ARFNET2 deployment

After the disastrous ISP schism

Masterplan

Stage 1: very safe - Close all ports - Nuke (or stop) all old VMs (exclude OPNSense) - Make DMZ - Make new basic VMs (cloning deb12 template) - Open basic ports

Stage 2: new services - IONOS VPS for mail - Some new very safe services - HE IPv6 tunnel - Own authoritative nameservers for domain zone

Stage 3*: finally - Another VPS in unknown provider for - Tor - Reverse-proxying the media library - PHP on main site with more web services from scratch, hopefully secure - More new services

Domain

arf20.com

Registrar: namecheap

Name sever glue records at registrar

Networking

Hardware

                   WAP
                    |
       +-----+   +--------------------------+     +----------------+
ISP ===| ONT |---| DELL switch              |-----| TP-Link switch |
       +-----+   +--------------------------+     +----------------+
                    |        |          |                |
                    |        |          |                |
                 +---------------+  Rest of devices   Living room devices
                 | eno1     eno2 |
                 | server router |
                 +---------------+
                   
- 1000BASE-T
= GPON fiber

DELL PowerConnect 5424 switch

Port assignents

Management

• interface vlan 4: 192.168.4.2/24 gw 192.168.4.1

Public IPs

• AVANZA_STATIC: 2.59.235.35
• AVANZA_CGNAT: dynamic
• HE prefixes
  • 2001:470:1f21:125::/64
  • 2600:70ff:f039::/48
• IONOS VPS: 5.250.186.185 2001:ba0:210:d600::1

Gateways

• AVANZA
  • WAN_STATIC: 2.59.235.1
  • WAN_CGNAT: dynamic
• HE v6 tunnel
  • server: 216.66.87.102, 2001:470:1f20:125::1/64
  • client: 2.59.235.35, 2001:470:1f20:125::2

Physical and Logical Networks

Firewall

Interface Rules

• WAN_CGNAT in
  • deny *
• WAN_STATIC in
  • allow v4 from * to {services} –> NAT rules
• DMZ in
  • deny v4 to LAN net
  • allow v4 to firewall
  • allow v4 to * gw WAN_STATIC
  • allow v6 to * gw HE_TUNNELV6
• LAN in
  • allow v4 ICMP to firewall
  • allow v4 IP DNS to firewall
  • allow v4 to DMZ net
  • allow v4 to * gw WAN_CGNAT
  • allow v6 to * gw HE_TUNNELV6
• Wireguard in
  • allow v4+6 to DMZ net
  • allow v4 to * gw WAN_CGNAT
  • allow v6 to * gw HE_TUNNELV6

IPv4 NAT Rules

IPv6 port rules

Hosts

• server - DELL PowerEdge R720 running Proxmox PVE - …
• mail - IONOS VPS running Debian 12 - 5.250.186.185 2001:ba0:210:d600::1

Management

• OPNSense router DMZ.1
• DELL switch DMZ.2
• TP-Link WAP LAN.2
• Proxmox hypervisor DMZ.4
• DELL server iDRAC DMZ.5
• HP printer DMZ.7

server VMs and services

server runs Proxmox PVE.

All VMs are Debian 12 (templated) with wazuh agent

proxmox DMZ.4 (hypervisor)

• SSH
• Proxmox management interface :8006
• smartmon + node exporter :9100
• sensor exporter*
• NUT - Network UPS TOols daemon (and proper UPS)*

router DMZ.1

• (routing/firewalling)
• SSH
• DHCP
• unbound DNS
• OpenVPN
• WireGuard
• IPsec*
• ntopng :3000
• telegraf - note: editing config via webfig breaks (timeout and unbound config)

nas DMZ.6

RAID attached here (with the grey stuff) (local only)

• SSH
• NFS
• Samba SMB*
• MiniDLNA*
• FTP
• qBittorrent-nox
• jellyfin
• nginx

web DMZ.9

• SSH
• cerbot
• nginx (status at :8080)
• fastcgi PHP
• mariadb SQL
• nginx-prometheus-exporter :9113
• prometheus :9090
• telegraf
• influxdb :8086
• grafana :3000
  • Proxmox
  • nginx
  • iDRAC
• zabbix*
• netbox*
• fcgiwrap
• git-http-backend - git smart http server CGI
• gitd - git daemon
• cgit - web frontend for git
• phpBB - forum software
• Jekyll - blog static site generator thing
• opentracker? - bittorrent tracker*
• gophernicus - gopher server*

wazuh DMZ.10 -> secure*

• SSH
• wazuh
• password manager server*

game DMZ.11

• SSH
• waterfall (minecraft reverse proxy) :25565
  • mclobby (auth)
  • mcrubenmc
  • mcgrupo4*
  • minepau*
• css dedicated server :27015

comm DMZ.12

• SSH
• cerbot
• unrealircd - IRC
• synapse - matrix
• postgresql - DB for synapse
• pantalaimon - encrypt matterbridge traffic to matrix
• matterbridge - bridge channels with different protocols
  • discord
  • matrix
  • irc
  • xmpp
• prosody - XMPP
• coturn - TURN server for matrix and xmpp
• asterisk - VoIP SIP PBX*

misc (Deb12 LXC) DMZ.13

• SSH
• iperf3
• bind9 - master authoritative nameserver for arf20.com zone NS1
  • public recursive*
• OpenLDAP LDAP*
• INN2 - NNTP USENET server with SDF peering
• Discord servers
  • gDebrid (gookie)

pubnix?*

mail (ARFNET-IONOS VPS) 5.250.186.185 2001:ba0:210:d600::1

• SSH
• certbot
• postfix - MTA smtpd, submission, submissions config
• dovecot - imapd
• opendkim
• majordomo? - mailing list manager*
• bind9 - slave authoritative nameserver NS2

proxy (ARFNET-HOSTMENOW VPS) *

• SSH*
• IPsec tunnel*
• IP forward to nas*

yerovps DMZ.192 (yero)

• SSH
• mariadb
• FiveM SuperioresRP

exovps DMZ.195 (exo)

• SSH
• netbox

*TODO

Internal Name and Number Assignation Table

DMZ IPv4s and IPv6 ends in the same way

DNS

Domain zone

HE v6 rDNS zone

IONOS rDNS zone

Software dev ideas (all PHP likely)

• client, service, ticket and invoice management system (WIP)
• mailing list manager
• status page