talexander/machine_setup
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Move my home server over to linfi.

Browse Source
This commit is contained in:
Tom Alexander
2024-10-13 22:49:12 -04:00
parent d2c1f5c94f
commit d2ff39b5e6
17 changed files with 61 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
ansible/roles/firewall/files/homeserver_pf.conf
View File

@@ -1,5 +1,5 @@
ext_if = "{ igb0 igb1 ix0 ix1 wlan0 }"
not_ext_if = "{ !igb0 !igb1 !ix0 !ix1 !wlan0 }"
ext_if = "{ igb0 igb1 ix0 ix1 linfi_host }"
not_ext_if = "{ !igb0 !igb1 !ix0 !ix1 !linfi_host }"
jail_nat_v4 = "{ 10.215.1.0/24 }"
not_jail_nat_v4 = "{ any, !10.215.1.0/24 }"
restricted_nat_v4 = "{ 10.215.2.0/24 }"
@@ -19,17 +19,17 @@ unifi_ports = "{ 8443 3478 10001 8080 1900 8843 8880 6789 5514 }"
set skip on lo
# queueing
# altq on wlan0 cbq queue { def, stuff }
# altq on linfi_host cbq queue { def, stuff }
# queue def cbq(default borrow)
# queue stuff bandwidth 8Mb cbq { dagger }
# queue dagger cbq(borrow)
# redirections
nat pass on $ext_if inet from $jail_nat_v4 to $not_jail_nat_v4 -> (wlan0)
nat pass on $ext_if inet from $jail_nat_v4 to $not_jail_nat_v4 -> (linfi_host)
rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.1.1 port 53 -> 172.16.0.1 port 53
# cloak
nat pass on $ext_if inet from 10.215.2.0/24 to !10.215.2.0/24 -> (wlan0)
nat pass on $ext_if inet from 10.215.2.0/24 to !10.215.2.0/24 -> (linfi_host)
rdr pass on $not_ext_if proto {tcp, udp} from any to 10.215.2.1 port 53 -> 172.16.0.1 port 53
# bastion

2
ansible/roles/firewall/files/rc.conf
View File

@@ -1,2 +1,2 @@
pf_enable="NO"
pf_enable="YES"
pf_rules="/etc/pf.conf"