State of the Network in December 2024

So I have not been blogging about my network for some time.  I have been busy at the end of the year with other things including family and my newfound hobby of genealogy,  I am also adding some WoodShop activity in there as well. So, my time with my network has taken a sideline.  However, now that I find that my Retirement Community is going over to a different way of doing things, I find myself coming back to the rack for some more experiments.

• I have changed the configuration of the rack and have removed the switch for the xPod, and removed both of the special purpose Edgerouter-X boxes
• I added a 24 port 1U keystone panel at the bottom to use for projects in the future
• I removed the SLATE router from the living room, since I was not using it very much
• I am first going to start by modifying a test RPi to have two or more namespaces using OpenVSwitch to provide a NAT router function between the NS
• I will also setup the routing tables to make the two NS get their IPs from different DHCP servers
• I am also going to setup a set of Docker containers that lie on either side of the NAT router
• I want to test the idea that normal flow across the NAT is controlled
• I want to test the setup being done via Ansible
• I am going to print a rack panel to mount a GS108T and ER-X at the bottom of the rack for future projects

I have now moved the Experiment Pod to my HomeLab rack

 I decided to drop my participation in the community sub-committee and focus on other things.  In so doing, I have moved the Experiment Pod to the HomeLab rack.  I decided to change out the rack and put the entire Experiment Pod panel into the rack as well as an Edgerouter-X to give the ExPod vlan a dhcp source and isolate it from the rest of the network.  The unmanaged 8 port switch is there as well to connect to each of the ExPod RPis.

In addition, I have added a managed switch (GS108Tv3) to offload the number of connections to the key managed switch outside of the HomeLab rack.

Using pfSense as a Multi-WAN interface for Monitoring within the HomeLab

 I am back.  I started playing with pfSense in my Proxmox server in order to have a multi-headed connection into vlans within my network.  The purpose is to have an isolated vlan (isolated in the sense that the other vlans cannot get to it) to use as a monitoring point.  My thought is this: let pfSense become the DNS/DHCP source for a number of hardware and VM/LXC components to provide monitoring and automation activities.  I would eventually use Ansible to automate setups within the HomeLab and would use Observium/collectd to monitor the different HW components.  I could also use a component to provide CA capabilities.  The steps needed include:

1. download a tar.gzip of pfSense Community Edition from the pfSense website
2. create a VM of pfSense on the Proxmox server
3. setup the VM to link to an existing vlan in the HomeLab on the WAN side and to an isolated vlan on the LAN side
4. check the pfSense console to make sure that the ports are configured correctly
5. add a Raspberry Pi w/SSD to the isolated vlan and bring it up; helps if it is already setup to integrate with the tailscale network
6. check that the Raspberry Pi can communicate through pfSense to the WAN side and that it has an IP within the subnet of the LAN; this will become the seat of monitoring and automation for the HomeLab
7. add XRDP to the Raspberry Pi so that I can access the GUI
8. setup Putty on my Windows laptop as an SSH tunnel to the web interface to pfSense through the Raspberry Pi; repeat with other things that I wish to monitor

Seemed like a good idea at the time.  Not sure why this would be frowned upon security wise.  I just need to be sure that I am always aware of new and clever attacks that might be possible within the network.

I'm wondering if the same thing can be done with one of my spare Edgerouter-X routers.

Update: I was able to do the same thing with the Edgerouter-X router.  So in retrospect, I have spun down the Proxmox pfSense router for use later.  I don't think that I will be getting rid of it anytime soon.  It's nice to know that I now have the ability to change the different routers that I have to give a multi-head ability to my HomeLab.

Zone Based Routing and the Edgerouter-X

I am attempting to use an Edgerouter-X (ERX1 for short) to provide specific, controlled access between vlans and certain equipment.  The first use case will be entirely composed of port forwarding, but between multiple vlans.  First case is to define what I mean by setup:

The New Setup for vlans on ERX1

• ERX1-1 will be connected to Media Router for access to the Media vlan
• ERX1-2 will be connected to Main Switch for access to the Admin vlan for configuration
• ERX1-5 will be connected to Main Switch for access to other vlans as a trunk line
• ERX1 vlans will be setup as normal, always getting IP from DHCP and doing DHCP Remote to keep the gateways pure

The following Zones will be defined:

• Local (ERX1 itself)
• Admin
• Media
• Personal
• IOT
• LAN3
• DMZ

The following special defined accesses are:

