Possible Networking Changes in an All WiFi Environment

Since the retirement village will have only WiFi connection, there will be some things that I will need to add to make the setup easier for the future.  It seems that I will be able to talk between devices over the WiFi network, including all over the campus.  I am counting on this to be able to do some interesting network things.  So there would need to be some of the following developed:

• WiFi Bridge - this will be needed to connect the non-WiFi equipment, like the Edgerouter-12, to the WiFi network
• MQTT Server - this would provide an MQTT instance at the WiFi level on the ER12 router for some automation things
• Home Assistant Server - this would provide an HA instance through the ER12 router
• L2TP IPSec Endpoint - this would provide a connection for my laptops from anywhere in the community through the ER12 router
• Raspberry Pi WiFi Endpoint - L2TP IPSec GRE based endpoint that isolates the Ethernet connection of the RPi from the WiFi portion which runs over the campus WiFi network; it also allows a point to point connection between RPi endpoints with multiple networking protocols running over it on whatever vlans I desire; this might possibly be implemented by an RPi Zero W/USB plug
• Plex Server - this would provide Plex capability through the ER12 router
• NextCloud Server - this would provide file and project services through the ER12 router

Setting up a Certificate Authority on the RPi

One of the things that I have determined that I need in my system is the ability to create security certificates, especially X.509 certs.  I don't want to have to spend money for certifications that I will only be using internally to my network or in connecting to my network.  I can do this by setting up my own Certificate Authority (CA).  A CA is used to create and sign certificates as being authenticate.  Since I am in a controlled environment I can make sure that these certificates are specific to my needs and since I will not be releasing the public CA certificate, will allow me to control access to my network.

I can use the CA to sign certificates to be used with: my internal network connections, openVPN, and IPSec connections from the outside.  In addition, I need to setup a simplified way of creating symetric encryption certificates.  I will only have the CA open long enough to do what I need to do and then I will shut it down and remove it from my network - so it will remain secure from attack from the outside.  I can also use it at work to do my certificates without being connected to a network so it is even more secure.

I used one specific article to setup my Certificate Authority at xxxxx.  I am repeating the steps here for reference purposes:

Make an SSL Certificate Authority and Associated Certificates

(1) Create the Root Key

[Mydev@xxx My_CA]$ mkdir -p MyCA/cert MyCA/key
[Mydev@xxx My_CA]$ cd MyCA
[Mydev@xxx MyCA]$ openssl genrsa -aes256 -out key/Myca.key.pem 4096
Generating RSA private key, 4096 bit long modulus
.......................................................++
....................................................................++
e is 65537 (0x10001)
Enter pass phrase for key/Myca.key.pem:
Verifying - Enter pass phrase for key/Myca.key.pem:
[Mydev@xxx MyCA]$ chmod 400 key/Myca.key.pem
[Mydev@xxx MyCA]$ 

(2) Create the Root Cert

[Mydev@xxx MyCA]$ openssl req -key key/Myca.key.pem -new -x509 -days 3650 -sha256 -extensions v3_ca -out cert/Mycert.pem
Enter pass phrase for key/Myca.key.pem:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:MyState
Locality Name (eg, city) [Default City]:MyTown
Organization Name (eg, company) [Default Company Ltd]:HOME
Organizational Unit Name (eg, section) []:HOME
Common Name (eg, your name or your server's hostname) []:My CERT
Email Address []:myemail@myemail.com
[Mydev@xxx MyCA]$ 

Note: cert/Mycert.pem is the CA's certificate and is public - this needs to be loaded into all clients in the My network.  key/Myca.key.pem is the CA's private key - it is protected by the password MYCAKEYPASSWORD and it should be restricted access so that only root can read it.

