admin/bf-infra
1
0
Fork 0
Code Issues 21 Pull Requests Actions Packages Projects Releases Wiki Activity

Initial import from bf-network-r6.opencode — opencode migration

Browse Source
This commit is contained in:
Christoph Emsenhuber
2026-08-26 12:44:21 +02:00
commit 5ee0716dda
297 changed files with 72324 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

71
routeros/tp10-cutover-apply.rsc Normal file
View File

@@ -0,0 +1,71 @@
# =====================================================================
# TP10 Cutover-Apply (ap1) — WG-Hub scharf + WAN-Input-Seal
# =====================================================================
# Zweck: ap1 in einem Rutsch von "geparkt" auf "Edge + VPN-Hub" bringen.
# WANN ANWENDEN: am Bridge-Tag, SCHRITT 2 des Runbooks — VOR dem Umstecken
# von ether1 an den FB-Passthrough-Port.
# SICHERHEIT: im Double-NAT harmlos — Peers warten auf die Spokes, der
# WAN-Drop trifft nur das (noch tote) ether1. Kein LAN-Lockout
# (Drop greift ausschliesslich in-interface-list=WAN = ether1).
# IDEMPOTENT: alle Blöcke sind wiederholbar (find-Guards / set).
# ROLLBACK: Peers disabled=yes, WG-Routen + TP10-seal-* Regeln entfernen.
#
# Anwenden via MikroMCP: upload_file -> run_script (oder /import)
# Vorab IMMER: export_config / create_backup
# ---------------------------------------------------------------------
:log info "TP10-cutover: apply start"
# --- A) WireGuard-Hub: Peers mit korrekten Keys + Allowed-IPs (self-healing)
# fm: erreichbar (eigener myfritz-Endpoint, KEIN CGNAT) -> bidirektional.
# dw: CGNAT -> Dial-in (Endpoint leer). NUR 10.95.10.0/24 (Gelis FB sourct daraus;
# Dual-Address 192.168.178.1/24,10.95.10.1/24 auf der FB verhindert LAN-Kopplung).
/interface/wireguard/peers
set [find where name="fm"] public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE=" \
allowed-address=10.101.0.0/24 \
endpoint-address=abxhutfgsid9snmy.myfritz.net endpoint-port=52476 disabled=no
set [find where name="dw"] public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw=" \
allowed-address=10.95.10.0/24 disabled=no
# --- B) Routen zu den Spoke-Netzen (Gateway = Interface wg-hub)
# RouterOS leitet aus allowed-address KEINE Routen ab -> explizit.
/ip/route
:if ([:len [find where dst-address="10.101.0.0/24" gateway="wg-hub"]]=0) do={ \
add dst-address=10.101.0.0/24 gateway=wg-hub comment="TP10: FM spoke -> wg-hub" }
:if ([:len [find where dst-address="10.95.10.0/24" gateway="wg-hub"]]=0) do={ \
add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke -> wg-hub" }
# --- C) Input-Chain abdichten (WAN-Seal). Reihenfolge oben->unten:
# est/rel | drop invalid | [WG 51821 vorhanden] | dhcp68 | icmp | LAN | drop WAN
/ip/firewall/filter
# 1+2 ueber die bestehende WG-Regel schieben (est zuerst, dann invalid)
:if ([:len [find where comment="TP10-seal-est"]]=0) do={ \
add chain=input action=accept connection-state=established,related,untracked \
comment="TP10-seal-est" place-before=[find where comment="TP10: WG hub listen (51821)"] }
:if ([:len [find where comment="TP10-seal-inv"]]=0) do={ \
add chain=input action=drop connection-state=invalid \
comment="TP10-seal-inv" place-before=[find where comment="TP10: WG hub listen (51821)"] }
# 4-7 NACH der WG-Regel anhaengen (in dieser Reihenfolge)
:if ([:len [find where comment="TP10-seal-dhcp"]]=0) do={ \
add chain=input action=accept protocol=udp dst-port=68 in-interface-list=WAN \
comment="TP10-seal-dhcp" }
:if ([:len [find where comment="TP10-seal-icmp"]]=0) do={ \
add chain=input action=accept protocol=icmp comment="TP10-seal-icmp" }
:if ([:len [find where comment="TP10-seal-lan"]]=0) do={ \
add chain=input action=accept in-interface-list=LAN comment="TP10-seal-lan" }
:if ([:len [find where comment="TP10-seal-wandrop"]]=0) do={ \
add chain=input action=drop in-interface-list=WAN comment="TP10-seal-wandrop" }
# --- D) ether1-DHCP-Client: kein ISP-DNS-Leak (DoH bleibt einzige Quelle)
# default-route-distance=1 ist bereits gesetzt (Auto-Switchover < Bridge-Fallback@2)
/ip/dhcp-client
set [find where interface="ether1"] use-peer-dns=no
:log info "TP10-cutover: apply done"
# =====================================================================
# NICHT Teil dieses Skripts (bereits korrekt auf ap1):
# - NAT: masquerade out-interface=ether1 (*3) + no-NAT 10.40.0.0/16 (*4)
# - Forward-FW: accept in/out-interface=wg-hub (*E/*F)
# - Default-Fallback-Route 0.0.0.0/0 via 10.40.41.254 distance=2
# VPN-Traffic egresst ueber wg-hub -> matcht keine Masquerade -> echte LAN-IPs.
# =====================================================================