Freifunk Gera-Greiz

lokaler Gateway

!!! unvollständig !!!

Diese Anleitung basiert auf andere Anleitungen und beschreibt nur die Unterschiede von einen normalen Mesh-Server zu einen lokalen GatewayAlle angegebenen IPs, MACs, VLANs, Interfaces müssen passend zum System geändert werden!

DNS+DHCP

### DNS

# DNS Server
server=192.168.178.1
server=193.28.153.254
server=213.73.91.35
server=8.8.8.8
server=8.8.4.4

local=/ffggrz/
domain=ffggrz


### DHCP / RA
#dhcp-authoritative
# abschalten der Namensaufloesung fuer DHCP-Clients
dhcp-ignore-names
#quiet-dhcp
#quiet-dhcp6
quiet-ra

####IPv4
dhcp-range=10.181.11.2,10.181.12.254,1h
#dhcp-option=option:router,10.181.0.202
dhcp-option=option:dns-server,10.181.0.202
dhcp-option=option:ntp-server,10.181.0.202
dhcp-option=option:domain-search,ffggrz
# IP-Fragmentierung am Client um die batman-adv-Fragmentierung zu reduzieren
# 1406 (fastd) - 24 (batman-adv) - reserve = 1380
#dhcp-option-force=26,1350

####IPv6
# ra-stateless: A+O-Bit fuer stateless-Adressen aber DHCPv6 (DNS+NTP)
dhcp-range=set:v6,::,constructor:br-freifunk,slaac,ra-stateless,1h
# ohne IPv6 nimmt dnsmasq selbst eine der IPv6-Adressen vom Interface
dhcp-option=tag:v6,option6:dns-server,::
dhcp-option=tag:v6,option6:ntp-server,::
dhcp-option=tag:v6,option6:domain-search,ffggrz

enable-ra
####low Priority
#ra-param=br-freifunk,low,600,0
ra-param=br-freifunk,low,600,1800

batman-adv

allow-hotplug bat0
iface bat0 inet manual
  hwaddress ether de:ad:be:60:05:01
  up ip link set up dev $IFACE
  down ip link set down dev $IFACE
  post-up sysctl net.ipv6.conf.$IFACE.disable_ipv6=1

  post-up echo 60 > /sys/class/net/$IFACE/mesh/hop_penalty
  post-up echo 1 > /sys/class/net/$IFACE/mesh/bridge_loop_avoidance
  #post-up batctl gw client 45
  #post-up batctl orig_interval 5000
  post-up batctl gw server 96mbit/96mbit
  post-up batctl orig_interval 30000
  post-up batctl multicast_mode 0

Firewall+NAT

IPV4

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-N DEFAULT_EXIT
-A DEFAULT_EXIT -m connmark --mark 0 -j CONNMARK --set-mark 8

-N BYPASS_exitVPN
-A BYPASS_exitVPN -m pkttype --pkt-type multicast -j RETURN
-A BYPASS_exitVPN -m pkttype --pkt-type broadcast -j RETURN
-A BYPASS_exitVPN -d 10.0.0.0/8 -j RETURN
-A BYPASS_exitVPN -d 169.254.0.0/16 -j RETURN
-A BYPASS_exitVPN -d 172.16.0.0/12 -j RETURN
-A BYPASS_exitVPN -d 192.168.0.0/16 -j RETURN
-A BYPASS_exitVPN -d 100.64.0.0/10 -j RETURN
-A BYPASS_exitVPN -d 192.0.2.0/24 -j RETURN
-A BYPASS_exitVPN -d 198.51.100.0/24 -j RETURN
-A BYPASS_exitVPN -d 203.0.113.0/24 -j RETURN
-A BYPASS_exitVPN ! -s 10.181.0.0/16 -j RETURN
-A BYPASS_exitVPN -m connmark --mark 0 -j DEFAULT_EXIT

