howto/Bird2.md
... ...
@@ -209,7 +209,7 @@ protocol rpki roa_dn42 {
209 209
```
210 210
To reflect changes in the ROA table without a manual reload, **ADD** "import table" switch for both channels in your DN42 BGP template:
211 211
212
-```
212
+```conf
213 213
template bgp dnpeers {
214 214
ipv4 {
215 215
...existing configuration
... ...
@@ -236,7 +236,7 @@ Then for each peer, create a configuration file similar to this one:
236 236
237 237
`/etc/bird/peers/<NEIGHBOR_NAME>.conf`:
238 238
239
-```
239
+```conf
240 240
protocol bgp <NEIGHBOR_NAME> from dnpeers {
241 241
neighbor <NEIGHBOR_IP> as <NEIGHBOR_ASN>;
242 242
}
howto/EdgeOS-Config.md
... ...
@@ -23,27 +23,31 @@ This document describes some possibilities for connecting to dn42 using an Ubiqu
23 23
24 24
Using the below as examples:
25 25
26
- Own ASN: AS111111
27
- Own IPv4 Space: 172.AA.AA.64/27
28
- Own IPv6 Space: fdBB:BBBB:CCCC::/48
29
- Own IPv4 If-Address: 172.AA.AA.65
30
- Own IPv6 If-Address: fdBB:BBBB:CCCC::1
31
-
32
- Peer OpenVPN Remote Address: 172.X.X.X //that's the peers OpenVPN IF IP
33
- Peer OpenVPN Remote Host: X.X.X.Y //that's the peers clearnet IP
34
- Peer OpenVPN IP for you: fdAA::BBB/64
35
- Peer OpenVPN IP: fdAA::CC
36
- Peer OpenVPN Port: 1194
37
- Peer OpenVPN encryption: aes256
38
- Peer ASN: AS222222
39
- Peer BGP Neighbour IPv4: Z.Z.Z.Z
40
- Peer BGP Neighbour IPv6: fdAA::CC
26
+```
27
+Own ASN: AS111111
28
+Own IPv4 Space: 172.AA.AA.64/27
29
+Own IPv6 Space: fdBB:BBBB:CCCC::/48
30
+Own IPv4 If-Address: 172.AA.AA.65
31
+Own IPv6 If-Address: fdBB:BBBB:CCCC::1
32
+
33
+Peer OpenVPN Remote Address: 172.X.X.X //that's the peers OpenVPN IF IP
34
+Peer OpenVPN Remote Host: X.X.X.Y //that's the peers clearnet IP
35
+Peer OpenVPN IP for you: fdAA::BBB/64
36
+Peer OpenVPN IP: fdAA::CC
37
+Peer OpenVPN Port: 1194
38
+Peer OpenVPN encryption: aes256
39
+Peer ASN: AS222222
40
+Peer BGP Neighbour IPv4: Z.Z.Z.Z
41
+Peer BGP Neighbour IPv6: fdAA::CC
42
+```
41 43
42 44
#### Copy OpenVPN key to the EdgeRouter
43 45
44 46
Copy the VPN key to `/config/auth/SomeSharedKey.key`:
45 47
46
- sudo cat > /config/auth/SomeSharedKey.key
48
+```sh
49
+sudo cat > /config/auth/SomeSharedKey.key
50
+```
47 51
48 52
Paste the key in the terminal window, hit return once and kill `cat` with CTRL+C. Then type `exit`.
49 53
... ...
@@ -51,30 +55,34 @@ Paste the key in the terminal window, hit return once and kill `cat` with CTRL+C
51 55
52 56
Create the OpenVPN virtual interface, i.e. using `vtun0`:
53 57
54
- configure
55
- set interfaces openvpn vtun0
56
- set interfaces openvpn vtun0 mode site-to-site
57
- set interfaces openvpn vtun0 local-port 1194
58
- set interfaces openvpn vtun0 remote-port 1194
59
- set interfaces openvpn vtun0 local-address 172.AA.AA.65
60
- set interfaces openvpn vtun0 remote-address 172.X.X.X
61
- set interfaces openvpn vtun0 remote-host X.X.X.Y
62
- set interfaces openvpn vtun0 shared-secret-key-file /config/auth/SomeSharedKey.key
63
- set interfaces openvpn vtun0 encryption aes256
64
-
65
- set interfaces openvpn vtun0 openvpn-option "--comp-lzo" //if your peer support compression
66
-
67
- commit
68
- save
69
- exit
58
+```
59
+configure
60
+set interfaces openvpn vtun0
61
+set interfaces openvpn vtun0 mode site-to-site
62
+set interfaces openvpn vtun0 local-port 1194
63
+set interfaces openvpn vtun0 remote-port 1194
64
+set interfaces openvpn vtun0 local-address 172.AA.AA.65
65
+set interfaces openvpn vtun0 remote-address 172.X.X.X
66
+set interfaces openvpn vtun0 remote-host X.X.X.Y
67
+set interfaces openvpn vtun0 shared-secret-key-file /config/auth/SomeSharedKey.key
68
+set interfaces openvpn vtun0 encryption aes256
69
+
70
+set interfaces openvpn vtun0 openvpn-option "--comp-lzo" //if your peer support compression
71
+
72
+commit
73
+save
74
+exit
75
+```
70 76
71 77
The OpenVPN tunnel should now be up and running.
