CPE 210 na borda

cpe_borda.md

/etc/config/network:

config interface 'loopback'
	option ifname 'lo'
	option proto 'static'
	option ipaddr '127.0.0.1'
	option netmask '255.0.0.0'

config globals 'globals'

config interface 'lan'
	option type 'bridge'
	option proto 'static'
	option ip6assign '60'
	option ipaddr '10.13.193.16'
	option netmask '255.255.0.0'
	option mtu '1500'
	option ip6addr 'fddb:ad8:3da7::10c1:1a00/64'
	list ifname 'bat0'
	list ifname 'eth0'

config interface 'bat0'
	option proto 'batadv'
	option bridge_loop_avoidance '1'
	option multicast_mode '0'
	option distributed_arp_table '0'
	option gw_mode 'client'

config device 'lm_net_br_lan_anygw_dev'
	option type 'macvlan'
	option name 'anygw'
	option ifname 'br-lan'
	option macaddr 'aa:aa:aa:db:0a:aa'

config interface 'lm_net_br_lan_anygw_if'
	option ifname 'anygw'
	option auto '1'
	option netmask '255.255.0.0'
	option proto 'static'
	option ipaddr '10.13.0.1'
	option ip6addr 'fddb:ad8:3da7::1/64'

config rule6 'lm_net_anygw_rule6'
	option src 'fddb:ad8:3da7::1/128'
	option lookup '170'

config route6 'lm_net_anygw_route6'
	option interface 'lm_net_br_lan_anygw_if'
	option target 'fddb:ad8:3da7::/64'
	option table '170'

config rule 'lm_net_anygw_rule4'
	option src '10.13.0.1/32'
	option lookup '170'

config route 'lm_net_anygw_route4'
	option interface 'lm_net_br_lan_anygw_if'
	option target '10.13.0.0'
	option netmask '255.255.0.0'
	option table '170'

config interface 'lm_net_wlan0_mesh'
	option proto 'none'
	option mtu '1536'
	option auto '1'

config device 'lm_net_wlan0_mesh_batadv_dev'
	option type '8021ad'
	option name 'wlan0-mesh_235'
	option ifname '@lm_net_wlan0_mesh'
	option vid '235'
	option macaddr '02:58:47:1a:c1:10'
	option mtu '1532'

config interface 'lm_net_wlan0_mesh_batadv_if'
	option auto '1'
	option ifname 'wlan0-mesh_235'
	option proto 'batadv_hardif'
	option master 'bat0'

config device 'lm_net_wlan0_mesh_babeld_dev'
	option type '8021ad'
	option name 'wlan0-mesh_17'
	option ifname '@lm_net_wlan0_mesh'
	option vid '17'

config interface 'lm_net_wlan0_mesh_babeld_if'
	option auto '1'
	option ifname 'wlan0-mesh_17'
	option proto 'static'
	option ipaddr '10.13.193.16'
	option netmask '255.255.255.255'

config device 'lm_net_eth0_batadv_dev'
	option type '8021ad'
	option name 'eth0_235'
	option ifname 'eth0'
	option vid '235'
	option macaddr '02:95:39:1a:c1:10'
	option mtu '1496'

config interface 'lm_net_eth0_batadv_if'
	option auto '1'
	option ifname 'eth0_235'
	option proto 'batadv_hardif'
	option master 'bat0'

config device 'lm_net_eth0_babeld_dev'
	option type '8021ad'
	option name 'eth0_17'
	option ifname 'eth0'
	option vid '17'
	option mtu '1496'

config interface 'lm_net_eth0_babeld_if'
	option auto '1'
	option ifname 'eth0_17'
	option proto 'static'
	option ipaddr '10.13.193.16'
	option netmask '255.255.255.255'
config device 'lm_net_eth0_batadv_dev'
	option type '8021ad'
	option name 'eth0_29'
	option ifname 'eth0'
	option vid '29'
	option mtu '1532'
config interface 'lm_net_eth0_batadv_if'
	option auto '1'
	option proto 'batadv'
	option ifname 'eth0_29'
	option mesh 'bat0'

config interface 'lm_net_eth0'
	option proto 'none'
	option auto '1'
	option ifname 'eth0'
	option mtu '1500'

config interface 'wan'
	option proto 'dhcp'
	option ifname 'eth0'

config interface 'wan6'
	option proto 'none'
	option ifname 'eth0'

