lukegb/depot
1
0
Fork 0
Code Issues 1 Pull requests Projects Packages Activity Actions

nixos/bgp: fixup

Browse source
This commit is contained in:
Luke Granger-Brown 2024-07-13 16:57:05 +00:00
parent 81f325bed6
commit 52a0d29396
5 changed files with 228 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
ops/nixos/cofractal-ams01/default.nix
View file

@ -259,14 +259,14 @@ in
matchConfig.Name = "wg-swann-ee"; matchConfig.Name = "wg-swann-ee";
address = [ address = [
"92.118.30.1/31" "92.118.30.1/31"
"2a09:a442::1:2/64" "2a09:a442::1:2/112"
]; ];
}; };
networks."40-wg-swann-gnet" = { networks."40-wg-swann-gnet" = {
matchConfig.Name = "wg-swann-gnet"; matchConfig.Name = "wg-swann-gnet";
address = [ address = [
"92.118.30.7/31" "92.118.30.7/31"
"2a09:a442::4:2/64" "2a09:a442::4:2/112"
]; ];
}; };
networks."40-wg-rexxar" = { networks."40-wg-rexxar" = {
@ -367,7 +367,16 @@ in
local.asn = 205479; local.asn = 205479;
in { in {
enable = true; enable = true;
config = { config = let
peer.swann = {
local.asn = 205479;
remote.bfd = true;
remote.asn = 205479;
remote.must_be_next_hop = false;
remote.export_community = 10;
remote.export_internal = true;
};
in {
local = { local = {
routerID = "199.19.152.160"; routerID = "199.19.152.160";
}; };
@ -375,7 +384,34 @@ in
export.v6 = [ "2a09:a446:1337::/48" "2a09:a442::/48" "2a09:a442:2000::/48" ]; export.v6 = [ "2a09:a446:1337::/48" "2a09:a442::/48" "2a09:a442:2000::/48" ];
internal.export.v4 = [ "92.118.30.252/32" ]; internal.export.v4 = [ "92.118.30.252/32" ];
internal.export.v4Extra = ''
route 92.118.30.0/31 via "wg-swann-ee";
route 92.118.30.6/31 via "wg-swann-gnet";
'';
internal.export.v6 = [ "2a09:a446:1337::/48" "2a09:a442:2000::/48" "2a09:a442::/48" ]; internal.export.v6 = [ "2a09:a446:1337::/48" "2a09:a442:2000::/48" "2a09:a442::/48" ];
internal.export.v6Extra = ''
route 2a09:a442::1:0/112 via "wg-swann-ee";
route 2a09:a442::4:0/112 via "wg-swann-gnet";
'';
peering.swann_ee = lib.mkMerge [peer.swann {
local.v4 = "92.118.30.1";
local.v6 = "2a09:a442::1:2";
remote.routers = [{
enabled = true;
v4 = "92.118.30.0";
v6 = "2a09:a442::1:1";
}];
}];
peering.swann_gnet = lib.mkMerge [peer.swann {
local.v4 = "92.118.30.7";
local.v6 = "2a09:a442::4:2";
remote.routers = [{
enabled = true;
v4 = "92.118.30.6";
v6 = "2a09:a442::4:1";
}];
}];
peering.cofractal = { peering.cofractal = {
local = local // { local = local // {
@ -408,6 +444,19 @@ in
set_imported_next_hop_to = "2a09:a446:1337:ffff::10"; set_imported_next_hop_to = "2a09:a446:1337:ffff::10";
}; };
}; };
bfd = ''
interface "*" {
min rx interval 10ms;
min tx interval 50ms;
idle tx interval 1s;
multiplier 20;
};
neighbor 92.118.30.0;
neighbor 2a09:a442::1:1;
neighbor 92.118.30.6;
neighbor 2a09:a442::4:1;
'';
}; };
}; };

