Unterschiede

Hier werden die Unterschiede zwischen zwei Versionen angezeigt.

--- know-how:firewall [2022/02/21 13:06] – [Blocks - IPSET] cc
+++ know-how:firewall [2024/02/26 10:31] (aktuell) – cc
@@ Zeile 1: / Zeile 1: @@
+~~ODT~~
 FIXME
 ====== Features ======
@@ Zeile 1139: / Zeile 1140: @@
 exit 0
+</code>
+====== unbound ======
+  * Rekursiver DNS Resolver der DNSSEC validiert und auch dns over tls unterstützt
+===== internal dns zone =====
+  * zB: wenn intern ein AD Server benutzt wird für interne Domäne
+<code>
+server:
+..
+..
+    #2024-02-11 cc: if pannoniait.intern was used by a e.g. windows ad server
+    private-domain: pannoniait.intern
+    domain-insecure: pannoniait.intern
+..
+..
+#2024-02-11 cc: If pannoniait.intern was used e.g. by windows ad server
+forward-zone:
+   name: pannoniait.intern
+   forward-addr: IP_DNS_SERVER
+</code>
+===== dns over tls =====
+  * führt zu massiven DNS Performanceeinbruch FIXME performance + prefetch usw.
+<code>
+server:
+..
+..
+    #2024-02-11 cc: The debian place where the bundle can be found
+    tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
+..
+..
+forward-zone:
+    name: "."
+    forward-addr: 9.9.9.9@853#dns.quad9.net
+    forward-addr: 149.112.112.112@853#dns.quad9.net
+    forward-tls-upstream: yes
+..
+..
 </code>
@@ Zeile 1365: / Zeile 1408: @@
    976 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            -m geoip --source-country CN,RS  LOG flags 0 level 4
 </code>
+====== GeoIP - map-geoip.sh ======
+  * GeoIP Lookup aus vorhandenen Logfiles / kann auch gepiped werden um vorher relevante Auszüge rauszugreppen
+  * **map-geoip.sh**
+<code>
+#!/bin/bash
+# cmd: foo=$(mmdblookup -f /usr/local/share/ip-db/dbip-country-lite.mmdb  -i 192.168.0.1 country iso_code 2>/dev/null)
+# https://download.db-ip.com/free/dbip-country-lite-2022-03.mmdb.gz
+PATH_LOGS="/var/log/fw.log.1"
+PATH_GEODB="/usr/local/share/ip-db/dbip-country-lite.mmdb"
+function bailout
+{
+        echo -e "$1" >&2
+	echo -e "\nUsage: $0 [LOGFILE_FIREWALLS]"
+	exit 2
+}
+function lookup_geo
+{
+	mmdblookup -f $PATH_GEODB  -i $1 country iso_code 2>/dev/null | grep -o -P "\"[a-zA-Z]{2}\"" | tr -d "\""
+}
+function lookup_ip
+{
+    echo $1 | grep -o -P "$2(([0-9]{1,3}\.)){3}[0-9]{1,3}"
+}
+[[ -r $PATH_GEODB ]] || bailout "Cannot read geodb database: $PATH_GEODB"
+[[ -r "$1" ]] && PATH_LOGS="$1"
+[[ $1 == "-" ]] && PATH_LOGS="-"
+[[ -r $PATH_LOGS || $PATH_LOGS == "-"  ]] || bailout "Cannot read path logs: $PATH_LOGS"
+which mmdblookup >/dev/null || bailout "Cannot find mmdblookup please install\n"
+IFS=$'\n'
+while read foo ;
+do
+        LOG_SUFFIX=""
+	SRC_IP=""
+	DST_IP=""
+	SRC_IP=$(lookup_ip $foo "SRC=" |tr -d "SRC=")
+	DST_IP=$(lookup_ip $foo "DST=" | tr -d "DST=" )
+	#echo "SRC: $SRC_IP"
+	#echo "DST: $DST_IP"
