blob: 11a7911ff17d16671b6221c14897ddd377dce8d3 (
plain) (
tree)
|
|
# ARFNET2 deployment
After the disastrous ISP [schism](http://arf20.com/explanation.txt)
## Masterplan
Stage 1: very safe
- Close all ports
- Nuke (or stop) all old VMs (exclude OPNSense)
- Make DMZ
- Make new basic VMs (cloning deb12 template)
- Open basic ports
Stage 2: new services
- IONOS VPS for mail
- Some new very safe services
- HE IPv6 tunnel
- Own authoritative nameservers for domain zone
Stage 3\*: finally
- Another VPS in unknown provider for
- Tor
- Reverse-proxying the media library
- PHP on main site with more web services from scratch, hopefully secure
- More new services
Stage 4\*: Site B (piso)
- Mikrotik and DELL switch
- Site to Site wireguard
- Establish telephony
## Domain
arf20.com
Registrar: namecheap
### Name sever glue records at registrar
| Nameserver | Name | IP |
|------------|------|----|
| NS1 | ns1.arf20.com | 2.59.235.35 <br> 2600:70ff:f039:4::13 |
| NS2 | ns2.arf20.com | 5.250.186.185 <br> 2001:ba0:210:d600::1 |
## Networking
### Hardware
```
WAP
|
+-----+ +--------------------------+ +----------------+
ISP ===| ONT |---| DELL switch |-----| TP-Link switch |
+-----+ +--------------------------+ +----------------+
| | | |
| | | |
+---------------+ Rest of devices Living room devices
| eno1 eno2 |
| server router |
+---------------+
- 1000BASE-T
= GPON fiber
```
12U rack
```
+--------------+--------+
| drawer | |
| drawer | PDU |
| patch panel | |
| switch | |
| | |
| | |
| R720 | |
| R720 | |
| | |
| | |
| | |
| | UPS |
+--------------+--------+
```
#### DELL PowerConnect 5424 switch
Port assignents
| port | endpoint | options |
|------|----------|---------|
| g2 | ONT | VLAN access 2 |
| g4 | server eno2 WAN | VLAN access 2 |
| g6 | test2 | VLAN access 2 |
| g3 | WAP | VLAN access 5 |
| g5 | PC | VLAN access 4 |
| g7 | Living R.| VLAN access 5 |
| g9 | server eno1 DMZ+LAN | VLAN trunk 4, 5 |
| g15 | test4 | VLAN access 4 |
| g17 | test1 | VLAN access 1 |
| g19 | test5 | VLAN access 5 |
| g21 | iDRAC | VLAN access 4 |
| g23 | printer | VLAN access 4 |
Management
- interface vlan 4: 192.168.4.2/24 gw 192.168.4.1
### Public IPs
- AVANZA_STATIC: 2.59.235.35
- AVANZA_CGNAT: dynamic
- HE prefixes
- 2001:470:1f21:125::/64
- 2600:70ff:f039::/48
- IONOS VPS: 5.250.186.185 2001:ba0:210:d600::1
### Gateways
- AVANZA
- WAN_STATIC: 2.59.235.1
- WAN_CGNAT: dynamic
- HE v6 tunnel
- server: 216.66.87.102, 2001:470:1f20:125::1/64
- client: 2.59.235.35, 2001:470:1f20:125::2
### Physical and Logical Networks
| name | VLAN | net | desc |
|------|------|-----|------|
| WAN | 2 | | |
| DMZ | 4 | 192.168.4.0/24 <br> 2600:70ff:f039:4::/64 | Services |
| LAN | 5 | 192.168.5.0/24 <br> 2600:70ff:f039:5::/64 | Clients |
| VPN | | 192.168.6.0/24 <br> 2600:70ff:f039:6::/64 | Wireguard clients |
