summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--arfnet2.md137
1 files changed, 85 insertions, 52 deletions
diff --git a/arfnet2.md b/arfnet2.md
index c7cbd79..8771efb 100644
--- a/arfnet2.md
+++ b/arfnet2.md
@@ -33,23 +33,6 @@ Registrar: namecheap
| NS2 | ns2.arf20.com | 5.250.186.185 <br> 2001:ba0:210:d600::1 |
## Networking
-### Public IPs
- - AVANZA: 2.59.235.35
- - HE v6 tunnel: 2001:470:1f20:125::2
- - IONOS VPS: 5.250.186.185 2001:ba0:210:d600::1
-
-### Gateways
- - AVANZA: 2.59.235.1
- - HE v6: 2001:470:1f20:125::1 via 216.66.87.102
-
-### Networks
-| name | VLAN | net | desc |
-|------|------|-----|------|
-| WAN | 2 | | |
-| DMZ | 4 | 192.168.4.0/24 <br> 2001:470:1f21:125::/64 | Services |
-| LAN | 5 | 192.168.5.0/24 | Clients |
-| VPN | | 10.5.0.0/24 | Wireguard clients |
-
### Hardware
```
WAP
@@ -88,6 +71,74 @@ Port assignents
Management
- interface vlan 4: 192.168.4.2/24 gw 192.168.4.1*
+### Public IPs
+ - AVANZA: 2.59.235.35
+ - HE v6 tunnel: 2001:470:1f20:125::2
+ - IONOS VPS: 5.250.186.185 2001:ba0:210:d600::1
+
+### Gateways
+ - AVANZA
+ - WAN_STATIC: 2.59.235.1
+ - WAN_CGNAT: dynamic
+ - HE v6: 2001:470:1f20:125::1 via 216.66.87.102
+
+### Physical and Logical Networks
+| name | VLAN | net | desc |
+|------|------|-----|------|
+| WAN | 2 | | |
+| DMZ | 4 | 192.168.4.0/24 <br> 2001:470:1f21:125::/64 | Services |
+| LAN | 5 | 192.168.5.0/24 | Clients |
+| VPN | | 10.5.0.0/24 | Wireguard clients |
+
+
+## Firewall
+### Interface Rules
+ - WAN_CGNAT in
+ - deny *
+ - WAN_STATIC in
+ - allow from * to {services} --> NAT rules
+ - DMZ in
+ - deny from DMZ net to LAN net
+ - allow from DMZ net to firewall
+ - allow from DMZ net to * gw WAN_STATIC
+ - LAN in
+ - allow ICMP from LAN net to firewall
+ - allow IP DNS from LAN net to firewall
+ - allow from LAN net to DMZ net
+ - allow from LAN net to * gw WAN_CGNAT
+
+### IPv4 NAT Rules
+ | Service | Customer | IPProto | Ext Port | Host | Re Port |
+ |---------|----------|---------|----------|------|---------|
+ | OpenVPN | | TCP | 1195 | router | |
+ | WireGuard | | UDP | 51820 | router | |
+ | DNS NS1 | | TCP/UDP | 53 | misc | |
+ | iperf3 | | TCP | 5201 | misc | |
+ | Web | | TCP | 80,443 | web | |
+ | Git | | TCP | 9418 | web | |
+ | bittorrent | | TCP/UDP | 8999 | nas | |
+ | rsync | | TCP/UDP | 873 | nas | |
+ | IRC | | TCP | 6667 | comm | |
+ | IRCS | | TCP | 6697 | comm | |
+ | XMPP c2s| | TCP | 5222 | comm | |
+ | XMPP s2s| | TCP | 5269 | comm | |
+ | TURN STUN| | TCP/UDP | 3478 | comm | |
+ | TURN | | TCP/UDP | 5349 | comm | |
+ | TURN UDP relay| | TCP/UDP | 49152-50176 | comm | |
+ | mc-waterfall-proxy| | TCP | 25565 | game | 25567 |
+ | | | | | | |
+ | exo-ssh | exo | TCP | 4041 | exovps | 22 | |
+ | exo-extra | exo | TCP | 4040 | exovps | 4040 | |
+ | yero-ssh | yero | TCP | 1511 | yerovps | 22 | |
+ | yero-sql | yero | TCP | 1512 | yerovps | 3306 |
+ | FiveM SuperioresRP | yero | TCP | 30120,40120 | yerovps | |
+
+### IPv6 port rules
+ | Service | Customer | IPProto | Host | Port |
+ |---------|----------|---------|------|------|
+ | DNS NS1 | | TCP/UDP | misc | 53 |
+ | Web | | TCP | web | 80,443 |
+
## Hosts
- server - DELL PowerEdge R720 running Proxmox PVE - ...