72 78
73 79
Check it with:
74 80
75
- show interfaces openvpn
76
- show interfaces openvpn detail
77
- show openvpn status site-to-site
81
+```
82
+show interfaces openvpn
83
+show interfaces openvpn detail
84
+show openvpn status site-to-site
85
+```
78 86
79 87
### Create BGP Session
80 88
... ...
@@ -88,35 +96,45 @@ When entering AS numbers, do not include the "AS" prefix, i.e. enter AS111111 as
88 96
89 97
Build the BGP session with your peer:
90 98
91
- configure
92
- set protocols bgp 111111 neighbor Z.Z.Z.Z remote-as 222222
93
- set protocols bgp 111111 neighbor Z.Z.Z.Z soft-reconfiguration inbound
94
- set protocols bgp 111111 neighbor Z.Z.Z.Z update-source 172.AA.AA.65
95
- commit
96
- save
99
+```
100
+configure
101
+set protocols bgp 111111 neighbor Z.Z.Z.Z remote-as 222222
102
+set protocols bgp 111111 neighbor Z.Z.Z.Z soft-reconfiguration inbound
103
+set protocols bgp 111111 neighbor Z.Z.Z.Z update-source 172.AA.AA.65
104
+commit
105
+save
106
+```
97 107
98 108
Check that the BGP session has come up:
99 109
100
- show ip bgp summary
110
+```
111
+show ip bgp summary
112
+```
101 113
102 114
#### Create Blackhole Route
103 115
104 116
so bgp can announce the route
105 117
106
- set protocols static route 172.AA.AA.64/27 blackhole
107
- commit
108
- save
118
+```
119
+set protocols static route 172.AA.AA.64/27 blackhole
120
+commit
121
+save
122
+```
109 123
110 124
#### Announce Route to BGP
111 125
112
- set protocols bgp 111111 network 172.A.A.64/27
113
- commit
114
- save
115
- exit
126
+```
127
+set protocols bgp 111111 network 172.A.A.64/27
128
+commit
129
+save
130
+exit
131
+```
116 132
117 133
You should now be able to see networks being advertised to your peer:
118 134
119
- show ip bgp neighbors Z.Z.Z.Z advertised-routes
135
+```
136
+show ip bgp neighbors Z.Z.Z.Z advertised-routes
137
+```
120 138
121 139
### Set DNS Forwarding
122 140
... ...
@@ -124,18 +142,22 @@ Try to ping `172.23.0.53` (anycast DNS resolver). If you get a response then you
124 142
125 143
Add the DNS forwarder:
126 144
127
- configure
128
- set service dns forwarding options server=/23.172.in-addr.arpa/172.23.0.53
129
- set service dns forwarding options server=/22.172.in-addr.arpa/172.23.0.53
130
- set service dns forwarding options server=/dn42/172.23.0.53
131
- commit
132
- save
133
- exit
145
+```
146
+configure
147
+set service dns forwarding options server=/23.172.in-addr.arpa/172.23.0.53
148
+set service dns forwarding options server=/22.172.in-addr.arpa/172.23.0.53
149
+set service dns forwarding options server=/dn42/172.23.0.53
150
+commit
151
+save
152
+exit
153
+```
134 154
135 155
### Create NAT rule
136 156
137
- set service nat rule 5013 outbound-interface vtun0
138
- set service nat rule 5013 type masquerade
139
- set service nat rule 5013 description "Masquerade for dn42"
157
+```
158
+set service nat rule 5013 outbound-interface vtun0
159
+set service nat rule 5013 type masquerade
160
+set service nat rule 5013 description "Masquerade for dn42"
161
+```
140 162
141
-You should now be able to access .dn42 domains.