/etc/config/firewall:

config defaults
  option syn_flood '1'
  option input 'ACCEPT'
  option output 'ACCEPT'
  option forward 'ACCEPT'

config zone
  option name 'lan'
  option input 'ACCEPT'
  option output 'ACCEPT'
  option forward 'ACCEPT'
  option mtu_fix '1'
  list network 'lan'
  list network 'lm_net_br_lan_anygw_if'
  list network 'lm_net_wlan0_mesh_batadv_if'
  list network 'lm_net_wlan0_mesh_babeld_if'
  list network 'lm_net_eth0_batadv_if'
  list network 'lm_net_eth0_babeld_if'
  list network 'lm_net_batadv_dummy_if'
  list network 'lm_net_wlan0_mesh_batadv_if'

config zone
  option name 'wan'
  list network 'wan'
  list network 'wan6'
  option input 'REJECT'
  option output 'ACCEPT'
  option forward 'REJECT'
  option masq '1'
  option mtu_fix '1'

config forwarding
  option src 'lan'
  option dest 'wan'

config rule
  option name 'Allow-DHCP-Renew'
  option src 'wan'
  option proto 'udp'
  option dest_port '68'
  option target 'ACCEPT'
  option family 'ipv4'

config rule
  option name 'Allow-Ping'
  option src 'wan'
  option proto 'icmp'
  option icmp_type 'echo-request'
  option family 'ipv4'
  option target 'ACCEPT'

config rule
  option name 'Allow-IGMP'
  option src 'wan'
  option proto 'igmp'
  option family 'ipv4'
  option target 'ACCEPT'

config rule
  option name 'Allow-DHCPv6'
  option src 'wan'
  option proto 'udp'
  option src_ip 'fc00::/6'
  option dest_ip 'fc00::/6'
  option dest_port '546'
  option family 'ipv6'
  option target 'ACCEPT'

config rule
  option name 'Allow-MLD'
  option src 'wan'
  option proto 'icmp'
  option src_ip 'fe80::/10'
  list icmp_type '130/0'
  list icmp_type '131/0'
  list icmp_type '132/0'
  list icmp_type '143/0'
  option family 'ipv6'
  option target 'ACCEPT'

config rule
  option name 'Allow-ICMPv6-Input'
  option src 'wan'
  option proto 'icmp'
  list icmp_type 'echo-request'
  list icmp_type 'echo-reply'
  list icmp_type 'destination-unreachable'
  list icmp_type 'packet-too-big'
  list icmp_type 'time-exceeded'
  list icmp_type 'bad-header'
  list icmp_type 'unknown-header-type'
  list icmp_type 'router-solicitation'
  list icmp_type 'neighbour-solicitation'
  list icmp_type 'router-advertisement'
  list icmp_type 'neighbour-advertisement'
  option limit '1000/sec'
  option family 'ipv6'
  option target 'ACCEPT'

config rule
  option name 'Allow-ICMPv6-Forward'
  option src 'wan'
  option dest '*'
  option proto 'icmp'
  list icmp_type 'echo-request'
  list icmp_type 'echo-reply'
  list icmp_type 'destination-unreachable'
  list icmp_type 'packet-too-big'
  list icmp_type 'time-exceeded'
  list icmp_type 'bad-header'
  list icmp_type 'unknown-header-type'
  option limit '1000/sec'
  option family 'ipv6'
  option target 'ACCEPT'

config rule
  option name 'Allow-IPSec-ESP'
  option src 'wan'
  option dest 'lan'
  option proto 'esp'
  option target 'ACCEPT'

config rule
  option name 'Allow-ISAKMP'
  option src 'wan'
  option dest 'lan'
  option dest_port '500'
  option proto 'udp'
  option target 'ACCEPT'

config include
  option path '/etc/firewall.user'

config include 'include_firewall_lime'
  option path '/etc/firewall.lime'