6c18e2ff94
firewall: add convenience nftables set for AD ports
...
Probably not all of these are necessary. Would be nice to allow
configuring this from the app.
2024-09-19 16:25:51 +02:00
ae1cfd5337
exit: enable forwarding directed broadcasts for WoL
...
Must be set in IPv4 sysctls for all interfaces and every input
interface from which broadcasts are sent. These are the virtual
MLAG interfaces (bridge-*-v0), which are created dynamically.
We enable directed broadcasts for (only MLAG) interfaces enumerated by
the ifaces_directed_broadcast value in NetBox device local context.
2024-09-18 14:27:30 +02:00
6322d5ec97
exit: add routes for VPN IPv4 addresses to outside and default VRFs
...
Like commit 7b5980f
2024-09-16 17:20:43 +02:00
6c8309f1c9
exit: leak non-NATted inside routes into default VRF
...
So we don’t have to NAT inside our own network. We still firewall.
2024-09-03 17:15:48 +02:00
103ecae2e7
exit: leak outside routes into default VRF
...
So L3 servers can acces L2 servers.
2024-09-01 12:19:13 +02:00
3caea81896
access: add voice VLAN support
2024-09-01 10:37:11 +02:00
c3ff39fe72
firewall: reload nftables in mgmt VRF
...
It doesn’t matter for the rules themselves as nft does not do VRFs,
but DNS names can only be resolved there. This is because all nodes
use the same IPs in the default VRF, so DNS replies sent from there go
to the active node.
This allows using DNS names in firewall rules. Not yet sure if that is
actually a good idea.
2024-08-19 13:54:01 +02:00
5032d1ac84
fabric: fix a template
...
This worked. Updated ansible. Then it didn’t.
2024-08-15 17:22:55 +02:00
14d2e00f0b
exit: only send RAs on interfaces with FHRP addresses
...
These are the ones we are router for.
2024-08-13 19:12:29 +02:00
7b5980f871
exit: add routes for internal IPv4 addresses to outside VRF
...
Routed through and mostly dropped by the firewall, of course. So we
don’t necessarily have to do NAT for everything that comes from the
old / USI network.
2024-08-13 19:02:03 +02:00
fe8f9161d9
exit: drop redundant and now misleading comment
2024-08-12 11:46:42 +02:00
9a56e48141
exit: allow multiple VLANs per VRF
...
Turns out that while Cumulus supports “up to” 255 VRFs, no switch it
runs on supports more than 64. So we have to turn down paranoia and
put internal networks for each tenant in the same VRF.
This commit just ensures VRF definitions are not duplicated on exits.
2024-08-04 14:12:26 +02:00
c239b91d17
Simplify README
2024-08-03 11:48:09 +02:00
c741b90981
fabric: disable less-than-sane Cumulus SSH default options
...
Why no ed25519 keys?
2024-07-26 14:27:34 +02:00
82b10e8133
exit: support custom VRF imports
...
Ten minutes to set up and ten hours to convince Ansible to not be
quite so retarded. The list2dict filter seems to be the (or another)
missing piece. Now let’s rewrite everything else using it. Or not.
2024-07-15 14:22:42 +02:00
99aef43574
exit: add DHCP relay for new server
...
Really quite shoddy as it is right now. Should get better once the old
server is retired.
2024-07-14 14:51:23 +02:00
bb41d406f8
exit, firewall: don’t hardcode prefix length
2024-07-10 16:57:08 +02:00
2327b42412
fabric: disable nvue-startup service
2024-07-04 15:36:02 +02:00
48b987180a
Move firewall_master role to servers repo
2024-07-04 15:35:41 +02:00
ff1abcb508
firewall: drop a line
...
It was rubbish.
2024-06-20 20:54:42 +02:00
668af8bdb6
firewall: use a handler to reboot
2024-05-19 10:10:02 +02:00
0e9dac6985
fabric: support arbitrary port breakouts
...
Not that we use anything but 1x and 4x. Mainly done so I can drop
nonexistent (because they have been broken out) interfaces from NetBox.
2024-05-13 17:44:39 +02:00
16f34c4502
Don’t gather facts when setting them
2024-05-13 17:39:47 +02:00
8c82af23e4
firewall: also configure VPN forwards in the app
...
There we can define forwards only for networks with actual VPN users.
2024-05-03 11:27:27 +02:00
7656c05b2d
Revert "firewall: configure NAT from NetBox data"
...
