First Push
This commit is contained in:
Jack
commit
4f93deea55
58
Monitoring VPS/docker-compose.yml
Normal file
58
Monitoring VPS/docker-compose.yml
Normal file
@ -0,0 +1,58 @@
|
||||
version: '3'
|
||||
networks:
|
||||
default:
|
||||
enable_ipv6: true
|
||||
driver: bridge
|
||||
driver_opts:
|
||||
com.docker.network.enable_ipv6: "true"
|
||||
ipam:
|
||||
driver: default
|
||||
config:
|
||||
- subnet: fd00:0:0:1:3::/64
|
||||
gateway: fd00:0:0:1:3::1
|
||||
- subnet: 172.18.0.0/16
|
||||
gateway: 172.18.0.1
|
||||
services:
|
||||
ipv6nat:
|
||||
container_name: ipv6nat
|
||||
restart: unless-stopped
|
||||
image: robbertkl/ipv6nat
|
||||
privileged: true
|
||||
network_mode: host
|
||||
volumes:
|
||||
- /var/run/docker.sock:/var/run/docker.sock:ro
|
||||
- /lib/modules:/lib/modules:ro
|
||||
|
||||
nginx-proxy-manager:
|
||||
image: 'jc21/nginx-proxy-manager:latest'
|
||||
restart: unless-stopped
|
||||
container_name: mainstack-nginxproxymanager
|
||||
ports:
|
||||
- '80:80'
|
||||
- '443:443'
|
||||
volumes:
|
||||
- ./nginx-proxy-manager/data:/data
|
||||
- ./nginx-proxy-manager/letsencrypt:/etc/letsencrypt
|
||||
networks:
|
||||
default:
|
||||
ipv6_address: "fd00:0:0:1:3::2"
|
||||
depends_on:
|
||||
- uptime-kuma
|
||||
- boris-uptime-koom
|
||||
|
||||
uptime-kuma:
|
||||
image: louislam/uptime-kuma:latest
|
||||
container_name: uptime-kuma
|
||||
restart: unless-stopped
|
||||
volumes:
|
||||
- ./uptime-kuma:/app/data
|
||||
networks:
|
||||
default:
|
||||
ipv6_address: "fd00:0:0:1:3::3"
|
||||
|
||||
telegraf:
|
||||
restart: unless-stopped
|
||||
image: telegraf:latest
|
||||
container_name: telegraf
|
||||
volumes:
|
||||
- ./telegraf.conf:/etc/telegraf/telegraf.conf
|
||||
10
Monitoring VPS/homeaccesswg.conf
Normal file
10
Monitoring VPS/homeaccesswg.conf
Normal file
@ -0,0 +1,10 @@
|
||||
[Interface]
|
||||
PrivateKey =
|
||||
Address = 172.16.16.6/32
|
||||
#DNS = 172.16.16.1
|
||||
|
||||
[Peer]
|
||||
PublicKey =
|
||||
AllowedIPs = 172.16.16.0/24, 192.168.5.0/24, 192.168.6.0/24, 192.168.11.0/30, 192.168.10.0/30
|
||||
PersistentKeepalive = 25
|
||||
Endpoint = router.internal.tgj.services:51830
|
||||
3
Monitoring VPS/readme.md
Normal file
3
Monitoring VPS/readme.md
Normal file
@ -0,0 +1,3 @@
|
||||
* Configs from vps.tgj.services runs uptime kuma (https://status.tgj.services)[https://status.tgj.services] and telegraf to collect ping data (https://tgj.services/graph/goto/hnhB7DkIR?orgId=1)[https://tgj.services/graph/goto/hnhB7DkIR?orgId=1]
|
||||
|
||||
** Server is a small one core system provided by a friend who runs a hosting provider Gets IPV6 from a huricane electric runnel, Also contains a wireguard tunnel to my house for internal service monitoring
|
||||
30
Monitoring VPS/telegraf.conf
Normal file
30
Monitoring VPS/telegraf.conf
Normal file
@ -0,0 +1,30 @@
|
||||
# Configuration for telegraf agent
|
||||
[agent]
|
||||
interval = "10s"
|
||||
round_interval = true
|
||||
metric_batch_size = 1000
|
||||
metric_buffer_limit = 10000
|
||||
collection_jitter = "0s"
|
||||
flush_interval = "10s"
|
||||
flush_jitter = "0s"
|
||||
precision = ""
|
||||
hostname = "TGJ-UK"
|
||||
omit_hostname = false
|
||||
|
||||
[[outputs.influxdb_v2]]
|
||||
|
||||
urls = ["https://influx.db.tgj.services"]
|
||||
|
||||
token = "<mytoken>"
|
||||
|
||||
