rohan-molloy

Using CloudNS to host LAN DNS

Table of contents

1. Intro
   • 1.1. What is CloudNS
   • 1.2. Pricing and Plans
2. Warning and caveats
3. Creating a zone
   • 3.1 Adding the records

rohan-molloy

#! /bin/bash

primary="badnets"
ipset create $primary hash:net &>/dev/null

if [[ -z "$sets" ]]; then
	sets=( firehol_level3 firehol_level2 firehol_level1 firehol_webclient );
fi

for s in "${sets[@]}"; do

rohan-molloy

Many-to-one Outbound Source NAT (IP Masquerade)

Allows a single globally routable address to be shared between multiple hosts on a network

This is one of the most frequently encountered type of NAT and is probably implemented on your home router.

When it sends out traffic, the router needs to change the source address from 192.168.1.x to whatever globally routable address is assigned on the "outside" interface. It needs to keep track of these egress translations so that it can direct the replies to the appropriate inside address.

1. Configure LAN interface

rohan-molloy

#! /bin/bash

ipset create badnets hash:net &>/dev/null

[[ -z "$sets" ]] && \
sets=( firehol_level3 firehol_level2 firehol_level1 firehol_webclient );

for s in "${sets[@]}"; do
	wget -qO- "https://iplists.firehol.org/files/"$s".netset" | grep -v "^#" |\
	while read entry; do 

rohan-molloy

Generating a Self Signed Ceritifcate, key, and certificate signining requests all in one cmd

openssl req -new \
-sha256 -nodes \
-newkey rsa:4096 \
-keyout server.key \
-subj /CN=$(hostname)/ \

-x509 -days 365 \

rohan-molloy

#
# Protocol options
#
Protocol 2
Port 22
AddressFamily inet
ListenAddress 0.0.0.0
#
# Host Keys
#

rohan-molloy

(for ip in $(grep -E 'sshd.*Invalid' /var/log/auth.log |awk '{print $NF}');do 
  dig $(tac -s.<<<"$ip.")origin.asn.cymru.com +noedns +short txt|tr -d \";done)|sort -s -n -k 1,1

rohan-molloy

### Remove the last nchars from each line
truncateLines(){
	d=`for ((i=1; i<=$nchars; i++)); do echo -n .; done`
	sed 's/'$d'$//'
}

rohan-molloy

• General settings
  • Include another configuration file
  • Include a directory of configuration files
  • Include a directory of configuration files excluding *.bak
  • Do not read /etc/hosts
  • Read an alternative host file
  • Set the resolve file
  • Disable the resolv file

rohan-molloy

Basic

    Port 22
    AddressFamily inet

Host keys

    HostKey /etc/ssh/ssh_host_rsa_key
    HostKey /etc/ssh/ssh_host_ecdsa_key
    HostKey /etc/ssh/ssh_host_ed25519_key

Crypto

    Ciphers aes128-ctr,aes192-ctr,aes256-ctr

KexAlgorithms [email protected],diffie-hellman-group-exchange-sha256