diff --git a/README.md b/README.md new file mode 100644 index 0000000..41dad29 --- /dev/null +++ b/README.md @@ -0,0 +1,45 @@ +# FRIwall + +Web application for managing the main firewall at FRI. + +## Operation + +The firewall consists of two servers (or “bricks”) in active–backup configuration, using weighted BGP routes for failover. Traffic filtering and VPN are done with nftables and WireGuard. Both are configured exactly the same on both servers. The settings are managed with this application. + +On each configuration change, a tarball of relevant files in `/etc` is generated and pushed via SSH to both nodes. This happens for instance each time an IP set or a forwarding rule is modified, or a VPN key is added or removed. Firewall nodes and the current configuration version for each are stored in `nodes.json`. + +## IP sets + +Names and IP prefixes for physical networks are configured in NetBox and stored in `networks.json`, which is never modified by the application. Custom IP sets used for forwarding rules may be defined at `/ipsets`, as well as NAT addresse and VPN access for all networks. These settings are stored in `ipsets.json` and added to static definitions in `networks.json` when generating firewall configuration. + +## Rules + +Forwarding rules are configured at `/rules` and toggled at `/rules/manage`. Enabled rules are included directly in the nftables configuration. For each rule, one or more manager groups can be set; users in these AD groups may toggle the rule without admin access. This is used for instance to allow teachers to disable Internet access in classrooms. + +## VPN + +WireGuard is used for remote access. Domain users can self‐register new keys at `/vpn`. The key database `wireguard.json` is a dictionary of entries like + + "10.0.0.26": { + "key": "ABC…XYZ=", + "ip6": "aaaa:bbbb:cccc:dddd:1a::/80", + "time": 1682166836.88937, + "name": "machine1", + "user": "user@domain" + } + +IP addresses for new keys are assigned automatically from the subnets defined in `wg_net` and `wg_net6` settings. When generating firewall configuration, each IP is placed in the nftables sets based on its user’s group and settings in `ipsets.json`. + +### Custom keys + +Administrators can define custom keys with access to specified networks at `/vpn/custom`. These keys are used to connect machines into secure networks where users are not allowed to attach arbitrary devices themselves. + +Custom keys are stored in the same database, but with a `networks` entry in place of `user`, for instance + + "10.0.0.27": { + "key": "FOO…BAR=", + "ip6": "aaaa:bbbb:cccc:dddd:1b::/80", + "time": 1682166836.88937, + "name": "machine2", + "networks": ["net1", "net2"] + } diff --git a/web/__init__.py b/web/__init__.py index 92da140..966e54e 100644 --- a/web/__init__.py +++ b/web/__init__.py @@ -25,7 +25,7 @@ def create_app(test_config=None): 'wg_endpoint': '', 'wg_port': '51820', 'wg_allowed_nets': '', - 'wg_dns': False, + 'wg_dns': '', 'wg_key': '', 'wg_net': '', 'wg_net6': '', diff --git a/web/static/vpn.js b/web/static/vpn.js new file mode 100644 index 0000000..5a846bd --- /dev/null +++ b/web/static/vpn.js @@ -0,0 +1,92 @@ +function delKey(key) { + fetch('del', { + credentials: 'include', + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ pubkey: key }) + }) + .then(response => { + if (!response.ok) + throw new Error('deleting key failed'); + return response.text(); + }) + .then(data => { + fetchKeys(); + }) + .catch(error => console.error(error)); +} + +function fetchKeys() { + fetch(endpoint, { + credentials: 'include' + }) + .then(response => { + if (!response.ok) + throw new Error('fetching keys failed'); + return response.json(); + }) + .then(data => { + update(Object.values(data)); + }) + .catch(error => console.error(error)); +} + +window.addEventListener('load', fetchKeys); + +const form = document.querySelector('form#request'); +form.addEventListener('submit', event => { + event.preventDefault(); + + const inputs = Array.from(document.querySelectorAll('form input')); + const settings = document.querySelector('section#settings'); + const submit = document.querySelector('button#submit'); + + const key = wireguard.generateKeypair(); + const options = Object.fromEntries(inputs.map(e => [e.name, e.type === 'checkbox' ? e.checked : e.value])); + const networks = Array.from(document.querySelectorAll('select#networks option:checked')).map(e => e.value); + + submit.innerHTML = 'Obdelovanje…'; + submit.disabled = true; + fetch('new', { + credentials: 'include', + method: 'POST', + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify({ + pubkey: key.publicKey, + options: options, + networks: networks, + }) + }) + .then(response => { + if (!response.ok) { + response.text().then(text => { + settings.innerHTML = response.status + ' ' + response.statusText + ': ' + text; + }); + } else { + return response.text(); + } + }) + .then(text => { + const config = text.replace(/PrivateKey = .*/, "PrivateKey = "+key.privateKey).trim(); + document.querySelector('code#config').innerHTML = config; + + const blob = new Blob([config], { type: 'text/plain;charset=utf-8' }); + const link = document.getElementById('download'); + link.download = 'wg-fri.conf'; + link.href = window.URL.createObjectURL(blob); + + const qr = qrcode(0, 'L'); + qr.addData(config.replace(/#.*\n/g, '')); + qr.make(); + document.getElementById('qr').innerHTML = qr.createSvgTag(3); + + fetchKeys(); + }) + .catch(error => { + settings.innerHTML = error; + }) + .finally(() => { + form.style.display = 'none'; + settings.style.display = 'unset'; + }); +}); diff --git a/web/system.py b/web/system.py index 3bb66b9..1bde640 100644 --- a/web/system.py +++ b/web/system.py @@ -77,17 +77,24 @@ def save_config(): settings = db.read('settings') version = settings['version'] = int(settings.get('version') or '0') + 1 - # Update IP sets with VPN addresses based on AD group membership. - vpn_groups = set([e['vpn'] for e in ipsets.values() if e.get('vpn')]) + # Find networks accessible to VPN users for each AD group. + vpn_groups = {e['vpn'] for e in ipsets.values() if e.get('vpn')} group_networks = { group: [name for name, data in ipsets.items() if data['vpn'] == group] for group in vpn_groups } + + # Add VPN addresses to IP sets. for ip, key in wireguard.items(): + # Find all networks this IP should belong to: + # - manually specified networks for custom keys, + # - networks accessible to any of the user’s groups. + key_networks = set(key.get('networks', ())) for group in user_groups.get(key.get('user', ''), ()): - for network in group_networks.get(group, ()): - ipsets[network]['ip'].append(f'{ip}/32') - if ip6 := key.get('ip6'): - ipsets[network]['ip6'].append(ip6) + key_networks |= set(group_networks.get(group, ())) + for network in key_networks: + ipsets[network]['ip'].append(f'{ip}/32') + if ip6 := key.get('ip6'): + ipsets[network]['ip6'].append(ip6) # Create config files. output = pathlib.Path.home() / 'config' / f'{version}' diff --git a/web/templates/base.html b/web/templates/base.html index add9ed1..7b0832c 100644 --- a/web/templates/base.html +++ b/web/templates/base.html @@ -9,7 +9,8 @@ body { margin: 1em auto; } code { - background-color: #eeeeee; + background-color: #f8f8f8; + padding: 0.1em 0.25em; } details { margin: 0.5em 1em; @@ -31,18 +32,22 @@ input:read-only { border-style: dotted; } pre { - background-color: #eeeeee; + background-color: #f8f8f8; border: 1px solid #cccccc; padding: 0.5em; } +table { + border-spacing: 0 0.1em; +} th { text-align: left; } th, td { padding-right: 1em; + vertical-align: middle; } -th { - border-bottom: 1px solid black; +tbody > tr:hover { + background-color: #f8f8f8; } ul.keys { margin: 0 0.5em 0.5em; diff --git a/web/templates/index.html b/web/templates/index.html index 01320ba..80ea4a6 100644 --- a/web/templates/index.html +++ b/web/templates/index.html @@ -3,7 +3,7 @@
VPN -
urejanje ključev za WireGuard VPN +
urejanje ključev za oddaljeni dostop
Pravila
vklop / izklop pravil za požarni zid
@@ -20,6 +20,8 @@
pravila za posredovanje prometa
Netmap
statične 1:1 preslikave naslovov za strežniška omrežja +
VPN po meri +
urejanje ključev za oddaljeni dostop do posebnih omrežij
Nastavitve
nastavitve aplikacije FRIwall diff --git a/web/templates/vpn/custom.html b/web/templates/vpn/custom.html new file mode 100644 index 0000000..d03398a --- /dev/null +++ b/web/templates/vpn/custom.html @@ -0,0 +1,68 @@ +{% extends 'base.html' %} +{% block header %} + +{% endblock %} + +{% block content %} +

