-
Notifications
You must be signed in to change notification settings - Fork 0
Production Network
For the final DN42 separate, there are two main networks, the Management and the DN42 networks. The management network provides supporting services (mainly ROA) to the router, but does not expose them to the DN42 network. The management network also does not make use of DN42 address space.
The management network uses the address space 172.19.255.240/28, which precedes the address space used by DN42, 172.20.0.0/14. The servers on this network have internet connectivity.
| Hostname | Description | IP Address |
|---|---|---|
| - | Router | 172.19.255.241 |
roa-1 |
Primary RTR cache server | 172.19.255.242 |
roa-2 |
Fallback RTR cache server | 172.19.255.243 |
roa-srv |
ROA signature database generator | 172.19.255.244 |
mon |
Monitoring and alerts server | 172.19.255.245 |
For security reasons, no servers on the management network are able to reach any Champlain addresses, these have been specifically blocked in the firewall config.
The DN42 network is actually comprised of two separate networks, one providing services, and one used to access the network without using NAT. These networks uses the address space from AS4242421878, 172.23.119.64/27 and fde6:a552:874f::/48.
The services network uses 172.23.119.64/28 (the first half of the IPv4 allocation) and fde6:a552:874f:1c2d::/64. EUI-64 is used for predictable address generation based on router advertisements.
| Hostname | Description | IPv4 Address |
|---|---|---|
| - | Router | 172.23.119.65 |
ns-1 |
Primary authoritative DNS server | 172.23.119.66 |
ns-2 |
Fallback authoritative DNS server | 172.23.119.67 |
dns-1 |
Primary DNS resolver | 172.23.119.68 |
dns-2 |
Fallback DNS resolver | 172.23.119.69 |
lg |
BGP Looking Glass | 172.23.119.70 |
For security reasons, servers on this network do not have any internet access, only access to DN42. For maintenance, they may be temporarily connected to the management network so they have internet connectivity.
The access network uses 172.23.119.80/28 (the second half of the IPv4 allocation) and fde6:a552:874f:9a3b::/64. It is accessible via Wireguard on standard port 51820/udp, providing access to DN42 but also to the management network to administer the underlying infrastructure.
Access to each network is enforced using a VyOS zone-based firewall. Each of the above networks encompasses an entire zone, plus the WAN and LOCAL zones, for the WAN interface and router itself, respectively. The DN42 zone covers the local DN42 network as well as all peer interfaces.
WANLOCALMGMTACCESSDN42
Note that zone pairs not listed below are simply not connected and thereby cannot transit any traffic.
| Name | Zone Pairs | Default Action | Rules |
|---|---|---|---|
ALLOW |
LOCAL > *, ACCESS > MGMT:DN42, MGMT > DN42
|
Accept | - |
DENY |
WAN > MGMT, * > LOCAL, DN42 > ACCESS:MGMT, MGMT > ACCESS
|
Drop | Accept established/related |
MGMT_WAN |
MGMT > WAN |
Accept | Drop Champlain addresses |
MGMT_LOCAL |
MGMT > LOCAL |
Drop | Accept SSH, Accept SNMP |
ACCESS_LOCAL |
ACCESS > LOCAL |
Drop | Accept SSH |
WAN_LOCAL |
WAN > LOCAL |
Drop | Accept primary Wireguard (51820/udp), Accept peer Wireguard (dynamic), Accept GRE, Accept ICMP |
NAT is implemented for the pair MGMT > WAN and MGMT > DN42.
Note that the firewall must not drop DN42 packets with invalid state under any circumstances. This is because packets transitting the router may be part of a connection taking separate paths in each direction (asymmetric routing), and so dropping invalid states will break routing through the firewall in some cases. See the Universal Network Rules for more info.