ffrl uplink and fastd split
Niklas Yann Wettengel
6 years ago
parent
d2270e2e50
commit
99dddff862
@ -0,0 +1,14 @@
|
||||
---
|
||||
- name: copy site specific iproute up config script
|
||||
template:
|
||||
src: ffmyk-iproute-up.j2
|
||||
dest: /usr/local/bin/ffmyk-iproute{{ item.name }}-up.sh
|
||||
mode: 0744
|
||||
with_items: "{{ sites }}"
|
||||
|
||||
- name: copy site specific iproute down config script
|
||||
template:
|
||||
src: ffmyk-iproute-down.j2
|
||||
dest: /usr/local/bin/ffmyk-iproute{{ item.name }}-down.sh
|
||||
mode: 0744
|
||||
with_items: "{{ sites }}"
|
||||
@ -0,0 +1,29 @@
|
||||
---
|
||||
- name: create wireguard config for peers
|
||||
template:
|
||||
src: wg.conf.j2
|
||||
dest: /etc/wireguard/wgbb{{ hostvars[item]['wireguard_bb_name'] }}.conf
|
||||
mode: 0400
|
||||
with_items: "{{ groups['ffrl_uplink'] }}"
|
||||
|
||||
- name: create wireguard up scripts for peers
|
||||
template:
|
||||
src: up.sh.j2
|
||||
dest: /etc/wireguard/upbb{{ hostvars[item]['wireguard_bb_name'] }}.sh
|
||||
mode: 0744
|
||||
with_items: "{{ groups['ffrl_uplink'] }}"
|
||||
|
||||
- name: create wireguard down scripts for peers
|
||||
template:
|
||||
src: down.sh.j2
|
||||
dest: /etc/wireguard/downbb{{ hostvars[item]['wireguard_bb_name'] }}.sh
|
||||
mode: 0744
|
||||
with_items: "{{ groups['ffrl_uplink'] }}"
|
||||
|
||||
- name: start and enable wireguard mesh
|
||||
systemd:
|
||||
name: wgbackbone@{{ hostvars[item]['wireguard_bb_name'] }}.service
|
||||
enabled: yes
|
||||
state: started
|
||||
daemon_reload: yes
|
||||
with_items: "{{ groups['ffrl_uplink'] }}"
|
||||
@ -0,0 +1,29 @@
|
||||
---
|
||||
- name: create wireguard config for peers
|
||||
template:
|
||||
src: wg.conf.j2
|
||||
dest: /etc/wireguard/wgbb{{ hostvars[item]['wireguard_bb_name'] }}.conf
|
||||
mode: 0400
|
||||
with_items: "{{ groups['fastd'] }}"
|
||||
|
||||
- name: create wireguard up scripts for peers
|
||||
template:
|
||||
src: up.sh.j2
|
||||
dest: /etc/wireguard/upbb{{ hostvars[item]['wireguard_bb_name'] }}.sh
|
||||
mode: 0744
|
||||
with_items: "{{ groups['fastd'] }}"
|
||||
|
||||
- name: create wireguard down scripts for peers
|
||||
template:
|
||||
src: down.sh.j2
|
||||
dest: /etc/wireguard/downbb{{ hostvars[item]['wireguard_bb_name'] }}.sh
|
||||
mode: 0744
|
||||
with_items: "{{ groups['fastd'] }}"
|
||||
|
||||
- name: start and enable wireguard mesh
|
||||
systemd:
|
||||
name: wgbackbone@{{ hostvars[item]['wireguard_bb_name'] }}.service
|
||||
enabled: yes
|
||||
state: started
|
||||
daemon_reload: yes
|
||||
with_items: "{{ groups['fastd'] }}"
|
||||
@ -1,34 +1,11 @@
|
||||
---
|
||||
- name: create wireguard config for peers
|
||||
template:
|
||||
src: wg.conf.j2
|
||||
dest: /etc/wireguard/wgbb{{ item.name }}.conf
|
||||
mode: 0400
|
||||
with_items: "{{ wireguard_bb_peers }}"
|
||||
|
||||
- name: create wireguard up scripts for peers
|
||||
template:
|
||||