+Urejate ključe WireGuard s posebnimi dostopi. + + + + +
KljučIPIPv6NapravaOmrežja +
+ +

+

Nov ključ

+
+

+
+ +

+
+ +

+ +

+ + +
+ + + + + +{% endblock %} diff --git a/web/templates/vpn/index.html b/web/templates/vpn/index.html index 473704d..c47b61c 100644 --- a/web/templates/vpn/index.html +++ b/web/templates/vpn/index.html @@ -2,10 +2,7 @@ {% block content %}

-Za VPN oziroma oddeljano povezavo v omrežje FRI uporabljamo WireGuard. Več informacij o uporabi in nastavitvah VPN najdete v dokumentaciji. - -

-Za priklop v omrežje spodaj ustvarite nov ključ in prenesite izpisano datoteko. Nato sledite napotkom za posamezni sistem. +Za VPN oziroma oddeljano povezavo v omrežje FRI uporabljamo WireGuard. Za priklop v omrežje ustvarite nov ključ in prenesite izpisano datoteko. Nato sledite napotkom za posamezni sistem.

Windows / Mac @@ -43,14 +40,14 @@ Na vsaki napravi, ki jo želite povezati v omrežje FRI, ustvarite nov ključ. P

- - + +
- - + +

-Če vklopite prvo opcijo, bo vaš računalnik čez VPN usmerjal ves promet. Če izklopite drugo opcijo, bodo nekateri strežniki dostopni le prek naslova IP. Če ste v dvomih, pustite privzete nastavitve. +Če vklopite prvo opcijo, bo vaš računalnik čez VPN usmerjal ves promet. Če izklopite drugo opcijo, bodo nekateri strežniki dostopni le prek naslova IP. Če ste v dvomih, pustite privzete nastavitve. Več informacij o uporabi in nastavitvah VPN najdemo v dokumentaciji.