| dark | | 192.168.7.0/24 <br> | dark IPsec remote subnet |
| B:PSN | un | 192.168.18.0/24 | Site-B:PisoNET |
| B:SBN | | 192.168.8.0/24 | Site-B:SiteBNET |
## Firewall
### Interface Rules
- WAN\_CGNAT in
- deny *
- WAN\_STATIC in
- allow v4 from * to {services} --> NAT rules
- DMZ in
- deny v4 to LAN net
- allow v4 to firewall
- allow v4 to * gw WAN\_STATIC
- allow v6 to * gw HE_TUNNELV6
- LAN in
- allow v4 ICMP to firewall
- allow v4 IP DNS to firewall
- allow v4 to DMZ net
- allow v4 to * gw WAN\_CGNAT
- allow v6 to * gw HE_TUNNELV6
- Wireguard in
- allow v4+6 to DMZ net
- allow v4 to * gw WAN\_CGNAT
- allow v6 to * gw HE_TUNNELV6
### IPv4 NAT Rules
| Service | Customer | IPProto | Ext Port | Host | Re Port |
|---------|----------|---------|----------|------|---------|
| WireGuard | | UDP | 51820 | router | |
| DNS NS1 | | TCP/UDP | 53 | misc | |
| iperf3 | | TCP | 5201 | misc | |
| NNTP | | TCP | 119 | misc | |
| Web | | TCP | 80,443 | web | |
| Git | | TCP | 9418 | web | |
| bittorrent | | TCP/UDP | 8999 | nas | |
| rsync | | TCP/UDP | 873 | nas | |
| IRC | | TCP | 6667 | comm | |
| IRCS | | TCP | 6697 | comm | |
| XMPP c2s| | TCP | 5222 | comm | |
| XMPP s2s| | TCP | 5269 | comm | |
| TURN STUN| | TCP/UDP | 3478 | comm | |
| TURN | | TCP/UDP | 5349 | comm | |
| TURN UDP relay| | TCP/UDP | 49152-50176 | comm | |
| mc waterfall proxy | | TCP | 25565 | game | 25567 | |
| mc bedrock geyser | | TCP | 19132 | game | 19132 | |
| css-ds | | TCP/UDP | 27015 | game | |
| | | | | | |
| exo ssh | exo | TCP | 4041 | exovps | 22 | |
| exo extra | exo | TCP | 4040 | exovps | 4040 | |
| yero ssh | yero | TCP | 1511 | yerovps | 22 | |
| yero mc | yero | TCP | 25569 | yerovps | 25565 | |
| yero panel | yero | TCP | 24444 | yerovps | 24444 | |
### IPv6 port rules
| Service | Customer | IPProto | Dest Host | Dest Port |
|---------|----------|---------|-----------|-----------|
| DNS NS1 | | TCP/UDP | misc | 53 |
| Web | | TCP | web | 80,443 |
| NNTP | | TCP | misc | 119 |
| iperf3 | | TCP | misc | 5201 |
| Git | | TCP | 9418 | web | |
| bittorrent | | TCP/UDP | 8999 | nas | |
| rsync | | TCP/UDP | 873 | nas | |
| IRC | | TCP | 6667 | comm | |
| IRCS | | TCP | 6697 | comm | |
| XMPP c2s| | TCP | 5222 | comm | |
| XMPP s2s| | TCP | 5269 | comm | |
| TURN STUN| | TCP/UDP | 3478 | comm | |
| TURN | | TCP/UDP | 5349 | comm | |
| TURN UDP relay| | TCP/UDP | 49152-50176 | comm | |
| mc-waterfall-proxy | | TCP | 25565 | game | 25567 |
|
| exo-ssh | exo | TCP | 4041 | exovps | 22 | |
| exo-extra | exo | TCP | 4040 | exovps | 4040 | |
| yero-ssh | yero | TCP | 1511 | yerovps | 22 | |
| yero-sql | yero | TCP | 1512 | yerovps | 3306 |
| FiveM SuperioresRP | yero | TCP/UDP | 30120,40120 | yerovps | |
## Hosts
- server - DELL PowerEdge R720 running Proxmox PVE - ...
