From 535a3bd7b96431084150682fd7366413f78e2c48 Mon Sep 17 00:00:00 2001 From: Christoph Emsenhuber Date: Wed, 26 Aug 2026 20:26:41 +0200 Subject: [PATCH] TP23 Stufe 2: AGH-Paar als DNS-Resolver + DHCP auf emsenhuber.net MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - adguard/AdGuardHome.yaml: AGH-Wizard-Setup (27 Rewrites ohne .bf, DoH zum CF-Gateway, conditional emsenhuber.net). - nautobot/mikrotik_routeros.j2: DHCP dns-server=10.40.20.36,.37, domain=emsenhuber.net. - docs/transaktionen/TP23-agh-firewall.commands.rsc: TP5-E2 LAN->AGH dns auf .16/.17 ersetzt durch .36/.37. - docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc: DHCP-Cutover (dns-server + domain in einem Deploy). Compliance 104/104, 0 Drifts. Core bleibt als Rückfallebene unangetastet. [KEIN go fuer den Rest: Persistenz (CLAUDE.md/memory), Host.Naming (.host.emsenhuber.net), add-dns-entries-Suffix, conditional-Upstream, lease-time-Transaktion, TP31-defer — alles im Plan, Wartet auf separates go des Users.] --- adguard/AdGuardHome.yaml | 273 ++++++++++++++++++ .../TP23-agh-dhcp-cutover.commands.rsc | 8 + .../TP23-agh-firewall.commands.rsc | 7 + nautobot/mikrotik_routeros.j2 | 2 +- 4 files changed, 289 insertions(+), 1 deletion(-) create mode 100644 adguard/AdGuardHome.yaml create mode 100644 docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc create mode 100644 docs/transaktionen/TP23-agh-firewall.commands.rsc diff --git a/adguard/AdGuardHome.yaml b/adguard/AdGuardHome.yaml new file mode 100644 index 0000000..27e2713 --- /dev/null +++ b/adguard/AdGuardHome.yaml @@ -0,0 +1,273 @@ +http: + pprof: + port: 6060 + enabled: false + doh: + routes: + - GET /dns-query + - POST /dns-query + - GET /dns-query/{ClientID} + - POST /dns-query/{ClientID} + insecure_enabled: false + address: 0.0.0.0:80 + session_ttl: 30d +users: + - name: admin + password: $2a$10$ue8PEedG4t2JRyT83XiGHeqIU4PFRzhn8rjDOZGYGt0sFC2qju2fi +auth_attempts: 5 +block_auth_min: 15 +http_proxy: "" +language: "" +theme: auto +dns: + bind_hosts: + - 0.0.0.0 + port: 53 + anonymize_client_ip: false + ratelimit: 20 + ratelimit_subnet_len_ipv4: 24 + ratelimit_subnet_len_ipv6: 56 + ratelimit_whitelist: [] + refuse_any: true + upstream_dns: + - https://px35ynlol3.cloudflare-gateway.com/dns-query + - '[/bf.lan/]10.40.20.1' + - '[/40.10.in-addr.arpa/]10.40.20.1' + upstream_dns_file: "" + bootstrap_dns: + - 1.1.1.1 + - 1.0.0.1 + fallback_dns: [] + upstream_mode: load_balance + fastest_timeout: 1s + allowed_clients: [] + disallowed_clients: [] + blocked_hosts: + - version.bind + - id.server + - hostname.bind + trusted_proxies: + - 127.0.0.0/8 + - ::1/128 + cache_enabled: true + cache_size: 4194304 + cache_ttl_min: 0 + cache_ttl_max: 0 + cache_optimistic: false + cache_optimistic_answer_ttl: 30s + cache_optimistic_max_age: 12h + bogus_nxdomain: [] + aaaa_disabled: false + enable_dnssec: true + edns_client_subnet: + custom_ip: "" + enabled: false + use_custom: false + max_goroutines: 300 + handle_ddr: true + ipset: [] + ipset_file: "" + bootstrap_prefer_ipv6: false + upstream_timeout: 10s + private_networks: [] + use_private_ptr_resolvers: true + local_ptr_upstreams: [] + use_dns64: false + dns64_prefixes: [] + serve_http3: false + use_http3_upstreams: false + serve_plain_dns: true + hostsfile_enabled: true + pending_requests: + enabled: true +tls: + enabled: false + server_name: "" + force_https: false + port_https: 443 + port_dns_over_tls: 853 + port_dns_over_quic: 853 + port_dnscrypt: 0 + dnscrypt_config_file: "" + certificate_chain: "" + private_key: "" + certificate_path: "" + private_key_path: "" + strict_sni_check: false +querylog: + dir_path: "" + ignored: [] + interval: 90d + size_memory: 1000 + enabled: true + ignored_enabled: false + file_enabled: true +statistics: + dir_path: "" + ignored: [] + interval: 1d + enabled: true + ignored_enabled: false +filters: + - enabled: true + url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_1.txt + name: AdGuard DNS filter + id: 1 + - enabled: false + url: https://adguardteam.github.io/HostlistsRegistry/assets/filter_2.txt + name: AdAway Default Blocklist + id: 2 +whitelist_filters: [] +user_rules: [] +dhcp: + enabled: false + interface_name: "" + local_domain_name: lan + dhcpv4: + gateway_ip: "" + subnet_mask: "" + range_start: "" + range_end: "" + lease_duration: 86400 + icmp_timeout_msec: 1000 + options: [] + dhcpv6: + range_start: "" + lease_duration: 86400 + ra_slaac_only: false + ra_allow_slaac: false +filtering: + blocking_ipv4: "" + blocking_ipv6: "" + blocked_services: + schedule: + time_zone: Local + ids: [] + protection_disabled_until: null + safe_search: + enabled: false + bing: true + duckduckgo: true + ecosia: true + google: true + pixabay: true + yandex: true + youtube: true + blocking_mode: default + parental_block_host: family-block.dns.adguard.com + safebrowsing_block_host: standard-block.dns.adguard.com + rewrites: + - domain: vw.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: hass.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: n8n.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: gitea.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: nautobot.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: ds-bf.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: ccu.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: iobroker.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: z2m25.