@@ -173,6 +224,7 @@ RAID attached here (with the grey stuff) (local only)
| blog.arf20.com | /var/www/blog.arf20.com/_site/ | |
| forum.arf20.com | /var/www/forum.arf20.com/html/ | |
| deb.arf20.com | /d/FTPServer/software/debian/ | |
+| memes.arf20.com | /var/www/memes.arf20.com/, /d/FTPserver/{dcimg, dcmemes, explosionsandfire} |
| | | |
| status.yero.dev | http://yerovps.lan:3001 | |
@@ -237,36 +289,6 @@ RAID attached here (with the grey stuff) (local only)
*TODO
-## Firewall
-### IPv4 NAT Port forwards
- | Service | Customer | IPProto | Ext Port | Host | Re Port |
- |---------|----------|---------|----------|------|---------|
- | OpenVPN | | TCP | 1195 | router | |
- | WireGuard | | UDP | 51820 | router | |
- | DNS NS1 | | TCP/UDP | 53 | misc | |
- | Web | | TCP | 80,443 | web | |
- | Git | | TCP | 9418 | web | |
- | bittorrent | | TCP/UDP | 8999 | nas | |
- | IRC | | TCP | 6667 | comm | |
- | IRCS | | TCP | 6697 | comm | |
- | XMPP c2s| | TCP | 5222 | comm | |
- | XMPP s2s| | TCP | 5269 | comm | |
- | TURN STUN| | TCP/UDP | 3478 | comm | |
- | TURN | | TCP/UDP | 5349 | comm | |
- | TURN UDP relay| | TCP/UDP | 49152-50176 | comm | |
- | grupo4mc| | TCP | 25565 | game | |
- | rubenmc | | TCP | 25566 | game | |
- | | | | | | |
- | yero-SSH | yero | TCP | 1511 | yerovps | 22 | |
- | yero-SQL | yero | TCP | 1512 | yerovps | 3306 |
- | FiveM SuperioresRP | yero | TCP | 30120,40120 | yerovps | |
-
-### IPv6 port rules
- | Service | Customer | IPProto | Host | Port |
- |---------|----------|---------|------|------|
- | DNS NS1 | | TCP/UDP | misc | 53 |
- | Web | | TCP | web | 80,443 |
-
## Internal Name and Number Assignation Table
DMZ IPv4s and IPv6 ends in the same way
| Addr | Name |
@@ -305,15 +327,26 @@ DMZ IPv4s and IPv6 ends in the same way
| selector._domainkey | TXT | (DKIM) | DKIM for selector 'selector' |
| _dmarc | TXT | (DMARC) | |
| arf20.com | TXT | (SPF) | |
-| www | CNAME | arf20.com |
-| jellyfin | CNAME | arf20.com |
+|
| irc | CNAME | arf20.com |
+| jellyfin | CNAME | arf20.com |
| matrix | CNAME | arf20.com |
-| xmpp | CNAME | arf20.com |
-| xmppconf | CNAME | arf20.com |
-| turn | CNAME | arf20.com |
| nextcloud | CNAME | arf20.com |
+| turn | CNAME | arf20.com |
| webmail | CNAME | arf20.com |
+| www | CNAME | arf20.com |
+| xmpp | CNAME | arf20.com |
+| xmppconf | CNAME | arf20.com |
+| grafana | CNAME | arf20.com |
+| git | CNAME | arf20.com |
+| cgit | CNAME | arf20.com |
+| blog | CNAME | arf20.com |
+| forum | CNAME | arf20.com |
+| deb | CNAME | arf20.com |
+| zabbix | CNAME | arf20.com |
+| memes | CNAME | arf20.com |
+| news | CNAME | arf20.com |
+|
| _acme-challenge.jellyfin | CNAME | (challenge) | |
| _acme-challenge.irc | CNAME | (challenge) | |
| _acme-challenge.matrix | CNAME | (challenge) | |