163
+You should now be able to access .dn42 domains.
howto/Registry-Authentication.md
... ...
@@ -148,7 +148,7 @@ Once configured, you can now use git to sign your commit as normal:
148 148
- Use `git commit -S` to commit and sign your change.
149 149
150 150
- If you have already committed your change without signing it, you can sign the existing commit using:
151
-```
151
+```sh
152 152
git commit --amend --no-edit -S
153 153
```
154 154
If you had already pushed your change to gitea, you must also do a force push (`git push --force`) to update the remote copy.
services/Automatic-CA.md
... ...
@@ -157,7 +157,7 @@ _dn42_tlsverify.ca.dn42. IN TXT XUU-MNT:pin-sha256:Qu/X5GNqOo05TdL7oexkamE34OUuD
157 157
158 158
After you set this TXT-Record for your domain, you can verify it with the following command (by replacing the domain with your own):
159 159
160
-```
160
+```sh
161 161
$ dig +short TXT _dn42_tlsverify.ca.dn42.
162 162
"XUU-MNT:pin-sha256:Qu/X5GNqOo05TdL7oexkamE34OUuDE60T+f0xc60UPQ="
163 163
```
services/Certificate-Authority.md
... ...
@@ -105,7 +105,7 @@ The name constraints can be verified for example by using openssl:
105 105
openssl x509 -in dn42.crt -text -noout
106 106
```
107 107
which will show among other things:
108
-```text
108
+```
109 109
X509v3 Name Constraints:
110 110
Permitted:
111 111
DNS:.dn42
services/IXP-frnte.md
... ...
@@ -91,7 +91,7 @@ protocol bgp ixp_rs from dnpeers {
91 91
92 92
**What does this configuration do?**
93 93
94
-First we create a new BGP session (`protocol bgp`). This is based on the dnpeers template which can be found in the standard Bird2 configuration in the [wiki](https://dn42.eu/howto/Bird2). We name this session "ixp\_rs". However, this is only an internal name and can be replaced with another one.
94
+First we create a new BGP session (`protocol bgp`). This is based on the dnpeers template which can be found in the standard Bird2 configuration in the [wiki](/howto/Bird2). We name this session "ixp\_rs". However, this is only an internal name and can be replaced with another one.
95 95
96 96
After that we determine with whom we want to have the session. This would be the RS. Therefore we put IPv6 address and ASN there.
97 97
services/Original-DNS-(deprecated).md
... ...
@@ -35,7 +35,7 @@ The root zone for `dn42.` is built from the [whois registry](/services/Whois). I
35 35
36 36
## DNS services for other networks
37 37
38
-Other networks are interconnected with dn42 (ChaosVPN, Freifunk, etc). Some of them also provide DNS service, you can configure your resolver to use it. See [External DNS](/service/dns/External-DNS).
38
+Other networks are interconnected with dn42 (ChaosVPN, Freifunk, etc). Some of them also provide DNS service, you can configure your resolver to use it. See [External DNS](/services/dns/External-DNS).
39 39
40 40
## Providing DNS services
41 41
services/Whois.md
... ...
@@ -92,6 +92,7 @@ We have anycast IPv4 and IPv6, both reachable under whois.dn42. IPs are 172.22.0
92 92
| burble | whois.burble.dn42 | 172.20.129.8 / fd42:4242:2601:ac43::1 |
93 93
| p3bk4c | whois.pebkac.dn42 | 172.21.83.27 / fd63:672f:38e7:27::1 |
94 94
| scooter | whois.scooter.dn42 | 172.23.109.170 / fd38:cfa3:7091:2::1 |
95
+| C4TG1RL5 | at-vie1.catgirls.dn42 | 172.23.196.33 / fd42:deca:fbad::1 |
95 96
| Bandura | whois.bandura.dn42 | 172.22.149.225 / fd04:234e:fc31::1 (may change in the future) |
96 97
97 98
## Down?
services/dns/Providing-Anycast-DNS.md
... ...
@@ -1,4 +1,4 @@
1
-# DEPRECATED - Please have a look at [Hierarchical DNS](/services/dns/Old-Hierarchical-DNS) instead
1
+# DEPRECATED - Please have a look at [Hierarchical DNS](/services/Old-Hierarchical-DNS) instead
2 2
3 3
You may want to participate in the anycast DNS cloud.
4 4