- mail - IONOS VPS running Debian 12 - 5.250.186.185 2001:ba0:210:d600::1
## Management
- OPNSense router DMZ.1
- DELL switch DMZ.2
- TP-Link WAP LAN.2
- Proxmox hypervisor DMZ.4
- DELL server iDRAC DMZ.5
- HP printer DMZ.7
## server VMs and services
server runs Proxmox PVE.
All VMs are Debian 12 (templated) with wazuh agent
### proxmox DMZ.4 (hypervisor)
- SSH
- Proxmox management interface :8006
- smartmon + node exporter :9100
- sensor exporter*
- NUT - Network UPS TOols daemon (and proper UPS)*
### router DMZ.1
- (routing/firewalling)
- SSH
- DHCP
- unbound DNS
- OpenVPN
- WireGuard
- IPsec*
- ntopng :3000
- telegraf - note: editing config via webfig breaks (timeout and unbound config)
### nas DMZ.6
RAID attached here (with the grey stuff) (local only)
- SSH
- NFS
- Samba SMB*
- MiniDLNA*
- FTP
- qBittorrent-nox
- jellyfin
- nginx
- mpd :8000
| vhost | webroot/proxy | Comment |
|-------|---------------|---------|
| dark.arf20.com* | /d/FTPServer/ | Allow only VPS and private |
### web DMZ.9
- SSH
- cerbot
- nginx (status at :8080)
- fastcgi PHP
- mariadb SQL
- nginx-prometheus-exporter :9113
- prometheus :9090
- telegraf
- influxdb :8086
- grafana :3000
- Proxmox
- nginx
- iDRAC
- zabbix*
- netbox*
- fcgiwrap
- git-http-backend - git smart http server CGI
- gitd - git daemon
- cgit - web frontend for git
- phpBB - forum software
- Jekyll - blog static site generator thing
- opentracker? - bittorrent tracker*
- gophernicus - gopher server*
- photoprism - photo shit
- squid - http proxy server :3128
| vhost | webroot/proxy | Comment |
|-------|---------------|---------|
| default | \<return 418 im a teapot> | |
| default:8080 | \<return nstub_status> | |
| arf20.com | /var/www/arf20.com/html/ | |
| www.arf20.com | <301 redirect arf20.com> | |
| matrix.arf20.com | http://comm.lan:8008/\_matrix | |
| webmail.arf20.com | /var/www/webmail.arf20.com/html/ | SquirrelMail |
| nextcloud.arf20.com | /var/www/nextcloud.arf20.com/html/ | |
| grafana.arf20.com | http://localhost:3000 | |
| jellyfin.arf20.com | http://nas.lan:8096 | |
| git.arf20.com | /srv/git/ | |
| cgit.arf20.com | fastcgi:/usr/lib/cgit/cgit.cgi | |
| blog.arf20.com | /var/www/blog.arf20.com/\_site/ | |
| forum.arf20.com | /var/www/forum.arf20.com/html/ | |
| deb.arf20.com | /d/FTPServer/software/debian/ | |
| memes.arf20.com | /var/www/memes.arf20.com/, /d/FTPserver/{dcimg, dcmemes, explosionsandfire} |
| news.arf20.com | Web-News NNTP newsgroups frontend |
| dash.arf20.com | /var/www/dash.arf20.com/html/ | CSTIMS |
| ftp.arf20.com | /d/FTPServer/public/ | |
| photo.arf20.com | [::1]:2342 | photoprism |
| radio.arf20.com | / = /var/www/radio.arf20.com/html/; /stream = nas:8000 | |
| os.arf20.com | / = /d/FTPServer/OS/ | |
| | | |
| status.yero.dev | http://yerovps.lan:3001 | |