src: up.sh.j2
|
||||
dest: /etc/wireguard/upbb{{ item.name }}.sh
|
||||
mode: 0744
|
||||
with_items: "{{ wireguard_bb_peers }}"
|
||||
|
||||
- name: create wireguard down scripts for peers
|
||||
template:
|
||||
src: down.sh.j2
|
||||
dest: /etc/wireguard/downbb{{ item.name }}.sh
|
||||
mode: 0744
|
||||
with_items: "{{ wireguard_bb_peers }}"
|
||||
|
||||
- name: create wireguard backbone service template
|
||||
copy:
|
||||
src: wgbackbone@.service
|
||||
dest: /etc/systemd/system/wgbackbone@.service
|
||||
|
||||
- name: start and enable wireguard mesh
|
||||
systemd:
|
||||
name: wgbackbone@{{ item.name }}.service
|
||||
enabled: yes
|
||||
state: started
|
||||
daemon_reload: yes
|
||||
with_items: "{{ wireguard_bb_peers }}"
|
||||
- include_tasks: ffrl_uplink_tasks.yml
|
||||
when: "'ffrl_uplink' in group_names"
|
||||
|
||||
- include_tasks: fastd_tasks.yml
|
||||
when: "'fastd' in group_names"
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
#!/bin/bash
|
||||
ip -4 rule del iif bb{{ item.name }} table ffmyk
|
||||
ip -6 rule del iif bb{{ item.name }} table ffmyk
|
||||
ip link set down dev bb{{ item.name }}
|
||||
ip link del bb{{ item.name }}
|
||||
ip -4 rule del iif bb{{ hostvars[item]['wireguard_bb_name'] }} table ffmyk
|
||||
ip -6 rule del iif bb{{ hostvars[item]['wireguard_bb_name'] }} table ffmyk
|
||||
ip link set down dev bb{{ hostvars[item]['wireguard_bb_name'] }}
|
||||
ip link del bb{{ hostvars[item]['wireguard_bb_name'] }}
|
||||
|
||||
@ -1,8 +1,8 @@
|
||||
#!/bin/bash
|
||||
ip link add bb{{ item.name }} type wireguard
|
||||
wg setconf bb{{ item.name }} /etc/wireguard/wgbb{{ item.name }}.conf
|
||||
ip addr add {{ item.address6 }} dev bb{{ item.name }}
|
||||
ip addr add {{ wireguard_bb_ipv4 }}/32 peer {{ item.address }}/32 dev bb{{ item.name }}
|
||||
ip link set up dev bb{{ item.name }}
|
||||
ip -4 rule add iif bb{{ item.name }} table ffmyk priority 10
|
||||
ip -6 rule add iif bb{{ item.name }} table ffmyk priority 10
|
||||
ip link add bb{{ hostvars[item]['wireguard_bb_name'] }} type wireguard
|
||||
wg setconf bb{{ hostvars[item]['wireguard_bb_name'] }} /etc/wireguard/wgbb{{ hostvars[item]['wireguard_bb_name'] }}.conf
|
||||
ip addr add {{ wireguard_bb_ipv6 }} dev bb{{ hostvars[item]['wireguard_bb_name'] }}
|
||||
ip addr add {{ wireguard_bb_ipv4 }}/32 peer {{ hostvars[item]['wireguard_bb_ipv4'] }}/32 dev bb{{ hostvars[item]['wireguard_bb_name'] }}
|
||||
ip link set up dev bb{{ hostvars[item]['wireguard_bb_name'] }}
|
||||
ip -4 rule add iif bb{{ hostvars[item]['wireguard_bb_name'] }} table ffmyk priority 10
|
||||
ip -6 rule add iif bb{{ hostvars[item]['wireguard_bb_name'] }} table ffmyk priority 10
|
||||
|
||||
@ -1,9 +1,9 @@
|
||||
[Interface]
|
||||
ListenPort = {{ item.local_port }}
|
||||
PrivateKey = {{ wireguard_bb_key }}
|
||||
ListenPort = {{ hostvars[item]['wireguard_bb_port'] }}
|
||||
PrivateKey = {{ wireguard_bb_priv_key }}