52
ops/nixos/lib/bgp.nix
View file

@ -33,6 +33,7 @@ let
} }
filter bgp_export_${ixName}4 filter bgp_export_${ixName}4
{ {
${if ix.remote.export_internal then "if ((ro, ${toString ix.local.asn}, 10) ~ bgp_ext_community) then accept;" else ""}
if ! ((ro, ${toString ix.local.asn}, 1000) ~ bgp_ext_community) then reject; if ! ((ro, ${toString ix.local.asn}, 1000) ~ bgp_ext_community) then reject;
bgp_ext_community.delete([(ro, ${toString ix.local.asn}, *)]); bgp_ext_community.delete([(ro, ${toString ix.local.asn}, *)]);
accept; accept;
@ -60,6 +61,7 @@ let
} }
filter bgp_export_${ixName}6 filter bgp_export_${ixName}6
{ {
${if ix.remote.export_internal then "if ((ro, ${toString ix.local.asn}, 10) ~ bgp_ext_community) then accept;" else ""}
if ! ((ro, ${toString ix.local.asn}, 1000) ~ bgp_ext_community) then reject; if ! ((ro, ${toString ix.local.asn}, 1000) ~ bgp_ext_community) then reject;
bgp_ext_community.delete([(ro, ${toString ix.local.asn}, *)]); bgp_ext_community.delete([(ro, ${toString ix.local.asn}, *)]);
accept; accept;
@ -79,6 +81,7 @@ let
multihopSnippet = { multihop ? null, ... }: if multihop == null then "# not multihop" else "multihop ${toString multihop};"; multihopSnippet = { multihop ? null, ... }: if multihop == null then "# not multihop" else "multihop ${toString multihop};";
nexthopSnippet = { next_hop ? null, ... }: if next_hop == null then "# no next hop override" else "next hop ${toString next_hop};"; nexthopSnippet = { next_hop ? null, ... }: if next_hop == null then "# no next hop override" else "next hop ${toString next_hop};";
passiveSnippet = { passive, ... }: "passive ${if passive then "on" else "off"};"; passiveSnippet = { passive, ... }: "passive ${if passive then "on" else "off"};";
bfdSnippet = { bfd, ... }: "bfd ${if bfd then "on" else "off"};";
prefixLimitSnippet = limit: if limit == null then "# no import limit" else "import limit ${toString limit} action restart;"; prefixLimitSnippet = limit: if limit == null then "# no import limit" else "import limit ${toString limit} action restart;";
generateSnippetForRouter = { ixName, ix, routerNum, router, ... }: '' generateSnippetForRouter = { ixName, ix, routerNum, router, ... }: ''
${lib.optionalString (ix.local.v4 != null) '' ${lib.optionalString (ix.local.v4 != null) ''
@ -88,6 +91,7 @@ let
${multihopSnippet router} ${multihopSnippet router}
${nexthopSnippet router} ${nexthopSnippet router}
${passiveSnippet ix.remote} ${passiveSnippet ix.remote}
${bfdSnippet ix.remote}
local ${ix.local.v4} as ${toString ix.local.asn}; local ${ix.local.v4} as ${toString ix.local.asn};
neighbor ${router.v4} as ${toString ix.remote.asn}; neighbor ${router.v4} as ${toString ix.remote.asn};
graceful restart on; graceful restart on;
@ -106,6 +110,7 @@ let
${passwordSnippet router} ${passwordSnippet router}
${multihopSnippet router} ${multihopSnippet router}
${passiveSnippet ix.remote} ${passiveSnippet ix.remote}
${bfdSnippet ix.remote}
local ${ix.local.v6} as ${toString ix.local.asn}; local ${ix.local.v6} as ${toString ix.local.asn};
neighbor ${router.v6} as ${toString ix.remote.asn}; neighbor ${router.v6} as ${toString ix.remote.asn};
graceful restart on; graceful restart on;
@ -221,6 +226,14 @@ in {
type = bool; type = bool;
default = false; default = false;
}; };
bfd = mkOption { # lukegbgp.config.peering.<foo>.remote.bfd
type = bool;
default = false;
};
export_internal = mkOption { # lukegbgp.config.peering.<foo>.remote.export_internal
type = bool;
default = false;
};
routers = mkOption { # lukegbgp.config.peering.<foo>.remote.routers routers = mkOption { # lukegbgp.config.peering.<foo>.remote.routers
type = listOf (submodule { type = listOf (submodule {
options = { options = {
@ -301,6 +314,29 @@ in {
}; };
}; };
}; };
internal.local = mkOption {
default = { v4 = []; v6 = []; };
type = submodule {
options = {
v4 = mkOption { # lukegbgp.config.internal.local.v4
type = listOf str;
default = [];
};
v4Extra = mkOption { #lukegbgp.config.internal.local.v4Extra
type = lines;
default = "";
};