-A INPUT -m mark --mark 0 -m connmark ! --mark 0 -j CONNMARK --restore-mark

-A OUTPUT -m mark ! --mark 0 -m connmark --mark 0 -j CONNMARK --save-mark

-A PREROUTING -m mark ! --mark 0 -m connmark --mark 0 -j CONNMARK --save-mark
-A PREROUTING -i br-freifunk -m conntrack --ctstate NEW -m connmark --mark 0 -m mark --mark 0 -j BYPASS_exitVPN
-A PREROUTING -m mark --mark 0 -m connmark ! --mark 0 -j CONNMARK --restore-mark
COMMIT

IPv6

*mangle

:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

-N DEFAULT_EXIT
-A DEFAULT_EXIT -m connmark --mark 0 -j CONNMARK --set-mark 8

-N BYPASS_exitVPN
-A BYPASS_exitVPN -m pkttype --pkt-type multicast -j RETURN
-A BYPASS_exitVPN -m pkttype --pkt-type broadcast -j RETURN
-A BYPASS_exitVPN -d fdb5:078b:64cc::/48 -j RETURN
-A BYPASS_exitVPN -d 2a03:2260:100b::/48 -j RETURN
-A BYPASS_exitVPN -d fe80::/10 -j RETURN
-A BYPASS_exitVPN -d ff00::/8 -j RETURN
-A BYPASS_exitVPN ! -d 2000::/3 -j RETURN
-A BYPASS_exitVPN -m connmark --mark 0 -j DEFAULT_EXIT

-A INPUT -m mark --mark 0 -m connmark ! --mark 0 -j CONNMARK --restore-mark

-A OUTPUT -m mark ! --mark 0 -m connmark --mark 0 -j CONNMARK --save-mark

-A PREROUTING -m mark ! --mark 0 -m connmark --mark 0 -j CONNMARK --save-mark
-A PREROUTING -i br-freifunk -m conntrack --ctstate NEW -m connmark --mark 0 -m mark --mark 0 -j BYPASS_exitVPN
-A PREROUTING -m mark --mark 0 -m connmark ! --mark 0 -j CONNMARK --restore-mark
COMMIT

Allgemein


*nat
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -o eth0 -m connmark --mark 8 -j MASQUERADE
COMMIT

*filter
-A FORWARD -i br-freifunk -o br-freifunk -j ACCEPT
-A FORWARD -i eth0 -o br-freifunk -m connmark --mark 8 -j ACCEPT
-A FORWARD -i br-freifunk -o eth0 -m connmark --mark 8 -j ACCEPT
-A FORWARD -i eth0 -o br-freifunk -j DROP
-A FORWARD -i br-freifunk -o eth0 -j DROP
COMMIT

Probleme

  • fällt ein Gateway irgendwo aus verlieren zufällige Knoten ihre ganzen Gateway-Einträge, wodurch kein DHCP für eine kurze möglich ist.
  • kein intercity-VPN
  • nur bedingt IPv6 (falls überhaupt beim Uplink vorhanden)
  • statisches DHCP
Details

LXC im Mesh (Debian)

Unter der Annahme dass schon batman-adv läuft, eingerichtet ist und br-client die Mesh-Bridge ist

Host-Konfiguration

Installation

sudo apt-get install lxc

ohne LVM

sudo lxc-create -n mein-container -t debian

mit LVM

lxc-create -t debian -n mein-container -B lvm --vgname lvm-gruppe --lvname lxc-mein-container --fssize 4G --fstype ext4
lxc-start -n mein-container
lxc-attach -n mein-container passwd

Konfiguration

/var/lib/lxc/marcus/config:

lxc.start.auto = 1
lxc.mount = /var/lib/lxc/marcus/fstab
lxc.rootfs = /var/lib/lxc/marcus/rootfs
lxc.utsname = marcus


lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br-client
lxc.network.name = eth0

# Common configuration
lxc.include = /usr/share/lxc/config/debian.common.conf

# Container specific configuration
lxc.arch = amd64
lxc.autodev = 1
lxc.kmsg = 0

Container-Konfiguration (im Container!)

