| Age | Commit message (Collapse) | Author |
|---|
|
Before:
- enp1s0: wan
- enp2s0: lan (with VLANs)
- enp3s0: mgt
Changes in this patch:
- wan is moved to VLAN id 5
- bond0 is created, replacing lan as lower device for VLANs
- mgt config is removed (could be reconfigured as a VLAN, and
made a available on a switch port)
- all 3 ports are enslaved in bond0
From the switch towards the space server load-balance algorithm
src-dst-ip* is used.
From the space server towards the switch L3+L4 is used.
Therefore a single IP pair will always use the same 1G
from the swith to the space server, a client therefore
needs to multiplex over multiple IPs in order to
*) The src-dst-ip algorithm on the switch hasn't been
tested with IPv6 yet. Hopefully we can find a better
switch at some point, so we can include the L4 ports in
the hashing on the switch.
Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@labitat.dk>
|
|
Move the Tor exit nodes to their own VLAN, and
their own address space.
Background for move
-------------------
For the first Tor exit node, we where able to
create inet6num object 2a01:4262:1ab:20::71/128.
So we could assign a specific Tor abuse contact.
When we added the second node it was no longer
possible to create /128 inet6num objects, but
only up to /64. We therefore need to move our
Tor exit nodes to a dedicated address space.
Connection tracking
-------------------
Connection tracking is quite expensive, so
it's better to only do it for Tor traffic,
when we actually need it, which is only when
internal clients need to access the servers.
In the future conntrack could also be disabled
for labicolo in general.
Current stats
~~~~~~~~~~~~~
[root@space ~]# grep -v '185\.38\.175\.7[12] ' /proc/net/nf_conntrack |
grep -v '2a01:4262:01ab:0020:0000:0000:0000:007[12]' | wc -l
4071
[root@space ~]# wc -l /proc/net/nf_conntrack
39138 /proc/net/nf_conntrack
Currently 4071 out of 39138 connections are not Tor related.
Also reading /proc/net/nf_conntrack is quite slow atm.:
[root@space ~]# time cat /proc/net/nf_conntrack > /dev/null
real 0m35.097s
user 0m0.010s
sys 0m28.114s
Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@labitat.dk>
|
|
Until now BGP connections have only been established
when the space server has initiated the connection to
the peer.
It's best practice for both BGP speakers to be able to
connect to one another, lowering recovery time.
|
|
This patch changes the reverse path filtering of the labicolo VLAN
to take place in the prerouting hook, using the kernel routing
table, and removes the need to maintain a static prefix list.
Labicolo routes are exported to the kernel routing table by BIRD,
hence it should be sufficient to only have prefix lists there.
This change has been tested, and it's only possible to spoof
fellow labicolo members address space (same as before).
Esmil: prerouting before input/forward makes more sense to me
|
|
Now that we use communities, we don't need this prefix filter
anymore, only the per-customer prefix filters.
|
|
We only announce a prefix, if we have recieved it from a customer
connection or if we originate it our self.
This way we avoid announcing prefixes matching the earlier used,
prefix list if we haven't recieved it via the customer connection.
This is important for multi-homed labicolo customers.
Esmil: consistent brace placement
|
|
Assign large communities on prefix import.
Later we can then use the community, to decide if we should
announce it to our peers.
|
|
This patch prepares us for adopting Large BGP Communities (RFC 8092).
Basic format of Large BGP Communities:
<uint32_t asn>:<uint32_t function>:<uint32_t value>
We use function 1 for storing prefix type (or relation).
We then assign a value to transit, peering, customer and originated
prefixes.
Large BGP Communities
http://largebgpcommunities.net/
https://tools.ietf.org/html/rfc8092
https://tools.ietf.org/html/rfc8195
Esmil: consistent brace placement
|
|
|
|
This protects us amount otherthings against 3rd parties
resetting the TCP connection underneat our BGP sessions.
This has been enabled in both ends, and this
_MUST_ remain enabled, otherwise these sessions
will go down.
If this needs to be disabled for some reason
then it must be coordinated with Fiberby.
RFC 5082 - The Generalized TTL Security Mechanism
https://datatracker.ietf.org/doc/html/rfc5082
|
|
The prefix was only routeable on the intern network, not the whole
internet, as it was not added in local_prefix_v6.
The 2a0e:8f02:f034::/48 is attached to my ASN, AS211153
Commit message fixed up by Esmil
|
|
Commit message and nftables rule fixed up by Esmil
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Discovered by IMAAL Research Lab, Brigham Young University,
thank you.
|
|
|
|
|
|
time.cloudflare.com has much lower ping than any of the
default N.fedora.pool.ntp.org servers.
|
|
This used to open up for polling our old switch for
traffic data, but it died and it doesn't work with
the new switch so let's plug the hole.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
..to align with debian role
|
|
Signed-off-by: Asbjørn Sloth Tønnesen <asbjorn@labitat.dk>
|
|
..of the dhcp zone and reverse dns for 10.42.0.0/16
This way the dhcp daemon can add entries when it
handles out leases.
|
|
|
|
This reverts commit 3b795796bd03488a385f3ad42b10b8c0d61282c1,
"space_server: unbound: use unbound instad of bind".
Unlike unbound, bind supports synthesizing DNS64 answers
only for certain clients, so only requests from the Labitat NAT64
network will get DNS64 answers.
|
|
Fixes: 78688483 space_server: add Asbjorn's colo addresses and net
|
|
|
|
|
|
|
|
|
|
|
|
|
|
..rather radvd
|
|
..rather than overriding ExecStart to call
networkd-wait-online with --ignore
|
|
|
|
|
|
..but don't let colo servers connect to internal addresses.
|
|
|
|
|
|
|