+	if [ ${#SRC_IP} -gt 0 ] && [ ${#DST_IP} -gt 0 ]
+	then
+		SRC_GEO=$(lookup_geo $SRC_IP)
+		DST_GEO=$(lookup_geo $DST_IP)
+                [[ -z $SRC_GEO  ]] && SRC_GEO="00"
+		[[ -z $DST_GEO ]] && DST_GEO="00"
+		LOG_SUFFIX="SRC_GEO=$SRC_GEO DST_GEO=$DST_GEO"
+		echo "$foo$LOG_SUFFIX"
+	fi
+done < <(zcat -f $PATH_LOGS )
+</code>
 ====== WEB Module ======
+===== Blocks - Multi - IPSET =====
+  * In Kombination mit dnsmasq und seiner Funktionalität ipsets aktualisieren zu können
+  *  www-data muss dnsmasq neu starten können zB: visudo -> www-data  ALL=(ALL)NOPASSWD:/usr/sbin/service dnsmasq restart / und die entsprechenden Berechtigungen für das Set File besitzen unter /etc/dnsmasq.d/ipset-foo.conf
+  * **Achtung:** Wenn es eine Vielzahl an Sets gibt die mit dnsmasq befüllt werden sollen muss auf die dnsmasq Syntax geachtet werden **ipset=/hostname/set1/set2/set3** und nicht jeweils eine extra Datei für set1, set2, set3
+  * **merge-ipsets.sh**
+<code>
+#!/bin/bash
+function bailout
+{
+        echo -e "$1" >&2
+        exit 2
+}
+which dnsmasq >/dev/null || bailout "Cannot find dnsmasq binary"
+LOCATION_DNSMASQS="/etc/dnsmasq.conf /etc/dnsmasq.d/*"
+TMP_LOCATION=$(mktemp)
+FINAL_LOCATION="/etc/dnsmasq.d/ipset-master.conf"
+if [ ! -w $FINAL_LOCATION ]
+then
+	rm $TMP_LOCATION
+	bailout "FAIL: Final config file: $FINAL_LOCATION cannot be written to "
+fi
+grep -h  "^ipset=" $LOCATION_DNSMASQS  | cut -d"/" -f"2" | sort | uniq -c  | while read hosts ;
+do
+	nr_matches=$(echo $hosts | awk '{print $1}')
+	host_entry=$(echo $hosts | awk '{print $2}')
+        if (($nr_matches > 1 ))  &&  [ -n $host_entry ] ;
+	then
+                 build_entry="ipset=/$host_entry"
+		 while read found_sets
+		 do
+			 build_entry+="/$found_sets"
+		 done <<< $(grep -h "^ipset=/$host_entry/" $LOCATION_DNSMASQS | cut -d"/" -f 3- | tr "/" "\n" | sort | uniq )
+		echo $build_entry >> $TMP_LOCATION
+                echo $build_entry
+	fi
+done
+filesize_tmp=$(stat -c %s $TMP_LOCATION)
+if [ $filesize_tmp == "0" ]
+then
+rm $TMP_LOCATION
+echo "No double ipsets found in $LOCATION_DNSMASQS"
+exit 0
+fi
+cmp -s $TMP_LOCATION $FINAL_LOCATION
+compare_ret="$?"
+if [ $compare_ret == "0" ]
+then
+	rm $TMP_LOCATION
+        echo "Current ipsets have already been merged"
+	exit 0
+fi
+dnsmasq --test --conf-file=$TMP_LOCATION
+ipset_tests="$?"
+if [ $ipset_tests != "0" ]
+then
+	rm $TMP_LOCATION
+	bailout "FAIL: Malformed config file: $TMP_LOCATION"
+fi
+#2022-02-21 cc: Keep Ownership intact
+cat $TMP_LOCATION > $FINAL_LOCATION
+rm $TMP_LOCATION
+systemctl reload dnsmasq || bailout "FAIL: Cannot reload dnsmasq"
+exit 0
+</code>
+  * {{ :know-how:ipset-master.zip |}}
 ===== Blocks - IPSET =====
   * In Kombination mit dnsmasq und seiner Funktionalität ipsets aktualisieren zu können