/etc/network/interfaces:

auto lo
iface lo inet loopback
# DHCP
#auto eth0
#iface eth0 inet dhcp

# Static
auto eth0
iface eth0 inet static
  address 10.181.0.251
  netmask 255.255.192.0
  #gateway 10.181.0.12
  post-up ip route add default via 10.181.0.11 dev eth0 metric 100
  post-up ip route add default via 10.181.0.12 dev eth0 metric 200
  post-up ip route add default via 10.181.0.13 dev eth0 metric 300
  #dns-nameservers 10.181.0.11 10.181.0.12 10.181.0.13
  #dns-search ffggrz
iface eth0 inet6 static
  address fdb5:78b:64cc::251
  netmask 64

/etc/resolv.conf:

{{{ domain ffggrz search ffggrz. nameserver 10.181.0.202 nameserver 10.181.0.11 nameserver 10.181.0.12 nameserver 10.181.0.13 nameserver 10.181.0.201 }}}
Details

batman-adv und alfred übersetzen (Debian)

Pakete

# sudo apt-get install linux-headers-amd64
sudo apt-get install build-essential cmake bison libcap-dev libsodium-dev libjson-c-dev bridge-utils xz-utils wget pkg-config libnl-genl-3-dev libnl-3-dev
sudo apt-get remove batctl

batman-adv

cd /usr/local/src

wget https://downloads.open-mesh.org/batman/releases/batman-adv-2021.1/batman-adv-2021.1.tar.gz
tar -xf batman-adv-2021.1.tar.gz
cd batman-adv-2021.1/
make
sudo make install

batctl

cd /usr/local/src

wget https://downloads.open-mesh.org/batman/releases/batman-adv-2021.1/batctl-2021.1.tar.gz
tar -xf batctl-2021.1.tar.gz
cd batctl-2021.1/
make
sudo make install

alfred

libuecc

cd /usr/local/src

wget https://git.universe-factory.net/libuecc/snapshot/libuecc-7.tar
tar -xf libuecc-7.tar
cd libuecc-7/
cmake .
make
sudo make install
sudo ldconfig

alfred

{{{ cd /usr/local/src

wget https://downloads.open-mesh.org/batman/releases/batman-adv-2017.3/alfred-2017.3.tar.gz tar -xf alfred-2017.3.tar.gz cd alfred-2017.3/ make CONFIG_ALFRED_GPSD=n sudo make CONFIG_ALFRED_GPSD=n install }}}

Details

interne Domains und DHCP mit dnsmasq

Konfiguration

/usr/local/sbin/update-dnsmasq-hostsfile.sh:

#!/bin/bash

# dnsmasq configuration directory
CONF_DIR=/etc/dnsmasq.d/dhcp-dns-static

function getCurrentVersion() {
# Get hash from latest revision
git log --format=format:%H -1
}

function reverseIp6 { # https://gist.github.com/lsowen/4447d916fd19cbb7fce4
  while read -r host ip; do
    ptr=$(echo "$ip" | awk -F: 'BEGIN {OFS=""; }{addCount = 9 - NF; for(i=1; i<=NF;i++){if(length($i) == 0){ for(j=1;j<=addCount;j++){$i = ($i "0000");} } else { $i = substr(("0000" $i), length($i)+5-4);}}; print}' | rev | sed -e "s/./&./g")
    echo "ptr-record=${ptr}ip6.arpa,${host}"
  done
}

cd $CONF_DIR

# Get current version hash
GIT_REVISION=$(getCurrentVersion)

# Automagically commit local changes
# This preserves local changes
git commit -m "CRON: auto commit"

# Pull latest changes from upstream
git fetch
git merge origin/master -m "Auto Merge"

# Get new version hash
GIT_NEW_REVISION=$(getCurrentVersion)

echo "old: $GIT_REVISION"
echo "new: $GIT_NEW_REVISION"

if [ $GIT_REVISION != $GIT_NEW_REVISION ]
then
  # Reload updated configuration
  echo "Reload dnsmasq configuration."
  cat $CONF_DIR/ffggrz-dns.conf | sed -r 's/^address=\\/([^\\/]*).*\\/([0-9]*)\\.([0-9]*)\\.([0-9]*)\\.([0-9]*)$/ptr-record=\\5.\\4.\\3.\\2.in-addr.arpa,\\1./' | grep '^ptr-record' > $CONF_DIR/ptr_records_from_static
  sed -r 's/^address=\\/([^\\/]*).*\\/([^\\/]*)$/\\1 \\2/' $CONF_DIR/ffggrz-dns.conf | grep -E ' (fdb5|2a03):' | reverseIp6 >> $CONF_DIR/ptr_records_from_static

  dnsmasq --test
  if [ $? -eq 0 ]; then
    systemctl restart dnsmasq
  else
    echo "dnsmasq not restartet!"
  fi
fi

