Outgoing IP

infra/ansible/roles/dns-frr/tasks/main.yaml

@@ -20,6 +20,13 @@
     mode: "640"
   when: EXTERNAL_LISTEN_IP != ""
 
+- name: dummy2 interface
+  ansible.builtin.template:
+    src: ../templates/netplan_dummy2.yaml.j2
+    dest: /etc/netplan/dummy1.yaml
+    mode: "640"
+  when: EXTERNAL_OUTGOING_IP != ""
+
 - name: eth0 interface
   ansible.builtin.template:
     src: ../templates/netplan_50_cloud_init.yaml.j2

infra/ansible/roles/dns-frr/templates/frr.conf.j2

@@ -14,6 +14,7 @@ router ospf
  network {{ INTERNAL_NETWORK_RANGE }} area 0
  network {{ INTERNAL_LISTEN_IP }}/32 area 0
 {% if EXTERNAL_LISTEN_IP != "" %} network {{ EXTERNAL_LISTEN_IP }}/32 area 0
+{% if EXTERNAL_OUTGOING_IP != "" %} network {{ EXTERNAL_OUTGOING_IP }}/32 area 0
 {% endif %}
 exit
 !

infra/ansible/roles/dns-frr/templates/iptables.j2

@@ -25,6 +25,14 @@
 -A INPUT -d {{ EXTERNAL_LISTEN_IP }}/32 -j DROP
 {% endif %}
 
+{% if EXTERNAL_OUTGOING_IP != "" %}
+-A INPUT -d {{ EXTERNAL_OUTGOING_IP }}/32 -p tcp -m tcp --dport 53 -j DROP
+-A INPUT -d {{ EXTERNAL_OUTGOING_IP }}/32 -p udp -m udp --dport 53 -j DROP
+-A INPUT -d {{ EXTERNAL_OUTGOING_IP }}/32 -p tcp -m udp --dport 443 -j DROP
+-A INPUT -d {{ EXTERNAL_OUTGOING_IP }}/32 -p tcp -m udp --dport 22 -j DROP
+#-A INPUT -d {{ EXTERNAL_LISTEN_IP }}/32 -j DROP
+{% endif %}
+
 -A FORWARD -s 10.70.90.53/32 -d {{ INTERNAL_MGT_IP }}/32 -j ACCEPT
 
 {% if INTERNAL_LISTEN_IP != "" %}

infra/ansible/roles/dns-frr/templates/netplan_dummy2.yaml.j2

@@ -0,0 +1,9 @@
+network:
+  version: 2
+  renderer: networkd
+  ethernets:
+    lo:
+      dhcp4: no
+      dhcp6: no
+      addresses:
+        - {{ EXTERNAL_OUTGOING_IP }}/32

infra/ansible/roles/knot-recursive/templates/kresd.conf.j2

@@ -14,6 +14,11 @@ net.listen('{{ EXTERNAL_LISTEN_IP }}', 53, { kind = 'dns' })
 net.listen('{{ EXTERNAL_LISTEN_IP }}', 443, { kind = 'doh2' })
 {% endif %}
 
+{% if EXTERNAL_OUTGOING_IP != "" %}
+-- EXTERNAL_OUTGOING_IP
+net.outgoing_v4({ '{{ EXTERNAL_OUTGOING_IP }}' })
+{% endif %}
+
 -- Load useful modules
 modules = {
         'hints > iterate',  -- Allow loading /etc/hosts or custom root hints

infra/terraform/dev_jon.tfvars

@@ -18,6 +18,9 @@ dns_auth_external_ip = [
 dns_rec_external_ip = [
   "", # Blank so it is not created
 ]
+dns_rec_outgoing_ip = [
+  "", # Blank so it is not created
+]
 dns_mgt_network_prefix          = "10.70.90.0"
 dns_mgt_network_host_identifier = "24"
 dns_mgt_gateway                 = "10.70.90.1"

infra/terraform/dns.tf

@@ -13,6 +13,7 @@ module "some_mesh_dns_servers" {
   dns_rec_internal_ip             = var.dns_rec_internal_ip
   dns_auth_external_ip            = var.dns_auth_external_ip
   dns_rec_external_ip             = var.dns_rec_external_ip
+  dns_rec_outgoing_ip             = var.dns_rec_outgoing_ip
   dns_mgt_network_prefix          = var.dns_mgt_network_prefix
   dns_mgt_network_host_identifier = var.dns_mgt_network_host_identifier
   dns_mgt_gateway                 = var.dns_mgt_gateway

infra/terraform/mesh_dns_servers/ansible.tf

@@ -33,6 +33,7 @@ resource "ansible_host" "rec-dns-mgt" {
   variables = {
     SERVER_HOSTNAME                  = "${var.hostname_prefix}-dns-rec-${sum([1, count.index, var.hostname_count_offset])}"
     EXTERNAL_LISTEN_IP               = var.dns_rec_external_ip[count.index]
+    EXTERNAL_OUTGOING_IP             = var.dns_rec_outgoing_ip[count.index]
     INTERNAL_NETWORK_RANGE           = format("%s/%s", var.dns_mgt_network_prefix, var.dns_mgt_network_host_identifier)
     INTERNAL_NETWORK_HOST_IDENTIFIER = var.dns_mgt_network_host_identifier
     INTERNAL_LISTEN_IP               = var.dns_rec_internal_ip[count.index]
@@ -53,6 +54,7 @@ resource "ansible_host" "auth-dns-mgt" {
   variables = {
     SERVER_HOSTNAME                  = "${var.hostname_prefix}-dns-auth-${sum([1, count.index, var.hostname_count_offset])}"
     EXTERNAL_LISTEN_IP               = var.dns_auth_external_ip[count.index]
+    EXTERNAL_OUTGOING_IP             = ""
     INTERNAL_NETWORK_RANGE           = format("%s/%s", var.dns_mgt_network_prefix, var.dns_mgt_network_host_identifier)
     INTERNAL_NETWORK_HOST_IDENTIFIER = var.dns_mgt_network_host_identifier
     INTERNAL_LISTEN_IP               = var.dns_auth_internal_ip[count.index]

infra/terraform/mesh_dns_servers/vars.tf

@@ -58,6 +58,11 @@ variable "dns_rec_external_ip" {
   description = "external listen IPs for the recursive dns vm(s), empty string for none"
 }
 
+variable "dns_rec_outgoing_ip" {
+  type        = list(any)
+  description = "external IPs used to resolve recursive dns queries, empty string for none"
+}
+
 variable "dns_mgt_network_prefix" {
   type        = string
   description = "network range to use for intneral networking"

infra/terraform/prod_sn3.tfvars

@@ -19,6 +19,9 @@ dns_auth_external_ip = [
 dns_rec_external_ip = [
   "", # Blank so it is not created
 ]
+dns_rec_outgoing_ip = [
+  "", # Blank so it is not created
+]
 dns_mgt_network_prefix          = "10.70.90.0"
 dns_mgt_network_host_identifier = "24"
 dns_mgt_gateway                 = "10.70.90.1"

infra/terraform/vars.tf

@@ -85,6 +85,11 @@ variable "dns_rec_external_ip" {
   description = "external listen IPs for the recursive dns vm(s), empty string for none"
 }
 
+variable "dns_rec_outgoing_ip" {
+  type        = list(any)
+  description = "external IPs used to resolve recursive dns queries, empty string for none"
+}
+
 variable "dns_mgt_network_prefix" {
   type        = string
   description = "network range to use for intneral networking"