summaryrefslogtreecommitdiff
path: root/docs/appendix/examples
diff options
context:
space:
mode:
Diffstat (limited to 'docs/appendix/examples')
-rw-r--r--docs/appendix/examples/dmvpn.rst105
-rw-r--r--docs/appendix/examples/index.rst13
-rw-r--r--docs/appendix/examples/zone-policy.rst379
3 files changed, 497 insertions, 0 deletions
diff --git a/docs/appendix/examples/dmvpn.rst b/docs/appendix/examples/dmvpn.rst
new file mode 100644
index 00000000..d3bf45c7
--- /dev/null
+++ b/docs/appendix/examples/dmvpn.rst
@@ -0,0 +1,105 @@
+
+.. _examples-dmvpn:
+
+VyOS DMVPN Hub
+--------------
+
+General infomration can be found in the :ref:`vpn-dmvpn` chapter.
+
+Configuration
+^^^^^^^^^^^^^
+
+.. code-block:: sh
+
+ set interfaces tunnel tun100 address '172.16.253.134/29'
+ set interfaces tunnel tun100 encapsulation 'gre'
+ set interfaces tunnel tun100 local-ip '11.22.33.44'
+ set interfaces tunnel tun100 multicast 'enable'
+ set interfaces tunnel tun100 parameters ip key '1'
+
+ set protocols nhrp tunnel tun100 cisco-authentication '<nhrp secret key>'
+ set protocols nhrp tunnel tun100 holding-time '300'
+ set protocols nhrp tunnel tun100 multicast 'dynamic'
+ set protocols nhrp tunnel tun100 redirect
+ set protocols nhrp tunnel tun100 shortcut
+
+ set vpn ipsec esp-group ESP-HUB compression 'disable'
+ set vpn ipsec esp-group ESP-HUB lifetime '1800'
+ set vpn ipsec esp-group ESP-HUB mode 'tunnel'
+ set vpn ipsec esp-group ESP-HUB pfs 'dh-group2'
+ set vpn ipsec esp-group ESP-HUB proposal 1 encryption 'aes256'
+ set vpn ipsec esp-group ESP-HUB proposal 1 hash 'sha1'
+ set vpn ipsec esp-group ESP-HUB proposal 2 encryption '3des'
+ set vpn ipsec esp-group ESP-HUB proposal 2 hash 'md5'
+ set vpn ipsec ike-group IKE-HUB ikev2-reauth 'no'
+ set vpn ipsec ike-group IKE-HUB key-exchange 'ikev1'
+ set vpn ipsec ike-group IKE-HUB lifetime '3600'
+ set vpn ipsec ike-group IKE-HUB proposal 1 dh-group '2'
+ set vpn ipsec ike-group IKE-HUB proposal 1 encryption 'aes256'
+ set vpn ipsec ike-group IKE-HUB proposal 1 hash 'sha1'
+ set vpn ipsec ike-group IKE-HUB proposal 2 dh-group '2'
+ set vpn ipsec ike-group IKE-HUB proposal 2 encryption 'aes128'
+ set vpn ipsec ike-group IKE-HUB proposal 2 hash 'sha1'
+ set vpn ipsec ipsec-interfaces interface 'eth0'
+
+ set vpn ipsec profile NHRPVPN authentication mode 'pre-shared-secret'
+ set vpn ipsec profile NHRPVPN authentication pre-shared-secret '<secretkey>'
+ set vpn ipsec profile NHRPVPN bind tunnel 'tun100'
+ set vpn ipsec profile NHRPVPN esp-group 'ESP-HUB'
+ set vpn ipsec profile NHRPVPN ike-group 'IKE-HUB'
+
+Cisco IOS Spoke
+^^^^^^^^^^^^^^^
+
+This example is verified with a Cisco 2811 platform running IOS 15.1(4)M9 and
+VyOS 1.1.7 (helium) up to VyOS 1.2 (Crux).
+
+.. code-block:: sh
+
+ Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M9, RELEASE SOFTWARE (fc3)
+ Technical Support: http://www.cisco.com/techsupport
+ Copyright (c) 1986-2014 by Cisco Systems, Inc.
+ Compiled Fri 12-Sep-14 10:45 by prod_rel_team
+
+ ROM: System Bootstrap, Version 12.3(8r)T7, RELEASE SOFTWARE (fc1)
+
+Use this configuration on your Cisco device:
+
+.. code-block:: sh
+
+ crypto pki token default removal timeout 0
+ crypto keyring DMVPN
+ pre-shared-key address 1.2.3.4 key <secretkey>
+ !