/etc/cron.d/freifunk:

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
*/15 * * * * root /usr/local/sbin/update-dnsmasq-hostsfile.sh > /dev/null

/etc/dnsmasq.conf:

conf-dir=/etc/dnsmasq.d/dhcp-dns-static,.md

Befehle

{{{ chmod 755 /usr/local/sbin/update-dnsmasq-hostsfile.sh mkdir /etc/dnsmasq.d/dhcp-dns-static/ cd /etc/dnsmasq.d/dhcp-dns-static/ git clone https://github.com/ffggrz/dhcp-dns-static.git . }}}
Details

iptables Firewall

Beispiel einer einfache Firewall fuer den Mesh-Server.

Warnung: Die Firewall ist alles andere als optimal oder perfekt! Bei einen Update des Paketes iptables-presistent werden die Regeln erneut eingelesen wodurch z.B. die Kommentare raus fliegen!

Konfiguration

IPv4

/etc/iptables/rules.v4:

#
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i mesh-vpn* -j DROP
-A INPUT -i bat0 -j DROP
-A INPUT -i eth1 -j DROP

-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 68 -m comment --comment "dhcp-client" -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A INPUT -p tcp -m conntrack --ctstate NEW -m hashlimit --hashlimit-above 1/sec --hashlimit-burst 200 --hashlimit-mode srcip --hashlimit-name global_cn_limit --hashlimit-htable-expire 3600000 -j DROP
-A INPUT -p tcp -m conntrack --ctstate NEW -m connlimit --connlimit-above 100 --connlimit-mask 32 --connlimit-saddr -j DROP
-A INPUT -m conntrack --ctstate NEW -m connlimit --connlimit-above 100 --connlimit-mask 32 --connlimit-saddr -j DROP
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -m connlimit --connlimit-upto 10 --connlimit-mask 32 --connlimit-saddr -m limit --limit 1/sec --limit-burst 20 -m comment --comment ssh -j ACCEPT

-A INPUT -p tcp -m conntrack --ctstate NEW -m multiport --dports 80,443 -m comment --comment webserver -j ACCEPT
-A INPUT -p icmp -m conntrack --ctstate NEW -m icmp --icmp-type 8 -m limit --limit 3/sec --limit-burst 50 -j ACCEPT
-A INPUT -i eth0 -p udp -m multiport --dports 137,138 -j DROP
-A INPUT -i eth0 -p igmp -j ACCEPT


-A INPUT -i br-client -p udp -m conntrack --ctstate NEW -m udp --dport 53 -m comment --comment "dns local" -j ACCEPT
-A INPUT -i br-client -p tcp -m conntrack --ctstate NEW -m tcp --dport 53 -m comment --comment "dns local" -j ACCEPT
-A INPUT -i br-client -p udp --dport 123 -m conntrack --ctstate NEW -m comment --comment "ntp-server" -j ACCEPT
-A INPUT -i br-client -p udp --dport 53 -m conntrack --ctstate NEW -m comment --comment "dns-server" -j ACCEPT
-A INPUT -i br-client -p tcp --dport 53 -m conntrack --ctstate NEW -m comment --comment "dns-server" -j ACCEPT

-A INPUT -i br-client -p udp -m multiport --dports 137,138 -m conntrack --ctstate NEW -m comment --comment "samba" -j ACCEPT
-A INPUT -i br-client -p tcp -m multiport --dports 139,445 -m conntrack --ctstate NEW -m comment --comment "samba" -j ACCEPT

-A INPUT -i br-client -p tcp -m multiport --dports 20,21 -m conntrack --ctstate NEW -m comment --comment "ftp" -j ACCEPT

