Git Product home page Git Product logo

icvpn-meta's Introduction

InterCityVPN meta information

Build Status

The data in this repository can be used for automatic configuration of routing daemons and DNS servers. You may leave out fields that do not apply to your community (e.g. asn, domains and nameservers).

Stick to one file per community. The filename must match your communityname on the freifunk-api. You may add stub DNS zones (e.g. dn42, rzl, hack) by leaving out everything but domains and nameservers.

Scripts for the automatic configuration generation and provisioning of various services (bird, bind, dnsmasq, ...) are kept in a separate repository: icvpn-scripts

Notes on IPv4 allocations

  • There is only a limited amount of usuable IPv4 space available.
  • 10/8 is used for connections between community networks across the ICVPN.
  • Previously, people just took a /16, which means space is exhausted after 255 communites picked a network.
  • Thus: think before you allocate a v4 network here: do you really need IPv4 connectivity between your and other Freifunk networks? If not, consider to use IPs from 172.16.0.0/12 or 198.18.0.0/15 internally and do NOT announce them to ICVPN.
  • If you think you do, please be conservative; rule of thumb: Meshes might not size well beyond 2000 concurrent users, double that for decent DHCP timings => a /20 (4k IPs) per Mesh sounds reasonable. For additional systems outside the Mesh, an additional /22 (1024 IPv4 addresses) might be sufficient.
  • If you use mostly routing (OLSR), things might look different, you might look into e. g. an /21 to distribute to clients and another /22 for p2p-links if needed.
  • Again, please plan ahead, than take your pick. Be prepared to be questioned on why, if you took e. g. more than /18 directly. But remember as well, that renumbering IS a pain.
  • If you need more than a /18 in one community or city you need a very good explaination, why you do need it.
  • Minimum net size is /22, round up if you need less.

Example

  # This is your ASN.
  asn: 65052

  # A list of people to contact in case of technical emergency.
  # Automated monitoring systems might use this.
  tech-c:
    - [email protected]
    - [email protected]
  
  # Prefixes announced by your AS. This may be used for filtering
  # routes. Keep the prefixes a short as possible. If you're
  # assigned 10.130.0.0/20 while you're using just a subnet of it
  # (e.g. 10.130.0.0/21) you must include 10.130.0.0/20 here. The details
  # will be taken care of by the routing daemons.
  networks:
    ipv4:
      - 10.130.0.0/20
    ipv6:
      - fdef:ffc0:3dd7::/48
      - 2001:bf7:110::/44

  # A list of BGP peers in IC-VPN announcing your AS.
  bgp:
    luebeck1:
      ipv4: 10.207.0.130
      ipv6: fec0::a:cf:0:82
    luebeck2:
      ipv4: 10.207.0.131
      ipv6: fec0::a:cf:0:83

  # If you're using custom TLDs, include them here.
  # Don't forget reverse zones!
  domains:
    - ffhl
    - 7.d.d.3.0.c.f.f.f.e.d.f.ip6.arpa
    - 130.10.in-addr.arpa

  # A list of nameservers capable of resolving your domains. 
  # All nameservers must be able to handle all domains listed above!
  nameservers:
    - 10.130.10.1
    - 10.130.14.1
    - fdef:ffc0:3dd7::a01
    - fdef:ffc0:3dd7::e01

  # Delegate part of our network allocations to another community
  # this needs to be a subnet to an already allocated network in the
  # networks section.
  delegate:
    65038: # Darmstadt
      - 10.130.252.0/22
      - fdef:ffc0:3dd7:ffda::/64

icvpn-meta's People

Contributors

barbarossatm avatar benbe avatar dachris avatar dracotrier avatar ecsv avatar elberfeld avatar fragstone avatar freifunkufo avatar jplitza avatar ka-ba avatar kerel-fs avatar kerlerm avatar kevin-olbrich avatar kokel avatar kpanic23 avatar kst87 avatar marku89 avatar marvin avatar mweinelt avatar ohrensessel avatar ranlvor avatar reddog99 avatar reissmann avatar rubo77 avatar sargon avatar skorpy2009 avatar strehi avatar thomasdotwtf avatar thooge avatar wusel42 avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

icvpn-meta's Issues

Duplicate Domain (ffwk): vfnnrw westkueste

Facts:

  • vfnnrw used the domain first
  • but not in icvpn; never assigned nameservers for it
  • current state of affairs is that ffwk resolves via icvpn to westkueste

Please resolve this collision as soon as possible.

westkueste:

efd34682 (olliff 2015-05-15 07:39:15 +0200 13) domains:
efd34682 (olliff 2015-05-15 07:39:15 +0200 14)   - ffwk
efd34682 (olliff 2015-05-15 07:39:15 +0200 15) nameservers:
c3d590ca (olliff 2015-05-17 16:46:54 +0200 16)   - 10.13.1.1
efd34682 (olliff 2015-05-15 07:39:15 +0200 17)   - fd23:dead:beef::ff01

vfnnrw

eb3c3ad6 wermelskirchen (Jan-Philipp Litza 2014-09-01 12:42:05 +0200 45) domains:
eb3c3ad6 wermelskirchen (Jan-Philipp Litza 2014-09-01 12:42:05 +0200 46)   - ffwk
cfae1a85 vfnnrw         (xlizard           2014-12-23 12:43:59 +0100 47)   - ffgro
eb3c3ad6 wermelskirchen (Jan-Philipp Litza 2014-09-01 12:42:05 +0200 48) # FIXME: Nameserver eintragen

bielefeld: Incorrect ASN for announced networks

The networks are set in ICVPN to 65529. But instead 4242420022 is used for them this currently breaks ROA checks on other BGP peers. icvpn's mkroa uses the data from icvpn-meta to generate this table. The icvpn-meta information must therefore be in sync with ASN used for the announcements.

