diff --git a/doc/flyer.svg b/doc/flyer.svg new file mode 100644 index 000000000..4c69773 --- /dev/null +++ b/doc/flyer.svg @@ -0,0 +1,318 @@ + + + + + + + + + + image/svg+xml + + + + + + + Datenvernetzung im Zentralwerk + https://lists.c3d2.de/cgi-bin/mailman/listinfo/zw + + + Informationenzum Anschluß + E-Mail-Liste zurnachbarschaftlichenKoordination + https://github.com/zentralwerk/network + Sprechzeiten:Di + Do 16:00-18:00Haus B Mitte Souterrain + + diff --git a/doc/hello.md b/doc/hello.md index 791cd09..f67c4a7 100644 --- a/doc/hello.md +++ b/doc/hello.md @@ -50,6 +50,19 @@ bestellen und konfigurieren wir ihn. ![TL-WR841N](https://upload.wikimedia.org/wikipedia/commons/thumb/2/23/TP-Link_TL-WR841N-2920.jpg/240px-TP-Link_TL-WR841N-2920.jpg) +### Netzverteilung + +Auch möglich sind diese Konfigurationen: + +* Ihr wohnt nebenan und möchtet euch einen WLAN-Router teilen? Dann + könnt ihr trotzdem individuell verschlüsselte private Subnetze + haben. + +* Du hast mehrere Büros oder Büro und Wohnung im Haus? Auf diese + Datendosen und WLAN-Router können wir dein Subnetz legen, auch wenn + sie an verschiedenen Orten im Haus sind. In einem Subnetz sind + Geräte wie zum Beispiel Drucker direkt auffindbar. + ### Alternative: Eigener alter WLAN-Router @@ -57,10 +70,11 @@ Selbstverständlich wollen wir nichts brauchbares wegwerfen. Zuerst würden wir uns das Gerät anschauen und uns für einen der folgenden Wege entscheiden: -1. Entweder das Gerät wird von [OpenWRT](https://openwrt.org/) - oder [LEDE](https://lede-project.org/) unterstützt, dann können wir - das Gerät analog zu den obigen Modellen mit privatem und Gäste-WLAN - einrichten. +1. Entweder das Gerät wird + von [OpenWRT](https://wiki.openwrt.org/toh/start) + oder [LEDE](https://lede-project.org/toh/views/toh_available_864) + unterstützt, dann können wir das Gerät analog zu den obigen + Modellen mit privatem und Gäste-WLAN einrichten. 2. Alternativ versuchen wir einfach Kabelanschlüsse und WLAN direkt zu verbinden. Damit könnten wir entweder Gästenetz oder dein privates @@ -87,6 +101,31 @@ Bei der Bestellung nehmt ihr das billigste Kabelmodem, nicht die Fritzbox. Um WLAN kümmern wir uns schließlich. +### Warum Internetanschluß routen lassen… + +…statt direkt das Kabelmodem zu verwenden? + +* Wir optimieren die ausgehende Bandbreite um + das [Bufferbloat](https://en.wikipedia.org/wiki/Bufferbloat)-Problem + zu umgehen. +* Du könntest deinen Internetanschluß mit Nachbarn teilen. +* Wir ermöglichen gleichzeitig Zugang zum internen Zentralwerk-Netz. + + +### Kabeldose in der Wohnung? + +…und nicht im Keller? Wir können die oben genannten Ziele trotzdem +erreichen wenn du einen der von uns konfigurierten Router nutzt. + + +## Statische IPv6-Adressen + +Du willst weltweit erreichbar sein mit dem Internet-Protokoll der +Zukunft? Kein Problem: