Alex/ff/logbuch

Logbuch 20141130

root@vm04:~# cat /etc/debian_version 
7.7

stolen from freifunk-muenster.de

deb http://repo.universe-factory.net/debian/ sid main
deb http://download.opensuse.org/repositories/home:/fusselkater:/ffms/Debian_7.0/ /
deb http://http.debian.net/debian wheezy-backports main
gpg --keyserver pgpkeys.mit.edu --recv-key 16EF3F64CB201D9C
gpg -a --export 16EF3F64CB201D9C | apt-key add -
wget http://download.opensuse.org/repositories/home:fusselkater:ffms/Debian_7.0/Release.key
apt-key add - < Release.key
aptitude update

aptitude install sudo bridge-utils batctl=2013.4.0-1 openvpn haveged fastd radvd isc-dhcp-server bind9 git alfred alfred-json batman-adv-dkms nagios-nrpe-server ntp

IP Forwarding aktivieren

/etc/sysctl.d/forwarding.conf <highlightSyntax language="txt">

1. IPv4 Forwarding

net.ipv4.ip_forward=1

1. IPv6 Forwarding

net.ipv6.conf.all.forwarding = 1 </highlightSyntax>

Als erstes brauchen wir eine Netzwerkbrücke, als Schnittstelle zwischen dem Mesh-Netz und dem MULLVAD-VPN.

Dazu füge in die Konfigurationsdatei /etc/network/interfaces folgendes hinzu: /etc/network/interfaces <highlightSyntax language="txt">

1. Netwerkbruecke fuer Freifunk
2. - Hier laeuft der Traffic von den einzelnen Routern und dem externen VPN
3. - zusammen
4. - Unter der hier konfigurierten IP ist der Server selber im Freifunk Netz
5. - erreichbar
6. - bridge_ports none sorgt dafuer, dass die Bruecke auch ohne Interface
7. - erstellt wird

auto br0

iface br0 inet static

       address 10.109.0.1    # die 1 für mein Gateway
       netmask 255.255.0.0
       bridge_ports none  

iface br0 inet6 static

       address fde6:36fc:c985::1 # die 1 für mein Gateway
       netmask 48

</highlightSyntax>

Als nächstes muss das bat0-Interface konfiguriert werden. Dazu bearbeitest du wieder die /etc/network/interfaces <highlightSyntax language="txt">

1. Batman Interface
2. - Erstellt das virtuelle Inteface fuer das Batman-Modul und bindet dieses an die Netzwerkbruecke
3. - Die unten angelegte Routing-Tabelle wird spaeter fuer das Routing innerhalb von Freifunk (Router/VPN) verwendet

allow-hotplug bat0

iface bat0 inet6 manual

       pre-up modprobe batman-adv
       post-up ip link set dev bat0 up
       post-up brctl addif br0 bat0
       post-up batctl it 10000
       post-up ip rule add from all fwmark 0x1 table 42
       post-up start-stop-daemon -b --start --exec /usr/sbin/alfred -- -i br0 -b bat0 -m;
       post-up start-stop-daemon -b --start --exec /usr/sbin/batadv-vis -- -i bat0 -s;

</highlightSyntax>

IPtables-Regeln

/etc/iptables.up.rules <highlightSyntax language="txt">

• filter # in wie weit ist das notwendig?

INPUT ACCEPT [0:0]

FORWARD ACCEPT [0:0]

OUTPUT ACCEPT [0:0]

COMMIT

1. Regeln zum markieren eingehender Pakete

• mangle

PREROUTING ACCEPT [0:0]

INPUT ACCEPT [0:0]

FORWARD ACCEPT [0:0]

OUTPUT ACCEPT [0:0]

POSTROUTING ACCEPT [0:0]

-A PREROUTING -i br0 -j MARK --set-xmark 0x1/0xffffffff -A OUTPUT -o eth0 -p udp --dport 53 -j MARK --set-xmark 0x1/0xffffffff -A OUTPUT -o eth0 -p tcp --dport 53 -j MARK --set-xmark 0x1/0xffffffff COMMIT </highlightSyntax>

/etc/iptables.up.rules <highlightSyntax language="txt">

1. Route an VPN per nat.

• nat

PREROUTING ACCEPT [0:0]

INPUT ACCEPT [0:0]

OUTPUT ACCEPT [0:0]

POSTROUTING ACCEPT [0:0]

-A POSTROUTING -o tun0 -j MASQUERADE COMMIT </highlightSyntax>

Als letztes musst du dafür sorgen, dass die IPtables-Regeln auch geladen werden. dazu erzeuge die Datei

/etc/network/if-pre-up.d/iptables <highlightSyntax language="bash">

1. !/bin/sh

/sbin/iptables-restore < /etc/iptables.up.rules </highlightSyntax>

chmod +x /etc/network/if-pre-up.d/iptables

iptables-restore < /etc/iptables.up.rules

--MULLVAD-VPN einrichten--

xxxxxx

--Einrichtung des Mesh-VPNs--

mkdir -p /etc/fastd/vpn/peers

fastd --generate-key

dieser Befehl zeigt dir die Schlüssel lediglich an. Heißt du musst sie dir aus dem Terminal kopieren, um sie im nächsten Schritt verwenden zu können.