v6 = mkOption { # lukegbgp.config.internal.local.v6
type = listOf str;
default = [];
};
v6Extra = mkOption { #lukegbgp.config.internal.local.v6Extra
type = lines;
default = "";
};
};
};
};
bfd = mkOption { # lukegbgp.config.bfd bfd = mkOption { # lukegbgp.config.bfd
type = lines; type = lines;
default = ""; default = "";
@ -384,6 +420,7 @@ in {
protocol static export4 { protocol static export4 {
ipv4 { ipv4 {
import filter { import filter {
bgp_ext_community.add((ro, 205479, 10));
bgp_ext_community.add((ro, 205479, 1000)); bgp_ext_community.add((ro, 205479, 1000));
bgp_ext_community.add((ro, 205479, 2000)); bgp_ext_community.add((ro, 205479, 2000));
bgp_ext_community.add((ro, 205479, 2001)); bgp_ext_community.add((ro, 205479, 2001));
@ -405,6 +442,7 @@ in {
bgp_ext_community.add((ro, 205479, 5009)); # fastly from rexxar bgp_ext_community.add((ro, 205479, 5009)); # fastly from rexxar
bgp_ext_community.add((ro, 205479, 5010)); # ovh from rexxar bgp_ext_community.add((ro, 205479, 5010)); # ovh from rexxar
bgp_ext_community.add((ro, 205479, 6000)); # EMF: EMF-IX Route Server bgp_ext_community.add((ro, 205479, 6000)); # EMF: EMF-IX Route Server
bgp_ext_community.add((ro, 205479, 7000)); # 1299 from rexxar
# do not export to clouvider; they do... strange things. # do not export to clouvider; they do... strange things.
bgp_ext_community.add((rt, 0, 62240)); bgp_ext_community.add((rt, 0, 62240));
@ -425,9 +463,15 @@ in {
${lib.concatMapStrings (ip: "route ${ip} blackhole;") config.services.lukegbgp.config.internal.export.v4} ${lib.concatMapStrings (ip: "route ${ip} blackhole;") config.services.lukegbgp.config.internal.export.v4}
${config.services.lukegbgp.config.internal.export.v4Extra} ${config.services.lukegbgp.config.internal.export.v4Extra}
}; };
protocol static localinternal4 {
ipv4 { import all; };
${lib.concatMapStrings (ip: "route ${ip} blackhole;") config.services.lukegbgp.config.internal.local.v4}
${config.services.lukegbgp.config.internal.local.v4Extra}
};
protocol static export6 { protocol static export6 {
ipv6 { ipv6 {
import filter { import filter {
bgp_ext_community.add((ro, 205479, 10));
bgp_ext_community.add((ro, 205479, 1000)); # export bgp_ext_community.add((ro, 205479, 1000)); # export
bgp_ext_community.add((ro, 205479, 2000)); # bgp_ext_community.add((ro, 205479, 2000)); #
bgp_ext_community.add((ro, 205479, 2001)); # bgp_ext_community.add((ro, 205479, 2001)); #
@ -449,6 +493,7 @@ in {
bgp_ext_community.add((ro, 205479, 5009)); # fastly from rexxar bgp_ext_community.add((ro, 205479, 5009)); # fastly from rexxar
bgp_ext_community.add((ro, 205479, 5010)); # ovh from rexxar bgp_ext_community.add((ro, 205479, 5010)); # ovh from rexxar
bgp_ext_community.add((ro, 205479, 6000)); # EMF: EMF-IX Route Server bgp_ext_community.add((ro, 205479, 6000)); # EMF: EMF-IX Route Server
bgp_ext_community.add((ro, 205479, 7000)); # 1299 from rexxar
# do not export to clouvider; they do... strange things. # do not export to clouvider; they do... strange things.
bgp_ext_community.add((rt, 0, 62240)); bgp_ext_community.add((rt, 0, 62240));
@ -462,13 +507,18 @@ in {
protocol static exportinternal6 { protocol static exportinternal6 {
ipv6 { ipv6 {
import filter { import filter {
bgp_ext_community.add((ro, 205479, 10)); # internal only bgp_ext_community.add((ro, 205479, 10)); # internal only
accept; accept;
}; };
}; };
${lib.concatMapStrings (ip: "route ${ip} blackhole;") config.services.lukegbgp.config.internal.export.v6} ${lib.concatMapStrings (ip: "route ${ip} blackhole;") config.services.lukegbgp.config.internal.export.v6}
${config.services.lukegbgp.config.internal.export.v6Extra} ${config.services.lukegbgp.config.internal.export.v6Extra}
}; };
protocol static localinternal6 {
ipv6 { import all; };
${lib.concatMapStrings (ip: "route ${ip} blackhole;") config.services.lukegbgp.config.internal.local.v6}
${config.services.lukegbgp.config.internal.local.v6Extra}
};
protocol bfd { protocol bfd {
${config.services.lukegbgp.config.bfd} ${config.services.lukegbgp.config.bfd}

