cwinfo/yggdrasil-network.github.io
5
0
Fork 0
mirror of https://github.com/cwinfo/yggdrasil-network.github.io.git synced 2025-02-28 17:31:34 +00:00
Code Releases Activity

Update platform-edgerouter.md

Browse Source
This commit is contained in:
Neil Alexander 2018-05-09 23:25:41 +01:00 committed by GitHub
parent 8be8263a06
commit 397333b3c0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
platform-edgerouter.md
View File

@ -82,7 +82,7 @@ If you have multiple IPv6 subnets, then they can be configured individually by s
IPv6 masquerade is not supported on VyOS 1.1.x due to missing support in the kernel. IPv6 masquerade is not supported on VyOS 1.1.x due to missing support in the kernel.
### Crash Detection ## Crash Detection
To make sure that the process is restarted if it crashes, schedule the `vyatta-check-yggdrasil` script to run at a regular interval: To make sure that the process is restarted if it crashes, schedule the `vyatta-check-yggdrasil` script to run at a regular interval:
``` ```
@ -91,3 +91,34 @@ set system task-scheduler task check-yggdrasil executable path /opt/vyatta/sbin/
set system task-scheduler task check-yggdrasil interval 1m set system task-scheduler task check-yggdrasil interval 1m
commit commit
``` ```
## Default Firewall Config
Use this as an example firewall configuration, which will allow outgoing connections but prevent unexpected incoming ones, with the exception of ICMPv6 which will be allowed:
```
set firewall ipv6-name YGG_IN default-action drop
set firewall ipv6-name YGG_LOCAL default-action drop
set firewall ipv6-name YGG_IN rule 10 action accept
set firewall ipv6-name YGG_IN rule 10 state established enable
set firewall ipv6-name YGG_IN rule 10 state related enable
set firewall ipv6-name YGG_IN rule 20 action drop
set firewall ipv6-name YGG_IN rule 20 state invalid enable
set firewall ipv6-name YGG_IN rule 30 action accept
set firewall ipv6-name YGG_IN rule 30 protocol icmpv6
set firewall ipv6-name YGG_LOCAL rule 10 action accept
set firewall ipv6-name YGG_LOCAL rule 10 state established enable
set firewall ipv6-name YGG_LOCAL rule 10 state related enable
set firewall ipv6-name YGG_LOCAL rule 20 action drop
set firewall ipv6-name YGG_LOCAL rule 20 state invalid enable
set firewall ipv6-name YGG_LOCAL rule 30 action accept
set firewall ipv6-name YGG_LOCAL rule 30 protocol icmpv6
set interfaces yggdrasil tun0 firewall in ipv6-name YGG_IN
set interfaces yggdrasil tun0 firewall local ipv6-name YGG_LOCAL
```