Christoph Emsenhuber
909e604ea6
Zwei RouterOS-Skripte fuer die DNS-Bypass-Sperre der TP5-forward-Kette, gespiegelt am TP5-Etappen-Stil (idempotent, place-before, Auto-Revert): - phaseA: Substrat (dns-resolvers/dns-bypass-exempt/jit-dns-bypass) + Exempt/JIT-Accepts + log-only TP5-WOULD-DROP-DNS. - phaseB: reject icmp-port-unreachable + Auto-Revert-Scheduler. Freigegeben 2026-09-11, bewusst NICHT deployt (Christoph remote, hartes Vor-Ort-Gate). Zwei Live-Verifikationen vor dem Deploy im Dateikopf markiert: Egress-Accept-Anker der forward-Kette + Exempt-IPs des dev-MacBooks (MikroMCP war beim Schreiben zu allen Geraeten tot -> nicht geraten). log-only wird beim Deploy als gc-Transaktion gefuehrt. Runbook-Zeiger auf beide Dateien ergaenzt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
60 lines
6.9 KiB
Plaintext
60 lines
6.9 KiB
Plaintext
# TP23 Stufe 6 — PHASE A: Substrat + Exempt/JIT-Accepts + log-only-Vorstufe.
|
|
#
|
|
# 🔴🔴 NUR VOR ORT. Dieser Deploy allein bricht noch nichts (kein drop/reject),
|
|
# aber Phase B (der reject) macht .36/.37 zum DNS-SPOF ohne Fern-Rollback.
|
|
# Runbook: docs/tp23-stufe6-bypass-sperre-runbook.md.
|
|
#
|
|
# STATUS: ENTWURF, freigegeben 2026-09-11, NOCH NICHT DEPLOYT (Christoph war remote).
|
|
#
|
|
# ┌─ LIVE-VERIFY VOR DEM DEPLOY (nicht raten — MikroMCP war beim Schreiben tot) ─┐
|
|
# │ (1) ANKER <<EGRESS-ACCEPT>>: die forward-Regel, die HEUTE LAN->WAN-DNS zu │
|
|
# │ 8.8.8.8:53 durchlaesst (der generische Internet-Egress-Accept). Meine │
|
|
# │ Regeln muessen DAVOR stehen, sonst greift der Egress-Accept zuerst und │
|
|
# │ die log-only-Regel zaehlt 0. Anker aus der Live-Kette holen: │
|
|
# │ /ip firewall filter print where chain=forward │
|
|
# │ und unten das place-before-Kommentar ersetzen. Faellt externer DNS heute │
|
|
# │ schon in deny-by-default (TVs mit 8.8.8.8 loesen JETZT nicht auf), ist │
|
|
# │ Stufe 6 gegenstandslos — dann Runbook neu bewerten. │
|
|
# │ (2) EXEMPT-IPs: dev-MacBook ist dual-homed. Beide Beine gegen die Realitaet │
|
|
# │ pruefen (en5/en0 koennen per DHCP gewechselt haben): │
|
|
# │ /ip dhcp-server lease print where comment~"macbook" │
|
|
# │ und mit der AGH-Seite (clients.persistent 'dns-bypass-exempt') abgleichen.│
|
|
# └───────────────────────────────────────────────────────────────────────────┘
|
|
#
|
|
# Weg (KEIN mikromcp-Direkt-Write — ip-firewall-filter steht unter Drift-Kontrolle):
|
|
# Backup davor: create_backup routerId=crs326-core (core-pre-tp23-s6-<datum>.backup)
|
|
# Deploy: python3 nautobot/gc-manual-plan.py --device crs326-core \
|
|
# --commands-file routeros/tp23-stufe6-phaseA-exempt-log.rsc \
|
|
# --change-id TP23-S6-PhaseA --deploy
|
|
# log-only als befristeter Versuch fuehren (NICHT als Versehen lesbar machen):
|
|
# python3 nautobot/gc-transaktion.py (Transaktion 'TP23-S6-would-drop-dns')
|
|
# Soll-Sync (Substrat + Accepts sind Dauerzustand -> ins intended):
|
|
# python3 nautobot/ingest-core-firewall.py --apply
|
|
# python3 nautobot/gc-configplan.py --refresh-compliance
|
|
# ---------------------------------------------------------------------------
|
|
|
|
# 0) Substrat: erlaubte Resolver (dst), permanente Exempts (src), leere JIT-Liste.
|
|
:do { :if ([:len [/ip firewall address-list find list="dns-resolvers" address="10.40.20.36"]] = 0) do={ /ip firewall address-list add list=dns-resolvers address=10.40.20.36 comment="TP23-S6: AGH agh-bf1" } } on-error={ :log info "tp23s6A: 00a warf" }
|
|
:do { :if ([:len [/ip firewall address-list find list="dns-resolvers" address="10.40.20.37"]] = 0) do={ /ip firewall address-list add list=dns-resolvers address=10.40.20.37 comment="TP23-S6: AGH agh-bf2" } } on-error={ :log info "tp23s6A: 00b warf" }
|
|