organization = "TGJ "
|
||||
bucket = "pings"
|
||||
|
||||
[[inputs.ping]]
|
||||
interval = '5s'
|
||||
# urls = ['router.internal.tgj.services','thatguyjack.co.uk','google.com','mail.uk.tgj.services','borishub.co.uk','luke.tgj.services','1.1.1.1','router.internal.borishub.co.uk','router.internal.swittcorp.net','router.internal.iwouldntdownloadacar.co.uk','2a12:bec0:210::1','2a12:bec0:212::1','2a12:bec0:213::1','2a12:bec0:214::1','2a12:bec0:215::1','2a12:bec0:216::1','2a12:bec0:21d::1','2a12:bec0:219::1','2a12:bec0:218::1','2a12:bec0:210:2::2', '2a12:bec0:210:3::2', '2a12:bec0:210:5::2', '2a12:bec0:210:4::2','149.18.80.30','149.18.80.31','149.18.80.32','149.18.80.33','149.18.80.35','149.18.80.36','149.18.80.37','149.18.80.38','149.18.80.39']
|
||||
urls = ['router.internal.tgj.services','thatguyjack.co.uk','google.com','mail.uk.tgj.services','borishub.co.uk','luke.tgj.services','1.1.1.1','router.internal.borishub.co.uk','router.internal.swittcorp.net','router.internal.iwouldntdownloadacar.co.uk','2a12:bec0:210::1','2a12:bec0:212::1','2a12:bec0:213::1','2a12:bec0:214::1','2a12:bec0:215::1','2a12:bec0:216::1','2a12:bec0:21d::1','2a12:bec0:219::1','2a12:bec0:218::1','2a12:bec0:210:2::2', '2a12:bec0:210:3::2', '2a12:bec0:210:5::2', '2a12:bec0:210:4::2','149.18.80.30','149.18.80.31','149.18.80.32','149.18.80.33','149.18.80.35','149.18.80.36','149.18.80.37','149.18.80.38','149.18.80.39','45.61.173.144','45.61.173.145','45.61.173.146','45.61.173.147','45.61.173.148','45.61.173.149','45.61.173.150','45.61.173.151','45.61.173.152','45.61.173.153']
|
||||
count = 1
|
||||
ping_interval = 1.0
|
||||
timeout = 3.0
|
||||
deadline = 3
|
||||
310
VDS/bird.conf
Normal file
310
VDS/bird.conf
Normal file
@ -0,0 +1,310 @@
|
||||
router id 45.61.173.144;
|
||||
|
||||
log syslog all;
|
||||
log "/var/log/bird/bird.log" { debug, trace, info, remote, warning, error, auth, fatal, bug };
|
||||
|
||||
protocol kernel {
|
||||
ipv6;
|
||||
scan time 15;
|
||||
# learn;
|
||||
}
|
||||
|
||||
protocol kernel {
|
||||
ipv4;
|
||||
scan time 15;
|
||||
# learn;
|
||||
}
|
||||
|
||||
protocol device {
|
||||
scan time 10;
|
||||
}
|
||||
|
||||
protocol static announcev6 {
|
||||
ipv6;
|
||||
description "Static v6 Routes";
|
||||
route 2a12:bec0:210::/44 blackhole; #default Blackhole for subnet
|
||||
|
||||
route 2a12:bec0:210:4::/64 via 2a12:bec0:210:4::1; #Pete-tunnel
|
||||
route 2a12:bec0:218::/48 via 2a12:bec0:210:4::2; #Pete-range
|
||||
|
||||
route 2a12:bec0:210:2::/64 via 2a12:bec0:210:2::1; #TGJ-tunnel
|
||||
route 2a12:bec0:214::/48 via 2a12:bec0:210:2::2; #TGJ-range
|
||||
|
||||
route 2a12:bec0:210:5::/64 via 2a12:bec0:210:5::1; #Hugo-tunnel
|
||||
route 2a12:bec0:21d::/48 via 2a12:bec0:210:5::2; #Hugo-range
|
||||
|
||||
route 2a12:bec0:210:3::/64 via 2a12:bec0:210:3::1; #Boris-tunnel
|
||||
route 2a12:bec0:219::/48 via 2a12:bec0:210:3::2; #Boris-Range
|
||||
|
||||
route 2a12:bec0:210:6::/64 via 2a12:bec0:210:6::1; #Khem
|
||||
route 2a12:bec0:213::/48 via 2a12:bec0:210:6::2; #Khem-Range
|
||||
|
||||
route 2a12:bec0:210:8::/64 via 2a12:bec0:210:8::1; #Jake
|
||||
route 2a12:bec0:215::/48 via 2a12:bec0:210:8::2; #Jake-Range
|
||||
|
||||
# route 2a12:bec0:210:7::/64 via 2a12:bec0:210:7::1; #Khempi
|
||||
# route 2a12:bec0:212::/48 via 2a12:bec0:210:7::2; #Khempi-Range
|
||||
}
|
||||
|
||||
