FAQ.md
... ...
@@ -58,7 +58,7 @@ Prior to using ASNs in the new private ASN range 4200000000-4294967294 ([RFC6996
58 58
59 59
By default, Docker overlaps with the entire DN42 range and then some. (172.16.0.0/12 == 172.16.0.0 - 172.31.255.255)
60 60
61
-In order to prevent this, you need to supply a different subnet range to the Docker daemon. This can be done by creating or updating `/etc/docker/daemon.json` with something along the following (this will use 192.168.128.0/18 == 192.168.128.0 - 192.168.128.0 - 192.168.191.255)
61
+In order to prevent this, you need to supply a different subnet range to the Docker daemon. This can be done by creating or updating `/etc/docker/daemon.json` with something along the following (this will use 192.168.128.0/18 == 192.168.128.0 - 192.168.191.255)
62 62
```json
63 63
{
64 64
"default-address-pools" : [
howto/IPv6-Multicast.md
... ...
@@ -99,7 +99,7 @@ $ ip -6 route add ff7e:230:fdd5:69d5:c530::/96 dev eth0 table local
99 99
$ ping6 -t 16 ff7e:230:fdd5:69d5:c530::123
100 100
```
101 101
102
-The "-t 16", a hop-limit of 16, is important here as **by default all multicast traffic is usually send with a hop-limit of just 1**.
102
+The "-t 16", a hop-limit of 16, is important here as **by default all multicast traffic is usually sent with a hop-limit of just 1**.
103 103
104 104
---
105 105
howto/nixos.md
... ...
@@ -1,10 +1,10 @@
1 1
# NixOS
2 2
3
-NixOS is a declarative Linux distribution based on the Nix package Manager. In this post I'll explain how I setup dn42 in this environment. I currently only peer with wireguard and use bird2. NixOS uses configuration files to manage the system state and has a builtin container module.
3
+NixOS is a declarative Linux distribution based on the Nix package Manager. In this post I'll explain how I set up dn42 in this environment. I currently only peer with wireguard and use bird2. NixOS uses configuration files to manage the system state and has a builtin container module.
4 4
5 5
## container disclaimer
6 6
7
-I had a spare IPv4 Address so I decided to use a container without a NAT and keep my host "clean" from dn42 Wireguard Interfaces and IP routes. However it's pain full to debug since nixos-rebuild restarts the container on every minor change. So every time you change a firewall rule or debug a DNS setting nixos-rebuild restarts the container before the change takes effect and since BGP is BGP, it can be really frustrating.
7
+I had a spare IPv4 Address so I decided to use a container without a NAT and keep my host "clean" from dn42 Wireguard Interfaces and IP routes. However it's painful to debug since nixos-rebuild restarts the container on every minor change. So every time you change a firewall rule or debug a DNS setting nixos-rebuild restarts the container before the change takes effect and since BGP is BGP, it can be really frustrating.
8 8
9 9
You may also want to have a look at this [Issue](https://github.com/NixOS/nixpkgs/issues/43652) and [Pull Request](https://github.com/NixOS/nixpkgs/pull/80169)
10 10
... ...
@@ -26,7 +26,7 @@ containers.dn42 = {
26 26
config = { config, pkgs, ... }: {
27 27
imports = [
28 28
./peers # Folder with a config for every Peer
29
- ./dns.nix # Bind with the litschi.dn42 zone deligated
29
+ ./dns.nix # Bind with the litschi.dn42 zone delegated
30 30
./bird.nix # Bird config for BGP Routing
31 31
./networking.nix # Static Network configuration (with firewall)
32 32
./nginx.nix # nginx config for litschi.dn42
... ...
@@ -65,7 +65,7 @@ containers.dn42 = {
65 65
66 66
### Network Setup
67 67
68
-As mentioned above, I got a spare public IPv4 Address, but by adding it as ```localAddress```, the container Part is configured static enough. But to forward traffic between Intferfaces ```/proc/sys/net/``` should configured
68
+As mentioned above, I got a spare public IPv4 Address, but by adding it as ```localAddress```, the container Part is configured static enough. But to forward traffic between Interfaces the following ```/proc/sys/net/``` parameters should be configured:
69 69
70 70
```nix
71 71
boot.kernel.sysctl = {
... ...
@@ -73,7 +73,7 @@ boot.kernel.sysctl = {
73 73
"net.ipv6.conf.all.forwarding" = 1;
74 74
};
75 75
```
76
-This allows our firewall to configure forwarding between peers and other tunnels. What is allowed to be forwarded can be configured in the firewall. Ferm has only few NixOS Options, but is pretty basic. Its configured with the ```services.ferm.config``` options, that contains just a string. Within this string there's standard plain ferm config. Example config is attached below.