| panaland.arf20.com | /var/www/panaland.arf20.com/html/ | |
### wazuh DMZ.10 -> secure*
- SSH
- wazuh
- password manager server*
### game DMZ.11
- SSH
- waterfall (minecraft reverse proxy) :25565
- mclobby (auth)
- minepau*
- panaland mc modded :25566
- css dedicated server :27015
### comm DMZ.12
- SSH
- cerbot
- unrealircd - IRC
- synapse - matrix
- postgresql - DB for synapse
- pantalaimon - encrypt matterbridge traffic to matrix
- matterbridge - bridge channels with different protocols
- discord
- matrix
- irc
- xmpp
- prosody - XMPP
- coturn - TURN server for matrix and xmpp
- asterisk - VoIP SIP PBX*
### misc (Deb12 LXC) DMZ.13
- SSH
- iperf3
- bind9 - master authoritative nameserver for arf20.com zone NS1
- public recursive*
- OpenLDAP LDAP*
- INN2 - NNTP USENET server with SDF peering
- Discord servers
- gDebrid (gookie)
### t2 (T/2 SDE) DMZ.15
### pubnix (OpenBSD 7.5) DMZ.16
- SSH
### mail (ARFNET-IONOS VPS) 5.250.186.185 2001:ba0:210:d600::1
- SSH
- certbot
- postfix - MTA smtpd, submission, submissions
[config](https://github.com/ARF20NET/mail-conf)
- dovecot - imapd
- opendkim
- opendmarc
- bind9 - slave authoritative nameserver NS2
- mlmmj - mailing list manager
- installed to /usr/local/bin/mlmmj-webarchiver.sh and
/etc/mlmmj-webarchiver
- mlmmj-webarchiver - mailing list archiver
| vhost | webroot/proxy | Comment |
|-------|---------------|---------|
| default | \<return 418 im a teapot> | |
| lists.arf20.com | / = /var/www/lists.arf20.com/html/<br> /archive = /srv/www/htdocs/archive/ | Mailing lists |
### proxy (ARFNET-HOSTMENOW VPS) 92.60.77.4
- SSH
- IPsec tunnel
- nginx reverse proxy to nas
| vhost | webroot/proxy | Comment |
|-------|---------------|---------|
| default | \<return 418 im a teapot> | |
| jokesondmca.mooo.com | http://nas/ | Stuff |
---
### yero-debian VPS DMZ.192 (yero)
- SSH
- mariadb
- FiveM SuperioresRP
### exo-debian VPS DMZ.195 (exo)
- SSH
- netbox
### loofa-debian VPS DMZ.196 (loofa)
- SSH
- ?
\*TODO
## Internal Name and Number Assignation Table
DMZ IPv4s and IPv6 ends in the same way
| Addr | Name |
|------|------|
| DMZ.1 | router.lan |
| DMZ.2 | switch.lan |
| DMZ.3 | wap.lan |
| DMZ.4 | proxmox.lan |
| DMZ.5 | idrac.lan |
| DMZ.6 | nas.lan |
| DMZ.7 | printer.lan |
| DMZ.8 | desktop.lan |
| DMZ.9 | web.lan |
| DMZ.10 | wazuh.lan |
| DMZ.11 | game.lan |
| DMZ.12 | comm.lan |
| DMZ.13 | misc.lan |
| DMZ.15 | (t2) |
| DMZ.16 | pubnix |
| | | |
| DMZ.192 | yero-debian | yero.lan |
| DMZ.195 | exo-debian | exo.lan |
| DMZ.196 | loofa-debian | loofa.lan |
Site-B:PiSoNet
| Addr | Name |
|------|------|
| PSN.1 | Huawei CPE Combo Box |
| PSN.2 | DELL switch on untagged |
| PSN.3 | Mikrotik firewall downstream |
| PSN.8 | desktop (when applies) |
## DNS
### Domain zone
| Name | Type | Content | Comment |
|------|------|---------|---------|