Hier ist noch was offen

/etc/fastd/vpn/fastd.conf <highlightSyntax language="txt">

1. Bind to a fixed address and port, IPv4 and IPv6

bind EXTERNE-IPv4-ADRESSE:14242 interface "eth0"; ## Anpassen bind [EXTERNE-IPv6-ADRESSE]:14242 interface "eth0"; ## Anpassen

1. Set the user, fastd will work as

user "nobody";

1. Set the interface name

interface "mesh-vpn";

1. Set the mode, the interface will work as

mode tap;

1. Set the mtu of the interface (salsa2012 with ipv6 will need 1406)

mtu 1406;

1. Set the methods (aes128-gcm preferred, salsa2012+umac preferred for nodes)

method "aes128-gcm"; method "salsa2012+umac"; method "salsa2012+gmac";

1. Secret key generated by `fastd --generate-key`

secret "SERVER-SECRET-KEY"; ## Anpassen

1. Log everything to syslog

log to syslog level debug;

1. Include peers from our git-repos

include peers from "/var/gateway-ffgoe/nodes/"; include peers from "/var/gateway-ffgoe/backbone/";

1. Configure a shell command that is run on connection attempts by unknown peers (true means, all attempts are accepted)
2. on verify "true";

1. Configure a shell command that is run when fastd comes up

on up "

 ip link set dev $INTERFACE address de:ad:be:ef:43:XX ## Anpassen
 ip link set dev $INTERFACE up
 ifup bat0
 batctl if add $INTERFACE
 batctl gw server 1024Mbit/1024Mbit  ## DOWNSTREAM/UPSTREAM  
 batctl vm server

"; </highlightSyntax>

Nun brauchst du die Peers aus unserem GIT-Repository. Wechsle dazu in das Verzeichnis '''/var''' und führe folgendes aus:

 git clone https://github.com/FreiFunkMuenster/gateway-ffms.git

--IPv6 Router Advertisements einrichten-- /etc/radvd.conf <highlightSyntax language="txt"> interface br0 {

   AdvSendAdvert on;
   IgnoreIfMissing on;

   AdvManagedFlag off;
   AdvOtherConfigFlag on;

   prefix fde6:36fc:c985::/64
   {
   };

   RDNSS fde6:36fc:c985::1 {  # :1 für meinen server
   };

}; </highlightSyntax>

--DHCPv4 Server einrichten-- /etc/dhcp/dhcpd.conf <highlightSyntax language="txt"> default-lease-time 120; max-lease-time 600;

authoritative;

log-facility local7;

subnet 10.109.0.0 netmask 255.255.0.0 {

   range 10.109.1.1 10.43.1.254;         # 1 für server #1 Anpassen

   option routers 10.43.0.1;             # .1 für server #1 Anpassen
   option domain-name-servers 10.43.0.1; # .1 für server #1 Anpassen

} </highlightSyntax>

/etc/default/isc-dhcp-server <highlightSyntax language="txt">

1. On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
2. Separate multiple interfaces with spaces, e.g. "eth0 eth1".

INTERFACES="br0" </highlightSyntax>

/etc/init.d/isc-dhcp6-server <highlightSyntax language="bash">

1. !/bin/sh

1. 1. 1. BEGIN INIT INFO
2. Provides: isc-dhcp6-server
3. Required-Start: $remote_fs $network $syslog
4. Required-Stop: $remote_fs $network $syslog
5. Should-Start: $local_fs slapd $named
6. Should-Stop: $local_fs slapd
7. Default-Start: 2 3 4 5
8. Default-Stop: 0 1 6
9. Short-Description: DHCP6 server
10. Description: Dynamic Host Configuration Protocol Server V6
    1. 1. END INIT INFO

PATH=/sbin:/bin:/usr/sbin:/usr/bin

test -f /usr/sbin/dhcpd || exit 0

DHCPD_DEFAULT="${DHCPD_DEFAULT:-/etc/default/isc-dhcp6-server}"