wir verfügen über eine Menge statischer +IPv6-Adressen über den Tunnel-Broker [SixXS](https://www.sixxs.net/) +mit mehreren schnellen Zugangspunkten in geographischer Nähe. + + # Alternative: Isolation Du trägst Bedenken und fühlst dich ohne uns im Internet besser aufgehoben? @@ -101,3 +140,6 @@ Kabelmodem und deine Datendose bekommen. Dienstags und Donnerstags 16:00-18:00 Uhr [C3D2](https://www.c3d2.de/space.html), Haus B Souterrain, genau in der Mitte + + +![Kernnetz visualisiert von eri!](core.png) diff --git a/salt-pillar/hosts/init.sls b/salt-pillar/hosts/init.sls index fe36b9a..b900995 100644 --- a/salt-pillar/hosts/init.sls +++ b/salt-pillar/hosts/init.sls @@ -106,3 +106,76 @@ hosts-inet: c3d2: c3d2-anon: 172.22.99.1 c3d2-gw: 172.22.99.4 + +hosts-inet6: + core: + server1: fd23:42:c3d2:581::1 + + anon1: fd23:42:c3d2:581::9:1 + serv-gw: fd23:42:c3d2:581::8:1 + pub-gw: fd23:42:c3d2:581::8:2 + c3d2-gw: fd23:42:c3d2:581::c3d2:1 + c3d2-anon: fd23:42:c3d2:581::c3d2:a + + upstream1: fd23:42:c3d2:581::b:0 + upstream2: fd23:42:c3d2:581::b:1 + upstream3: fd23:42:c3d2:581::b:2 + upstream4: fd23:42:c3d2:581::b:3 + + priv1-gw: fd23:42:c3d2:581::c:0 + priv2-gw: fd23:42:c3d2:581::c:1 + priv3-gw: fd23:42:c3d2:581::c:2 + priv4-gw: fd23:42:c3d2:581::c:3 + priv5-gw: fd23:42:c3d2:581::c:4 + priv6-gw: fd23:42:c3d2:581::c:5 + priv7-gw: fd23:42:c3d2:581::c:6 + priv8-gw: fd23:42:c3d2:581::c:7 + priv9-gw: fd23:42:c3d2:581::c:8 + priv10-gw: fd23:42:c3d2:581::c:9 + priv11-gw: fd23:42:c3d2:581::c:a + priv12-gw: fd23:42:c3d2:581::c:b + priv13-gw: fd23:42:c3d2:581::c:c + priv14-gw: fd23:42:c3d2:581::c:d + priv15-gw: fd23:42:c3d2:581::c:e + priv16-gw: fd23:42:c3d2:581::c:d + + serv: + serv-gw: fd23:42:c3d2:582::1 + pub: + pub-gw: fd23:42:c3d2:583::1 + priv1: + priv1-gw: fd23:42:c3d2:5c0::1 + priv2: + priv2-gw: fd23:42:c3d2:5c1::1 + priv3: + priv3-gw: fd23:42:c3d2:5c2::1 + priv4: + priv4-gw: fd23:42:c3d2:5c3::1 + priv5: + priv5-gw: fd23:42:c3d2:5c4::1 + priv6: + priv6-gw: fd23:42:c3d2:5c5::1 + priv7: + priv7-gw: fd23:42:c3d2:5c6::1 + priv8: + priv8-gw: fd23:42:c3d2:5c7::1 + priv9: + priv9-gw: fd23:42:c3d2:5c8::1 + priv10: + priv10-gw: fd23:42:c3d2:5c9::1 + priv11: + priv11-gw: fd23:42:c3d2:5ca::1 + priv12: + priv12-gw: fd23:42:c3d2:5cb::1 + priv13: + priv13-gw: fd23:42:c3d2:5cc::1 + priv14: + priv14-gw: fd23:42:c3d2:5cd::1 + priv15: + priv15-gw: fd23:42:c3d2:5ce::1 + priv16: + priv16-gw: fd23:42:c3d2:5cf::1 + + c3d2: + c3d2-anon: fd23:42:c3d2:523::c3d2:1 + c3d2-gw: fd23:42:c3d2:523::c3d2:4 diff --git a/salt-pillar/lxc-containers/server1.sls b/salt-pillar/lxc-containers/server1.sls index 3953d7f..daf9be3 100644 --- a/salt-pillar/lxc-containers/server1.sls +++ b/salt-pillar/lxc-containers/server1.sls @@ -4,6 +4,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 pub: type: veth @@ -20,6 +21,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 priv1: type: phys @@ -28,6 +30,7 @@ containers: core: type: veth gw: upstream2 + gw6: upstream2 priv2: type: phys @@ -36,6 +39,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 priv3: type: phys @@ -44,6 +48,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 priv4: type: phys @@ -52,6 +57,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 priv5: type: phys @@ -60,6 +66,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 priv6: type: phys @@ -68,6 +75,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 priv7: type: phys @@ -76,6 +84,7 @@ containers: core: type: veth gw: anon1 + gw6: anon1 priv8: type: phys @@ -114,5 +123,6 @@ containers: core: type: veth gw: anon1 + gw6: anon1 c3d2: type: veth diff --git a/salt-pillar/ospf/gw.sls b/salt-pillar/quagga/ospfd/gw.sls similarity index 100% rename from salt-pillar/ospf/gw.sls rename to salt-pillar/quagga/ospfd/gw.sls diff --git a/salt-pillar/ospf/init.sls b/salt-pillar/quagga/ospfd/init.sls similarity index 100% rename from salt-pillar/ospf/init.sls rename to salt-pillar/quagga/ospfd/init.sls diff --git a/salt-pillar/subnets/init.sls b/salt-pillar/subnets/init.sls index 0eb407b..a9981d3 100644 --- a/salt-pillar/subnets/init.sls +++ b/salt-pillar/subnets/init.sls @@ -20,3 +20,25 @@ subnets-inet: priv16: 172.20.75.224/28 c3d2: 172.22.99.0/24 mgmt: 10.0.0.0/24 + +subnets-inet6: + core: fd23:42:c3d2:581::/64 + serv: fd23:42:c3d2:582::/64 + pub: fd23:42:c3d2:583::/64 + priv1: fd23:42:c3d2:5c0::/64 + priv2: fd23:42:c3d2:5c1::/64 + priv3: fd23:42:c3d2:5c2::/64 + priv4: fd23:42:c3d2:5c3::/64 + priv5: fd23:42:c3d2:5c4::/64 + priv6: fd23:42:c3d2:5c5::/64 + priv7: fd23:42:c3d2:5c6::/64 + priv8: fd23:42:c3d2:5c7::/64 + priv9: fd23:42:c3d2:5c8::/64 + priv10: fd23:42:c3d2:5c9::/64 + priv11: fd23:42:c3d2:5ca::/64 + priv12: fd23:42:c3d2:5cb::/64 + priv13: fd23:42:c3d2:5cc::/64 + priv14: fd23:42:c3d2:5cd::/64 + priv15: fd23:42:c3d2:5ce::/64 + priv16: fd23:42:c3d2:5cf::/64 + c3d2: fd23:42:c3d2:523::/64 diff --git a/salt-pillar/top.sls b/salt-pillar/top.sls index 32b9d5c..5cfc5f0 100644 --- a/salt-pillar/top.sls +++ b/salt-pillar/top.sls @@ -3,18 +3,18 @@ base: - hosts - subnets - vlans - - ospf + - quagga.ospfd 'priv*-gw': - dhcp - - ospf.gw + - quagga.ospfd.gw 'pub-gw': - dhcp - - ospf.gw + - quagga.ospfd.gw 'serv-gw': - dhcp - - ospf.gw + - quagga.ospfd.gw 'c3d2-gw or c3d2-anon': - - ospf.gw + - quagga.ospfd.gw 'anon1': - vpn.anon1 - upstream.anon1 diff --git a/salt-pillar/upstream/upstream2.sls b/salt-pillar/upstream/upstream2.sls index 211754e..cc9a9ff 100644 --- a/salt-pillar/upstream/upstream2.sls +++ b/salt-pillar/upstream/upstream2.sls @@ -1,7 +1,7 @@ upstream: interface: up2 nat66-interface: up2 - up-bandwidth: 6200 + up-bandwidth: 12400 flow-keys: nfct-src flows: 2048 diff --git a/salt/lxc-containers/config b/salt/lxc-containers/config index 36e1a49..4309f90 100644 --- a/salt/lxc-containers/config +++ b/salt/lxc-containers/config @@ -22,24 +22,35 @@ lxc.network.hwaddr={{ hwaddr_prefix }}:{{ n.