Changed my mind. All NAT and VPN is configured from the app now.
2024-04-30 20:59:49 +02:00
8a9d47f176
firewall: configure NAT from NetBox data
...
This is dynamic NAT for (mostly) physical networks. NAT for custom
prefixes can still be defined in the app.
2024-04-28 15:54:01 +02:00
457ab7d3b7
Query prefixes once for all hosts
...
And group them into vrf_prefixes for VLAN networks and bgp_prefixes for
servers plugged directly into fabric.
This should reduce the number of queries to NetBox when configuring
firewalls and exit switches. Not sure but I think set_fact helps to
avoid queries (as opposed to setting group_vars).
2024-04-28 12:14:05 +02:00
1c0709a6a6
fabric: allow all VLANs on bridge
...
Don’t try to guess what should be allowed because not all switch links
are tagged in NetBox. For now we limit mainly on access switches.
2024-04-27 11:30:20 +02:00
c07c03a430
Set default inventory
2024-04-27 11:04:02 +02:00
2443a90bc5
fabric: use FHRP groups for virtual router IPs
...
More realistic- and supported-like and also avoids duplicated gateway
addresses.
2024-04-14 15:15:48 +02:00
db397cb2b1
exit: store VLAN interface addresses in NetBox
...
… instead of generating them from prefixes. A NetBox script can be
used to create and configure all necessary data for a new VLAN.
Instead of VLAN roles “inside" and “outside” we now create separate
VRFs for inside VLANs to match the actual exit/firewall configuration.
The “outside” VRF is for all VLANs that are directly accessible from
the internet.
2024-04-10 14:03:50 +02:00
ece3b8a377
exit: sort prefixes by family values
...
Because I made some seemingly unrelated changes in NetBox and they all
got flipped‐turned upside down.
2024-04-09 10:47:51 +02:00
000f625988
Move VM secrets to a separate password store directory
2024-04-08 15:06:18 +02:00
6dcae194d7
firewall: accept VPN connections from inside also
...
People tend to leave WireGuard tunnels active and we don’t want things
to become unreachable when moving to one of the inside networks.
2024-04-08 15:03:29 +02:00
c479f90669
access: move switch config templates back to this repo
...
Let’s keep it simple. Also editing templates in NetBox is a pain.
2024-04-08 14:45:39 +02:00
1ffdea8e43
firewall: fix duplicate space in template
2024-04-05 12:00:55 +02:00
f489555ba1
access: fix password store subdirectory for switches
2024-04-05 12:00:22 +02:00
7ef4023424
firewall: add known IP ranges in network ipset definitions
...
This data should only change in NetBox, so no point deploying it from
firewall master. Sometimes the first approach is the best approach.
2024-03-19 09:46:26 +01:00
aa82e5aa18
firewall_master: don’t define ipsets for VLAN groups
...
Was a harebrained idea from the start.
2024-03-19 09:45:23 +01:00
a97d133873
fabric: don’t set bond slaves if there are none
...
Not that that should happen except by mistake.
2024-03-05 12:46:26 +01:00
be0cc49b33
access: ignore more non‐changes
...
Should probably move this somewhere more listy if it keeps growing.
2024-03-04 10:12:38 +01:00
dbc00fd448
fabric: add custom field on dcim.Interface for bond mode
2024-02-27 13:35:29 +01:00
ce7c1bd49e
fabric: consolidate interface templates
...
Mostly to avoid special‐casing bond interfaces, and to support BGP
connections over virtual interfaces.
2024-02-27 13:35:29 +01:00
5381fecaa4
fabric: fix check for peer switch
2024-02-27 13:35:29 +01:00
65c16dbc63
Drop BGP update-delay option
...
Dropped from Cumulus manual and advised by seniors.
2024-02-27 13:35:29 +01:00
e93877c83d
firewall_master: add newly required option to pip invocation
...
System in Schutt und Asche legen.
2024-02-27 13:35:29 +01:00
7fe1dac008
firewall: use slurp instead of generic command to get host key
2024-02-27 13:35:29 +01:00
cacf46c891
Lowercows
2024-02-27 13:35:10 +01:00
Gašper Fele-Žorž
2a644e7936
Eliminate the bovine infestation through ansible.cfg
2024-02-21 12:40:04 +01:00
c20c47709c
exit: fix keepalive configuration
...
There will be order or there will be chaos.
2024-02-18 16:28:35 +01:00
