}
}
route 172.16.42.0/24 {
next-hop 172.16.43.9 {
}
}
route 192.168.0.0/16 {
interface wg0 {
}
}
route6 ::/0 {
next-hop 2001:470:1f0a:563::1 {
}
}
}
}
service {
dns {
forwarding {
allow-from 172.16.0.0/12
cache-size 150
listen-address 172.16.10.1
name-server 8.8.8.8
}
}
router-advert {
interface eth1 {
prefix 2001:470:1f0b:563::/64 {
}
}
}
snmp {
community aquapool {
authorization ro
network 172.16.10.0/24
}
listen-address 172.16.10.1 {
port 161
}
}
ssh {
disable-password-authentication
listen-address 78.47.239.0
port 22
}
}
system {
config-management {
commit-revisions 20
}
console {
device ttyS0 {
speed 9600
}
}
host-name router.aquapool.de
login {
user falk {
authentication {
encrypted-password $1$voX2XI/s$4LcZVA.PZRcHJlS2T7Q5w/
plaintext-password ""
public-keys fstern@nb-stern {
key AAAAB3NzaC1yc2EAAAABIwAAAQEAzAMO7qr+wTBJy5koRY/1QMbK/GyEttp1DE0VimrqCG7yF3kyMPhMj0Pc2pLBEFbsh9Boec54hGUBnT4+1xC6I5sHxbxnkWpImTyF1KnNDAwh4qYHZby3iJu08xLgsG1XCaeoX8vyzyrXU0n2iH6TjRycgi63jYz+F4vcYKn9tT3ijciFdxMHz82kCpbCa+AfqUex902MB2PhFu2ymKJHQSdT2PmIUqmeEdSPBcmGyhFtTBgpGc+9ZjEFZd34Y0kgXbYNYSnG7lycLY9tWKq379uL3gBBNScuKMJHldjC7KVe8lkvHY563OZ9Y0OvdBXRGKL06+Xl9ZHIRqXa4tC/FQ==
type ssh-rsa
}
}
}
user mg {
authentication {
public-keys mg {
key AAAAB3NzaC1yc2EAAAADAQABAAACAQC8nakviS7pW6x8Guw0/+qqngJNJfqZdjfsZEDfDtaHMPmGlUAo30kWMXQdzBT8B0WgPBjy66vqKPoZJTQ9d0XGElMcaR1lEWS6eRB7ND4sEHO3wNCFL74rwetu4I2nzpIZxJ4ctXhrXS34RVPS0YksiVltoRBVAORETqesgiuQIQtBzZCtKxymD6BjbX/lkE5YPoyszahkKFSVbHeRbiIS0yPpAu6LaJ0Lmpk+o3Fi8xB4Ouc9VL3yqbtb7yVnF4HRzeF3W56ntkAjeEkl8ZW2Hs+pRQSdh/NEsqs2vX0f+FA6RRGYy5SRQonyUVhNPYP8O8BRM71CLXJFOSZ+c4mTy1aLgbRTuf6ipETpdhvcXnKN4Bx1Ph7uOhkvQFOmtEo7DJCvTQG5VkNKkmHFxrGlpHXyJsjbBf4WKog8fNzxSWBcKr6Z7mc0a5pplXILjgRWO0BZUHk9I7ZuXP9ZBe5/LtNENjyFgXtjeNhyyZNTtNl5RVeXsvJYPHn23+W9++lZeIXrZDUF5iHhcD2v8aRWzIBGNKZw6pNONG2S7MumfeCJnkJl2piS1xaEgPo2es/g9p9jHTC/vRUPzGiACSq+8KrBPSIqookK8XdK4w7kPzoizLnTmd8CbXih5qFsJOTuAlVdyzeAzqVh3zOakUxzRQLrfe7IHEQN2HOYMObtUQ==
type ssh-rsa
}
}
}
user njk {
authentication {
encrypted-password $1$QmEAxU4/$AZZjjd2fA9QxQxbN1yrQt/
plaintext-password ""
public-keys me@njk {
key AAAAB3NzaC1yc2EAAAABIwAAAQEAvLKBzTArq91swhxmS8UDCaEIhX1CDD35aeubyUnU3WSM8rguHTxbDjY4XWfPGO38uABmt5GEk1DqNcqOXG9XwSH523jxaG/2KsJpuBHBngM2rxZmR7LL9Gxy4GNPNuRsVk8R9iqJU7DD4N+g1WJZC/mM3so12YjKE+dfPGJhimUt0wWYqkU6fBX7COZb0p56g02AO5ovVmDQTfqJ9qSXLumWnvt0eGN8us4g/+cNO9RqJBMj+hsXfkbi6bnYVy6fhHVan9B4tLllzSCfxli5Q+NfzIu5rpIR63TiheSQNlvPEqrVs44OkOPLFhBX8McSUlWebwofbPhck+DLrBwz1Q==
type ssh-rsa
}
}
}
}
name-server 213.133.100.100
ntp {
server 0.pool.ntp.org {
}
server 0.vyatta.pool.ntp.org {
}
server 1.pool.ntp.org {
}
server 1.vyatta.pool.ntp.org {
}
server 2.pool.ntp.org {
}
server 2.vyatta.pool.ntp.org {
}
}
static-host-mapping {
host-name app1.aquapool.de {
inet 172.16.10.7
}
host-name crm.aquapool.de {
alias wiki.aquapool.de
alias wiki2.aquapool.de
inet 172.16.10.11
}
host-name db1.aquapool.de {
inet 172.16.10.8
}
host-name mail2.aquapool.de {
alias mail.aquapool.de
inet 172.16.10.22
}
host-name om.aquapool.de {
inet 172.16.10.14
}
host-name owncloud.aquapool.de {
alias cloud.aquapool.de
inet 172.16.10.3
}
host-name service.aquapool.de {
inet 172.16.10.12
}
host-name web3.aquapool.de {
alias aquacaetum.aquapool.de
inet 172.16.10.6
}
host-name web4.aquapool.de {
alias www.aquapool.de
inet 172.16.10.5
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone GMT
}
// Warning: Do not remove the following line.
// vyos-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack@2:conntrack-sync@1:dhcp-relay@2:dhcp-server@5:dhcpv6-server@1:dns-forwarding@3:firewall@5:https@2:interfaces@19:ipoe-server@1:ipsec@5:l2tp@3:lldp@1:mdns@1:nat@5:nat66@1:ntp@1:pppoe-server@5:pptp@2:qos@1:quagga@8:rpki@1:salt@1:snmp@2:ssh@2:sstp@3:system@20:vrrp@2:vyos-accel-ppp@2:wanloadbalance@3:webproxy@2:zone-policy@1"
// Release version: 1.4-rolling-202102130218
Software
pptpd für den VPN Zugriff von außen dnsmasq für die Interne DNS Auflösung
DNSMASQ
/etc/dnsmasq.conf
expand-hosts domain=aquapool.de dhcp-range=172.16.42.240,172.16.42.250,12h dhcp-authoritative
PPTPD Konfiguration
/etc/pptpd.conf
option /etc/ppp/pptpd-options logwtmp localip 172.16.42.200 remoteip 172.16.42.201-204
/etc/ppp/pptpd-options
name pptpd auth ms-dns 172.16.42.1 refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 proxyarp nodefaultroute noipx lock nobsdcomp
Sonstiges
Hat einen GRE Tunnel zu DS3000 mail damit die internen Rechner vom Bacula erreicht werden können.