59
ops/nixos/rexxar/bgp.nix
View file

@ -20,7 +20,15 @@
export.v6 = [ "2a09:a442:1000::/48" "2a09:a442::/48" ]; export.v6 = [ "2a09:a442:1000::/48" "2a09:a442::/48" ];
internal.export.v4 = [ "92.118.30.251/32" ]; internal.export.v4 = [ "92.118.30.251/32" ];
internal.export.v4Extra = ''
route 92.118.30.2/31 via "wg-swann-ee";
route 92.118.30.4/31 via "wg-swann-gnet";
'';
internal.export.v6 = [ "2a09:a442:1000::/48" "2a09:a442::/48" ]; internal.export.v6 = [ "2a09:a442:1000::/48" "2a09:a442::/48" ];
internal.export.v6Extra = ''
route 2a09:a442::2:0/112 via "wg-swann-ee";
route 2a09:a442::3:0/112 via "wg-swann-gnet";
'';
peering = let peering = let
base = [{ base = [{
@ -47,7 +55,31 @@
export_community = 4001; export_community = 4001;
bgp_local_pref = 101; bgp_local_pref = 101;
}; };
peer.swann = {
remote.bfd = true;
remote.asn = 205479;
remote.must_be_next_hop = false;
remote.export_community = 10;
};
in { in {
swann_ee = lib.mkMerge (base ++ [peer.swann {
local.v4 = "92.118.30.3";
local.v6 = "2a09:a442::2:2";
remote.routers = [{
enabled = true;
v4 = "92.118.30.2";
v6 = "2a09:a442::2:1";
}];
}]);
swann_gnet = lib.mkMerge (base ++ [peer.swann {
local.v4 = "92.118.30.5";
local.v6 = "2a09:a442::3:2";
remote.routers = [{
enabled = true;
v4 = "92.118.30.4";
v6 = "2a09:a442::3:1";
}];
}]);
veloxserv1 = lib.mkMerge (link.velox1 ++ [peer.velox { veloxserv1 = lib.mkMerge (link.velox1 ++ [peer.velox {
remote.routers = [{ remote.routers = [{
enabled = true; enabled = true;
@ -245,7 +277,34 @@
prefix_limit.v6 = 200; prefix_limit.v6 = 200;
}; };
}]); }]);
arelion = lib.mkMerge (base ++ [{
local = {
v4 = "62.115.150.105";
v6 = "2001:2035:0:1f7e::2";
};
remote = {
asn = 1299;
export_community = 7000;
bgp_local_pref = 101;
routers = [{
v4 = "62.115.150.104";
v6 = "2001:2035:0:1f7e::1";
}];
};
}]);
}; };
bfd = ''
interface "*" {
min rx interval 10ms;
min tx interval 50ms;
idle tx interval 1s;
multiplier 20;
};
neighbor 92.118.30.4;
neighbor 2a09:a442::2:1;
neighbor 92.118.30.6;
neighbor 2a09:a442::3:1;
'';
}; };
}; };
} }

