72 lines
4.2 KiB
Plaintext
72 lines
4.2 KiB
Plaintext
# =====================================================================
|
|
# TP10 Cutover-Apply (ap1) — WG-Hub scharf + WAN-Input-Seal
|
|
# =====================================================================
|
|
# Zweck: ap1 in einem Rutsch von "geparkt" auf "Edge + VPN-Hub" bringen.
|
|
# WANN ANWENDEN: am Bridge-Tag, SCHRITT 2 des Runbooks — VOR dem Umstecken
|
|
# von ether1 an den FB-Passthrough-Port.
|
|
# SICHERHEIT: im Double-NAT harmlos — Peers warten auf die Spokes, der
|
|
# WAN-Drop trifft nur das (noch tote) ether1. Kein LAN-Lockout
|
|
# (Drop greift ausschliesslich in-interface-list=WAN = ether1).
|
|
# IDEMPOTENT: alle Blöcke sind wiederholbar (find-Guards / set).
|
|
# ROLLBACK: Peers disabled=yes, WG-Routen + TP10-seal-* Regeln entfernen.
|
|
#
|
|
# Anwenden via MikroMCP: upload_file -> run_script (oder /import)
|
|
# Vorab IMMER: export_config / create_backup
|
|
# ---------------------------------------------------------------------
|
|
|
|
:log info "TP10-cutover: apply start"
|
|
|
|
# --- A) WireGuard-Hub: Peers mit korrekten Keys + Allowed-IPs (self-healing)
|
|
# fm: erreichbar (eigener myfritz-Endpoint, KEIN CGNAT) -> bidirektional.
|
|
# dw: CGNAT -> Dial-in (Endpoint leer). NUR 10.95.10.0/24 (Gelis FB sourct daraus;
|
|
# Dual-Address 192.168.178.1/24,10.95.10.1/24 auf der FB verhindert LAN-Kopplung).
|
|
/interface/wireguard/peers
|
|
set [find where name="fm"] public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE=" \
|
|
allowed-address=10.101.0.0/24 \
|
|
endpoint-address=abxhutfgsid9snmy.myfritz.net endpoint-port=52476 disabled=no
|
|
set [find where name="dw"] public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw=" \
|
|
allowed-address=10.95.10.0/24 disabled=no
|
|
|
|
# --- B) Routen zu den Spoke-Netzen (Gateway = Interface wg-hub)
|
|
# RouterOS leitet aus allowed-address KEINE Routen ab -> explizit.
|
|
/ip/route
|
|
:if ([:len [find where dst-address="10.101.0.0/24" gateway="wg-hub"]]=0) do={ \
|
|
add dst-address=10.101.0.0/24 gateway=wg-hub comment="TP10: FM spoke -> wg-hub" }
|
|
:if ([:len [find where dst-address="10.95.10.0/24" gateway="wg-hub"]]=0) do={ \
|
|
add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke -> wg-hub" }
|
|
|
|
# --- C) Input-Chain abdichten (WAN-Seal). Reihenfolge oben->unten:
|
|
# est/rel | drop invalid | [WG 51821 vorhanden] | dhcp68 | icmp | LAN | drop WAN
|
|
/ip/firewall/filter
|
|
# 1+2 ueber die bestehende WG-Regel schieben (est zuerst, dann invalid)
|
|
:if ([:len [find where comment="TP10-seal-est"]]=0) do={ \
|
|
add chain=input action=accept connection-state=established,related,untracked \
|
|
comment="TP10-seal-est" place-before=[find where comment="TP10: WG hub listen (51821)"] }
|
|
:if ([:len [find where comment="TP10-seal-inv"]]=0) do={ \
|
|
add chain=input action=drop connection-state=invalid \
|
|
comment="TP10-seal-inv" place-before=[find where comment="TP10: WG hub listen (51821)"] }
|
|
# 4-7 NACH der WG-Regel anhaengen (in dieser Reihenfolge)
|
|
:if ([:len [find where comment="TP10-seal-dhcp"]]=0) do={ \
|
|
add chain=input action=accept protocol=udp dst-port=68 in-interface-list=WAN \
|
|
comment="TP10-seal-dhcp" }
|
|
:if ([:len [find where comment="TP10-seal-icmp"]]=0) do={ \
|
|
add chain=input action=accept protocol=icmp comment="TP10-seal-icmp" }
|
|
:if ([:len [find where comment="TP10-seal-lan"]]=0) do={ \
|
|
add chain=input action=accept in-interface-list=LAN comment="TP10-seal-lan" }
|
|
:if ([:len [find where comment="TP10-seal-wandrop"]]=0) do={ \
|
|
add chain=input action=drop in-interface-list=WAN comment="TP10-seal-wandrop" }
|
|
|
|
# --- D) ether1-DHCP-Client: kein ISP-DNS-Leak (DoH bleibt einzige Quelle)
|
|
# default-route-distance=1 ist bereits gesetzt (Auto-Switchover < Bridge-Fallback@2)
|
|
/ip/dhcp-client
|
|
set [find where interface="ether1"] use-peer-dns=no
|
|
|
|
:log info "TP10-cutover: apply done"
|
|
# =====================================================================
|
|
# NICHT Teil dieses Skripts (bereits korrekt auf ap1):
|
|
# - NAT: masquerade out-interface=ether1 (*3) + no-NAT 10.40.0.0/16 (*4)
|
|
# - Forward-FW: accept in/out-interface=wg-hub (*E/*F)
|
|
# - Default-Fallback-Route 0.0.0.0/0 via 10.40.41.254 distance=2
|
|
# VPN-Traffic egresst ueber wg-hub -> matcht keine Masquerade -> echte LAN-IPs.
|
|
# =====================================================================
|