|
||||
|
||||
[Peer]
|
||||
PublicKey = {{ item.key }}
|
||||
PublicKey = {{ hostvars[item]['wireguard_bb_pub_key'] }}
|
||||
AllowedIPs = 0.0.0.0/0,::/0
|
||||
Endpoint = [{{ item.endpoint }}]:{{ item.remote_port }}
|
||||
Endpoint = [{{ hostvars[item]['wireguard_bb_endpoint'] }}]:{{ wireguard_bb_port }}
|
||||
PersistentKeepalive = 30
|
||||
|
||||
@ -0,0 +1,9 @@
|
||||
---
|
||||
- name: reenable netctl
|
||||
command: netctl reenable {{ item.name }}
|
||||
with_items: "{{ ffrl_peers }}"
|
||||
|
||||
- name: reload bird
|
||||
systemd:
|
||||
name: bird.service
|
||||
state: reloaded
|
||||
@ -0,0 +1,36 @@
|
||||
---
|
||||
- name: create netctl config
|
||||
template:
|
||||
src: netctl
|
||||
dest: /etc/netctl/{{ item.name }}
|
||||
with_items: "{{ ffrl_peers }}"
|
||||
notify: reenable netctl
|
||||
|
||||
- name: enable netctl config
|
||||
command: netctl enable {{ item.name }}
|
||||
args:
|
||||
creates: /etc/systemd/system/netctl@{{ item.name }}.service
|
||||
with_items: "{{ ffrl_peers }}"
|
||||
|
||||
- name: start netctl config
|
||||
systemd:
|
||||
name: netctl@{{ item.name }}.service
|
||||
state: started
|
||||
with_items: "{{ ffrl_peers }}"
|
||||
|
||||
- name: install bird
|
||||
pacman:
|
||||
name: bird
|
||||
state: present
|
||||
|
||||
- name: create bird config
|
||||
template:
|
||||
src: bird.conf
|
||||
dest: /etc/bird.conf
|
||||
notify: reload bird
|
||||
|
||||
- name: start and enable bird
|
||||
systemd:
|
||||
name: bird.service
|
||||
state: started
|
||||
enabled: yes
|
||||
@ -0,0 +1,160 @@
|
||||
timeformat protocol iso long;
|
||||
|
||||
log "bird.log" all;
|
||||
# debug protocols all;
|
||||
|
||||
define ffrl_nat_address = {{ ffrl_ip4 }};
|
||||
|
||||
define ffmyk_as = 65032; # private AS of ffmyk
|
||||
define ffrl_as = 201701; # public AS of rheinland
|
||||
|
||||
router id ffrl_nat_address;
|
||||
|
||||
ipv4 table ffrl4;
|
||||
ipv6 table ffrl6;
|
||||
|
||||
function is_default4() {
|
||||
return net ~ [
|
||||
0.0.0.0/0
|
||||
];
|
||||
}
|
||||
|
||||
function is_default6() {
|
||||
return net ~ [
|
||||
::/0
|
||||
];
|
||||
}
|
||||
|
||||
function is_ffrl_nat4() {
|
||||
return net ~ [
|
||||
{{ ffrl_ip4 }}/32
|
||||
];
|
||||
}
|
||||
|
||||
function is_ffrl_public_nets6() {
|
||||
return net ~ [
|
||||
2a03:2260:1016::/48{48,56}
|
||||
];
|
||||
}
|
||||
|
||||
function is_ffrl_tunnel_nets4() {
|
||||
return net ~ [
|
||||
100.64.0.0/10
|
||||
];
|
||||
}
|
||||
|
||||
function is_ffrl_tunnel_nets6() {
|
||||
return net ~ [
|
||||
2a03:2260:0::/48
|
||||
];
|
||||
}
|
||||
|
||||
# BGP Import Filter für Rheinland
|
||||
filter ebgp_ffrl_import_filter4 {
|
||||
if is_default4() then accept;
|
||||
reject;
|
||||
}
|
||||
|
||||
# BGP Export Filter für Rheinland
|
||||
filter ebgp_ffrl_export_filter4 {
|
||||
if is_ffrl_nat4() then accept;
|
||||
reject;
|
||||
}
|
||||
|
||||
filter ebgp_ffrl_import_filter6 {
|