protocol static announcev4 {
|
||||
ipv4;
|
||||
description "Static v4 Routes";
|
||||
# route 2a12:bec0:215::/48 blackhole; #default Blackhole for subnet
|
||||
}
|
||||
|
||||
protocol static {
|
||||
ipv6;
|
||||
}
|
||||
|
||||
protocol static {
|
||||
ipv4;
|
||||
}
|
||||
|
||||
define BOGON_ASNS = [
|
||||
0, # RFC 7607
|
||||
23456, # RFC 4893 AS_TRANS
|
||||
64496..64511, # RFC 5398 and documentation/example ASNs
|
||||
64512..65534, # RFC 6996 Private ASNs
|
||||
65535, # RFC 7300 Last 16 bit ASN
|
||||
65536..65551, # RFC 5398 and documentation/example ASNs
|
||||
65552..131071, # RFC IANA reserved ASNs
|
||||
4200000000..4294967294, # RFC 6996 Private ASNs
|
||||
4294967295 # RFC 7300 Last 32 bit ASN
|
||||
];
|
||||
|
||||
define V6_BOGON_PREFIXES = [
|
||||
#v6 bogon
|
||||
::/8+, # RFC 4291 IPv4-compatible, loopback, et al
|
||||
0100::/64+, # RFC 6666 Discard-Only
|
||||
2001:2::/48+, # RFC 5180 BMWG
|
||||
2001:10::/28+, # RFC 4843 ORCHID
|
||||
2001:db8::/32+, # RFC 3849 documentation
|
||||
2002::/16+, # RFC 7526 6to4 anycast relay
|
||||
3ffe::/16+, # RFC 3701 old 6bone
|
||||
fc00::/7+, # RFC 4193 unique local unicast
|
||||
fe80::/10+, # RFC 4291 link local unicast
|
||||
fec0::/10+, # RFC 3879 old site local unicast
|
||||
ff00::/8+ # RFC 4291 multicast
|
||||
];
|
||||
|
||||
define V4_BOGON_PREFIXES = [
|
||||
#v4 bogon
|
||||
0.0.0.0/8+, # RFC 1122 'this' network
|
||||
10.0.0.0/8+, # RFC 1918 private space
|
||||
100.64.0.0/10+, # RFC 6598 Carrier grade nat space
|
||||
127.0.0.0/8+, # RFC 1122 localhost
|
||||
169.254.0.0/16+, # RFC 3927 link local
|
||||
172.16.0.0/12+, # RFC 1918 private space
|
||||
192.0.2.0/24+, # RFC 5737 TEST-NET-1
|
||||
192.88.99.0/24+, # RFC 7526 6to4 anycast relay
|
||||
192.168.0.0/16+, # RFC 1918 private space
|
||||
198.18.0.0/15+, # RFC 2544 benchmarking
|
||||
198.51.100.0/24+, # RFC 5737 TEST-NET-2
|
||||
203.0.113.0/24+, # RFC 5737 TEST-NET-3
|
||||
224.0.0.0/4+, # multicast
|
||||
240.0.0.0/4+ # reserved
|
||||
];
|
||||
|
||||
function reject_bogon_asns() {
|
||||
|
||||
if (bgp_path ~ BOGON_ASNS) then
|
||||
{
|
||||
print "Reject: bogon AS_PATH: ", net, " ", bgp_path;
|
||||
reject;
|
||||
}
|
||||
}
|
||||
|
||||
function reject_v4_bogon_prefixes() {
|
||||
if (net ~ V4_BOGON_PREFIXES) then
|
||||
{
|
||||
print "Reject: Bogon prefix: ", net, " ", bgp_path;
|
||||
reject;
|
||||
}
|
||||
}
|
||||
|
||||
function reject_v6_bogon_prefixes() {
|
||||
if (net ~ V6_BOGON_PREFIXES) then
|
||||
{
|
||||
print "Reject: Bogon prefix: ", net, " ", bgp_path;
|
||||
reject;
|
||||
}
|
||||
}
|
||||
|
||||
function reject_smallv6_prefixes() {
|
||||
if (net.len > 64) then
|
||||
{
|
||||
print "Reject: Too small prefix: ", net, " ", bgp_path;
|
||||
reject;
|
||||
}
|
||||
}
|
||||
|
||||
function reject_smallv4_prefixes() {
|
||||
if (net.len > 24) then
|
||||
{
|
||||
print "Reject: Too small prefix: ", net, " ", bgp_path;
|
||||
reject;
|
||||
}
|
||||
}
|
||||
|
||||
function reject_long_aspaths() {
|
||||
if (bgp_path.len > 100) then
|
||||
{
|
||||
print "Reject: Too long AS path: ", net, " ", bgp_path;
|
||||
reject;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
filter rt_import {
|
||||
reject_bogon_asns();
|
||||
reject_v4_bogon_prefixes();
|
||||
reject_v6_bogon_prefixes();
|
||||
reject_smallv6_prefixes();