| @ | NS | ns1.arf20.com | |
| @ | NS | ns2.arf20.com | |
|
| ns1 | A | 2.59.235.35 | |
| ns1 | AAAA | 2600:70ff:f039:4::13 | |
| ns2 | A | 5.250.186.185 | |
| ns2 | AAAA | 2001:ba0:210:d600::1 | |
|
| arf20.com | A | 2.59.235.35 | |
| arf20.com | AAAA | 2600:70ff:f039:4::9 | |
|
| mail.arf20.com | A | 5.250.186.185 | ARFNET-IONOS
| mail.arf20.com | AAAA | 2001:ba0:210:d600::1 | ARFNET-IONOS
| web.arf20.com | A | 2.59.235.35
| web.arf20.com | AAAA |
| game.arf20.com | A | 2.59.235.35
| game.arf20.com | AAAA | 2600:70ff:f039:4::11
| comm.arf20.com | A | 2.59.235.35
| comm.arf20.com | AAAA | 2600:70ff:f039:4::12
| misc.arf20.com | A | 2.59.235.35
| misc.arf20.com | AAAA | 2600:70ff:f039:4::13
| pubnix.arf20.com | A | 2.59.235.35
| pubnix.arf20.com | AAAA | 2600:70ff:f039:4::16
|
| irc.arf20.com | CNAME | comm.arf20.com |
| jellyfin.arf20.com | CNAME | web.arf20.com |
| matrix.arf20.com | CNAME | web.arf20.com |
| nextcloud.arf20.com | CNAME | web.arf20.com |
| turn.arf20.com | CNAME | comm.arf20.com |
| webmail.arf20.com | CNAME | web.arf20.com |
| www.arf20.com | CNAME | web.arf20.com |
| xmpp.arf20.com | CNAME | comm.arf20.com |
| xmppconf.arf20.com | CNAME | comm.arf20.com |
| grafana.arf20.com | CNAME | web.arf20.com |
| git.arf20.com | CNAME | web.arf20.com |
| cgit.arf20.com | CNAME | web.arf20.com |
| blog.arf20.com | CNAME | web.arf20.com |
| forum.arf20.com | CNAME | web.arf20.com |
| deb.arf20.com | CNAME | web.arf20.com |
| zabbix.arf20.com | CNAME | web.arf20.com |
| memes.arf20.com | CNAME | web.arf20.com |
| news.arf20.com | CNAME | misc.arf20.com |
| dash.arf20.com | CNAME | web.arf20.com |
| ftp.arf20.com | CNAME | web.arf20.com |
| photo.arf20.com | CNAME | web.arf20.com |
|
| lahomosexualidadde.arf20.com | CNAME | weonpollo.xyz |
| panaland.arf20.com | CNAME | web.arf20.com |
|
| _acme-challenge.jellyfin | CNAME | (challenge) | |
| _acme-challenge.irc | CNAME | (challenge) | |
| _acme-challenge.matrix | CNAME | (challenge) | |
| _acme-challenge.mail | CNAME | (challenge) | |
| _acme-challenge.xmpp | CNAME | (challenge) | |
|
| arf20.com | MX | mail.arf20.com | |
| selector._domainkey | TXT | (DKIM) | DKIM for selector 'selector' |
| _dmarc | TXT | (DMARC) | |
| arf20.com | TXT | (SPF) | |
### HE v6 rDNS zone
| Name | Type | Content | Comment |
|------|------|---------|---------|
| 2600:70ff:f039:4::13 | PTR | ns1.arf20.com | |
| 2600:70ff:f039:4::9 | PTR | arf20.com | |
|
| 2600:70ff:f039:4::195 | PTR | global.dns.navy | |
### IONOS rDNS zone
| Name | Type | Content | Comment |
|------|------|---------|---------|
| 5.250.186.185 | PTR | mail.arf20.com | |
## Custom ARFNET software
- [cstims](https://cgit.arf20.com/arfnet2-cstims): client, service, ticket and invoice management system
- [lists](https://cgit.arf20.com/arfnet2-lists): mailing list browser
|