  • 10.26.48.0/20 ASN 4242420022
  • 10.26.64.0/18 ASN 4242420022
  • fdef:17a0:ffb1:ffff::/64 ASN 4242420022

Maybe this could be used as an example for find a workaround for other communities like

  • 10.31.0.0/24 ASN 4242421279
  • fda1:384a:74de::/48 ASN 4242423214

How do I find a free ip for a new community?

Is there an easy way to extract all given IPs from this repository?

I would just pick any new IP and search for this IP in this repositroy and hope it is free? but that seems a bit rude

for example 10.88 seems to be free, but it seems to be taken by Frankfurt Großenried aloready???

Unexpected ICVPN BGP connections after "Grossreinemachen"

Just noticed that one of the FFV servers (vogtland3) had a full HDD and the reason for that was a rather big daemon.log. The "culprit" was bird which logged a lot of connection requests from unknown peers. Unfortunately, the log on this server cannot be used anymore - but I've checked on vogtland1 and vogtland4 for the same error messages via

sudo grep 'Unexpected connect from unknown address' /var/log/daemon.log|sed -e 's/.*Unexpected connect from unknown address//' -e 's/port.*$//'|sort|uniq -c |sort -n

I found following IPs:

  • misconfigured servers?
  • unknown and most likely unrelated to icvpn
    • 198.20.87.98
    • 45.55.21.184
    • 71.6.135.131
    • 80.82.77.139
    • 80.82.77.33
  • entries which were disabled during the "Grossreinemachen" #507 @kpanic23

The first two points are not actually a problem of icvpn-meta. But the last point is the interesting part. Should these be re-added or should there certificate be removed from the icvpn tinc keys repository? And should fec0::a:cf:0:17 be re-added for franken?

Reservierung für private Netze

Es wäre schön, wenn nicht das ganze 10.0.0.0/8er Netz für "öffentliche" Freifunk-IPs genutzt würde, sondern wenn ein kleiner Teilbereich (z.B. /12) für private LAN genutzt werden könnte ohne einen Adresskonflikt zu provozieren.

rhein-neckar: Bad peer AS

rhein-neckar is currently using nazco's ASN 76118.
I guess this should be either corrected in the meta file or on their peer.

neonetwork: new nameserver breaks mkdns

The last commit 763c74e for neonetwork breaks the mkdns script from icvpn-scripts.

Traceback (most recent call last):
  File "/home/admin/clones/icvpn-scripts/mkdns", line 190, in <module>
    [filters[options.filter]] if options.filter else [])
  File "/home/admin/clones/icvpn-scripts/mkdns", line 138, in create_config
    formatter.add_data(domains, servers)
  File "/home/admin/clones/icvpn-scripts/mkdns", line 28, in add_data
    """ % (domain, "; ".join(servers))).lstrip())
TypeError: sequence item 1: expected str instance, dict found

It looks like the script does not like IPv6 addresses with :: at the end.
Changing fd10:127:ffff:53:: to fd10:127:ffff:53::0 seems to fix it.

Check missing communities

For example Who is Frankfurt Großenried? The Wiki sais it is there with the IP-Range 10.88.0.0: https://wiki.freifunk.net/IP-Netze :

10.88.0.0/16                Freifunk Großenried - linon 

But ti is not found in this icvpn-meta repository.

since 27. April 2015 there is a hint :

TODO: Die hier aufgeführten Netze müssen geprüft und anschließend in das icvpn-meta Repository übertragen werden.

How can we help to check these communities?
How where these added those to the Wiki?

Problem mit Community Netzen

Moin moin,

ich finde das eigentlich nicht so richtig prall, dass die Zuteilung IP-Netz / ASN nun hier über das Repo erfolgen soll, aber man kann sich dem nicht entziehen.

Als ich nun unsere Community Netze anlegen wollte, (zu denen mir gesagt wurde ich müsste diese einzeln anlegen, da jede Community eine eigene ASN hat und mehrere ASN pro File nicht zulässig sind) rannte die Prüfung direkt auf nen Hammer, da es anscheinend ebenfalls nicht zulässig ist mehrere ASN in unterschiedlichen Files über das selbe Gateway zu routen.

Was nun?

Sieh PR #101 #102

Too specific announced networks in celle and gera-greiz

The roa tables generated by icvpn's mkroa (using icvpn-meta) currently set the max prefix length to 24. But there are communities which are announcing more specific networks.

celle @ffce

  • 10.252.63.192/26 ASN 64861

gera-greiz @joerg-d

  • 10.181.0.11/32 ASN 65181
  • 10.181.0.12/32 ASN 65181

This has to be fixed either by the communities or by the way the tables are generated

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.