diff --git a/bird/bird.conf b/bird/bird.conf index 3fde0c5..d28d6d2 100644 --- a/bird/bird.conf +++ b/bird/bird.conf @@ -7,15 +7,39 @@ protocol device { scan time 10; }; -protocol kernel { +protocol kernel kernel_main4 { scan time 20; ipv4 { import none; export filter { - if unet_is_valid_network_v4() then { - krt_prefsrc = UNET_V4_kernel; - accept; - } + if bgp_large_community ~ [(UNET_ASN, 10,4)] then accept; + reject; + }; + }; +}; + +protocol kernel kernel_t102v4 { + scan time 20; + kernel table 102; + ipv4 { + table t102v4; + import none; + export filter { + if bgp_large_community ~ [(UNET_ASN, 10,10204)] then accept; + reject; + }; + }; +}; + + +protocol kernel kernel_t102v6 { + scan time 20; + kernel table 102; + ipv6 { + table t102v6; + import none; + export filter { + if bgp_large_community ~ [(UNET_ASN, 10,10206)] then accept; reject; }; }; diff --git a/bird/function/tables.conf b/bird/function/tables.conf index ce9c19d..7eaf822 100644 --- a/bird/function/tables.conf +++ b/bird/function/tables.conf @@ -1,3 +1,5 @@ +ipv4 table t102v4; +ipv6 table t102v6; ipv4 table inet4; ipv6 table inet6; ipv4 table dn42v4; diff --git a/bird/net/dn42.conf b/bird/net/dn42.conf index c610644..1d247b3 100644 --- a/bird/net/dn42.conf +++ b/bird/net/dn42.conf @@ -1,33 +1,29 @@ -protocol kernel kernel_dn42v4_105 { - scan time 20; - kernel table 105; - ipv4 { - table dn42v4; - import none; - export filter { - if bgp_large_community ~ [(DN42_ASN, 3,*)] then reject; - if is_dn42_prefix() then { - krt_prefsrc = DN42_V4_kernel; - accept; - } - reject; - }; +protocol pipe dn42v4_sync { + table dn42v4; + peer table t102v4; + export filter { + if bgp_large_community ~ [(DN42_ASN, 3,*)] then reject; + if !is_dn42_prefix() then reject; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10204)); + krt_prefsrc = DN42_V4_kernel; + accept; }; -}; + import none; +} -protocol kernel kernel_dn42v6_105 { - scan time 20; - kernel table 105; - ipv6 { - table dn42v6; - import none; - export filter { - if bgp_large_community ~ [(DN42_ASN, 3,*)] then reject; - if is_dn42_prefix() then { - krt_prefsrc = DN42_V6_kernel; - accept; - } - reject; - }; +protocol pipe dn42v6_sync { + table dn42v6; + peer table t102v6; + export filter { + if bgp_large_community ~ [(DN42_ASN, 3,*)] then reject; + if !is_dn42_prefix() then reject; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10206)); + krt_prefsrc = DN42_V6_kernel; + accept; }; -}; \ No newline at end of file + import none; +} \ No newline at end of file diff --git a/bird/net/inet.conf b/bird/net/inet.conf index 20af223..7305f74 100644 --- a/bird/net/inet.conf +++ b/bird/net/inet.conf @@ -1,34 +1,29 @@ -protocol kernel kernel_inet4_102 { - scan time 20; - kernel table 102; - ipv4 { - table inet4; - import none; - export filter { - if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject; - if !is_bogon_prefix() then { - krt_prefsrc = LOCAL_V4_kernel; - accept; - } - reject; - }; +protocol pipe inet4_sync { + table inet4; + peer table t102v4; + export filter { + if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject; + if is_bogon_prefix() then reject; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10204)); + krt_prefsrc = LOCAL_V4_kernel; + accept; }; -}; + import none; +} - -protocol kernel kernel_inet6_102 { - scan time 20; - kernel table 102; - ipv6 { - table inet6; - import none; - export filter { - if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject; - if !is_bogon_prefix() then { - krt_prefsrc = LOCAL_V6_kernel; - accept; - } - reject; - }; +protocol pipe inet6_sync { + table inet6; + peer table t102v6; + export filter { + if bgp_large_community ~ [(LOCAL_ASN, 3,*)] then reject; + if is_bogon_prefix() then reject; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10206)); + krt_prefsrc = LOCAL_V6_kernel; + accept; }; -}; \ No newline at end of file + import none; +} \ No newline at end of file diff --git a/bird/net/unet.conf b/bird/net/unet.conf index 421eeaa..1980d7b 100644 --- a/bird/net/unet.conf +++ b/bird/net/unet.conf @@ -1,10 +1,15 @@ # 公网处理 => inet4/6 protocol pipe unet4_inet4_sync { table