#DHCP-Server
#DHCPDISCOVER
-A INPUT -i br-client -p udp --sport 68 --dport 67 -s 0.0.0.0 -d 255.255.255.255 -j ACCEPT
# eigenes empfangen
-A INPUT -i br-client -p udp --sport 67 --dport 68 -d 255.255.255.255 -j ACCEPT
#DHCPREQUEST
-A INPUT -i br-client -p udp --dport 67 -j ACCEPT
-A INPUT -i br-client -p udp --sport 68 --dport 67 -d 255.255.255.255 -j ACCEPT


-A INPUT -i br-client -m pkttype --pkt-type multicast -j DROP
-A INPUT -i br-client -m pkttype --pkt-type broadcast -j DROP
-A INPUT -i br-anycast -j DROP
-A INPUT -p tcp -m hashlimit --hashlimit-above 10/min --hashlimit-burst 1 --hashlimit-mode srcip --hashlimit-name log_level --hashlimit-htable-expire 3600000 -j LOG
-A INPUT ! -p tcp -j LOG
-A INPUT -p tcp -m state --state NEW -m limit --limit 1/sec --limit-burst 10 -j REJECT --reject-with tcp-reset
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j DROP

-A FORWARD -i lo -j ACCEPT
-A FORWARD -o lo -j ACCEPT
-A FORWARD -i br-client -o br-client -j ACCEPT
-A FORWARD -j LOG
-A FORWARD -j DROP

-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
COMMIT

*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RPFILTER - [0:0]
-A PREROUTING -i eth1 -j DROP
-A PREROUTING -i bat0 -j DROP
-A PREROUTING -i mesh-vpn* -j DROP

-A RPFILTER -m rpfilter -j RETURN
-A RPFILTER -m rpfilter --validmark -j RETURN
-A RPFILTER -m rpfilter --accept-local -j RETURN

-A RPFILTER -m pkttype --pkt-type broadcast -j RETURN
-A RPFILTER -m pkttype --pkt-type multicast -j RETURN

# Internet -> LXC (srv02 hat keine default-route ins internet fuer br-client)
-A RPFILTER -i br-client -d 10.181.0.0/18 -j RETURN

-A RPFILTER -m limit --limit 60/minute --limit-burst 5 -j LOG --log-prefix "RPF: "
-A RPFILTER -j DROP

-A PREROUTING -j RPFILTER
COMMIT

IPv6

/etc/iptables/rules.v6:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -i mesh-vpn* -j DROP
-A INPUT -i eth1 -j DROP
-A INPUT -i bat0 -j DROP

-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A INPUT -p tcp -m conntrack --ctstate NEW -m hashlimit --hashlimit-above 1/sec --hashlimit-burst 200 --hashlimit-mode srcip --hashlimit-name global_cn_limit --hashlimit-htable-expire 3600000 -j DROP
-A INPUT -p tcp -m conntrack --ctstate NEW -m connlimit --connlimit-above 100 --connlimit-mask 128 --connlimit-saddr -j DROP
-A INPUT -m conntrack --ctstate NEW -m connlimit --connlimit-above 100 --connlimit-mask 128 --connlimit-saddr -j DROP

# https://www.cert.org/downloads/IPv6/ip6tables_rules.txt
-A INPUT -i br-client -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
-A INPUT -i br-client -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
-A INPUT -i br-client -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
-A INPUT -i br-client -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPT

-A INPUT -i eth0 -p icmpv6 --icmpv6-type router-advertisement -m hl --hl-eq 255 -j ACCEPT
-A INPUT -i eth0 -p icmpv6 --icmpv6-type neighbor-solicitation -m hl --hl-eq 255 -j ACCEPT
-A INPUT -i eth0 -p icmpv6 --icmpv6-type neighbor-advertisement -m hl --hl-eq 255 -j ACCEPT
-A INPUT -i eth0 -p icmpv6 --icmpv6-type redirect -m hl --hl-eq 255 -j ACCEPT

-A INPUT -d fe80::/10 -i br-client -p ipv6-icmp -j ACCEPT
-A INPUT -s fe80::/10 -i br-client -p ipv6-icmp -j ACCEPT
-A INPUT -s ff00::/8 -i br-client -p ipv6-icmp -j ACCEPT
-A INPUT -d ff00::/8 -i br-client -p ipv6-icmp -j ACCEPT