5
ops/nixos/rexxar/default.nix
View file

@ -91,6 +91,7 @@
51821 51822 51823 51821 51822 51823
34197 # factorio 34197 # factorio
443 443
3784 # BFD
]; ];
allowedTCPPorts = [ allowedTCPPorts = [
80 443 80 443
@ -145,14 +146,14 @@
matchConfig.Name = "wg-swann-ee"; matchConfig.Name = "wg-swann-ee";
address = [ address = [
"92.118.30.3/31" "92.118.30.3/31"
"2a09:a442::2:2/64" "2a09:a442::2:2/112"
]; ];
}; };
networks."40-wg-swann-gnet" = { networks."40-wg-swann-gnet" = {
matchConfig.Name = "wg-swann-gnet"; matchConfig.Name = "wg-swann-gnet";
address = [ address = [
"92.118.30.5/31" "92.118.30.5/31"
"2a09:a442::3:2/64" "2a09:a442::3:2/112"
]; ];
}; };
networks."40-wg-cofractal" = { networks."40-wg-cofractal" = {

70
ops/nixos/swann/default.nix
View file

@ -406,7 +406,7 @@ in {
}; };
}; };
}; };
my.vault.secrets = let my.vault.secrets = let
wireguardSecret = key: { wireguardSecret = key: {
group = "systemd-network"; group = "systemd-network";
template = '' template = ''
@ -779,7 +779,34 @@ in {
protocol device {}; protocol device {};
protocol static export4 { protocol static export4 {
ipv4 {}; ipv4 {
import filter {
if (ro, 205479, 1000) ~ bgp_ext_community then {
bgp_ext_community.add((ro, 205479, 2000)); #
bgp_ext_community.add((ro, 205479, 2001)); #
bgp_ext_community.add((ro, 205479, 2002)); #
bgp_ext_community.add((ro, 205479, 2003)); #
bgp_ext_community.add((ro, 205479, 3000)); # clouvider from clouvider-lon01
bgp_ext_community.add((ro, 205479, 4000)); # frantech from frantech-nyc01/veloxserv from etheroute-lon01
bgp_ext_community.add((ro, 205479, 4001)); # veloxserv from rexxar
bgp_ext_community.add((ro, 205479, 4002)); # mercury from etheroute-lon01
bgp_ext_community.add((ro, 205479, 5000)); # linx route collector from rexxar
bgp_ext_community.add((ro, 205479, 5001)); # linx route server from rexxar
bgp_ext_community.add((ro, 205479, 5002)); # facebook from rexxar
bgp_ext_community.add((ro, 205479, 5003)); # openpeering from rexxar
bgp_ext_community.add((ro, 205479, 5004)); # freetransitnet from rexxar
bgp_ext_community.add((ro, 205479, 5005)); # he from rexxar
bgp_ext_community.add((ro, 205479, 5006)); # clouvider from rexxar
bgp_ext_community.add((ro, 205479, 5007)); # google from rexxar
bgp_ext_community.add((ro, 205479, 5008)); # cloudflare from rexxar
bgp_ext_community.add((ro, 205479, 5009)); # fastly from rexxar
bgp_ext_community.add((ro, 205479, 5010)); # ovh from rexxar
bgp_ext_community.add((ro, 205479, 6000)); # EMF: EMF-IX Route Server
bgp_ext_community.add((ro, 205479, 7000)); # 1299 from rexxar
}
accept;
};
};
route 0.0.0.0/0 via 92.118.30.3 bfd { route 0.0.0.0/0 via 92.118.30.3 bfd {
# EE, rexxar # EE, rexxar
preference = 10; preference = 10;
@ -798,6 +825,7 @@ in {
}; };
route 92.118.30.0/24 unreachable { route 92.118.30.0/24 unreachable {
bgp_ext_community.add((ro, 205479, 10)); # export this - internal
bgp_ext_community.add((ro, 205479, 1000)); # export this bgp_ext_community.add((ro, 205479, 1000)); # export this
}; };
route 92.118.30.16/28 via "br-internal"; route 92.118.30.16/28 via "br-internal";
@ -809,7 +837,34 @@ in {
route 92.118.30.6/31 via "wg-cofractal-gn"; route 92.118.30.6/31 via "wg-cofractal-gn";
}; };
protocol static export6 { protocol static export6 {
ipv6 {}; ipv6 {