:do { :if ([:len [/ip firewall address-list find list="dns-bypass-exempt" address="10.40.10.183"]] = 0) do={ /ip firewall address-list add list=dns-bypass-exempt address=10.40.10.183 comment="TP23-S6: dev-MacBook en5 (VERIFY)" } } on-error={ :log info "tp23s6A: 00c warf" }
|
|
:do { :if ([:len [/ip firewall address-list find list="dns-bypass-exempt" address="10.40.10.82"]] = 0) do={ /ip firewall address-list add list=dns-bypass-exempt address=10.40.10.82 comment="TP23-S6: dev-MacBook en0 (VERIFY)" } } on-error={ :log info "tp23s6A: 00d warf" }
|
|
|
|
# 1) Exempt-Accepts. dev-MacBook + Agent-Toolchain behalten ihren DNS-Ausweg.
|
|
# MUSS vor der log-only-Regel stehen (action=accept terminiert -> Exempt-Traffic
|
|
# erreicht die Log-Regel nie und taucht im WOULD-DROP-Log korrekt NICHT auf).
|
|
:do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-exempt udp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=dns-bypass-exempt protocol=udp dst-port=53,853 comment="TP23-S6: dns-exempt udp" place-before=[/ip firewall filter find comment="<<EGRESS-ACCEPT — LIVE VERIFY>>"] } } on-error={ :log info "tp23s6A: 01a warf" }
|
|
:do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-exempt tcp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=dns-bypass-exempt protocol=tcp dst-port=53,853 comment="TP23-S6: dns-exempt tcp" place-before=[/ip firewall filter find comment="<<EGRESS-ACCEPT — LIVE VERIFY>>"] } } on-error={ :log info "tp23s6A: 01b warf" }
|
|
|
|
# 2) JIT-Accepts. Leere, selbstverfallende Liste (Muster jit-admin, tp5-etappe4):
|
|
# /ip firewall address-list add list=jit-dns-bypass address=<ip> timeout=1h
|
|
:do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-jit udp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=jit-dns-bypass protocol=udp dst-port=53,853 comment="TP23-S6: dns-jit udp" place-before=[/ip firewall filter find comment="<<EGRESS-ACCEPT — LIVE VERIFY>>"] } } on-error={ :log info "tp23s6A: 02a warf" }
|
|
:do { :if ([:len [/ip firewall filter find comment="TP23-S6: dns-jit tcp"]] = 0) do={ /ip firewall filter add chain=forward action=accept src-address-list=jit-dns-bypass protocol=tcp dst-port=53,853 comment="TP23-S6: dns-jit tcp" place-before=[/ip firewall filter find comment="<<EGRESS-ACCEPT — LIVE VERIFY>>"] } } on-error={ :log info "tp23s6A: 02b warf" }
|
|
|
|
# 3) log-only-Vorstufe. Loggt LAN->extern DNS, das NICHT zu einem erlaubten
|
|
# Resolver geht. dst-address-list=!dns-resolvers negiert die Liste. Mehrere
|
|
# Tage lesen (Kollektor 10.40.20.18:514), dann Phase B. NUR 53/853-Zeilen zaehlen.
|
|
:do { :if ([:len [/ip firewall filter find comment="TP23-S6: WOULD-DROP-DNS udp"]] = 0) do={ /ip firewall filter add chain=forward action=log log-prefix="TP5-WOULD-DROP-DNS" protocol=udp dst-port=53,853 dst-address-list=!dns-resolvers comment="TP23-S6: WOULD-DROP-DNS udp" place-before=[/ip firewall filter find comment="<<EGRESS-ACCEPT — LIVE VERIFY>>"] } } on-error={ :log info "tp23s6A: 03a warf" }
|
|
:do { :if ([:len [/ip firewall filter find comment="TP23-S6: WOULD-DROP-DNS tcp"]] = 0) do={ /ip firewall filter add chain=forward action=log log-prefix="TP5-WOULD-DROP-DNS" protocol=tcp dst-port=53,853 dst-address-list=!dns-resolvers comment="TP23-S6: WOULD-DROP-DNS tcp" place-before=[/ip firewall filter find comment="<<EGRESS-ACCEPT — LIVE VERIFY>>"] } } on-error={ :log info "tp23s6A: 03b warf" }
|
|
|
|
:log info ("tp23s6A: ENDE exempt-udp=" . [:tostr [:len [/ip firewall filter find comment="TP23-S6: dns-exempt udp"]]] . " log-udp=" . [:tostr [:len [/ip firewall filter find comment="TP23-S6: WOULD-DROP-DNS udp"]]] . " resolvers=" . [:tostr [:len [/ip firewall address-list find list="dns-resolvers"]]] . " exempt=" . [:tostr [:len [/ip firewall address-list find list="dns-bypass-exempt"]]])
|