|
||||
reject_smallv4_prefixes();
|
||||
reject_long_aspaths();
|
||||
accept;
|
||||
}
|
||||
|
||||
filter rt_export {
|
||||
if (proto = "announcev4") then
|
||||
accept;
|
||||
if (proto = "announcev6") then
|
||||
accept;
|
||||
reject;
|
||||
}
|
||||
|
||||
#EBGP upstream sessions
|
||||
protocol bgp scaleblade {
|
||||
local 2a12:bec0:7000:1:149:18:80:30 as 199519;
|
||||
# local 2a12:bec1:b00b:b00b:b00b:b00b:b00b:b00b as 199519;
|
||||
neighbor 2a12:bec0:7000::1 as 52041;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
export limit 20;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
graceful restart on;
|
||||
};
|
||||
}
|
||||
|
||||
#protocol bgp R64 {
|
||||
# local 2a0f:5707:abf8:134::2 as 199519;
|
||||
# neighbor 2a0f:5707:abf8:134::1 as 212895;
|
||||
# ipv6 {
|
||||
# import none;
|
||||
# export filter rt_export;
|
||||
# };
|
||||
#}
|
||||
|
||||
#IBGP sessions
|
||||
protocol bgp TGJHOME {
|
||||
local 2a12:bec0:210:2::1 as 199519;
|
||||
neighbor 2a12:bec0:210:2::2 as 199519;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import limit 20;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
protocol bgp hugo {
|
||||
local 2a12:bec0:210:5::1 as 199519;
|
||||
neighbor 2a12:bec0:210:5::2 as 199519;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import limit 10;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
protocol bgp pete {
|
||||
local 2a12:bec0:210:4::1 as 199519;
|
||||
neighbor 2a12:bec0:210:4::2 as 199519;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import limit 10;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
protocol bgp boris {
|
||||
local 2a12:bec0:210:3::1 as 199519;
|
||||
neighbor 2a12:bec0:210:3::2 as 199519;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import limit 10;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
protocol bgp khem {
|
||||
local 2a12:bec0:210:6::1 as 199519;
|
||||
neighbor 2a12:bec0:210:6::2 as 199519;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import limit 20;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
protocol bgp luke {
|
||||
local 2a12:bec0:210:7::1 as 199519;
|
||||
neighbor 2a12:bec0:210:7::2 as 199519;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import limit 20;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
#iBGP Customers
|
||||
|
||||
#protocol bgp mrcool {
|
||||
# local 2a12:bec0:210:10::1 as 199519;
|
||||
# neighbor 2a12:bec0:210:10::2 as 199187;
|
||||
# multihop 255;
|
||||
# ipv6 {
|
||||
# import limit 10;
|
||||
# import filter rt_import;
|
||||
# export filter rt_export;
|
||||
# };
|
||||
#}
|
||||
|
||||
protocol bgp jake {
|
||||
local 2a12:bec0:210:8::1 as 199519;
|
||||
neighbor 2a12:bec0:210:8::2 as 199519;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import limit 10;
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
#Monitoring
|
||||
protocol bgp QRT {
|
||||
local 45.61.173.144 as 199519;
|
||||
neighbor 178.248.237.29 as 197068;
|
||||
multihop 255;
|
||||
ipv6 {
|
||||
import filter rt_import;
|
||||
export filter rt_export;
|
||||
};
|
||||
}
|
||||
|
||||
# off till full table
|
||||
#protocol bgp bgptools {
|
||||
# local 2a12:bec0:7000:1:149:18:80:30 as 199519;
|
||||
# neighbor 2a0c:2f07:9459::b6 as 212232;
|
||||
# multihop 255;
|
||||
# ipv6 {
|
||||
# import all;
|
||||