unet4; - peer table inet4; + peer table t102v4; export filter { if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject; if is_bogon_prefix() then reject; + bgp_path.empty; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10204)); + krt_prefsrc = LOCAL_V4_kernel; accept; }; import none; @@ -12,10 +17,15 @@ protocol pipe unet4_inet4_sync { protocol pipe unet6_inet6_sync { table unet6; - peer table inet6; + peer table t102v6; export filter { if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject; if is_bogon_prefix() then reject; + bgp_path.empty; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10206)); + krt_prefsrc = LOCAL_V6_kernel; accept; }; import none; @@ -25,10 +35,15 @@ protocol pipe unet6_inet6_sync { # DN42处理 => dn42v4/6 protocol pipe unet4_dn42v4_sync { table unet4; - peer table dn42v4; + peer table t102v4; export filter { if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject; if !is_dn42_prefix() then reject; + bgp_path.empty; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10204)); + krt_prefsrc = DN42_V4_kernel; accept; }; import none; @@ -36,10 +51,15 @@ protocol pipe unet4_dn42v4_sync { protocol pipe unet6_dn42v6_sync { table unet6; - peer table dn42v6; + peer table t102v6; export filter { if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject; if !is_dn42_prefix() then reject; + bgp_path.empty; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10206)); + krt_prefsrc = DN42_V6_kernel; accept; }; import none; @@ -53,6 +73,24 @@ protocol pipe unet4_sync { export filter { if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject; if !unet_is_valid_network_v4() then reject; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,4)); + krt_prefsrc = UNET_V4_kernel; + accept; + }; + import none; +} + +protocol pipe unet4_syncto_inet4 { + table unet4; + peer table t102v4; + export filter { + if bgp_large_community ~ [(UNET_ASN, 3,*)] then reject; + bgp_community.empty; + bgp_large_community.empty; + bgp_large_community.add((UNET_ASN,10,10204)); + krt_prefsrc = UNET_V4_kernel; accept; }; import none; diff --git a/ip-policy-rules b/ip-policy-rules index 1389cfc..039f18c 100644 --- a/ip-policy-rules +++ b/ip-policy-rules @@ -36,11 +36,11 @@ add_rules() { current_prio=$((current_prio + 2)) done - ip rule add from ${LAN_SUBNET_V4} to ${LAN_SUBNET_V4} lookup 105 priority ${current_prio} 2>/dev/null + ip rule add from ${LAN_SUBNET_V4} to ${LAN_SUBNET_V4} lookup 102 priority ${current_prio} 2>/dev/null current_prio=$((current_prio + 10)) ip -6 rule add from ${TUNNEL_SUBNET_V6} to ${TUNNEL_SUBNET_V6} lookup 102 priority ${BASE_PRIORITY} 2>/dev/null - ip -6 rule add from ${LAN_SUBNET_V6_FD} to ${LAN_SUBNET_V6_FD} lookup 105 priority $((BASE_PRIORITY + 10)) 2>/dev/null + ip -6 rule add from ${LAN_SUBNET_V6_FD} to ${LAN_SUBNET_V6_FD} lookup 102 priority $((BASE_PRIORITY + 10)) 2>/dev/null } del_rules() { @@ -51,11 +51,11 @@ del_rules() { current_prio=$((current_prio + 2)) done - ip rule del from ${LAN_SUBNET_V4} to ${LAN_SUBNET_V4} lookup 105 priority ${current_prio} 2>/dev/null + ip rule del from ${LAN_SUBNET_V4} to ${LAN_SUBNET_V4} lookup 102 priority ${current_prio} 2>/dev/null current_prio=$((current_prio + 10)) ip -6 rule del from ${TUNNEL_SUBNET_V6} to ${TUNNEL_SUBNET_V6} lookup 102 priority ${BASE_PRIORITY} 2>/dev/null - ip -6 rule del from ${LAN_SUBNET_V6_FD} to ${LAN_SUBNET_V6_FD} lookup 105 priority $((BASE_PRIORITY + 10)) 2>/dev/null + ip -6 rule del from ${LAN_SUBNET_V6_FD} to ${LAN_SUBNET_V6_FD} lookup 102 priority $((BASE_PRIORITY + 10)) 2>/dev/null } start() { diff --git a/update.sh b/update.sh index e4a3f1b..6914808 100644 --- a/update.sh +++ b/update.sh @@ -12,7 +12,11 @@ mv ./bird_config/bird/net/dn42.conf /etc/bird/net/dn42.conf rm /etc/bird/net/inet.conf mv ./bird_config/bird/net/inet.conf /etc/bird/net/inet.conf -mv ./bird_config/bird/conf/static.conf /etc/bird/conf/static.conf.disable +rm /etc/bird/net/unet.conf +mv ./bird_config/bird/net/unet.conf /etc/bird/net/unet.conf + +rm /etc/bird/function/tables.conf +mv ./bird_config/bird/function/tables.conf /etc/bird/function/tables.conf birdc c cd