ARFNET2 deployment

After the disastrous ISP schism

Masterplan

Stage 1: very safe

Stage 2: new services

Stage 3*: finally

Domain

arf20.com

Registrar: namecheap

Name sever glue records at registrar

Nameserver Name IP
NS1 ns1.arf20.com 2.59.235.35
2600:70ff:f039:4::13
NS2 ns2.arf20.com 5.250.186.185
2001:ba0:210:d600::1

Networking

Hardware

                   WAP
                    |
       +-----+   +--------------------------+     +----------------+
ISP ===| ONT |---| DELL switch              |-----| TP-Link switch |
       +-----+   +--------------------------+     +----------------+
                    |        |          |                |
                    |        |          |                |
                 +---------------+  Rest of devices   Living room devices
                 | eno1     eno2 |
                 | server router |
                 +---------------+
                   
- 1000BASE-T
= GPON fiber

12U rack

+--------------+--------+
| drawer       |        |
| drawer       | PDU    |
| patch panel  |        |
| switch       |        |
|              |        |
|              |        |
| R720         |        |
| R720         |        |
|              |        |
|              |        |
|              |        |
|              | UPS    |
+--------------+--------+

DELL PowerConnect 5424 switch

Port assignents

port endpoint options
g2 ONT VLAN access 2
g4 server eno2 WAN VLAN access 2
g6 test2 VLAN access 2
g3 WAP VLAN access 5
g5 PC VLAN access 4
g7 Living R. VLAN access 5
g9 server eno1 DMZ+LAN VLAN trunk 4, 5
g15 test4 VLAN access 4
g17 test1 VLAN access 1
g19 test5 VLAN access 5
g21 iDRAC VLAN access 4
g23 printer VLAN access 4

Management

Public IPs

Gateways

Physical and Logical Networks

name VLAN net desc
WAN 2
DMZ 4 192.168.4.0/24
2600:70ff:f039:4::/64
Services
LAN 5 192.168.5.0/24
2600:70ff:f039:5::/64
Clients
VPN 192.168.6.0/24
2600:70ff:f039:6::/64
Wireguard clients

Firewall

Interface Rules

IPv4 NAT Rules

Service Customer IPProto Ext Port Host Re Port
WireGuard UDP 51820 router
DNS NS1 TCP/UDP 53 misc
iperf3 TCP 5201 misc
NNTP TCP 119 misc
Web TCP 80,443 web
Git TCP 9418 web
bittorrent TCP/UDP 8999 nas
rsync TCP/UDP 873 nas
IRC TCP 6667 comm
IRCS TCP 6697 comm
XMPP c2s TCP 5222 comm
XMPP s2s TCP 5269 comm
TURN STUN TCP/UDP 3478 comm
TURN TCP/UDP 5349 comm
TURN UDP relay TCP/UDP 49152-50176 comm
mc waterfall proxy TCP 25565 game 25567
mc bedrock geyser TCP 19132 game 19132
css-ds TCP/UDP 27015 game
exo ssh exo TCP 4041 exovps 22
exo extra exo TCP 4040 exovps 4040
yero ssh yero TCP 1511 yerovps 22
yero mc yero TCP 25569 yerovps 25565
yero panel yero TCP 24444 yerovps 24444

IPv6 port rules

Service Customer IPProto Dest Host Dest Port
DNS NS1 TCP/UDP misc 53
Web TCP web 80,443
NNTP TCP misc 119
iperf3 TCP misc 5201
Git TCP 9418 web
bittorrent TCP/UDP 8999 nas
rsync TCP/UDP 873 nas
IRC TCP 6667 comm
IRCS TCP 6697 comm
XMPP c2s TCP 5222 comm
XMPP s2s TCP 5269 comm
TURN STUN TCP/UDP 3478 comm
TURN TCP/UDP 5349 comm
TURN UDP relay TCP/UDP 49152-50176 comm
mc-waterfall-proxy TCP 25565 game
exo-ssh exo TCP 4041 exovps
exo-extra exo TCP 4040 exovps
yero-ssh yero TCP 1511 yerovps
yero-sql yero TCP 1512 yerovps
FiveM SuperioresRP yero TCP/UDP 30120,40120 yerovps

Hosts

Management

server VMs and services

server runs Proxmox PVE.

All VMs are Debian 12 (templated) with wazuh agent

proxmox DMZ.4 (hypervisor)

router DMZ.1

nas DMZ.6

RAID attached here (with the grey stuff) (local only)

vhost webroot/proxy Comment
dark.arf20.com* /d/FTPServer/ Allow only VPS and private

web DMZ.9

vhost webroot/proxy Comment
default <return 418 im a teapot>
default:8080 <return nstub_status>
arf20.com /var/www/arf20.com/html/
www.arf20.com <301 redirect arf20.com>
matrix.arf20.com http://comm.lan:8008/_matrix
webmail.arf20.com /var/www/webmail.arf20.com/html/ SquirrelMail
nextcloud.arf20.com /var/www/nextcloud.arf20.com/html/
grafana.arf20.com http://localhost:3000
jellyfin.arf20.com http://nas.lan:8096
git.arf20.com /srv/git/
cgit.arf20.com fastcgi:/usr/lib/cgit/cgit.cgi
blog.arf20.com /var/www/blog.arf20.com/_site/
forum.arf20.com /var/www/forum.arf20.com/html/
deb.arf20.com /d/FTPServer/software/debian/
memes.arf20.com /var/www/memes.arf20.com/, /d/FTPserver/{dcimg, dcmemes, explosionsandfire}
news.arf20.com Web-News NNTP newsgroups frontend
dash.arf20.com /var/www/dash.arf20.com/html/ CSTIMS
ftp.arf20.com /d/FTPServer/public/
photo.arf20.com [::1]:2342 photoprism
radio.arf20.com / = /var/www/radio.arf20.com/html/; /stream = nas:8000
os.arf20.com / = /d/FTPServer/OS/
status.yero.dev http://yerovps.lan:3001
panaland.arf20.com /var/www/panaland.arf20.com/html/