||||
if is_default6() then accept;
|
||||
reject;
|
||||
}
|
||||
|
||||
filter ebgp_ffrl_export_filter6 {
|
||||
if is_ffrl_public_nets6() then accept;
|
||||
reject;
|
||||
}
|
||||
|
||||
protocol device {
|
||||
scan time 10;
|
||||
}
|
||||
|
||||
# IP-NAT-Adresse legen wir in die interne BIRD Routing Table
|
||||
protocol static ffrl_uplink_hostroute4 {
|
||||
ipv4 { table ffrl4; };
|
||||
route {{ ffrl_ip4 }}/32 reject;
|
||||
}
|
||||
|
||||
protocol static ffrl_public_routes6 {
|
||||
ipv6 { table ffrl6; };
|
||||
route 2a03:2260:1016::/48 reject;
|
||||
}
|
||||
|
||||
# Wir legen die Transfernetze in die interne BIRD Routing Table
|
||||
#protocol direct {
|
||||
# ipv4;
|
||||
# table ffrl4;
|
||||
# interface {% for peer in ffrl_peers %}"{{ peer.name }}", {% endfor %};
|
||||
# import where is_ffrl_tunnel_nets4();
|
||||
#}
|
||||
|
||||
# Wir exportieren über Rheinland gelernte Routen in die Kernel Table 47 (ffrl)
|
||||
protocol kernel kernel_ffrl4 {
|
||||
scan time 30;
|
||||
ipv4 {
|
||||
import none;
|
||||
export filter {
|
||||
krt_prefsrc = ffrl_nat_address;
|
||||
accept;
|
||||
};
|
||||
table ffrl4;
|
||||
};
|
||||
kernel table 42;
|
||||
};
|
||||
|
||||
protocol kernel kernel_ffrl6 {
|
||||
scan time 30;
|
||||
ipv6 {
|
||||
import none;
|
||||
export filter {
|
||||
if is_default6() then accept;
|
||||
reject;
|
||||
};
|
||||
table ffrl6;
|
||||
};
|
||||
kernel table 42;
|
||||
};
|
||||
|
||||
# BGP Template für Rheinland Peerings
|
||||
template bgp ffrl_uplink4 {
|
||||
local as ffmyk_as;
|
||||
ipv4 {
|
||||
table ffrl4;
|
||||
import keep filtered;
|
||||
import filter ebgp_ffrl_import_filter4;
|
||||
export filter ebgp_ffrl_export_filter4;
|
||||
next hop self;
|
||||
};
|
||||
direct;
|
||||
};
|
||||
|
||||
template bgp ffrl_uplink6 {
|
||||
local as ffmyk_as;
|
||||
ipv6 {
|
||||
table ffrl6;
|
||||
import keep filtered;
|
||||
import filter ebgp_ffrl_import_filter6;
|
||||
export filter ebgp_ffrl_export_filter6;
|
||||
next hop self;
|
||||
};
|
||||
direct;
|
||||
};
|
||||
|
||||
{% for peer in ffrl_peers %}
|
||||
protocol bgp ffrl_{{ peer.name }}4 from ffrl_uplink4 {
|
||||
source address {{ peer.ip4 }};
|
||||
neighbor {{ peer.peer_ip4 }} as 201701;
|
||||
};
|
||||
|
||||
protocol bgp ffrl_{{ peer.name }}6 from ffrl_uplink6 {
|
||||
source address {{ peer.ip6 }};
|
||||
neighbor {{ peer.peer_ip6 }} as 201701;
|
||||
}
|
||||
|
||||
{% endfor %}
|
||||
@ -0,0 +1,14 @@
|
||||
Connection=tunnel
|
||||
Interface={{ item.name }}
|
||||
|
||||
Mode=gre
|
||||
Local={{ ansible_default_ipv4.address }}
|
||||
Remote={{ item.remote }}
|
||||
|
||||
ExecUpPost="/usr/bin/ip link set dev {{ item.name }} mtu 1400; /usr/bin/ip tunnel change {{ item.name }} ttl 64"
|
||||
|
||||
IP=static
|
||||
Address=('{{ item.ip4 }}/31' '{{ ffrl_ip4 }}/32')
|
||||
|
||||
IP6=static
|
||||
Address6=('{{ item.ip6 }}/64')
|
||||
Loading…
Reference in New Issue