(3) Create the First Server key/cert combo

[Mydev@xxx MyCA]$ mkdir myserver1
[Mydev@xxx MyCA]$ openssl genrsa -aes256 -out myserver1/myserver1.My.local.key 4096
Generating RSA private key, 4096 bit long modulus
.........................................................................................................++
................................................................................++
e is 65537 (0x10001)
Enter pass phrase for myserver1/myserver1.My.local.key:
Verifying - Enter pass phrase for myserver1/myserver1.My.local.key:
[Mydev@xxx MyCA]$ openssl req -new -key myserver1/myserver1.My.local.key -out myserver1/myserver1.My.local.csrEnter pass phrase for myserver1/myserver1.My.local.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:MyState
Locality Name (eg, city) [Default City]:MyTown
Organization Name (eg, company) [Default Company Ltd]:HOME
Organizational Unit Name (eg, section) []:HOME
Common Name (eg, your name or your server's hostname) []:My OPERATOR CERT
Email Address []:myemail@myemail.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[Mydev@xxx MyCA]$ openssl x509 -req -days 3650 -in myserver1/myserver1.My.local.csr -CA cert/Mycert.pem -CAkey key/Myca.key.pem -set_serial 01 -out myserver1/myserver1.My.local.crt
Signature ok
subject=/C=US/ST=MyState/L=MyTown/O=HOME/OU=HOME/CN=My OPERATOR CERT/emailAddress=myemail@myemail.com
Getting CA Private Key
Enter pass phrase for key/Myca.key.pem:
[Mydev@xxx MyCA]$ 

(4) Make a passwordless version of the server key

[Mydev@xxx MyCA]$ openssl rsa -in myserver1/myserver1.My.local.key -out myserver1/myserver1.My.local.key.insecure
Enter pass phrase for myserver1/myserver1.My.local.key:
writing RSA key
[Mydev@xxx MyCA]$ mv myserver1/myserver1.My.local.key myserver1/myserver1.My.local.key.secure
[Mydev@xxx MyCA]$ mv myserver1/myserver1.My.local.key.insecure myserver1/myserver1.My.local.key

Note: this passwordless key is the key that we will ultimately use so that we do not need human intervention when trying to use the certs.  Otherwise you type in the cert password everytime you restart the service.

(5) Import the CA and Cert

Note: copy the MyCA/Mycert.pem, myserver1/myserver1.My.local.key, and myserver1/myserver1.My.local.crt files to the server.  The MyCA/Mycert.pem has to be imported into the certificate store - this is the intermediate CA certificate and identifies the myserver1 certs as valid.

(6) Repeat for the Second cert

[Mydev@My-ib6-devel MyCA]$ mkdir myserver2
[Mydev@My-ib6-devel MyCA]$ openssl genrsa -aes256 -out myserver2/myserver2.My.local.key 4096
Generating RSA private key, 4096 bit long modulus
............................................................................................................................................................++
..................................++
e is 65537 (0x10001)
Enter pass phrase for myserver2/myserver2.My.local.key:
Verifying - Enter pass phrase for myserver2/myserver2.My.local.key:
[Mydev@My-ib6-devel MyCA]$ openssl req -new -key myserver2/myserver2.My.local.key -out myserver2/myserver2.My.local.csr
Enter pass phrase for myserver2/myserver2.My.local.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:MyState
Locality Name (eg, city) [Default City]:MyTown 
Organization Name (eg, company) [Default Company Ltd]:HOME
Organizational Unit Name (eg, section) []:HOME
Common Name (eg, your name or your server's hostname) []:My MAINTAINER CERT
Email Address []:myemail@myemail.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[Mydev@My-ib6-devel MyCA]$ openssl x509 -req -days 3650 -in myserver2/myserver2.My.local.csr -CA cert/Mycert.pem -CAkey key/Myca.key.pem -set_serial 01 -out myserver2/myserver2.My.local.crt
Signature ok
subject=/C=US/ST=MyState/L=MyTown/O=HOME/OU=HOME/CN=My MAINTAINER CERT/emailAddress=myemail@myemail.com
Getting CA Private Key
Enter pass phrase for key/Myca.key.pem:
[Mydev@My-ib6-devel MyCA]$ openssl rsa -in myserver2/myserver2.My.local.key -out myserver2/myserver2.My.local.key.insecure
Enter pass phrase for myserver2/myserver2.My.local.key:
writing RSA key
[Mydev@My-ib6-devel MyCA]$ mv myserver2/myserver2.My.local.key myserver2/myserver2.My.local.key.secure
[Mydev@My-ib6-devel MyCA]$ mv myserver2/myserver2.My.local.key.insecure myserver2/myserver2.My.local.key