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: pve-mcp.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: ha-mcp.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: n8n-mcp.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: gitea-mcp.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: pve.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: portainer.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: pbs.emsenhuber.net + answer: 10.40.20.40 + enabled: true + - domain: nas.emsenhuber.net + answer: 10.40.20.10 + enabled: true + - domain: macmini.emsenhuber.net + answer: 10.40.20.167 + enabled: true + - domain: mfc.emsenhuber.net + answer: 10.40.10.6 + enabled: true + - domain: tv.emsenhuber.net + answer: 10.40.40.11 + enabled: true + - domain: docker.emsenhuber.net + answer: 10.40.20.126 + enabled: true + - domain: platform-pg.emsenhuber.net + answer: 10.40.20.20 + enabled: true + - domain: core.emsenhuber.net + answer: 10.40.99.1 + enabled: true + - domain: ap1.emsenhuber.net + answer: 10.40.99.11 + enabled: true + - domain: ap2.emsenhuber.net + answer: 10.40.99.12 + enabled: true + - domain: branch.emsenhuber.net + answer: 10.40.99.2 + enabled: true + safe_fs_patterns: + - /opt/AdGuardHome/userfilters/* + max_http_size: 256MB + safebrowsing_cache_size: 1048576 + safesearch_cache_size: 1048576 + parental_cache_size: 1048576 + cache_time: 30 + filters_update_interval: 24 + blocked_response_ttl: 10 + filtering_enabled: true + rewrites_enabled: true + parental_enabled: false + safebrowsing_enabled: false + protection_enabled: true +clients: + runtime_sources: + whois: true + arp: true + rdns: true + dhcp: true + hosts: true + persistent: [] +log: + enabled: true + file: "" + max_backups: 0 + max_size: 100 + max_age: 3 + compress: false + local_time: false + verbose: false +os: + group: "" + user: "" + rlimit_nofile: 0 +schema_version: 34 diff --git a/docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc b/docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc new file mode 100644 index 0000000..0329901 --- /dev/null +++ b/docs/transaktionen/TP23-agh-dhcp-cutover.commands.rsc @@ -0,0 +1,8 @@ +/ip dhcp-server network set [find address~"10.40.10.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net +/ip dhcp-server network set [find address~"10.40.20.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net +/ip dhcp-server network set [find address~"10.40.30.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net +/ip dhcp-server network set [find address~"10.40.40.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net +/ip dhcp-server network set [find address~"10.40.50.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net +/ip dhcp-server network set [find address~"10.40.90.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net +/ip dhcp-server network set [find address~"10.40.99.0"] dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net +:log info ("agh-cutover: dns-server=" . [/ip dhcp-server network get [find address~"10.40.10.0"] dns-server] . " domain=" . [/ip dhcp-server network get [find address~"10.40.10.0"] domain]) diff --git a/docs/transaktionen/TP23-agh-firewall.commands.rsc b/docs/transaktionen/TP23-agh-firewall.commands.rsc new file mode 100644 index 0000000..7ef963b --- /dev/null +++ b/docs/transaktionen/TP23-agh-firewall.commands.rsc @@ -0,0 +1,7 @@ +:do { /ip firewall filter remove [find comment="TP5-E2: LAN->AGH dns (Vorrat)"] } on-error={ :log info "agh: remove udp .16 hat geworfen" } +:do { /ip firewall filter remove [find comment="TP5-E2: LAN->AGH dns-tcp (Vorrat)"] } on-error={ :log info "agh: remove tcp .16 hat geworfen" } +/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns" dst-address=10.40.20.36 dst-port=53 protocol=udp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"] +/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns-tcp" dst-address=10.40.20.36 dst-port=53 protocol=tcp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"] +/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns" dst-address=10.40.20.37 dst-port=53 protocol=udp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"] +/ip firewall filter add action=accept chain=forward comment="TP5-E2: LAN->AGH dns-tcp" dst-address=10.40.20.37 dst-port=53 protocol=tcp place-before=[find comment="TP5: log-only, Vorstufe zum deny-by-default"] +:log info ("agh: rest .16=" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.16]]] . " neu .36/.37=" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.36]]] . "/" . [:tostr [:len [/ip firewall filter find dst-address=10.40.20.37]]]) diff --git a/nautobot/mikrotik_routeros.j2 b/nautobot/mikrotik_routeros.j2 index aa7466e..5cb42d2 100644 --- a/nautobot/mikrotik_routeros.j2 +++ b/nautobot/mikrotik_routeros.j2 @@ -127,7 +127,7 @@ /ip dhcp-server add address-pool=pool-v{{ v.id }} comment={{ v.name }} interface=vlan{{ v.id }} lease-time={{ v.lease }} name=dhcp-v{{ v.id }} {% endfor %} {% for v in vlans %} -/ip dhcp-server network add address=10.40.{{ v.id }}.0/24 dns-server=10.40.{{ v.id }}.1 domain=bf.lan gateway=10.40.{{ v.id }}.1 ntp-server=10.40.{{ v.id }}.1 +/ip dhcp-server network add address=10.40.{{ v.id }}.0/24 dns-server=10.40.20.36,10.40.20.37 domain=emsenhuber.net gateway=10.40.{{ v.id }}.1 ntp-server=10.40.{{ v.id }}.1 {% endfor %} /ip dhcp-server option add code=6 name="dns 1.1.1.1" value=0x01010101