wazuh DMZ.10 -> secure*

game DMZ.11

comm DMZ.12

misc (Deb12 LXC) DMZ.13

t2 (T/2 SDE) DMZ.15

pubnix (OpenBSD 7.5) DMZ.16

mail (ARFNET-IONOS VPS) 5.250.186.185 2001:ba0:210:d600::1

vhost webroot/proxy Comment
default <return 418 im a teapot>
lists.arf20.com / = /var/www/lists.arf20.com/html/
/archive = /srv/www/htdocs/archive/
Mailing lists

proxy (ARFNET-HOSTMENOW VPS) 92.60.77.4

vhost webroot/proxy Comment
default <return 418 im a teapot>
jokesondmca.mooo.com http://nas/ Stuff

yero-debian VPS DMZ.192 (yero)

exo-debian VPS DMZ.195 (exo)

loofa-debian VPS DMZ.196 (loofa)

*TODO

Internal Name and Number Assignation Table

DMZ IPv4s and IPv6 ends in the same way

Addr Name
DMZ.1 router.lan
DMZ.2 switch.lan
DMZ.3 wap.lan
DMZ.4 proxmox.lan
DMZ.5 idrac.lan
DMZ.6 nas.lan
DMZ.7 printer.lan
DMZ.8 desktop.lan
DMZ.9 web.lan
DMZ.10 wazuh.lan
DMZ.11 game.lan
DMZ.12 comm.lan
DMZ.13 misc.lan
DMZ.15 (t2)
DMZ.16 pubnix
DMZ.192 yero-debian
DMZ.195 exo-debian
DMZ.196 loofa-debian

DNS

Domain zone

Name Type Content Comment
@ NS ns1.arf20.com
@ NS ns2.arf20.com
ns1 A 2.59.235.35
ns1 AAAA 2600:70ff:f039:4::13
ns2 A 5.250.186.185
ns2 AAAA 2001:ba0:210:d600::1
arf20.com A 2.59.235.35
arf20.com AAAA 2600:70ff:f039:4::9
mail.arf20.com A 5.250.186.185 ARFNET-IONOS
mail.arf20.com AAAA 2001:ba0:210:d600::1 ARFNET-IONOS
web.arf20.com A 2.59.235.35
web.arf20.com AAAA
game.arf20.com A 2.59.235.35
game.arf20.com AAAA 2600:70ff:f039:4::11
comm.arf20.com A 2.59.235.35
comm.arf20.com AAAA 2600:70ff:f039:4::12
misc.arf20.com A 2.59.235.35
misc.arf20.com AAAA 2600:70ff:f039:4::13
pubnix.arf20.com A 2.59.235.35
pubnix.arf20.com AAAA 2600:70ff:f039:4::16
irc.arf20.com CNAME comm.arf20.com
jellyfin.arf20.com CNAME web.arf20.com
matrix.arf20.com CNAME web.arf20.com
nextcloud.arf20.com CNAME web.arf20.com
turn.arf20.com CNAME comm.arf20.com
webmail.arf20.com CNAME web.arf20.com
www.arf20.com CNAME web.arf20.com
xmpp.arf20.com CNAME comm.arf20.com
xmppconf.arf20.com CNAME comm.arf20.com
grafana.arf20.com CNAME web.arf20.com
git.arf20.com CNAME web.arf20.com
cgit.arf20.com CNAME web.arf20.com
blog.arf20.com CNAME web.arf20.com
forum.arf20.com CNAME web.arf20.com
deb.arf20.com CNAME web.arf20.com
zabbix.arf20.com CNAME web.arf20.com
memes.arf20.com CNAME web.arf20.com
news.arf20.com CNAME misc.arf20.com
dash.arf20.com CNAME web.arf20.com
ftp.arf20.com CNAME web.arf20.com
photo.arf20.com CNAME web.arf20.com
lahomosexualidadde.arf20.com CNAME weonpollo.xyz
panaland.arf20.com CNAME web.arf20.com
_acme-challenge.jellyfin CNAME (challenge)
_acme-challenge.irc CNAME (challenge)
_acme-challenge.matrix CNAME (challenge)
_acme-challenge.mail CNAME (challenge)
_acme-challenge.xmpp CNAME (challenge)
arf20.com MX mail.arf20.com
selector._domainkey TXT (DKIM) DKIM for selector ‘selector’
_dmarc TXT (DMARC)
arf20.com TXT (SPF)

HE v6 rDNS zone

Name Type Content Comment
2600:70ff:f039:4::13 PTR ns1.arf20.com
2600:70ff:f039:4::9 PTR arf20.com
2600:70ff:f039:4::195 PTR global.dns.navy

IONOS rDNS zone

Name Type Content Comment
5.250.186.185 PTR mail.arf20.com

Custom ARFNET software