-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -m connlimit --connlimit-upto 10 --connlimit-mask 128 --connlimit-saddr -m limit --limit 1/sec --limit-burst 20 -m comment --comment ssh -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m multiport --dports 80,443 -m comment --comment webserver -j ACCEPT

-A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 128 -j ACCEPT
-A INPUT -i br-client -p udp -m udp --dport 16962 -m state --state NEW -m comment --comment alfred -j ACCEPT
-A INPUT -i br-client -p tcp -m conntrack --ctstate NEW --dport 5201 -m comment --comment "iperf3" -j ACCEPT
-A INPUT -i br-client -p udp -m conntrack --ctstate NEW --dport 5201 -m comment --comment "iperf3" -j ACCEPT
-A INPUT -i br-client -p udp -m multiport --dports 1001 -m state --state NEW -m comment --comment "respondd" -j ACCEPT
-A INPUT -i br-client -p udp --dport 123 -m conntrack --ctstate NEW -m comment --comment "ntp-server" -j ACCEPT
-A INPUT -i br-client -p udp --dport 53 -m conntrack --ctstate NEW -m comment --comment "dns-server" -j ACCEPT
-A INPUT -i br-client -p tcp --dport 53 -m conntrack --ctstate NEW -m comment --comment "dns-server" -j ACCEPT

-A INPUT -i br-client -p udp -m multiport --dports 137,138 -m conntrack --ctstate NEW -m comment --comment "samba" -j ACCEPT
-A INPUT -i br-client -p tcp -m multiport --dports 139,445 -m conntrack --ctstate NEW -m comment --comment "samba" -j ACCEPT

-A INPUT -i br-client -p tcp -m multiport --dports 20,21 -m conntrack --ctstate NEW -m comment --comment "ftp" -j ACCEPT

-A INPUT -j LOG
-A INPUT -j DROP
-A FORWARD -i br-client -o br-client -j ACCEPT
-A FORWARD -j LOG
-A FORWARD -j DROP
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -j ACCEPT
-A OUTPUT -j DROP
COMMIT


*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:RPFILTER - [0:0]
-A PREROUTING -i eth1 -j DROP
-A PREROUTING -i bat0 -j DROP
-A PREROUTING -i mesh-vpn* -j DROP

-A RPFILTER -m rpfilter -j RETURN
-A RPFILTER -m rpfilter --validmark -j RETURN
-A RPFILTER -m rpfilter --accept-local -j RETURN

-A RPFILTER -m pkttype --pkt-type broadcast -j RETURN
-A RPFILTER -m pkttype --pkt-type multicast -j RETURN

# Internet -> LXC (srv02 hat keine default-route ins internet fuer br-client)
-A RPFILTER -i br-client -d 2a03:2260:100b::/64 -j RETURN

-A RPFILTER -m limit --limit 60/minute --limit-burst 5 -j LOG --log-prefix "RPF: "
-A RPFILTER -j DROP

-A PREROUTING -j RPFILTER
COMMIT

Kernel-Config

Reverse-Path-Filter erledigen wir in iptables damit wir flexibler sind.

/etc/sysctl.conf:

net.ipv4.conf.default.rp_filter=0
net.ipv4.conf.all.rp_filter=0
#net.ipv6.conf.default.rp_filter=0
#net.ipv6.conf.all.rp_filter=0

Befehle

{{{ sudo apt-get install iptables-presistent sudo iptables-apply /etc/iptables/rules.v4 sudo ip6tables-apply /etc/iptables/rules.v6 }}}
Details

Unterkategorien

Allgemein

Freifunkkommune Gera

FAQ

Öffentlichkeitsarbeit

Flohmarkt

Soziale Projekte

Organisation

Anleitungen

Dokumentation

Seite 43 von 44

namespace geöffnet?

<name>space
geschlossen seit 06.06.2026 17:29 Uhr

Weitere Informationen

RSS

Veranstaltungen / Ereignisse

19 Aug. 2026
18:30 - 22:00
namespace geöffnet
21 Aug. 2026
15:00 - 18:00
Repaircafé auf Tour in Gera/Zentrum