ARFNET2 deployment

After the disastrous ISP schism

Masterplan

Stage 1: very safe

• Close all ports
• Nuke (or stop) all old VMs (exclude OPNSense)
• Make DMZ
• Make new basic VMs (cloning deb12 template)
• Open basic ports

Stage 2: new services

• IONOS VPS for mail
• Some new very safe services
• HE IPv6 tunnel
• Own authoritative nameservers for domain zone

Stage 3*: finally

• Another VPS in unknown provider for
  • Tor
  • Reverse-proxying the media library
• PHP on main site with more web services from scratch, hopefully secure
• More new services

Domain

arf20.com

Registrar: namecheap

Name sever glue records at registrar

Networking

Hardware

                   WAP
                    |
       +-----+   +--------------------------+     +----------------+
ISP ===| ONT |---| DELL switch              |-----| TP-Link switch |
       +-----+   +--------------------------+     +----------------+
                    |        |          |                |
                    |        |          |                |
                 +---------------+  Rest of devices   Living room devices
                 | eno1     eno2 |
                 | server router |
                 +---------------+
                   
- 1000BASE-T
= GPON fiber

12U rack

+--------------+--------+
| drawer       |        |
| drawer       | PDU    |
| patch panel  |        |
| switch       |        |
|              |        |
|              |        |
| R720         |        |
| R720         |        |
|              |        |
|              |        |
|              |        |
|              | UPS    |
+--------------+--------+

DELL PowerConnect 5424 switch

Port assignents

Management

• interface vlan 4: 192.168.4.2/24 gw 192.168.4.1

Public IPs

• AVANZA_STATIC: 2.59.235.35
• AVANZA_CGNAT: dynamic
• HE prefixes
  • 2001:470:1f21:125::/64
  • 2600:70ff:f039::/48
• IONOS VPS: 5.250.186.185 2001:ba0:210:d600::1

Gateways

• AVANZA
  • WAN_STATIC: 2.59.235.1
  • WAN_CGNAT: dynamic
• HE v6 tunnel
  • server: 216.66.87.102, 2001:470:1f20:125::1/64
  • client: 2.59.235.35, 2001:470:1f20:125::2

Physical and Logical Networks

Firewall

Interface Rules

• WAN_CGNAT in
  • deny *
• WAN_STATIC in
  • allow v4 from * to {services} –> NAT rules
• DMZ in
  • deny v4 to LAN net
  • allow v4 to firewall
  • allow v4 to * gw WAN_STATIC
  • allow v6 to * gw HE_TUNNELV6
• LAN in
  • allow v4 ICMP to firewall
  • allow v4 IP DNS to firewall
  • allow v4 to DMZ net
  • allow v4 to * gw WAN_CGNAT
  • allow v6 to * gw HE_TUNNELV6
• Wireguard in
  • allow v4+6 to DMZ net
  • allow v4 to * gw WAN_CGNAT
  • allow v6 to * gw HE_TUNNELV6

IPv4 NAT Rules

IPv6 port rules

Hosts

• server - DELL PowerEdge R720 running Proxmox PVE - …
• mail - IONOS VPS running Debian 12 - 5.250.186.185 2001:ba0:210:d600::1

Management

• OPNSense router DMZ.1
• DELL switch DMZ.2
• TP-Link WAP LAN.2
• Proxmox hypervisor DMZ.4
• DELL server iDRAC DMZ.5
• HP printer DMZ.7

server VMs and services

server runs Proxmox PVE.

All VMs are Debian 12 (templated) with wazuh agent

proxmox DMZ.4 (hypervisor)

• SSH
• Proxmox management interface :8006
• smartmon + node exporter :9100
• sensor exporter*
• NUT - Network UPS TOols daemon (and proper UPS)*

router DMZ.1

• (routing/firewalling)
• SSH
• DHCP
• unbound DNS
• OpenVPN
• WireGuard
• IPsec*
• ntopng :3000
• telegraf - note: editing config via webfig breaks (timeout and unbound config)

nas DMZ.6

RAID attached here (with the grey stuff) (local only)

• SSH
• NFS
• Samba SMB*
• MiniDLNA*
• FTP
• qBittorrent-nox
• jellyfin
• nginx

web DMZ.9

• SSH
• cerbot
• nginx (status at :8080)
• fastcgi PHP
• mariadb SQL
• nginx-prometheus-exporter :9113
• prometheus :9090
• telegraf
• influxdb :8086
• grafana :3000
  • Proxmox
  • nginx
  • iDRAC
• zabbix*
• netbox*
• fcgiwrap
• git-http-backend - git smart http server CGI
• gitd - git daemon
• cgit - web frontend for git
• phpBB - forum software
• Jekyll - blog static site generator thing
• opentracker? - bittorrent tracker*
• gophernicus - gopher server*
• photoprism

wazuh DMZ.10 -> secure*

• SSH
• wazuh
• password manager server*

game DMZ.11

• SSH
• waterfall (minecraft reverse proxy) :25565
  • mclobby (auth)
  • minepau*
• panaland mc modded :25566
• css dedicated server :27015

comm DMZ.12

• SSH
• cerbot
• unrealircd - IRC
• synapse - matrix
• postgresql - DB for synapse
• pantalaimon - encrypt matterbridge traffic to matrix
• matterbridge - bridge channels with different protocols
  • discord
  • matrix
  • irc
  • xmpp
• prosody - XMPP
• coturn - TURN server for matrix and xmpp
• asterisk - VoIP SIP PBX*

misc (Deb12 LXC) DMZ.13

• SSH
• iperf3
• bind9 - master authoritative nameserver for arf20.com zone NS1
  • public recursive*
• OpenLDAP LDAP*
• INN2 - NNTP USENET server with SDF peering
• Discord servers
  • gDebrid (gookie)

t2 (T/2 SDE) DMZ.15

pubnix (OpenBSD 7.5) DMZ.16

• SSH

mail (ARFNET-IONOS VPS) 5.250.186.185 2001:ba0:210:d600::1

• SSH
• certbot
• postfix - MTA smtpd, submission, submissions config
• dovecot - imapd
• opendkim
• opendmarc
• bind9 - slave authoritative nameserver NS2
• mlmmj - mailing list manager
  • installed to /usr/local/bin/mlmmj-webarchiver.sh and /etc/mlmmj-webarchiver
• mlmmj-webarchiver - mailing list archiver

proxy (ARFNET-HOSTMENOW VPS) 92.60.77.4

• SSH
• IPsec tunnel
• nginx reverse proxy to nas

yero-debian VPS DMZ.192 (yero)

• SSH
• mariadb
• FiveM SuperioresRP

exo-debian VPS DMZ.195 (exo)

• SSH
• netbox

loofa-debian VPS DMZ.196 (loofa)

• SSH
• ?

*TODO

Internal Name and Number Assignation Table

DMZ IPv4s and IPv6 ends in the same way

DNS

Domain zone

HE v6 rDNS zone

IONOS rDNS zone

Custom ARFNET software

• cstims: client, service, ticket and invoice management system
• status page (TODO)