恢复 OCI Terraform 与站点网络 IaC
This commit is contained in:
@@ -0,0 +1,9 @@
|
||||
#!/bin/sh
|
||||
set -eu
|
||||
# 5101..5103 保留给此互联，优先于 Tailscale 的 52 表（规则 5270）。
|
||||
# 主表仍使用 OCI 网关；VCN 路由表再将这三个前缀交给 AMD。
|
||||
{% for prefix in wg_home_prefixes %}
|
||||
if ! ip -4 rule show | grep -F 'to {{ prefix }} lookup main' >/dev/null; then
|
||||
ip -4 rule add priority {{ 5100 + loop.index }} to {{ prefix }} lookup main
|
||||
fi
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,62 @@
|
||||
! Ansible 管理：首个 DN42 peer，单 IPv6 会话双 AFI。
|
||||
! 精确出口与地址范围入口；尚未接入注册表 ROA 校验。
|
||||
no ip prefix-list DN42-RB-IN
|
||||
ip prefix-list DN42-RB-IN seq 1 deny 172.22.166.0/24 le 32
|
||||
ip prefix-list DN42-RB-IN seq 5 deny 172.21.111.160/27 le 32
|
||||
ip prefix-list DN42-RB-IN seq 10 deny 10.0.0.0/24 le 32
|
||||
ip prefix-list DN42-RB-IN seq 20 deny 10.60.0.0/24 le 32
|
||||
ip prefix-list DN42-RB-IN seq 30 deny 10.61.0.0/24 le 32
|
||||
ip prefix-list DN42-RB-IN seq 40 deny 192.168.10.0/24 le 32
|
||||
ip prefix-list DN42-RB-IN seq 1001 permit 172.20.0.0/24 ge 28 le 32
|
||||
ip prefix-list DN42-RB-IN seq 1002 permit 172.21.0.0/24 ge 28 le 32
|
||||
ip prefix-list DN42-RB-IN seq 1003 permit 172.22.0.0/24 ge 28 le 32
|
||||
ip prefix-list DN42-RB-IN seq 1004 permit 172.23.0.0/24 ge 28 le 32
|
||||
ip prefix-list DN42-RB-IN seq 1100 permit 172.20.0.0/14 ge 21 le 29
|
||||
ip prefix-list DN42-RB-IN seq 2001 permit 10.100.0.0/14 le 32
|
||||
ip prefix-list DN42-RB-IN seq 2002 permit 10.127.0.0/16 le 32
|
||||
ip prefix-list DN42-RB-IN seq 2003 permit 10.0.0.0/8 ge 15 le 24
|
||||
ip prefix-list DN42-RB-IN seq 3001 permit 172.31.0.0/16 le 32
|
||||
ip prefix-list DN42-RB-IN seq 9999 deny 0.0.0.0/0 le 32
|
||||
ip prefix-list DN42-RB-OUT seq 10 permit 172.21.111.160/27
|
||||
no ipv6 prefix-list DN42-RB6-IN
|
||||
ipv6 prefix-list DN42-RB6-IN seq 5 deny fdd0:98df:15b0::/48 le 128
|
||||
ipv6 prefix-list DN42-RB6-IN seq 1001 permit fd00::/8 ge 44 le 64
|
||||
ipv6 prefix-list DN42-RB6-IN seq 9999 deny ::/0 le 128
|
||||
ipv6 prefix-list DN42-RB6-OUT seq 10 permit fdd0:98df:15b0::/48
|
||||
interface {{ dn42_interface }}
|
||||
exit
|
||||
router bgp 4242421811
|
||||
no neighbor {{ dn42_peer_linklocal }}
|
||||
neighbor {{ dn42_peer_linklocal }} remote-as {{ dn42_peer_asn }}
|
||||
neighbor {{ dn42_peer_linklocal }} shutdown
|
||||
neighbor {{ dn42_peer_linklocal }} interface {{ dn42_interface }}
|
||||
neighbor {{ dn42_peer_linklocal }} update-source {{ dn42_interface }}
|
||||
neighbor {{ dn42_peer_linklocal }} description RoutedBits-OSA1
|
||||
neighbor {{ dn42_peer_linklocal }} capability extended-nexthop
|
||||
neighbor {{ dn42_peer_linklocal }} timers connect 10
|
||||
address-family ipv4 unicast
|
||||
neighbor {{ dn42_peer_linklocal }} activate
|
||||
neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB-IN in
|
||||
neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB-OUT out
|
||||
neighbor {{ dn42_peer_linklocal }} maximum-prefix 10000
|
||||
exit-address-family
|
||||
address-family ipv6 unicast
|
||||
neighbor {{ dn42_peer_linklocal }} activate
|
||||
neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB6-IN in
|
||||
neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB6-OUT out
|
||||
neighbor {{ dn42_peer_linklocal }} maximum-prefix 10000
|
||||
exit-address-family
|
||||
no neighbor {{ dn42_peer_linklocal }} shutdown
|
||||
exit
|
||||
! 保留既有业务源地址规则，在其后为 DN42 路由选择注册地址；不是 NAT。
|
||||
route-map OCI-WG-SOURCE permit 20
|
||||
match ip address prefix-list DN42-RB-IN
|
||||
set src 172.21.111.162
|
||||
exit
|
||||
route-map DN42-SOURCE6 permit 10
|
||||
match ipv6 address prefix-list DN42-RB6-IN
|
||||
set src fdd0:98df:15b0::2
|
||||
exit
|
||||
route-map DN42-SOURCE6 permit 100
|
||||
exit
|
||||
ipv6 protocol bgp route-map DN42-SOURCE6
|
||||
@@ -0,0 +1,14 @@
|
||||
set service dns forwarding listen-address '192.168.10.2'