+ crypto isakmp policy 10
+ encr aes 256
+ authentication pre-share
+ group 2
+ !
+ crypto isakmp invalid-spi-recovery
+ crypto isakmp keepalive 30 30 periodic
+ crypto isakmp profile DMVPN
+ keyring DMVPN
+ match identity address 11.22.33.44 255.255.255.255
+ !
+ crypto ipsec transform-set DMVPN-AES256 esp-aes 256 esp-sha-hmac
+ mode transport
+ !
+ crypto ipsec profile DMVPN
+ set security-association idle-time 720
+ set transform-set DMVPN-AES256
+ !
+ interface Tunnel10
+ description Tunnel to DMVPN HUB
+ ip address 172.16.253.129 255.255.255.248
+ no ip redirects
+ ip nhrp authentication <nhrp secret key>
+ ip nhrp map multicast 11.22.33.44
+ ip nhrp map 172.16.253.134 11.22.33.44
+ ip nhrp network-id 1
+ ip nhrp holdtime 600
+ ip nhrp nhs 172.16.253.134
+ ip nhrp registration timeout 75
+ tunnel source Dialer1
+ tunnel mode gre multipoint
+ tunnel key 1
diff --git a/docs/appendix/examples/index.rst b/docs/appendix/examples/index.rst
new file mode 100644
index 00000000..c6e10eeb
--- /dev/null
+++ b/docs/appendix/examples/index.rst
@@ -0,0 +1,13 @@
+.. _examples:
+
+Configuration Examples
+======================
+
+This chapter contains various configuration Examples
+
+
+.. toctree::
+ :maxdepth: 2
+
+ dmvpn
+ zone-policy
diff --git a/docs/appendix/examples/zone-policy.rst b/docs/appendix/examples/zone-policy.rst
new file mode 100644
index 00000000..d159d02d
--- /dev/null
+++ b/docs/appendix/examples/zone-policy.rst
@@ -0,0 +1,379 @@
+.. _examples-zone-policy:
+
+Zone-Policy example
+-------------------
+
+Native IPv4 and IPv6
+^^^^^^^^^^^^^^^^^^^^
+
+We have three networks.
+
+.. code-block:: sh
+
+ WAN - 172.16.10.0/24, 2001:0DB8:0:9999::0/64
+ LAN - 192.168.100.0/24, 2001:0DB8:0:AAAA::0/64
+ DMZ - 192.168.200.0/24, 2001:0DB8:0:BBBB::0/64
+
+
+This specific example is for a router on a stick, but is very easily adapted
+for however many NICs you have.
+
+[http://imgur.com/Alz1J.png Topology Image]
+
+The VyOS interface is assigned the .1/:1 address of their respective networks.
+WAN is on VLAN 10, LAN on VLAN 20, and DMZ on VLAN 30.
+
+It will look something like this:
+
+.. code-block:: sh
+
+ interfaces {
+ ethernet eth0 {
+ duplex auto
+ hw-id 00:0c:29:6e:2a:92
+ smp_affinity auto
+ speed auto
+ vif 10 {
+ address 172.16.10.1/24
+ address 2001:db8:0:9999::1/64
+ }
+ vif 20 {
+ address 192.168.100.1/24
+ address 2001:db8:0:AAAA::1/64
+ }
+ vif 30 {
+ address 192.168.200.1/24
+ address 2001:db8:0:BBBB::1/64
+ }
+ }
+ loopback lo {
+ }
+ }
+
+
+Zones Basics
+^^^^^^^^^^^^
+
+Each interface is assigned to a zone. The interface can be physical or virtual
+such as tunnels (VPN, pptp, gre, etc) and are treated exactly the same.
+
+Traffic flows from zone A to zone B. That flow is what I refer to as a
+zone-pair-direction. eg. A->B and B->A are two zone-pair-destinations.
+
+Ruleset are created per zone-pair-direction.
+
+I name rule sets to indicate which zone-pair-direction they represent. eg.
+ZoneA-ZoneB or ZoneB-ZoneA. LAN-DMZ, DMZ-LAN.
+
+In VyOS, you have to have unique Ruleset names. In the event of overlap, I
+add a "-6" to the end of v6 rulesets. eg. LAN-DMZ, LAN-DMZ-6. This allows for
+each auto-completion and uniqueness.
+
+In this example we have 4 zones. LAN, WAN, DMZ, Local. The local zone is the
+firewall itself.