1. It is not safe to start if we don't have a default configuration...

if [ ! -f "$DHCPD_DEFAULT" ]; then

       echo "$DHCPD_DEFAULT does not exist! - Aborting..."
       if [ "$DHCPD_DEFAULT" = "/etc/default/isc-dhcp6-server" ]; then
               echo "Run 'dpkg-reconfigure isc-dhcp-server' to fix the problem."
       fi
       exit 0

fi

. /lib/lsb/init-functions

1. Read init script configuration

[ -f "$DHCPD_DEFAULT" ] && . "$DHCPD_DEFAULT"

NAME=dhcpd DESC="ISC DHCP6 server"

1. fallback to default config file

DHCPD_CONF=${DHCPD_CONF:-/etc/dhcp/dhcpd6.conf}

1. try to read pid file name from config file, with fallback to /var/run/dhcpd.pid

if [ -z "$DHCPD_PID" ]; then

       DHCPD_PID=$(sed -n -e 's/^[ \t]*pid-file-name[ \t]*"(.*)"[ \t]*;.*$/\1/p' < "$DHCPD_CONF" 2>/dev/null | head -n 1)

fi DHCPD_PID="${DHCPD_PID:-/var/run/dhcpd6.pid}"

test_config() {

       if ! /usr/sbin/dhcpd -6 -t $OPTIONS -q -cf "$DHCPD_CONF" > /dev/null 2>&1; then
               echo "dhcpd self-test failed. Please fix $DHCPD_CONF."
               echo "The error was: "
               /usr/sbin/dhcpd -6 -t $OPTIONS -cf "$DHCPD_CONF"
               exit 1
       fi

}

1. single arg is -v for messages, -q for none

check_status() {

   if [ ! -r "$DHCPD_PID" ]; then
       test "$1" != -v || echo "$NAME is not running."
       return 3
   fi
   if read pid < "$DHCPD_PID" && ps -p "$pid" > /dev/null 2>&1; then
       test "$1" != -v || echo "$NAME is running."
       return 0
   else  
       test "$1" != -v || echo "$NAME is not running but $DHCPD_PID exists."
       return 1
   fi

}

case "$1" in

       start)
               test_config
               log_daemon_msg "Starting $DESC" "$NAME"
               start-stop-daemon --start --quiet --pidfile "$DHCPD_PID" \
                       --exec /usr/sbin/dhcpd -- \
                       -6 -q $OPTIONS -cf "$DHCPD_CONF" -pf "$DHCPD_PID" $INTERFACES
               sleep 2

               if check_status -q; then
                       log_end_msg 0
               else
                       log_failure_msg "check syslog for diagnostics."
                       log_end_msg 1
                       exit 1
               fi
               ;;
       stop)
               log_daemon_msg "Stopping $DESC" "$NAME"
               start-stop-daemon --stop --quiet --pidfile "$DHCPD_PID"
               log_end_msg $?
               rm -f "$DHCPD_PID"
               ;;
       restart | force-reload)
               test_config
               $0 stop
               sleep 2
               $0 start
               if [ "$?" != "0" ]; then
                       exit 1
               fi
               ;;
       status)
               echo -n "Status of $DESC: "
               check_status -v   
               exit "$?"
               ;;
       *)
               echo "Usage: $0 {start|stop|restart|force-reload|status}"
               exit 1 

esac

exit 0 </highlightSyntax>

Danach mache das Script ausführbar und lege es in den Autostart via:

chmod +x /etc/init.d/isc-dhcp6-server
update-rc.d isc-dhcp6-server defaults

/etc/default/isc-dhcp6-server <highlightSyntax language="txt">

1. Defaults for isc-dhcp-server initscript
2. sourced by /etc/init.d/isc-dhcp-server
3. installed at /etc/default/isc-dhcp-server by the maintainer scripts

2. This is a POSIX shell fragment

1. Path to dhcpd's config file (default: /etc/dhcp/dhcpd6.conf).
2. DHCPD_CONF=/etc/dhcp/dhcpd6.conf

1. Path to dhcpd's PID file (default: /var/run/dhcpd6.pid).
2. DHCPD_PID=/var/run/dhcpd6.pid

1. Additional options to start dhcpd with.
2. Don't use options -cf or -pf here; use DHCPD_CONF/ DHCPD_PID instead
3. OPTIONS=""

1. On what interfaces should the DHCP server (dhcpd) serve DHCP requests?
2. Separate multiple interfaces with spaces, e.g. "eth0 eth1".

INTERFACES="br0" </highlightSyntax>

/etc/dhcp/dhcpd6.conf <highlightSyntax language="txt">

1. Enable RFC 5007 support (same than for DHCPv4)

allow leasequery;

1. Global definitions for name server address(es)

option dhcp6.name-servers fd68:e2ea:a53::z;

subnet6 fde6:36fc:c985::/64 { } </highlightSyntax>