Penguin
Diff: MetaNetConfiguration
EditPageHistoryDiffInfoLikePages

Differences between current version and previous revision of MetaNetConfiguration.

Other diffs: Previous Major Revision, Previous Author, or view the Annotated Edit History

Newer page: version 15 Last edited on Saturday, February 17, 2007 11:05:09 pm by AlastairPorter
Older page: version 14 Last edited on Thursday, November 18, 2004 5:30:23 pm by MikeBeattie Revert
@@ -13,17 +13,20 @@
 !!Routing 
  
 Add to your boot scripts somewhere (/etc/network/interfaces is a good place for Debian. Can you tell we love Debian here?): 
  
+<pre>  
  route add -net 10.0.0.0 netmask 255.0.0.0 reject 
  route add -net 192.168.0.0 netmask 255.255.0.0 metric 1000 reject 
+</pre>  
  
 This will give you "Destination host unreachable errors", without sending random packets out your default gateway. 
  
 !![DNS] 
  
 After you have zebra working correctly, and you can ping 10.66.10.1, then you may want to setup [DNS] (Debian: apt-get install bind). In your name server, you need to make sure you don't have any forwarders[1], and that you have blocks that look much like this: 
  
+<pre>  
  zone "10.in-addr.arpa" { 
  type stub; 
  masters { 10.66.10.1; }; 
  file "/var/cache/bind/stubs/10.x"; 
@@ -33,11 +36,13 @@
  type stub; 
  masters { 10.66.10.1; }; 
  file "/var/cache/bind/stubs/tla"; 
  }; 
+</pre>  
  
 For future use, and resolving metanet routers, also add 
  
+<pre>  
  zone "168.192.in-addr.arpa" { 
  type stub; 
  masters { 10.66.10.1; }; 
  file "/var/cache/bind/stubs/192.168.x"; 
@@ -47,8 +52,9 @@
  type stub; 
  masters { 10.66.10.1; }; 
  file "/var/cache/bind/stubs/metaix.tla"; 
  }; 
+</pre>  
  
 as well. 
  
  
@@ -67,16 +73,19 @@
 !!Firewalling 
 See FirewallNotes and PerrysFirewallingScript. Although you should be able to mostly trust other people on the metanet, you should at the very least do some basic firewalling. 
  
 For example, samba/nmbd does broadcasts that will go across the metanet. You can either block traffic to and from the metanet on ports 137, 138 and 139 (both [TCP] and [UDP]) or you can add the following in smb.conf's global section: 
+<pre>  
  bind interfaces only = yes 
  interfaces = 10.x.y.0/24 
+</pre>  
  
 __Note:__ The following is geared towards a system where the MetaNet router doesn't supply services to the MetaNet, and isn't your desktop, for example. But it can still be used and applied, with (relatively heavy) modification. 
  
 The only traffic __required__ on the 192.168.0.0/16 range for your MetaNet router is BGP. So you can safely firewall off everything except port 179 tcp/udp incoming. You will need to leave outgoing open, and ports >=1024 incoming with stateful acceptance (RELATED,ESTABLISHED) since your MetaNet router will use the IP on the wan0 interface for its communication onto the MetaNet. You'll also need to allow traffic to pass back and forth between 192.168.0.0/16 and 10.x.y.z/24, but that's in your FORWARD chain. 
  
 An example of this is: 
+<pre>  
  iptables -A INPUT -p udp --dport 179 -s 192.168.0.0/16 -i wan0 -d 192.168.x.y -j ACCEPT 
  iptables -A INPUT -p tcp --dport 179 -s 192.168.0.0/16 -i wan0 -d 192.168.x.y -j ACCEPT 
  <Add extra allowances here, if your MetaNet router is serving services (like DNS, etc)...> 
  <you may also want to allow things in from your lan here (ssh!), since the following 4 rules will block them.> 
@@ -87,15 +96,18 @@
  iptables -A INPUT -p imcp -j ACCEPT 
  iptables -A OUTPUT -d 192.168.0.0/16 -o wan0 -s 192.168.x.y -j ACCEPT 
  iptables -A OUTPUT -d 10.0.0.0/8 -o wan0 -s 192.168.x.y -j ACCEPT 
  iptables -A OUTPUT -p imcp -j ACCEPT 
+</pre>  
  
 The following allows pretty much open slather access from anything on the MetaNet into your 10.x.y.z/24 segment. (change ethX to the NIC with your 10.x.y.z/24 on it): 
+<pre>  
  iptables -A FORWARD -d 192.168.0.0/16 -o wan0 -s 10.x.y.z/24 -i ethX -j ACCEPT 
  iptables -A FORWARD -d 10.x.y.z/24 -o ethX -s 192.168.0.0/16 -i wan0 -j ACCEPT 
  iptables -A FORWARD -d 10.0.0.0/8 -o wan0 -s 10.x.y.z/24 -i ethX -j ACCEPT 
  iptables -A FORWARD -d 10.x.y.z/24 -o ethX -s 10.0.0.0/8 -i wan0 -j ACCEPT 
  iptables -A FORWARD -p imcp -j ACCEPT 
+</pre>  
  
 You'll need more than the above in your FORWARD chain if you also run something like NAT for your internet connection on your MetaNet router. 
  
  
@@ -105,5 +117,5 @@
 Now, go to MetaNetResources to see what you can do with your new internetwork. 
  
 ----- 
  
-[1] The reason is that if you use a forwarder, then all queries for anything other than master/slave zones get forwarded to the other server and you won't be able to resolve metanet names and addresses. 
+# [|ftnt_ 1]~[[1|#ftnt_ref_1]~] The reason is that if you use a forwarder, then all queries for anything other than master/slave zones get forwarded to the other server and you won't be able to resolve metanet names and addresses.