+
+If your computer is on the LAN and you need to SSH into your VyOS box, you
+would need a rule to allow it in the LAN-Local ruleset. If you want to access
+a webpage from your VyOS box, you need a rule to allow it in the Local-LAN
+ruleset.
+
+In rules, it is good to keep them named consistently. As the number of rules
+you have grows, the more consistency you have, the easier your life will be.
+
+.. code-block:: sh
+
+ Rule 1 - State Established, Related
+ Rule 2 - State Invalid
+ Rule 100 - ICMP
+ Rule 200 - Web
+ Rule 300 - FTP
+ Rule 400 - NTP
+ Rule 500 - SMTP
+ Rule 600 - DNS
+ Rule 700 - DHCP
+ Rule 800 - SSH
+ Rule 900 - IMAPS
+
+The first two rules are to deal with the idiosyncrasies of VyOS and iptables.
+
+Zones and Rulesets both have a default action statement. When using
+Zone-Policies, the default action is set by the zone-policy statement and is
+represented by rule 10000.
+
+It is good practice to log both accepted and denied traffic. It can save you
+significant headaches when trying to troubleshoot a connectivity issue.
+
+To add logging to the default rule, do:
+
+.. code-block:: sh
+
+ set firewall name <ruleSet> enable-default-log
+
+
+By default, iptables does not allow traffic for established session to return,
+so you must explicitly allow this. I do this by adding two rules to every
+ruleset. 1 allows established and related state packets through and rule 2
+drops and logs invalid state packets. We place the established/related rule at
+the top because the vast majority of traffic on a network is established and
+the invalid rule to prevent invalid state packets from mistakenly being matched
+against other rules. Having the most matched rule listed first reduces CPU load
+in high volume environments. Note: I have filed a bug to have this added as a
+default action as well.
+
+''It is important to note, that you do not want to add logging to the
+established state rule as you will be logging both the inbound and outbound
+packets for each session instead of just the initiation of the session.
+Your logs will be massive in a very short period of time.''
+
+In VyOS you must have the interfaces created before you can apply it to the
+zone and the rulesets must be created prior to applying it to a zone-policy.
+
+I create/configure the interfaces first. Build out the rulesets for each
+zone-pair-direction which includes at least the three state rules. Then I setup
+the zone-policies.
+
+Zones do not allow for a default action of accept; either drop or reject.
+It is important to remember this because if you apply an interface to a zone
+and commit, any active connections will be dropped. Specifically, if you are
+SSH’d into VyOS and add local or the interface you are connecting through to a
+zone and do not have rulesets in place to allow SSH and established sessions,
+you will not be able to connect.
+
+The following are the rules that were created for this example
+(may not be complete), both in IPv4 and IPv6. If there is no IP specified,
+then the source/destination address is not explicit.
+
+.. code-block:: sh
+
+ WAN – DMZ:192.168.200.200 – tcp/80
+ WAN – DMZ:192.168.200.200 – tcp/443
+ WAN – DMZ:192.168.200.200 – tcp/25
+ WAN – DMZ:192.168.200.200 – tcp/53
+ WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/80
+ WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/443
+ WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/25
+ WAN – DMZ:2001:0DB8:0:BBBB::200 – tcp/53
+
+ DMZ - Local - tcp/53
+ DMZ - Local - tcp/123
+ DMZ - Local - tcp/67,68
+
+ LAN - Local - tcp/53
+ LAN - Local - tcp/123
+ LAN - Local - tcp/67,68
+ LAN:192.168.100.10 - Local - tcp/22
+ LAN:2001:0DB8:0:AAAA::10 - Local - tcp/22
+
+ LAN - WAN - tcp/80
+ LAN - WAN - tcp/443
+ LAN - WAN - tcp/22
+ LAN - WAN - tcp/20,21
+
+ DMZ - WAN - tcp/80
+ DMZ - WAN - tcp/443
+ DMZ - WAN - tcp/22
+ DMZ - WAN - tcp/20,21
+ DMZ - WAN - tcp/53
+ DMZ - WAN - udp/53
+
+ Local - WAN - tcp/80
+ Local - WAN - tcp/443
+ Local - WAN - tcp/20,21
+
+ Local - DMZ - tcp/25
+ Local - DMZ - tcp/67,68
+ Local - DMZ - tcp/53
+ Local - DMZ - udp/53
+
+ Local - LAN - tcp/67,68
+
+ LAN - DMZ - tcp/80
+ LAN - DMZ - tcp/443
+ LAN - DMZ - tcp/993
+ LAN:2001:0DB8:0:AAAA::10 - DMZ:2001:0DB8:0:BBBB::200 - tcp/22
+ LAN:192.168.100.10 - DMZ:192.168.200.200 - tcp/22
+
+Since we have 4 zones, we need to setup the following rulesets.