(7) Repeat for the Third cert

[Mydev@My-ib6-devel MyCA]$ mkdir myserver3
[Mydev@My-ib6-devel MyCA]$ openssl genrsa -aes256 -out myserver3/myserver3.My.local.key 4096
Generating RSA private key, 4096 bit long modulus
...........................................................................................++
..........++
e is 65537 (0x10001)
Enter pass phrase for myserver3/myserver3.My.local.key:
Verifying - Enter pass phrase for myserver3/myserver3.My.local.key:
[Mydev@My-ib6-devel MyCA]$ openssl req -new -key myserver3/myserver3.My.local.key -out myserver3/myserver3.My.local.csr
Enter pass phrase for myserver3/myserver3.My.local.key:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [XX]:US
State or Province Name (full name) []:MyState
Locality Name (eg, city) [Default City]:MyTown
Organization Name (eg, company) [Default Company Ltd]:HOME
Organizational Unit Name (eg, section) []:HOME
Common Name (eg, your name or your server's hostname) []:My ADMINISTRATOR CERT
Email Address []:myemail@myemail.com

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
[Mydev@My-ib6-devel MyCA]$ openssl x509 -req -days 3650 -in myserver3/myserver3.My.local.csr -CA cert/Mycert.pem -CAkey key/Myca.key.pem -set_serial 01 -out myserver3/myserver3.My.local.crt
Signature ok
subject=/C=US/ST=MyState/L=MyTown/O=HOME/OU=HOME/CN=My ADMINISTRATOR CERT/emailAddress=myemail@myemail.com
Getting CA Private Key
Enter pass phrase for key/Myca.key.pem:
[Mydev@My-ib6-devel MyCA]$ openssl rsa -in myserver3/myserver3.My.local.key -out myserver3/myserver3.My.local.key.insecure 
Enter pass phrase for myserver3/myserver3.My.local.key:
writing RSA key
[Mydev@My-ib6-devel MyCA]$ mv myserver3/myserver3.My.local.key myserver3/myserver3.My.local.key.secure
[Mydev@My-ib6-devel MyCA]$ mv myserver3/myserver3.My.local.key.insecure myserver3/myserver3.My.local.key

IPSec VLAN #1 - Keeping VLANs Separate Using Encryption

I was reviewing some Capability Package (CP) documents from NSA the other day and it occurred to me that one of the ideas I could use was to keep VLANs separate from each other even across the internet.  This has appeal since I have a couple of VLANs in my home network that are not connected to the outside world or each other, yet I want to be able to do something with them during lunch at work.

Without going into too much detail re: the CP from NSA, they describe a virtual private network using commercial products which keep security domains separate from each other.  This is done through a double encryption linkage.  The following illustrates what I am talking about:

In this diagram, an OpenVPN Gateway is used on both sides (with certificate based connection) to form a connection between two No Man's Land LANs.  This is roughly equivalent to what we normally do on a day to day basis connecting a laptop using an OpenVPN client to our home networks through an OpenVPN server.  That being said, the connection goes between two LANs that do nothing in this diagram except give a place to combine packets from multiple IPSec VPN Gateways.  If we use a separate certificate to access each "VLAN", the information will not cross between them.  In other words, I could have an IPSec VPN Gateway at work, with a certificate for LAN A, and I could only connect through IPSec VPN Gateways at home that used the same certificate.  Those would be ones that are part of the same LAN A "VLAN".  Notice that I don't have to have a switch/router that is VLAN aware; I could have everything on separate conventional networks.

My thought is to implement OpenVPN on a RPi which would serve as an OpenVPN Gateway into the No Man's Land LAN (after hardening the RPi to attack of course, using a certificate specific to the OpenVPN connection). I would then implement IPSec VPN Gateways on other RPis (also hardened to attack) with certificates specific to the LAN that they connect to.  This speaks of having my own certificate authority (which is food for another post).  The OpenVPN Gateway doesn't necessarily need to be on an RPi either; I just would like to see if I can get this working using commodity items.  Note that the IPSec VPN Gateways could be implemented in VMs as well running on a server.

More Later.

Project #12 - Explore and Add a VPN Capability into the Network

I have been wanting to get a simple connection into my network for a long time now.  I have tried some experiments with the Mac Mini using IPSec and have had minimal success.  This is a project to be able to get into my network from the outside anytime I am remote from home.

Cluster#2 - Setting up an IPSec VPN into the Cluster

I want to set up the cluster to provide an IPSec VPN into the No-Mans Land vlan.  From there, I intend on setting up the other three RPis to connect to various vlans throughout my network.  The following diagram shows what I intend on doing:

The RPi coming from the Internet into NoManVlan would run the IPSec VPN.  I would then be able to access the cluster from external places.  The other three RPis would then perform the function of a gateway into other vlans from there.  Quagga would still be used to setup the routing tables in each RPi with respect to the NoManVlan.