ARFNET2 deployment

After the disastrous ISP schism

Masterplan

Stage 1: very safe - Close all ports - Nuke (or stop) all old VMs (exclude OPNSense) - Make DMZ - Make new basic VMs (cloning deb12 template) - Open basic ports

Stage 2: new services - IONOS VPS for mail - Some new very safe services - HE IPv6 tunnel - Own authoritative nameservers for domain zone

Stage 3*: finally - Another VPS in unknown provider for - Tor - Reverse-proxying the media library - PHP on main site with more web services from scratch, hopefully secure - More new services

Domain

arf20.com

Registrar: namecheap

Name sever glue records at registrar

Networking

Hardware

                   WAP
                    |
       +-----+   +--------------------------+     +----------------+
ISP ===| ONT |---| DELL switch              |-----| TP-Link switch |
       +-----+   +--------------------------+     +----------------+
                    |        |          |                |
                    |        |          |                |
                 +---------------+  Rest of devices   Living room devices
                 | eno1     eno2 |
                 | server router |
                 +---------------+
                   
- 1000BASE-T
= GPON fiber

DELL PowerConnect 5424 switch

Port assignents

Management

• interface vlan 4: 192.168.4.2/24 gw 192.168.4.1

Public IPs

• AVANZA_STATIC: 2.59.235.35
• AVANZA_CGNAT: dynamic
• HE v6 tunnel: 2001:470:1f20:125::2
• IONOS VPS: 5.250.186.185 2001:ba0:210:d600::1

Gateways

• AVANZA
  • WAN_STATIC: 2.59.235.1
  • WAN_CGNAT: dynamic
• HE v6: 2001:470:1f20:125::1 via 216.66.87.102

Physical and Logical Networks

Firewall

Interface Rules

• WAN_CGNAT in
  • deny *
• WAN_STATIC in
  • allow from * to {services} –> NAT rules
• DMZ in
  • deny from DMZ net to LAN net
  • allow from DMZ net to firewall
  • allow from DMZ net to * gw WAN_STATIC
• LAN in
  • allow ICMP from LAN net to firewall
  • allow IP DNS from LAN net to firewall
  • allow from LAN net to DMZ net
  • allow from LAN net to * gw WAN_CGNAT

IPv4 NAT Rules

IPv6 port rules

Hosts

• server - DELL PowerEdge R720 running Proxmox PVE - …
• mail - IONOS VPS running Debian 12 - 5.250.186.185 2001:ba0:210:d600::1

Management

• OPNSense router DMZ.1
• DELL switch DMZ.2
• TP-Link WAP LAN.2
• Proxmox hypervisor DMZ.4
• DELL server iDRAC DMZ.5
• HP printer DMZ.7

server VMs and services

server runs Proxmox PVE.

All VMs are Debian 12 (templated) with wazuh agent

proxmox DMZ.4 (hypervisor)

• SSH
• Proxmox management interface :8006
• smartmon + node exporter :9100
• sensor exporter*
• NUT - Network UPS TOols daemon (and proper UPS)*

router DMZ.1

• (routing/firewalling)
• SSH
• DHCP
• unbound DNS
• OpenVPN
• WireGuard
• IPsec*
• ntopng :3000
• telegraf - note: editing config via webfig breaks (timeout and unbound config)

nas DMZ.6

RAID attached here (with the grey stuff) (local only) - SSH - NFS - Samba SMB - MiniDLNA - FTP - qBittorrent-nox - jellyfin

web DMZ.9

• SSH
• cerbot
• nginx (status at :8080)
• fastcgi PHP
• mariadb SQL
• nginx-prometheus-exporter :9113
• prometheus :9090
• telegraf
• influxdb :8086
• grafana :3000
  • Proxmox
  • nginx
  • iDRAC
• zabbix*
• netbox*
• fcgiwrap
• git-http-backend - git smart http server CGI
• gitd - git daemon
• cgit - web frontend for git
• phpBB - forum software
• Jekyll - blog static site generator thing
• opentracker? - bittorrent tracker*
• gophernicus - gopher server*

wazuh DMZ.10

• SSH
• wazuh

game DMZ.11

• SSH
• waterfall (minecraft reverse proxy)
  • mclobby (auth)
  • mcrubenmc
  • mcgrupo4*
  • minepau*
• csgo server*

comm DMZ.12

• SSH
• cerbot
• unrealircd - IRC
• synapse - matrix
• postgresql - DB for synapse
• pantalaimon - encrypt matterbridge traffic to matrix
• matterbridge - bridge channels with different protocols
• prosody - XMPP
• coturn - TURN server for matrix and xmpp
• asterisk - VoIP SIP PBX*

misc (Deb12 LXC) DMZ.13

• SSH

• iperf3

• bind9 - master authoritative nameserver for arf20.com zone NS1

  • public recursive*

• OpenLDAP LDAP*

• INN2 - NNTP USENET server with SDF peering

• Discord servers

  • gDebrid

pubnix?*

mail (ARFNET-IONOS VPS) 5.250.186.185 2001:ba0:210:d600::1

• SSH
• certbot
• postfix - MTA smtpd, submission, submissions config
• dovecot - imapd
• opendkim
• majordomo? - mailing list manager*
• bind9 - slave authoritative nameserver NS2

### proxy (ARFNET-HOSTMENOW VPS) *

• SSH*
• IPsec client*
• proxy for ftp.arf20.com somehow*

yerovps DMZ.192 (yero)

• SSH
• mariadb
• FiveM SuperioresRP

exovps DMZ.195 (exo)

• SSH
• netbox

*TODO

Internal Name and Number Assignation Table

DMZ IPv4s and IPv6 ends in the same way | Addr | Name | |——|——| | DMZ.1 | router.lan | | DMZ.2 | switch.lan | | DMZ.3 | wap.lan | | DMZ.4 | proxmox.lan | | DMZ.5 | idrac.lan | | DMZ.6 | nas.lan | | DMZ.7 | printer.lan | | DMZ.8 | desktop.lan | | DMZ.9 | web.lan | | DMZ.10 | wazuh.lan | | DMZ.11 | game.lan | | DMZ.12 | comm.lan | | DMZ.13 | misc.lan | | | | | | DMZ.192 | yerovps | yero.lan | | DMZ.195 | exovps | exo.lan |

Domain DNS zone

HE v6 rDNS zone

IONOS rDNS zone