|
||||
set service dns forwarding source-address '172.21.111.161'
|
||||
set service dns forwarding source-address 'fdd0:98df:15b0::1'
|
||||
set service dns forwarding no-serve-rfc1918
|
||||
{% for prefix in wg_home_prefixes %}
|
||||
set service dns forwarding allow-from '{{ prefix }}'
|
||||
{% endfor %}
|
||||
{% for zone in dn42_dns_zones %}
|
||||
set service dns forwarding domain {{ zone }} recursion-desired
|
||||
set service dns forwarding domain {{ zone }} addnta
|
||||
{% for server in dn42_dns_servers %}
|
||||
set service dns forwarding domain {{ zone }} name-server '{{ server }}'
|
||||
{% endfor %}
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,10 @@
|
||||
{% for lan in dn42_ra_lans %}
|
||||
set interfaces ethernet {{ lan.interface }} address '{{ lan.address }}'
|
||||
set service router-advert interface {{ lan.interface }} default-lifetime '0'
|
||||
set service router-advert interface {{ lan.interface }} interval min '10'
|
||||
set service router-advert interface {{ lan.interface }} interval max '30'
|
||||
set service router-advert interface {{ lan.interface }} prefix {{ lan.prefix }} preferred-lifetime '14400'
|
||||
set service router-advert interface {{ lan.interface }} prefix {{ lan.prefix }} valid-lifetime '86400'
|
||||
set service router-advert interface {{ lan.interface }} route fd00::/8 route-preference 'medium'
|
||||
set service router-advert interface {{ lan.interface }} route fd00::/8 valid-lifetime '180'
|
||||
{% endfor %}
|
||||
@@ -0,0 +1,12 @@
|
||||
source /opt/vyatta/etc/functions/script-template
|
||||
if /bin/cli-shell-api existsActive interfaces wireguard wg42 private-key; then
|
||||
echo KEY_EXISTS
|
||||
builtin exit 0
|
||||
fi
|
||||
configure
|
||||
set interfaces wireguard wg42 address '10.255.254.2/30'
|
||||
set interfaces wireguard wg42 private-key "$(wg genkey)"
|
||||
commit || builtin exit 1
|
||||
save || builtin exit 1
|
||||
exit
|
||||
echo KEY_CREATED
|
||||
@@ -0,0 +1,84 @@
|
||||
set interfaces wireguard wg42 description 'OCI AMD / DN42 internal transport'
|
||||
set interfaces wireguard wg42 address '172.21.111.161/32'
|
||||
set interfaces wireguard wg42 address 'fdd0:98df:15b0:ffff::2/64'
|
||||
set interfaces wireguard wg42 mtu '1380'
|
||||
set interfaces wireguard wg42 port '51820'
|
||||
set interfaces wireguard wg42 peer amd address '129.225.176.134'
|
||||
set interfaces wireguard wg42 peer amd port '51820'
|
||||
set interfaces wireguard wg42 peer amd public-key '{{ hostvars.oci_amd.wg_public_key.stdout | trim }}'
|
||||
set interfaces wireguard wg42 peer amd persistent-keepalive '25'
|
||||
set interfaces wireguard wg42 peer amd allowed-ips '10.255.254.1/32'
|
||||
set interfaces wireguard wg42 peer amd allowed-ips '10.0.0.0/24'
|
||||
set interfaces wireguard wg42 peer amd allowed-ips '172.21.111.162/32'
|
||||
set interfaces wireguard wg42 peer amd allowed-ips 'fdd0:98df:15b0::/48'
|
||||
set interfaces loopback lo address 'fdd0:98df:15b0::1/128'
|
||||
set protocols static route 172.21.111.160/27 blackhole distance '254'
|
||||
set protocols static route6 fdd0:98df:15b0::/48 blackhole distance '254'
|
||||
set protocols bgp system-as '{{ dn42_asn }}'
|
||||
set protocols bgp parameters router-id '172.21.111.161'
|
||||
{% for p in ['10.0.0.0/24', '172.21.111.162/32', '172.20.0.0/14'] %}
|
||||
set policy prefix-list OCI-SITE-IN rule {{ loop.index * 10 }} action 'permit'
|
||||
set policy prefix-list OCI-SITE-IN rule {{ loop.index * 10 }} prefix '{{ p }}'
|
||||
{% endfor %}
|
||||
{% for p in wg_home_prefixes + [dn42_ipv4] %}
|
||||
set protocols bgp address-family ipv4-unicast network '{{ p }}'
|
||||
set policy prefix-list OCI-SITE-OUT rule {{ loop.index * 10 }} action 'permit'
|
||||
set policy prefix-list OCI-SITE-OUT rule {{ loop.index * 10 }} prefix '{{ p }}'
|
||||
{% endfor %}
|
||||