+ {% endblock %} diff --git a/web/templates/vpn/wg-fri.conf b/web/templates/vpn/wg-fri.conf index 09bbf9c..136490b 100644 --- a/web/templates/vpn/wg-fri.conf +++ b/web/templates/vpn/wg-fri.conf @@ -1,5 +1,5 @@ [Interface] -# {{ timestamp }} {{ current_user['username'] }} {{ name }} +# {{ timestamp }} {{ user }} {{ name }} # PublicKey = {{ pubkey }} PrivateKey = # paste private key here Address = {{ ip }}{% if ip6 %}, {{ ip6 }}{% endif %} diff --git a/web/vpn.py b/web/vpn.py index ce82fe4..876fc50 100644 --- a/web/vpn.py +++ b/web/vpn.py @@ -18,23 +18,46 @@ wgkey_regex = re.compile(r'^[A-Za-z0-9/+=]{44}$') def index(): return flask.render_template('vpn/index.html') +@blueprint.route('/custom') +@flask_login.login_required +def custom(): + if not flask_login.current_user.is_admin: + return flask.Response('forbidden', status=403, mimetype='text/plain') + with db.locked(): + keys = {ip: data for ip, data in db.read('wireguard').items() if data.get('networks') and not data.get('user')} + ipsets = db.read('networks') | db.read('ipsets') + return flask.render_template('vpn/custom.html', keys=keys, ipsets=ipsets.keys()) + @blueprint.route('/list') @flask_login.login_required def list(): + # Return logged-in user’s keys, marking the key used for current connection (if any). user = flask_login.current_user.get_id() - return flask.jsonify( - {k: v | {'active': flask.request.remote_addr in (v.get('ip'), v.get('ip6'))} - for k, v in db.load('wireguard').items() if v.get('user') == user}) + return flask.jsonify([ + data | {'ip': ip, 'active': flask.request.remote_addr in (ip, data.get('ip6'))} + for ip, data in db.load('wireguard').items() if data.get('user') == user + ]) + +@blueprint.route('/list-custom') +@flask_login.login_required +def list_custom(): + # Return all custom keys. + if not flask_login.current_user.is_admin: + return flask.Response('forbidden', status=403, mimetype='text/plain') + return flask.jsonify([ + data | {'ip': ip, 'active': flask.request.remote_addr in (ip, data.get('ip6'))} + for ip, data in db.load('wireguard').items() if data.get('networks') and not data.get('user') + ]) @blueprint.route('/new', methods=('POST',)) @flask_login.login_required def new(): - # Each key is associated with a new IPv4 address from the pool settings['wg_net']. - # Each key gets an IPv6 subnet depending on the amount of surplus addresses available. + # Each key is assigned a new IPv4 address from the pool settings['wg_net']. + # Each key is then assigned a corresponding IPv6 subnet, depending on the amount of surplus addresses available. # For wg_net 10.10.0.0/18 and wg_net6 1234:5678:90ab:cdef::/64, # the key for 10.10.0.10/32 would get 1234:5678:90ab:cdef:a::/80. def ipv4to6(net4, ip4, net6): - # Calculate the address and prefix length for the assigned IPv6 network. + # Calculate the address and prefix length for the IPv6 network that can be assigned to this key. len4 = (net4.max_prefixlen - net4.prefixlen) len6 = (net6.max_prefixlen - net6.prefixlen) # Make sure the network address ends at a colon. Wastes some addresses but IPv6. @@ -43,35 +66,42 @@ def new(): return ip6 + '/' + str(net6.max_prefixlen - assigned) pubkey = flask.request.json.get('pubkey', '') + options = flask.request.json.get('options', {}) if not re.match(wgkey_regex, pubkey): return flask.Response('invalid key', status=400, mimetype='text/plain') + # Read server’s private key and find the corresponding public key. settings = db.load('settings') server_pubkey = subprocess.run([f'wg pubkey'], input=settings.get('wg_key'), text=True, capture_output=True, shell=True).stdout.strip() + now = datetime.datetime.utcnow() + key = { + 'key': pubkey, + 'time': now.timestamp(), + 'name': re.sub('[^-._A-Za-z0-9]', '', options.get('name', '')), + } + + # Determine IPv4 and IPv6 addresses for the new key. host = ipaddress.ip_interface(settings.get('wg_net') or '10.0.0.1/24') - ip6 = None + key['ip6'] = None with db.locked(): # Find a free address for the new key. keys = db.read('wireguard') for index, ip in enumerate(host.network.hosts(), start=1): if ip != host.ip and str(ip) not in keys: if wg_net6 := settings.get('wg_net6'): - ip6 = ipv4to6(host.network, ip, ipaddress.ip_interface(wg_net6).network) + key['ip6'] = ipv4to6(host.network, ip, ipaddress.ip_interface(wg_net6).network) break else: return flask.Response('no more available IP addresses', status=500, mimetype='text/plain') - now = datetime.datetime.utcnow() - name = re.sub('[^-._A-Za-z0-9]', '', flask.request.json.get('name', '')) - keys[str(ip)] = { - 'key': pubkey, - 'ip6': str(ip6) if ip6 else None, - 'time': now.timestamp(), - 'user': flask_login.current_user.get_id(), - 'name': name, - } + # Add remaining attributes to new key and update key database. + if flask_login.current_user.is_admin and flask.request.json.get('networks'): + key['networks'] = flask.request.json.get('networks') + else: + key['user'] = flask_login.current_user.get_id() + keys[str(ip)] = key db.write('wireguard', keys) # Generate a new config archive for firewall nodes. @@ -83,13 +113,14 @@ def new(): 'port': settings.get('wg_port') or '51820', 'server_key': server_pubkey, 'pubkey': pubkey, - 'ip': str(ip), - 'ip6': str(ip6) if ip6 else None, 'timestamp': now, - 'name': name, - 'dns': settings.get('wg_dns') if flask.request.json.get('use_dns', True) else False, + 'ip': str(ip), + 'ip6': key['ip6'], + 'name': key['name'], + 'user': key.get('user', 'custom'), + 'dns': settings.get('wg_dns', '') if options.get('use-dns', True) else False, 'allowed_nets': settings.get('wg_allowed_nets', ''), - 'add_default': flask.request.json.get('add_default', False), + 'add_default': options.get('add-default', False), } return flask.render_template('vpn/wg-fri.conf', **args) @@ -102,7 +133,10 @@ def delete(): with db.locked(): user = flask_login.current_user.get_id() - keys = {k: v for k, v in db.read('wireguard').items() if v.get('user') != user or v.get('key') != pubkey} + keys = { + ip: data for ip, data in db.read('wireguard').items() + if not (data.get('key') == pubkey and (data.get('user') == user or flask_login.current_user.is_admin)) + } db.write('wireguard', keys) system.run(system.save_config)