Home Explore Help
Register Sign In
FreifunkHochstift
/
gluon
6
0
Fork 0
Files Issues 0 Pull Requests 0
Tree: 146787fa5c
Branches Tags
gluon
/
docs
/
dev
/
wan.rst

wan.rst 2.6 KB
History Raw

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849 
  1. WAN support
    2. 

  2. ===========
    3. 

  3. 

  4. As the WAN port of a node will be connected to a user's private network, it
    5. 

  5. is essential that the node only uses the WAN when it is absolutely necessary.
    6. 

  6. There are two cases in which the WAN port is used:
    7. 

  7. 

  8. * Mesh VPN (package ``gluon-mesh-vpn-fastd``
    9. 

  9. * DNS to resolve the VPN servers' addresses (package ``gluon-wan-dnsmasq``)
    10. 

  10. 

  11. After the VPN connection has been established, the node should be able to reach
    12. 

  12. the mesh's DNS servers and use these for all other name resolution.
    13. 

  13. 

  14. 

  15. Routing tables
    16. 

  16. ~~~~~~~~~~~~~~
    17. 

  17. As a node may get IPv6 default routes both over the WAN and the mesh, Gluon
    18. 

  18. uses two routing tables for IPv6. As all normal traffic should go over the mesh,
    19. 

  19. the mesh routes are added to the default table (table 0). All routes on the WAN interface
    20. 

  20. are put into table 1 (see ``/lib/gluon/upgrade/110-network`` in ``gluon-core``).
    21. 

  21. 

  22. There is also an *ip -6 rule* which routes all IPv6 traffic with a packet mark with the
    23. 

  23. bit 1 set though table 1.
    24. 

  24. 

  25. 

  26. libpacketmark
    27. 

  27. ~~~~~~~~~~~~~
    28. 

  28. *libpacketmark* is a library which can be loaded with ``LD_PRELOAD`` and will set the packet mark of all
    29. 

  29. sockets created by a process in accordance with the ``LIBPACKETMARK_MARK`` environment variable. This allows setting
    30. 

  30. the packet mark for processes which don't support this themselves. The process must run as root (or at least
    31. 

  31. with ``CAP_NET_ADMIN``) for this to work.
    32. 

  32. 

  33. Unfortunately there's no nice way to set the packet mark via iptables for outgoing packets. The iptables will
    34. 

  34. run after the packet has been created, to even when the packet mark is changed and the packet is re-routed, the
    35. 

  35. source address won't be rewritten to the default source address of the newly chosen route. *libpacketmark* avoids
    36. 

  36. this issue as the packet mark will already be set when the packet is created.
    37. 

  37. 

  38. gluon-wan-dnsmasq
    39. 

  39. ~~~~~~~~~~~~~~~~~
    40. 

  40. To separate the DNS servers in the mesh from the ones on the WAN, the ``gluon-wan-dnsmasq`` package provides
    41. 

  41. a secondary DNS daemon which runs on ``127.0.0.1:54``. It will automatically use all DNS servers explicitly
    42. 

  42. configured in ``/etc/config/gluon-wan-dnsmasq`` or received via DNS/RA on the WAN port. It is important that
    43. 

  43. no DNS servers for the WAN interface are configured in ``/etc/config/network`` and that ``peerdns`` is set to 0
    44. 

  44. so the WAN DNS servers aren't leaked to the primary DNS daemon.
    45. 

  45. 

  46. *libpacketmark* is used to make the secondary DNS daemon send its requests over the WAN interface.
    47. 

  47. 

  48. The package ``gluon-mesh-vpn-fastd`` provides an iptables rule which will redirect all DNS requests from processes running
    49. 

  49. with the primary group ``gluon-mesh-vpn`` to ``127.0.0.1:54``, thus making fastd use the secondary DNS daemon.
    50.