# TP23 Stufe 6 — PHASE A: Substrat + Exempt/JIT-Accepts + log-only-Vorstufe. # # 🔴🔴 NUR VOR ORT. Dieser Deploy allein bricht noch nichts (kein drop/reject), # aber Phase B (der reject) macht .36/.37 zum DNS-SPOF ohne Fern-Rollback. # Runbook: docs/tp23-stufe6-bypass-sperre-runbook.md. # # STATUS: ENTWURF, freigegeben 2026-09-11, NOCH NICHT DEPLOYT (Christoph war remote). # # ┌─ LIVE-VERIFY VOR DEM DEPLOY (nicht raten — MikroMCP war beim Schreiben tot) ─┐ # │ (1) ANKER <>: die forward-Regel, die HEUTE LAN->WAN-DNS zu │ # │ 8.8.8.8:53 durchlaesst (der generische Internet-Egress-Accept). Meine │ # │ Regeln muessen DAVOR stehen, sonst greift der Egress-Accept zuerst und │ # │ die log-only-Regel zaehlt 0. Anker aus der Live-Kette holen: │ # │ /ip firewall filter print where chain=forward │ # │ und unten das place-before-Kommentar ersetzen. Faellt externer DNS heute │ # │ schon in deny-by-default (TVs mit 8.8.8.8 loesen JETZT nicht auf), ist │ # │ Stufe 6 gegenstandslos — dann Runbook neu bewerten. │ # │ (2) EXEMPT-IPs: dev-MacBook ist dual-homed. Beide Beine gegen die Realitaet │ # │ pruefen (en5/en0 koennen per DHCP gewechselt haben): │ # │ /ip dhcp-server lease print where comment~"macbook" │ # │ und mit der AGH-Seite (clients.persistent 'dns-bypass-exempt') abgleichen.│ # └───────────────────────────────────────────────────────────────────────────┘ # # Weg (KEIN mikromcp-Direkt-Write — ip-firewall-filter steht unter Drift-Kontrolle): # Backup davor: create_backup routerId=crs326-core (core-pre-tp23-s6-.backup) # Deploy: python3 nautobot/gc-manual-plan.py --device crs326-core \ # --commands-file routeros/tp23-stufe6-phaseA-exempt-log.rsc \ # --change-id TP23-S6-PhaseA --deploy # log-only als befristeter Versuch fuehren (NICHT als Versehen lesbar machen): # python3 nautobot/gc-transaktion.py (Transaktion 'TP23-S6-would-drop-dns') # Soll-Sync (Substrat + Accepts sind Dauerzustand -> ins intended): # python3 nautobot/ingest-core-firewall.py --apply # python3 nautobot/gc-configplan.py --refresh-compliance # --------------------------------------------------------------------------- # 0) Substrat: erlaubte Resolver (dst), permanente Exempts (src), leere JIT-Liste. :do { :if ([:len [/ip firewall address-list find list="dns-resolvers" address="10.40.20.36"]] = 0) do={ /ip firewall address-list add list=dns-resolvers address=10.40.20.36 comment="TP23-S6: AGH agh-bf1" } } on-error={ :log info "tp23s6A: 00a warf" } :do { :if ([:len [/ip firewall address-list find list="dns-resolvers" address="10.40.20.37"]] = 0) do={ /ip firewall address-list add list=dns-resolvers address=10.40.20.37 comment="TP23-S6: AGH agh-bf2" } } on-error={ :log info "tp23s6A: 00b warf" } :do { :if ([:len [/ip firewall address-list find list="dns-bypass-exempt" address="10.40.10.183"]] = 0) do={ /ip firewall address-list add list=dns-bypass-exempt address=10.40.10.183 comment="TP23-S6: dev-MacBook en5 (VERIFY)" } } on-error={ :log info "tp23s6A: 00c warf" } :do { :if ([:len [/ip firewall address-list find list="dns-bypass-exempt" address="10.40.10.82"]] = 0) do={ /ip firewall address-list add list=dns-bypass-exempt address=10.40.10.82 comment="TP23-S6: dev-MacBook en0 (VERIFY)" } } on-error={ :log info "tp23s6A: 00d warf" } # 1) Exempt-Accepts. dev-MacBook + Agent-Toolchain behalten ihren DNS-Ausweg. # MUSS vor der log-only-Regel stehen (action=accept terminiert -> Exempt-Traffic # erreicht die Log-Regel nie und taucht im WOULD-DROP-Log korrekt NICHT auf). :do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-exempt udp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=dns-bypass-exempt protocol=udp dst-port=53,853 comment="TP23-S6: dns-exempt udp" place-before=[/ip firewall filter find comment="<>"] } } on-error={ :log info "tp23s6A: 01a warf" } :do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-exempt tcp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=dns-bypass-exempt protocol=tcp dst-port=53,853 comment="TP23-S6: dns-exempt tcp" place-before=[/ip firewall filter find comment="<>"] } } on-error={ :log info "tp23s6A: 01b warf" } # 2) JIT-Accepts. Leere, selbstverfallende Liste (Muster jit-admin, tp5-etappe4): # /ip firewall address-list add list=jit-dns-bypass address= timeout=1h :do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-jit udp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=jit-dns-bypass protocol=udp dst-port=53,853 comment="TP23-S6: dns-jit udp" place-before=[/ip firewall filter find comment="<>"] } } on-error={ :log info "tp23s6A: 02a warf" } :do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-jit tcp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=jit-dns-bypass protocol=tcp dst-port=53,853 comment="TP23-S6: dns-jit tcp" place-before=[/ip firewall filter find comment="<>"] } } on-error={ :log info "tp23s6A: 02b warf" } # 3) log-only-Vorstufe. Loggt LAN->extern DNS, das NICHT zu einem erlaubten # Resolver geht. dst-address-list=!dns-resolvers negiert die Liste. Mehrere # Tage lesen (Kollektor 10.40.20.18:514), dann Phase B. NUR 53/853-Zeilen zaehlen. :do { :if ([:len [/ip firewall filter find comment="TP23-S6: WOULD-DROP-DNS udp"]] = 0) do={ /ip firewall filter add chain=forward action=log log-prefix="TP5-WOULD-DROP-DNS" protocol=udp dst-port=53,853 dst-address-list=!dns-resolvers comment="TP23-S6: WOULD-DROP-DNS udp" place-before=[/ip firewall filter find comment="<>"] } } on-error={ :log info "tp23s6A: 03a warf" } :do { :if ([:len [/ip firewall filter find comment="TP23-S6: WOULD-DROP-DNS tcp"]] = 0) do={ /ip firewall filter add chain=forward action=log log-prefix="TP5-WOULD-DROP-DNS" protocol=tcp dst-port=53,853 dst-address-list=!dns-resolvers comment="TP23-S6: WOULD-DROP-DNS tcp" place-before=[/ip firewall filter find comment="<>"] } } on-error={ :log info "tp23s6A: 03b warf" } :log info ("tp23s6A: ENDE exempt-udp=" . [:tostr [:len [/ip firewall filter find comment="TP23-S6: dns-exempt udp"]]] . " log-udp=" . [:tostr [:len [/ip firewall filter find comment="TP23-S6: WOULD-DROP-DNS udp"]]] . " resolvers=" . [:tostr [:len [/ip firewall address-list find list="dns-resolvers"]]] . " exempt=" . [:tostr [:len [/ip firewall address-list find list="dns-bypass-exempt"]]])