set protocols bgp address-family ipv6-unicast network '{{ dn42_ipv6 }}'
|
||||
set policy prefix-list6 OCI-SITE6-IN rule 10 action 'permit'
|
||||
set policy prefix-list6 OCI-SITE6-IN rule 10 prefix 'fdd0:98df:15b0::2/128'
|
||||
set policy prefix-list6 OCI-SITE6-OUT rule 10 action 'permit'
|
||||
set policy prefix-list6 OCI-SITE6-OUT rule 10 prefix '{{ dn42_ipv6 }}'
|
||||
set policy prefix-list OCI-TO-OSPF rule 10 action 'permit'
|
||||
set policy prefix-list OCI-TO-OSPF rule 10 prefix '10.0.0.0/24'
|
||||
set policy route-map OCI-TO-OSPF rule 10 action 'permit'
|
||||
set policy route-map OCI-TO-OSPF rule 10 match ip address prefix-list 'OCI-TO-OSPF'
|
||||
set protocols ospf redistribute bgp route-map 'OCI-TO-OSPF'
|
||||
set protocols ospf redistribute bgp metric-type '1'
|
||||
set policy prefix-list DN42-TO-OSPF rule 10 action 'permit'
|
||||
set policy prefix-list DN42-TO-OSPF rule 10 prefix '{{ dn42_ipv4 }}'
|
||||
set policy route-map DN42-TO-OSPF rule 10 action 'permit'
|
||||
set policy route-map DN42-TO-OSPF rule 10 match ip address prefix-list 'DN42-TO-OSPF'
|
||||
set protocols ospf redistribute static route-map 'DN42-TO-OSPF'
|
||||
set protocols ospf redistribute static metric-type '1'
|
||||
set interfaces wireguard wg42 peer amd allowed-ips 'fe80::/64'
|
||||
|
||||
set interfaces wireguard wg42 peer amd allowed-ips '172.20.0.0/14'
|
||||
set interfaces wireguard wg42 peer amd allowed-ips 'fd00::/8'
|
||||
set policy prefix-list6 OCI-SITE6-IN rule 20 action 'permit'
|
||||
set policy prefix-list6 OCI-SITE6-IN rule 20 prefix 'fd00::/8'
|
||||
set policy prefix-list OCI-TO-OSPF rule 20 action 'permit'
|
||||
set policy prefix-list OCI-TO-OSPF rule 20 prefix '172.20.0.0/14'
|
||||
|
||||
set interfaces wireguard wg42 address 'fe80::1811:1/64'
|
||||
set protocols bgp neighbor fe80::1811:2 remote-as '{{ dn42_asn }}'
|
||||
set protocols bgp neighbor fe80::1811:2 description 'OCI AMD internal MP-BGP'
|
||||
set protocols bgp neighbor fe80::1811:2 interface source-interface 'wg42'
|
||||
set protocols bgp neighbor fe80::1811:2 update-source 'fe80::1811:1'
|
||||
set protocols bgp neighbor fe80::1811:2 capability extended-nexthop
|
||||
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast prefix-list import 'OCI-SITE-IN'
|
||||
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast prefix-list export 'OCI-SITE-OUT'
|
||||
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast prefix-list import 'OCI-SITE6-IN'
|
||||
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast prefix-list export 'OCI-SITE6-OUT'
|
||||
|
||||
{% for path in vyos_retired_paths %}
|
||||
{% if vyos_retired_present.results[loop.index0].rc == 0 %}
|
||||
delete {{ path }}
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
set nat source rule 18100 description 'Exclude local DN42 allocation'
|
||||
set nat source rule 18100 outbound-interface name 'wg42'
|
||||
set nat source rule 18100 destination address '172.21.111.160/27'
|
||||
set nat source rule 18100 exclude
|
||||
{% for prefix in wg_home_prefixes %}
|
||||
set nat source rule {{ 18100 + loop.index * 10 }} description 'LAN to DN42 masquerade'
|
||||
set nat source rule {{ 18100 + loop.index * 10 }} outbound-interface name 'wg42'
|
||||
set nat source rule {{ 18100 + loop.index * 10 }} source address '{{ prefix }}'
|
||||
set nat source rule {{ 18100 + loop.index * 10 }} destination address '172.20.0.0/14'
|
||||
set nat source rule {{ 18100 + loop.index * 10 }} translation address 'masquerade'
|
||||
{% endfor %}
|
||||
set policy route-map OCI-MP-IN rule 10 action 'permit'
|
||||
set policy route-map OCI-MP-IN rule 10 set ipv6-next-hop prefer-global
|
||||
set protocols bgp neighbor fe80::1811:2 address-family ipv4-unicast route-map import 'OCI-MP-IN'
|
||||
set protocols bgp neighbor fe80::1811:2 address-family ipv6-unicast route-map import 'OCI-MP-IN'
|
||||
Reference in New Issue
Block a user