• Port 8123 of the HA-IOT server on IOT vlan <-> every IP on LAN3 vlan
• HA-IOT server on IOT vlan <-> data server ports on Personal vlan
• ports for Plex server on Personal vlan <-> every IP on the Media vlan
• ports for Plex server on Personal vlan <-> every IP on the LAN3 vlan
• every IP on the Media vlan <-> data server ports on Personal vlan
• Docker container ports in the Development vlan <-> the MQTT server on the HA-IOT server in the LAN3 vlan
• every IP on the LAN3 vlan <-> Media equipment ports on the Media vlan
• specific IPs on the DMZ <-> data server ports on Personal vlan
• Some of these alternate connections are going to require the device to be on the same subnet

Group Definitions needed:

• port 8123 on HA-IOT Server on IOT vlan
• data server ports on Personal vlan
• Plex server ports on Personal vlan
• MQTT server port on IOT vlan 
• Media equipment ports on Media vlan
• Specific IPs on the DMZ vlan

The first items on the ERX1 that need to be completed for setup include resetting the ERX1 to default, setting up an initial default router setup with two subnets, defining the Admin vlan, setting up the main switch to accommodate connection to the Admin vlan and to the Media vlan (with the WAN port).  From there I should be able to update the ERX1 as I go.

Project #23 - What Makes Sense to ChangeUp in the Network?

What makes sense in the changeup of my network?

I do have a problem in the way that things are partitioned:

1. vlans are just that, they are setup to not have connection to each other.  This is by design, and I went out of my way when I setup my Edgerouter-12 to force vlan isolation even though by default vlans can talk to each other.

2. I actually setup some vlans so that the elements in those vlans would only be able to talk outside the router to the internet and not to each other.  This was a security design.

3. I made sure that vlans that were isolated to other vlans were not able to modify any of the settings on my Edgerouter-12 except for the admin vlan.  This was a security design.

4. I have a couple of specific computers that are allowed to contact other vlans.  This was by design and allows me to monitor equipment as necessary without having to give all my equipment the same level of access.  This was a security design.

5. The above way of partitioning has resulted in some problems with being able to get to certain servers.  I actually need the following:

• I need to be able to get to port 8123 of my HA-IOT server, on the IOT vlan, from the LAN3 vlan which contains my iPhones, iPads, and laptops.
• My HA-IOT server needs to get to the data servers in the Server vlan
• My Plex server resides in the Server vlan and both the Media and the LAN3 vlan need to get to it
• My Media equipment needs to get to the data servers in the Server vlan
• For testing purposes I need to have some Docker containers in the Development vlan be able to get to the MQTT server on the HA-IOT server in the LAN3 vlan
• My iPhones, iPads, and laptops on the LAN3 vlan need to be able to get to Media equipment on the Media vlan
• Some of these alternate connections are going to require the device to be on the same subnet

So, this means that there needs to be overlap between the different vlans, but at the same time it needs to be controlled.  I do have an additional Edgerouter-X which I can use for that purpose.  This will be an exploration of what I can accomplish.  This Edgerouter-X will not be used as a normal router, but will in fact be the way that I can provide a controlled interface between vlans.  If the router is removed, then everything will go back to the way it was before.  This will also give me a chance to try out zone based routing on the Edgerouter-X.

DHCP-DNS on a PiHole

So now is the time to start putting in a PiHole to control DNS access.  All along I have been thinking of constraining the dns connections from the IOT equipment.  There are times when equipment will attempt to get it’s DNS ip addresses through a hard coded IP address.  What I want to do is force the DNS access through the PiHole and have the PiHole get its DNS addresses via DNSSEC to either 1.1.1.1 or 9.9.9.9.  That way I have the PiHole restricting the trackers and the DNSSEC servers to provide restriction from known bad addresses, whether web or ip.  Since I have moved the IOT equipment to one of the Edgerouter-Xs, I should be able to control the DNS access through some judicious ACL setups.  Should be interesting.

First of all the PiHole is put into the IOT lan subnet, and the ER-X then uses the PiHole as both DHCP and DNS services.  I will setup the ER-X to force any DNS service connections to go through the PiHole (https://community.ui.com/questions/Intercepting-and-Re-Directing-DNS-Queries/cd0a248d-ca54-4d16-84c6-a5ade3dc3272 and https://benninger.ca/posts/force-dns-go-through-pihole/ and https://www.myhelpfulguides.com/2018/07/30/redirect-hard-coded-dns-to-pi-hole-using-edgerouter-x/ ).  Since I know all of the equipment in my network, including the IOT network, I will force IP addresses where I want them through Static assignment (TBD).  In addition, I am going to restrict Bonjour access throughout the ER-X lan subnet (TBD).  I will of course restrict changes to the ER-X through my Admin vlan and not through the IOT vlan (TBD).  Anyway that is the idea at the moment.  Time will tell how well this works.