diff options
Diffstat (limited to 'docs/configuration')
| -rw-r--r-- | docs/configuration/loadbalancing/reverse-proxy.rst | 47 | ||||
| -rw-r--r-- | docs/configuration/service/dns.rst | 98 |
2 files changed, 136 insertions, 9 deletions
diff --git a/docs/configuration/loadbalancing/reverse-proxy.rst b/docs/configuration/loadbalancing/reverse-proxy.rst index 19ef3773..77d6d67b 100644 --- a/docs/configuration/loadbalancing/reverse-proxy.rst +++ b/docs/configuration/loadbalancing/reverse-proxy.rst @@ -43,7 +43,7 @@ Service .. cfgcmd:: set load-balancing reverse-proxy service <name> ssl certificate <name> - Set SSL certeficate <name> for service <name> + Set SSL certificate <name> for service <name> Rules @@ -97,8 +97,8 @@ Backend .. cfgcmd:: set load-balancing reverse-proxy backend <name> balance <balance> - Load-balancing algorithms to be used for distributind requests among the - vailable servers + Load-balancing algorithms to be used for distributed requests among the + available servers Balance algorithms: * ``source-address`` Distributes requests based on the source IP address @@ -144,9 +144,12 @@ Backend Send a Proxy Protocol version 2 header (binary format) +.. cfgcmd:: set load-balancing reverse-proxy backend <name> ssl ca-certificate <ca-certificate> + Configure requests to the backend server to use SSL encryption and + authenticate backend against <ca-certificate> -Gloabal +Global ------- Global parameters @@ -243,12 +246,12 @@ to the backend ``bk-api-02`` Terminate SSL ------------- -The following configuration reverse-proxy terminate SSL. +The following configuration terminates SSL on the router. -The ``http`` service is lestens on port 80 and force redirects from HTTP to +The ``http`` service is listens on port 80 and force redirects from HTTP to HTTPS. -The ``https`` service listens on port 443 with backend `bk-default` to +The ``https`` service listens on port 443 with backend ``bk-default`` to handle HTTPS traffic. It uses certificate named ``cert`` for SSL termination. Rule 10 matches requests with the exact URL path ``/.well-known/xxx`` @@ -287,3 +290,33 @@ connection limit of 4000 and a minimum TLS version of 1.3. set load-balancing reverse-proxy global-parameters max-connections '4000' set load-balancing reverse-proxy global-parameters tls-version-min '1.3' +SSL Bridging +------------- +The following configuration terminates incoming HTTPS traffic on the router, then re-encrypts the traffic and sends +to the backend server via HTTPS. This is useful if encryption is required for both legs, but you do not want to +install publicly trusted certificates on each backend server. + +Backend service certificates are checked against the certificate authority specified in the configuration, which +could be an internal CA. + +The ``https`` service listens on port 443 with backend ``bk-bridge-ssl`` to +handle HTTPS traffic. It uses certificate named ``cert`` for SSL termination. + +The ``bk-bridge-ssl`` backend connects to sr01 server on port 443 via HTTPS and checks backend +server has a valid certificate trusted by CA ``cacert`` + + +.. code-block:: none + + set load-balancing reverse-proxy service https backend 'bk-bridge-ssl' + set load-balancing reverse-proxy service https description 'listen on 443 port' + set load-balancing reverse-proxy service https mode 'http' + set load-balancing reverse-proxy service https port '443' + set load-balancing reverse-proxy service https ssl certificate 'cert' + + set load-balancing reverse-proxy backend bk-bridge-ssl description 'SSL backend' + set load-balancing reverse-proxy backend bk-bridge-ssl mode 'http' + set load-balancing reverse-proxy backend bk-bridge-ssl ssl ca-certificate 'cacert' + set load-balancing reverse-proxy backend bk-bridge-ssl server sr01 address '192.0.2.23' + set load-balancing reverse-proxy backend bk-bridge-ssl server sr01 port '443' + diff --git a/docs/configuration/service/dns.rst b/docs/configuration/service/dns.rst index c6deb179..365e7885 100644 --- a/docs/configuration/service/dns.rst +++ b/docs/configuration/service/dns.rst @@ -143,6 +143,100 @@ avoid being tracked by the provider of your upstream DNS server. 168.192.in-addr.arpa, 16-31.172.in-addr.arpa, which enabling upstream DNS server(s) to be used for reverse lookups of these zones. +Authoritative zones +------------------- + +The VyOS DNS forwarder can also be configured to host authoritative records for a domain. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> disable + + Disable hosting authoritative zone for `<domain-name>` without deleting from + configuration. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records <type> + <name> disable + + Disable specific record without deleting it from configuration. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records <type> + <name> ttl <seconds> + + Set the :abbr:`TTL (Time-to-live)` for the record in seconds. Default is 300 seconds. + +Record types +^^^^^^^^^^^^ + +Below are a list of record types available to be configured within VyOS. Some records +support special `<name>` keywords: + +* ``@`` Use @ as record name to set the record for the root domain. + +* ``any`` Use any as record name to configure the record as a wildcard. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + a <name> address <x.x.x.x> + + Set an :abbr:`A (Address)` record. Supports ``@`` and ``any`` keywords. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + aaaa <name> address <h:h:h:h:h:h:h:h> + + Set an :abbr:`AAAA (IPv6 Address)` record. Supports ``@`` and ``any`` keywords. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + cname <name> target <target-domain-name> + + Set an :abbr:`CNAME (Canonical name)` record. Supports ``@`` keyword. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + naptr <name> rule <rule-number> <option> <value> + + Set an :abbr:`NAPTR (Naming authority pointer)` record. Supports ``@`` keyword. + NAPTR records support the following options: + + * **lookup-a** A Flag. + + * **lookup-srv** S flag. + + * **order** Rule order. Requires `<value>`. + + * **preference** Rule preference. Requires `<value>`. Defaults to 0 if not set. + + * **protocol-specific** P flag. + + * **regexp** Regular expression. Requires `<value>`. + + * **replacement** Replacement DNS name. + + * **resolve-uri** U flag. + + * **service** Service type. Requires `<value>`. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + ns <name> target <target-name> + + Set an :abbr:`NS (Nameserver)` record. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + ptr <name> target <target-name> + + Set an :abbr:`PTR (Pointer record)` record. Supports ``@`` keyword. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + spf <name> value <value> + + Set an :abbr:`SPF (Sender policy framework)` record. Supports ``@`` keyword. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + srv <name> entry <entry-number> [hostname | port | priority | weight] <value> + + Set an :abbr:`SRV (Service)` record. Supports ``@`` keyword. + +.. cfgcmd:: set service dns forwarding authoritative-domain <domain-name> records + txt <name> value <value> + + Set an :abbr:`TXT (Text)` record. Supports ``@`` keyword. + Example ======= @@ -208,7 +302,7 @@ one involves a third party service, like DynDNS.com or any other such service provider. This method uses HTTP requests to transmit the new IP address. You can configure both in VyOS. -.. _dns:dynmaic_config: +.. _dns:dynamic_config: Configuration ============= @@ -254,7 +348,7 @@ Configuration Specify interval in seconds to wait between Dynamic DNS updates. The default is 300 seconds. -.. _dns:dynmaic_example: +.. _dns:dynamic_example: Example ^^^^^^^ |