__str__().rjust(2, '0') }} {%- if conf['type'] == 'veth' %} lxc.network.veth.pair={{ id }}-{{ net }} {%- endif %} + {%- set hosts = pillar['hosts-inet'].get(net) %} {%- set inet_addr = hosts and hosts.get(id) %} {%- if inet_addr %} {%- set prefix_len = pillar['subnets-inet'][net].split('/')[1] %} lxc.network.ipv4={{ inet_addr }}/{{ prefix_len }} {%- endif %} +{%- set gw = conf.get('gw') %} +{%- if gw %} +lxc.network.ipv4.gateway={{ pillar['hosts-inet'][net][gw] }} +{%- endif %} + +{%- set hosts6 = pillar['hosts-inet6'].get(net) %} +{%- set inet6_addr = hosts6 and hosts6.get(id) %} +{%- if inet6_addr %} +{%- set prefix6_len = pillar['subnets-inet6'][net].split('/')[1] %} +lxc.network.ipv6={{ inet6_addr }}/{{ prefix6_len }} +{%- endif %} +{%- set gw6 = conf.get('gw6') %} +{%- if gw6 %} +lxc.network.ipv6.gateway={{ pillar['hosts-inet6'][net][gw] }} +{%- endif %} + {%- if conf['type'] == 'veth' %} lxc.network.link=br-{{ net }} {%- elif conf['type'] == 'phys' %} lxc.network.link=bond0.{{ pillar['vlans'].get(net) }} {%- endif %} lxc.network.name={{ net }} -{%- set gw = conf.get('gw') %} -{%- if gw %} -lxc.network.ipv4.gateway={{ pillar['hosts-inet'][net][gw] }} -{%- endif %} -#lxc.network.ipv6= -#lxc.network.ipv6.gateway=fe80::1 {%- set n = n + 1 %} {%- endfor %} diff --git a/salt/ospf/init.sls b/salt/ospf/init.sls deleted file mode 100644 index f98235e..000000000 --- a/salt/ospf/init.sls +++ /dev/null @@ -1,31 +0,0 @@ -quagga: - pkg.installed: [] - -{%- for daemon in ['zebra', 'ospfd'] %} -/etc/systemd/system/{{ daemon }}.service: - file.managed: - - source: salt://ospf/{{ daemon }}.service - -/etc/quagga/{{ daemon }}.conf: - file.managed: - - source: salt://ospf/{{ daemon }}.conf - - template: 'jinja' - - require: - - pkg: quagga - -autostart-{{ daemon }}: - service.enabled: - - name: {{ daemon }} - require: - - file: /etc/systemd/system/{{ daemon }}.service - - file: /etc/quagga/{{ daemon }}.conf - -start-{{ daemon }}: - service.running: - - name: {{ daemon }} - require: - - service: autostart-{{ daemon }} - watch: - - file: /etc/quagga/{{ daemon }}.conf - -{%- endfor %} diff --git a/salt/ospf/zebra.conf b/salt/ospf/zebra.conf deleted file mode 100644 index 95d8a69..000000000 --- a/salt/ospf/zebra.conf +++ /dev/null @@ -1,2 +0,0 @@ -hostname {{ salt['grains.get']('id') }} -log file /var/log/quagga/zebra.log diff --git a/salt/quagga/ospf6d/init.sls b/salt/quagga/ospf6d/init.sls new file mode 100644 index 000000000..73dbe8c --- /dev/null +++ b/salt/quagga/ospf6d/init.sls @@ -0,0 +1,25 @@ +/etc/systemd/system/ospf6d.service: + file.managed: + - source: salt://quagga/ospf6d/ospf6d.service + +/etc/quagga/ospf6d.conf: + file.managed: + - source: salt://quagga/ospf6d/ospf6d.conf + - template: 'jinja' + - require: + - pkg: quagga + +autostart-ospf6d: + service.enabled: + - name: ospf6d + require: + - file: /etc/systemd/system/ospf6d.service + - file: /etc/quagga/ospf6d.conf + +start-ospf6d: + service.running: + - name: ospf6d + require: + - service: autostart-ospf6d + watch: + - file: /etc/quagga/ospf6d.conf diff --git a/salt/quagga/ospf6d/ospf6d.conf b/salt/quagga/ospf6d/ospf6d.conf new file mode 100644 index 000000000..1ba6106 --- /dev/null +++ b/salt/quagga/ospf6d/ospf6d.conf @@ -0,0 +1,25 @@ +log file /var/log/quagga/ospfd.log + +{%- set id = salt['grains.get']('id') %} +{%- set core_ifaces = ['br-core', 'core'] %} + +{%- for iface in core_ifaces %} +interface {{ iface }} + ipv6 ospf6 network broadcast + +{%- endfor %} + +router ospf6 + router-id {{ pillar['hosts-inet']['core'][id] }} + +{%- for iface in core_ifaces %} + interface {{ iface }} area 0.0.0.0 +{%- endfor %} + area 0.0.0.0 range {{ pillar['subnets-inet6']['core'] }} + +{%- set redistribute = pillar['ospf'].get('redistribute') %} +{%- if redistribute %} +{%- for kind in redistribute %} + redistribute {{ kind }} +{%- endfor %} +{%- endif %} diff --git a/salt/quagga/ospf6d/ospf6d.service b/salt/quagga/ospf6d/ospf6d.service new file mode 100644 index 000000000..6304684 --- /dev/null +++ b/salt/quagga/ospf6d/ospf6d.service @@ -0,0 +1,11 @@ +[Unit] +Requires = zebra.service +After = network.target + +[Service] +ExecStartPre = /bin/mkdir -p /var/run/quagga +ExecStartPre = /bin/chown -R quagga:quagga /var/run/quagga/ +ExecStart = /usr/lib/quagga/ospf6d + +[Install] +WantedBy = default.target diff --git a/salt/quagga/ospfd/init.sls b/salt/quagga/ospfd/init.sls new file mode 100644 index 000000000..aa4e6cd --- /dev/null +++ b/salt/quagga/ospfd/init.sls @@ -0,0 +1,25 @@ +/etc/systemd/system/ospfd.service: + file.managed: + - source: salt://quagga/ospfd/ospfd.service + +/etc/quagga/ospfd.conf: + file.managed: + - source: salt://quagga/ospfd/ospfd.conf + - template: 'jinja' + - require: + - pkg: quagga + +autostart-ospfd: + service.enabled: + - name: ospfd + require: + - file: /etc/systemd/system/ospfd.service + - file: /etc/quagga/ospfd.conf + +start-ospfd: + service.running: + - name: ospfd + require: + - service: autostart-ospfd + watch: + - file: /etc/quagga/ospfd.conf diff --git a/salt/ospf/ospfd.conf b/salt/quagga/ospfd/ospfd.conf similarity index 98% rename from salt/ospf/ospfd.conf rename to salt/quagga/ospfd/ospfd.conf index dd5cae3..9cbd2cb 100644 --- a/salt/ospf/ospfd.conf +++ b/salt/quagga/ospfd/ospfd.conf @@ -7,7 +7,6 @@ log file /var/log/quagga/ospfd.log interface {{ iface }} ip ospf network broadcast ip ospf authentication message-digest - ! TODO: ip ospf message-digest-key 1 md5 {{ pillar['ospf']['ospf_secret'] }} {%- endfor %} diff --git a/salt/ospf/ospfd.service b/salt/quagga/ospfd/ospfd.service similarity index 100% rename from salt/ospf/ospfd.service rename to salt/quagga/ospfd/ospfd.service diff --git a/salt/quagga/zebra/init.sls b/salt/quagga/zebra/init.sls new file mode 100644 index 000000000..8d2c908 --- /dev/null +++ b/salt/quagga/zebra/init.sls @@ -0,0 +1,28 @@ +quagga: + pkg.installed: [] + +/etc/systemd/system/zebra.service: + file.managed: + - source: salt://quagga/zebra/zebra.service + +/etc/quagga/zebra.conf: + file.managed: + - source: salt://quagga/zebra/zebra.conf + - template: 'jinja' + - require: + - pkg: quagga + +autostart-zebra: + service.enabled: + - name: zebra + require: + - file: /etc/systemd/system/zebra.service + - file: /etc/quagga/zebra.conf + +start-zebra: + service.running: + - name: zebra + require: + - service: autostart-zebra + watch: + - file: /etc/quagga/zebra.conf diff --git a/salt/quagga/zebra/zebra.conf b/salt/quagga/zebra/zebra.conf new file mode 100644 index 000000000..734bc50 --- /dev/null +++ b/salt/quagga/zebra/zebra.conf @@ -0,0 +1,19 @@ +hostname {{ salt['grains.get']('id') }} +log file /var/log/quagga/zebra.log + +{%- for iface, ips in salt['grains.get']('ip_interfaces').items() %} +{%- if iface not in ['br-core', 'core', 'lo', 'c3d2'] and pillar['subnets-inet6'].get(iface) %} +{%- set subnet6 = pillar['subnets-inet6'][iface] %} +{%- set prefix6_len = subnet6.split('/')[1] %} +interface {{ iface }} + ipv6 address {{ pillar['hosts-inet6'][iface][salt['grains.get']('id')] }}/{{ prefix6_len }} + ipv6 nd prefix {{ subnet6 }} + ipv6 nd ra-interval 10 + ipv6 nd ra-lifetime 60 + ipv6 nd reachable-time 180 + no ipv6 nd suppress-ra +{%- endif %} +{%- endfor %} + +ip forwarding +ipv6 forwarding diff --git a/salt/ospf/zebra.service b/salt/quagga/zebra/zebra.service similarity index 100% rename from salt/ospf/zebra.service rename to salt/quagga/zebra/zebra.service diff --git a/salt/top.sls b/salt/top.sls index 9e9805a..d7bd930 100644 --- a/salt/top.sls +++ b/salt/top.sls @@ -3,22 +3,37 @@ base: - salt-master - server1-network - lxc-containers - - ospf + - quagga.zebra + - quagga.ospfd + - quagga.ospf6d - switches - cpe 'priv*-gw': - no-ssh - forwarding - - ospf + - quagga.zebra + - quagga.ospfd + - quagga.ospf6d + - dhcp + 'pub-gw or serv-gw': + - no-ssh + - forwarding + - quagga.zebra + - quagga.ospfd + - quagga.ospf6d - dhcp 'c3d2-gw or c3d2-anon': - no-ssh - forwarding - - ospf + - quagga.zebra + - quagga.ospfd + - quagga.ospf6d 'upstream*': - no-ssh - forwarding - - ospf + - quagga.zebra + - quagga.ospfd + - quagga.ospf6d - unbound - upstream.dhcp - upstream.shaping @@ -32,7 +47,9 @@ base: 'anon*': - no-ssh - forwarding - - ospf + - quagga.zebra + - quagga.ospfd + - quagga.ospf6d - vpn.openvpn - upstream.masquerade - upstream.shaping