+
+.. code-block:: sh
+
+ Lan-wan
+ Lan-local
+ Lan-dmz
+ Wan-lan
+ Wan-local
+ Wan-dmz
+ Local-lan
+ Local-wan
+ Local-dmz
+ Dmz-lan
+ Dmz-wan
+ Dmz-local
+
+Even if the two zones will never communicate, it is a good idea to create the
+zone-pair-direction rulesets and set enable-default-log. This will allow you to
+log attempts to access the networks. Without it, you will never see the
+connection attempts.
+
+This is an example of the three base rules.
+
+.. code-block:: sh
+
+ name wan-lan {
+ default-action drop
+ enable-default-log
+ rule 1 {
+ action accept
+ state {
+ established enable
+ related enable
+ }
+ }
+ rule 2 {
+ action drop
+ log enable
+ state {
+ invalid enable
+ }
+ }
+ }
+
+
+Here is an example of an IPv6 DMZ-WAN ruleset.
+
+.. code-block:: sh
+
+ ipv6-name dmz-wan-6 {
+ default-action drop
+ enable-default-log
+ rule 1 {
+ action accept
+ state {
+ established enable
+ related enable
+ }
+ }
+ rule 2 {
+ action drop
+ log enable
+ state {
+ invalid enable
+ }
+ rule 100 {
+ action accept
+ log enable
+ protocol ipv6-icmp
+ }
+ rule 200 {
+ action accept
+ destination {
+ port 80,443
+ }
+ log enable
+ protocol tcp
+ }
+ rule 300 {
+ action accept
+ destination {
+ port 20,21
+ }
+ log enable
+ protocol tcp
+ }
+ rule 500 {
+ action accept
+ destination {
+ port 25
+ }
+ log enable
+ protocol tcp
+ source {
+ address 2001:db8:0:BBBB::200
+ }
+ }
+ rule 600 {
+ action accept
+ destination {
+ port 53
+ }
+ log enable
+ protocol tcp_udp
+ source {
+ address 2001:db8:0:BBBB::200
+ }
+ }
+ rule 800 {
+ action accept
+ destination {
+ port 22
+ }
+ log enable
+ protocol tcp
+ }
+ }
+
+Once you have all of your rulesets built, then you need to create your
+zone-policy.
+
+Start by setting the interface and default action for each zone.
+
+.. code-block:: sh
+
+ set zone-policy zone dmz default-action drop
+ set zone-policy zone dmz interface eth0.30
+
+In this case, we are setting the v6 ruleset that represents traffic sourced
+from the LAN, destined for the DMZ.
+Because the zone-policy firewall syntax is a little awkward, I keep it straight
+by thinking of it backwards.
+
+ set zone-policy zone dmz from lan firewall ipv6-name lan-dmz-6
+
+dmz-lan policy is lan-dmz. You can get a rhythm to it when you build out a bunch at one time.
+
+In the end, you will end up with something like this config. I took out everything but the Firewall, Interfaces, and zone-policy sections. It is long enough as is.
+== IPv6 Tunnel ==
+
+If you are using a IPv6 tunnel from HE.net or someone else, the basis is the same except you have two WAN interface. One for v4 and one for v6.
+
+You would have 5 zones instead of just 4 and you would configure your v6 ruleset between your tunnel interface and your LAN/DMZ zones instead of to the WAN.
+
+LAN, WAN, DMZ, local and TUN (tunnel)
+
+v6 pairs would be:
+
+.. code-block:: sh
+
+ lan-tun
+ lan-local
+ lan-dmz
+ tun-lan
+ tun-local
+ tun-dmz
+ local-lan
+ local-tun
+ local-dmz
+ dmz-lan
+ dmz-tun
+ dmz-local
+
+Notice, none go to WAN since WAN wouldn't have a v6 address on it.
+
+You would have to add a couple of rules on your wan-local ruleset to allow protocol 41 in.
+
+Something like:
+
+.. code-block:: sh
+
+ rule 400 {
+ action accept
+ destination {
+ address 172.16.10.1
+ }
+ log enable
+ protocol 41
+ source {
+ address ip.of.tunnel.broker
+ }
+ }
+
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-23 17:23:40 +0000