# export all;
|
||||
# };
|
||||
#}
|
||||
1
VDS/readme.md
Normal file
1
VDS/readme.md
Normal file
@ -0,0 +1 @@
|
||||
* Configs from vds.tgj.services
|
||||
6
VDS/tayga.conf
Normal file
6
VDS/tayga.conf
Normal file
@ -0,0 +1,6 @@
|
||||
tun-device nat64 #Virtual Device name
|
||||
ipv4-addr 192.168.255.1 #Nat64 v4 address range
|
||||
ipv6-addr 2a12:bec0:210:65::1 #ipv6 address for external access
|
||||
prefix 2a12:bec0:210:64::/96 #ipv6 subnet for DNS64'd requests
|
||||
dynamic-pool 192.168.255.0/24 #Dynamic pool for v4 Clients
|
||||
data-dir /var/spool/tayga
|
||||
44
VDS/wireguard-example.conf
Normal file
44
VDS/wireguard-example.conf
Normal file
@ -0,0 +1,44 @@
|
||||
#ipv6 ibgp wireguard
|
||||
#Server PrivateKey
|
||||
#Server Publickey
|
||||
|
||||
[Interface]
|
||||
PrivateKey =
|
||||
Address = 2a12:bec0:210:2::1/64,172.23.10.1/30 #Local Interface addresses
|
||||
ListenPort = 51819
|
||||
MTU = 1430 #MTU supported on a standard GPON network
|
||||
|
||||
PreUp = iptables -t nat -A PREROUTING -d <ExternalIP> -p tcp --dport 1:65000 -j DNAT --to-destination 172.23.10.2 #Forward all TCP ports on external IP to Peers Address
|
||||
PreUp = iptables -t nat -A PREROUTING -d <ExternalIP> -p udp --dport 1:65000 -j DNAT --to-destination 172.23.10.2 #Forward all UDP ports on external IP to Peers Address
|
||||
PreUp = iptables -t nat -A POSTROUTING -s 172.23.10.2/30 -j SNAT --to-source <ExternalIP> #Add SNAT (source NAT) rule for outgoing traffic
|
||||
PreUp = ip6tables -A FORWARD -i ens18 -o wg1 -j ACCEPT #allow BGP'd traffic between interfaces
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o ens18 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o wg2 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o wg3 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o wg4 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o wg5 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o wg9 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o wg10 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i wg1 -o nat64 -j ACCEPT
|
||||
PreUp = ip6tables -A FORWARD -i nat64 -o wg1 -j ACCEPT
|
||||
|
||||
|
||||
#Same as above but removing rules
|
||||
PostDown = ip6tables -D FORWARD -i nat64 -o wg1 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o nat64 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o wg2 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o wg3 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o wg4 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o wg5 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o wg9 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o wg10 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i ens18 -o wg1 -j ACCEPT
|
||||
PostDown = ip6tables -D FORWARD -i wg1 -o ens18 -j ACCEPT
|
||||
PostDown = iptables -t nat -D PREROUTING -d <ExternalIP> -p tcp --dport 1:65000 -j DNAT --to-destination 172.23.10.2
|
||||
PostDown = iptables -t nat -D PREROUTING -d <ExternalIP> -p udp --dport 1:65000 -j DNAT --to-destination 172.23.10.2
|
||||
PostDown = iptables -t nat -D POSTROUTING -s 172.23.10.2/30 -j SNAT --to-source <ExternalIP>
|
||||
|
||||
[Peer]
|
||||
#PublicKey =
|
||||
PublicKey =
|
||||
AllowedIPs = 2a12:bec0:210:2::2/64,2a12:bec0:214::/48,172.23.10.2/30
|
||||
Loading…
x
Reference in New Issue
Block a user