76
+This allows our firewall to configure forwarding between peers and other tunnels. What is allowed to be forwarded can be configured in the firewall. Ferm has only few NixOS Options, but is pretty basic. It's configured with the ```services.ferm.config``` option, that contains just a string. Within this string there's standard plain ferm config. Example config is attached below.
77 77
If the dn42 address is not bound at any other Interface, you need to add it to the lo Interface to use it as source IP when routing via peers with dedicated transfer net.
78 78
```nix
79 79
networking.interfaces.lo = {
... ...
@@ -126,8 +126,8 @@ services.ferm = {
126 126
interface intern-+ outerface dn42-+ ACCEPT;
127 127
# but dn42 -> intern only with execptions
128 128
interface dn42-+ outerface intern-+ {
129
- proto (ipv6-icmp icmp) ACCEPT; # Allow SSH Access from dn42 to devices behind intern-+ Interfaces
130
- proto tcp dport (ssh) ACCEPT;
129
+ proto (ipv6-icmp icmp) ACCEPT;
130
+ proto tcp dport (ssh) ACCEPT; # Allow SSH Access from dn42 to devices behind intern-+ Interfaces
131 131
mod state state (ESTABLISHED) ACCEPT;
132 132
}
133 133
}
... ...
@@ -138,7 +138,7 @@ services.ferm = {
138 138
139 139
### Peering with wireguard
140 140
141
-Explained above, every peer gets a dedicated wireguard Interface and so a dedicated file. In the container config folder theres a peer subfolder and within a folder for dn42- (extern) Peers and intern- configs e.g. my Home Router or mobile devices.
141
+As explained above, every peer gets a dedicated wireguard Interface and so a dedicated file. In the container config folder there's a peer subfolder and within a folder for dn42- (extern) Peers and intern- configs e.g. my Home Router or mobile devices.
142 142
143 143
A sample wireguard config may look like this:
144 144
```nix
... ...
@@ -215,7 +215,7 @@ in
215 215
216 216
### Bird Looking Glass
217 217
218
-There is now (thanks to [Tchekda](https://github.com/NixOS/nixpkgs/pull/153481)) a direct way to setup a looking glass for bird on Nixos. [Documentation](https://github.com/NixOS/nixpkgs/blob/3aab5ebd436023ca8343a84804d51cd227dd01dd/nixos/modules/services/networking/bird-lg.nix) and sample :
218
+There is now (thanks to [Tchekda](https://github.com/NixOS/nixpkgs/pull/153481)) a direct way to set up a looking glass for bird on Nixos. [Documentation](https://github.com/NixOS/nixpkgs/blob/3aab5ebd436023ca8343a84804d51cd227dd01dd/nixos/modules/services/networking/bird-lg.nix) and sample:
219 219
220 220
```nix
221 221
bird-lg = {
... ...
@@ -234,9 +234,8 @@ bird-lg = {
234 234
235 235
### Services
236 236
237
-I also run services like a nameserver for .litschi.dn42 zones and a nginx webserver within this container. Since Host path for ```/var/www/dn42``` and ```/var/dns/dn42``` are booth binded into the container, zone config and e.g. website and be edited directly from Host without need the rebuild the hole container.
237
+I also run services like a nameserver for .litschi.dn42 zones and a nginx webserver within this container. Since Host paths for ```/var/www/dn42``` and ```/var/dns/dn42``` are both bound into the container, zone config and e.g. website can be edited directly from Host without rebuilding the whole container.
238 238
239 239
### Sample configuration
240 240
241
-You can find a sample Wireguard + Bird configuration made by Tchekda ready for dn42 on [this](https://github.com/Tchekda/nixos-configuration/tree/master/llitt/dn42) repository
242
-
241
+You can find a sample Wireguard + Bird configuration made by Tchekda ready for dn42 in [this](https://github.com/Tchekda/nixos-configuration/tree/master/llitt/dn42) repository.
services/New-DNS.md
... ...
@@ -6,7 +6,7 @@ After frequent issues with the [Old Hierarchical DNS](/services/Old-Hierarchical
6 6
# End Users
7 7
It is **strongly recommended** to run your own resolver for security and privacy reasons. Setting it up and maintaining it should be easy, see [services/dns/Configuration](/services/dns/Configuration).
8 8
9
-If running your own resolver is not possible or undesirable, you can choose one or more instances from [dns/recursive-servers.dn42 in the registry](https://git.dn42.dev/dn42/registry/src/master/data/dns/recursive-servers.dn42). Please make sure you fully understand the consequences and fully trust these operators.
9
+If running your own resolver is not possible or desirable, you can choose one or more instances from [dns/recursive-servers.dn42 in the registry](https://git.dn42.dev/dn42/registry/src/master/data/dns/recursive-servers.dn42). Please make sure you fully understand the consequences and fully trust these operators.
10 10
11 11
You can also use the globally anycasted a.recursive-servers.dn42 but you won't have any control over which instance you get. This is a **very bad idea** from a security standpoint.
12 12