initial commit

demo-flies/etc/bird/bird.conf

@@ -0,0 +1,151 @@
+router id 82.215.64.105;
+
+log syslog all;
+log "/var/log/bird/bird.log" { debug, trace, remote, warning, error, auth, fatal, bug };
+#log "/var/log/bird/info-bird.log" { info };
+
+protocol device { scan time 5; }
+protocol direct { ipv6; }
+
+protocol kernel {
+	ipv6 { export none; };
+#	ipv6;
+	scan time 15;
+#	learn;
+}
+
+protocol kernel {
+	ipv4;
+	scan time 15;
+#	export filter rt_export;
+#	learn;
+}
+
+protocol static announcev6 {
+    ipv6;
+    description "Static v6 Routes";
+#    route 2a12:bec0:6b0::/44 blackhole;
+    route 2a12:bec0:6b1::/48 via 2a12:bec2:b00b::201;
+#    route 2a12:bec0:6b9::/48 via 2a12:bec2:b00b::1f7;
+#    route 2a12:bec0:210:4::/64 via 2a12:bec0:210:4::1; #Pete-tunnel
+#    route 2a12:bec0:218::/48 via 2a12:bec0:210:4::2; #Pete-range
+
+}
+
+protocol static announcev4 {
+    ipv4;
+    description "Static v4 Routes";
+}
+
+protocol static {
+	ipv6;
+}
+
+protocol static {
+	ipv4;
+}
+
+filter rt_importv4 {
+	accept;
+}
+
+filter rt_importv6 {
+        accept;
+}
+
+filter rt_nothanks {
+
+	if (net ~ [ fd00:dead:beef:c0::/80 ]) then
+		reject;
+        if (net ~ [ fd4d:6169:6c69:6f77::/64 ]) then
+                reject;
+        if (net ~ [ fd7a:115c:a1e0::/48 ]) then
+                reject;
+        if (net ~ [ fd8c:c43c:133e::/64 ]) then
+                reject;
+        if (net ~ [ fd8c:c43c:133e:1::/64 ]) then
+                reject;
+        if (net ~ [ fd8c:c43c:133e:2::/64 ]) then
+                reject;
+        if (net ~ [ fd00:1::/64 ]) then
+                reject;
+        if (net ~ [ 2a12:bec2:b00b::/64 ]) then
+                reject;
+        if (net ~ [ ::10.10.10.1/128 ]) then
+                reject;
+        if (net ~ [ 2a12:bec0:210:3::/64 ]) then
+                reject;
+	else
+		accept;
+}
+
+filter sbehop {
+	gw = 2a12:bec0:210:3::1;
+	accept;
+}
+
+filter brt_importv6 {
+        reject;
+}
+
+filter rt_export {
+	if (proto = "announcev4") then
+		accept;
+	if (proto = "announcev6") then
+		accept;
+#        reject_bogon_asns();
+#        reject_v6_bogon_prefixes();
+#        reject_smallv6_prefixes();
+#        reject_long_aspaths();
+	reject;
+#	accept; #export Any Accepted Prefixes
+}
+
+#EBGP upstream sessions
+protocol bgp tgj4 {
+#    debug all;
+        local 172.22.10.2 as 213026;
+        neighbor 172.22.10.1 as 199519;
+#	default bgp_local_pref 20;
+        multihop 255;
+        ipv6 {
+                export limit 30;
+                import filter sbehop;
+                export filter rt_nothanks;
+                graceful restart on;
+        };
+}
+
+protocol bgp scaleblade6 {
+#       debug all;
+        local 2a12:bec2:b00b::201 as 213026;
+        neighbor 2a12:bec1::2 as 52041;
+        multihop 255;
+#	default bgp_local_pref 20;
+        ipv6 {
+                export limit 50;
+                import filter rt_importv6;
+                export filter rt_nothanks;
+                graceful restart on;
+        };
+}
+
+#IBGP sessions
+protocol bgp ntbx {
+	local 172.18.72.1 as 213026;
+        neighbor 172.18.72.2 as 213026;
+        multihop 255;
+        ipv6 {
+                import limit 20;
+#		import none;
+                import filter rt_importv6;
+                export filter rt_export;
+#		export none;
+        };
+#        ipv4 {
+#                import limit 20;
+#                import none;
+#                export filter rt_export;
+##               graceful restart on;
+#        };
+}

demo-flies/etc/bird/envvars

@@ -0,0 +1,3 @@
+BIRD_RUN_USER=bird
+BIRD_RUN_GROUP=bird
+#BIRD_ARGS=

demo-flies/etc/sysctl.conf

@@ -0,0 +1,3 @@
+net.ipv6.conf.all.forwarding = 1
+net.ipv6.conf.default.forwarding = 1
+net.ipv4.ip_forward = 1

demo-flies/etc/wireguard/wg1.conf

@@ -0,0 +1,16 @@
+# Wireguard to pfSense
+
+[Interface]
+PrivateKey = ${WG1_PRIVATEKEY}
+Address = 2a12:bec0:6b1::1/64,172.18.72.1/30
+ListenPort = 51825
+MTU = 1430
+
+PreUp = ip neigh add proxy 82.215.64.187 dev eth0
+
+PostDown = ip neigh del proxy 82.215.64.187 dev eth0
+
+[Peer]
+PublicKey = SsGjCLJBKQFDuxSnVgwua77fvb/ha4KFRiJcCBk7vF0=
+AllowedIPs = 2a12:bec0:6b1::2/64,2a12:bec0:6b9::/48,172.18.72.0/30,82.215.64.187/32
+#2a12:bec0:6b9:2::/64,2a12:bec0:6b9:3::/64,2a12:bec0:6b9:10::/64,2a12:bec0:6b9::/48,172.18.72.0/30,82.215.64.187/32

demo-flies/etc/wireguard/wg2.conf

@@ -0,0 +1,13 @@
+# Wireguard to TGJ
+
+[Interface]
+PrivateKey = ${WG2_PRIVATEKEY}
+Address = 2a12:bec0:210:3::2/64,172.22.10.2/30
+ListenPort = 51820
+MTU = 1430
+
+[Peer]
+PublicKey = 1XaLeqKZimM1cS57dPzTSf/UGW8bThADjf+oBmRF82I=
+AllowedIPs = 2a12:bec0:21f::2/64,172.22.10.1/30,2a12:bec0:212::/48,2a12:bec0:210::/48,2a12:bec0:214::/48
+Endpoint = v4.router.colo.tgj.services:51869
+PersistentKeepalive = 25

demo-flies/readme.md

@@ -0,0 +1,8 @@
+82.215.64.187 = Virtual Home IP used by Bird
+82.215.64.105 = BIRD VPS IP
+82.215.64.169 = VPS IP
+v4.router.colo.tgj.services:51869 = TGJ WG Remote Node
+
+82.215.64.187 is cloud-init added to the default interface, this should be removed in wireguard PreUp, or ansible config
+
+Should use ansible variables for allowedIPs, private / public keys, etc. anything that should not be committed to github should be in group vars or envy