import filter {
if ((ro, 205479, 1000) ~ bgp_ext_community) then {
bgp_ext_community.add((ro, 205479, 2000)); #
bgp_ext_community.add((ro, 205479, 2001)); #
bgp_ext_community.add((ro, 205479, 2002)); #
bgp_ext_community.add((ro, 205479, 2003)); #
bgp_ext_community.add((ro, 205479, 3000)); # clouvider from clouvider-lon01
bgp_ext_community.add((ro, 205479, 4000)); # frantech from frantech-nyc01/veloxserv from etheroute-lon01
bgp_ext_community.add((ro, 205479, 4001)); # veloxserv from rexxar
bgp_ext_community.add((ro, 205479, 4002)); # mercury from etheroute-lon01
bgp_ext_community.add((ro, 205479, 5000)); # linx route collector from rexxar
bgp_ext_community.add((ro, 205479, 5001)); # linx route server from rexxar
bgp_ext_community.add((ro, 205479, 5002)); # facebook from rexxar
bgp_ext_community.add((ro, 205479, 5003)); # openpeering from rexxar
bgp_ext_community.add((ro, 205479, 5004)); # freetransitnet from rexxar
bgp_ext_community.add((ro, 205479, 5005)); # he from rexxar
bgp_ext_community.add((ro, 205479, 5006)); # clouvider from rexxar
bgp_ext_community.add((ro, 205479, 5007)); # google from rexxar
bgp_ext_community.add((ro, 205479, 5008)); # cloudflare from rexxar
bgp_ext_community.add((ro, 205479, 5009)); # fastly from rexxar
bgp_ext_community.add((ro, 205479, 5010)); # ovh from rexxar
bgp_ext_community.add((ro, 205479, 6000)); # EMF: EMF-IX Route Server
bgp_ext_community.add((ro, 205479, 7000)); # 1299 from rexxar
}
accept;
};
};
route ::/0 via 2a09:a442::1:2 bfd { route ::/0 via 2a09:a442::1:2 bfd {
# EE, cofractal-ams01 # EE, cofractal-ams01
preference = 10; preference = 10;
@ -837,6 +892,7 @@ in {
route 2a09:a443:2::/64 via "vl-eduroam"; route 2a09:a443:2::/64 via "vl-eduroam";
route 2a09:a443:3::/48 via "vl-eduroam"; route 2a09:a443:3::/48 via "vl-eduroam";
route 2a09:a443::/32 unreachable { route 2a09:a443::/32 unreachable {
bgp_ext_community.add((ro, 205479, 10)); # export this - internal
bgp_ext_community.add((ro, 205479, 1000)); # export this bgp_ext_community.add((ro, 205479, 1000)); # export this
}; };
}; };
@ -884,7 +940,7 @@ in {
direct; direct;
bfd on; bfd on;
ipv4 { ipv6 {
export filter { export filter {
if source != RTS_STATIC then reject; if source != RTS_STATIC then reject;
if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject; if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject;
@ -922,7 +978,7 @@ in {
direct; direct;
bfd on; bfd on;
ipv4 { ipv6 {
export filter { export filter {
if source != RTS_STATIC then reject; if source != RTS_STATIC then reject;
if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject; if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject;
@ -960,7 +1016,7 @@ in {
direct; direct;
bfd on; bfd on;
ipv4 { ipv6 {
export filter { export filter {
if source != RTS_STATIC then reject; if source != RTS_STATIC then reject;
if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject; if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject;
@ -998,7 +1054,7 @@ in {
direct; direct;
bfd on; bfd on;
ipv4 { ipv6 {
export filter { export filter {
if source != RTS_STATIC then reject; if source != RTS_STATIC then reject;
if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject; if ! ((ro, 205479, 10) ~ bgp_ext_community) then reject;