State of the Network in December 2024

So I have not been blogging about my network for some time.  I have been busy at the end of the year with other things including family and my newfound hobby of genealogy,  I am also adding some WoodShop activity in there as well. So, my time with my network has taken a sideline.  However, now that I find that my Retirement Community is going over to a different way of doing things, I find myself coming back to the rack for some more experiments.

• I have changed the configuration of the rack and have removed the switch for the xPod, and removed both of the special purpose Edgerouter-X boxes
• I added a 24 port 1U keystone panel at the bottom to use for projects in the future
• I removed the SLATE router from the living room, since I was not using it very much
• I am first going to start by modifying a test RPi to have two or more namespaces using OpenVSwitch to provide a NAT router function between the NS
• I will also setup the routing tables to make the two NS get their IPs from different DHCP servers
• I am also going to setup a set of Docker containers that lie on either side of the NAT router
• I want to test the idea that normal flow across the NAT is controlled
• I want to test the setup being done via Ansible
• I am going to print a rack panel to mount a GS108T and ER-X at the bottom of the rack for future projects

State of the Network - September 2024

I haven't posted in a while so I thought I might get the blog up to speed.  I have been busily pushing things in the rack to an everyday state.  To do that I had an epihany about the connection between the living room manaaged switch (GS108Tv2) and the back bedroom managed switch (GS116Tv2).  It turns out that instead of using a Powerline adapter, I would be able to use a 35 foot flat Ethernet cable to accomplish the same thing.  So I obtained a flat Ethernet cable, ran it along the floorboard, through the balcony door, around the back of the balcony, through the bedroom door, and plugged into an extension Ethernet cable coming from the back bedroom managed switch.  In doing that, I managed to get the speedtest to triple on downlink (at times) and double the upload speed (at times) [201.9/237 Mbps].  I assume that this means I am approaching the 1Gbps speed between the two managed switches.  This also means that I am not susceptable to power fluctuations on the Ethernet line between the Powerline adapters.

I have also been busily rearranging the rack equipment to use the Netgear M4100-26 and Ubiquity Edgerouter-12.  The Netgear and Edgerouter have been changed to always power on when the rack has power.  This simplifies the overall structure of the rack and eliminates the need for using the two Edgerouter-X routers and another GS108Tv2 switch.  I can now power off those three components until I might need them again.  I left them plugged into the Ethernet patch panel on the bottom.  The only disadvantage is that the Netgear M4100-26 now runs hotter; but the fans at the top are putting out cold air which indicates that it is not as hot as I might assume in the rack; currently at 104 degrees F.

I am now trying to configure a monitor system that can gather statistics and send out commands to update, reboot, shutdown, etc. equipment in the rack.  I hope to continue to get closer to an automatic mode int he rack which will support experiments in the future.

NetUpdate #01 - Review of the Current State of the Network

 As I sit here, now retired, I have been going over what components my network has and how I want to continue on with this HomeLab hobby.  Whether I want to admit it or not I have decided that making changes to this network is a sort of hobby in and of itself.  I enjoy trying out new things and making changes here and there to better how I use the network.  Since I am now retired, I have time to do things that I have been putting off in the network, i.e. to completion. Currently I have a number of home network things that I want to incorporate, such as:

• Cover the entire house with wifi 
• Bring in a Kanban board to be hosted on my HomeLab, instead of relying on Trello
• Make the Kanban board accessible from the outside by incorporating a VPN into the house
• Further isolate different portions of the network that do not need to be touching each other
• Have some built in redundancy in case things go south in the network
• Work up the security on the HomeLab, including isolation of an Admin vlan for the infrastructure
• Incorporate more Raspberry Pi units into the HomeLab that are on continuously
• Get back into Home Automation
• Get into CI/CD for developing software on the HomeLab
• Go with the Zero Trust Network theme throughout (encryption becomes important now)

These items will of course take time over the next few months and years to come.  I am reasonably happy with how things have turned out so far.

Tips #11 - Shorthand notation for network diagrams

The following are some example rules for diagram shorthand notation.  This was developed to be able to not only indicate where the connections are, but to identify the ports on each end.  Makes it easy to put a wiring list together.

• General Format: {port_from}[What_flow_contains]{port_to}
• Port designation: {device-port}
• {ONT} for Verizon ONT
• {SW1-5} for Switch#1, port 5
• {RT3-2} for Router#3, port 2
• {RT3-W} for Router#3, wan port
• {RPi05-D1} for Raspberry Pi #5, dongle on usb port 1
• {RPi05-E} for Raspberry Pi #5, ethernet port
• {PP1-15} for patch panel #1, port 15
• Flow designation: [non_tagged_vlan/Ttrunk_vlan_list]
• [32] for non-tagged vlan 32
• [T4,6,8] for tagged vlans 4, 6, and 8
• [12/T14,70] for non-tagged vlan 12 with tagged vlans 14 and 70
• [Trunk] for generic <defined elsewhere> trunk with tagged vlans; shorthand

Tips #6 - Faking an Admin vlan on the Netgear GS108Ev3 and GS116Ev2

My network at home is distributed and I try to minimize the number of wires going throughout the house.  That becomes a problem if you are single switch dependent.  But with judicious use of vlans throughout the house, I can distribute these through the use of trunk lines.  One thing I am very conscious about is security in the network.  I make judicious use of Admin vlans in order to keep the network framework from being changed by someone who has hacked into my system.

I went out and bought a GS108Ev3 thinking it was a good and cheap alternative to the GS108Tv2.  Boy was I wrong.  My focus on security took a nose dive, or so I thought, when I started incorporating this switch into my network.  It was the same thing for the GS116Ev2 when I added this switch.  If you follow a simple set of rules, you can keep your Admin vlan:

1. a normal Netgear managed switch like the GS108Tv2 has an Admin vlan capability.  In fact, you can actually put the vlan number into a field in the web interface.  The switch will use this vlan number to accept DHCP IP addresses for the switch.  If you fix the IP address of the switch, you will need to be in the subnet of the Admin vlan for the switch to work.
2. there is a new class of Netgear switches, like the GS108Ev3 and the GS116Ev2 which are simplified but have much of the capabilities of the GS108Tv2.  One of the capabilities that is missing is the Admin vlan.  There is no field to set it and you are forced to use vlan 1 in some manner to interface to your network.  You do that on a trunk port
3. On GS108Ev3/GS116Ev2: either use DHCP or set the IP address/Gateway to be within the Admin vlan subnet
4. On GS108Ev3/GS116Ev2: set vlan 1 to be untagged on the trunk port; set the Admin vlan to be tagged on the trunk port; set the Admin vlan to be the PVID on the trunk port
5. On GS108Tv2/M4100: set the Admin vlan to be the PVID on the trunk port; set the Admin vlan to be tagged on the trunk port
6. On GS108Ev3/GS116Ev2: no other ports may have vlan 1 as untagged, except the trunk ports

Not a difficult configuration, but as long as you remember the rules you can get an Admin vlan on these GS108Ev3/GS116Ev2 switches.

Network General - added an EdgeRouter X as an OpenVPN server

I had attempted to use one of the GL-iNet routers (AR800M) to act as an OpenVPN server on my network.  I setup one of the vlans from the Main Router and had a whole lot of problems with the setup.  I discovered that the EdgeRouter-X (ER-X) was only $65 from MicroCenter and a lot of people indicated that is was an easy setup for OpenVPN.  I decided that what I would do was setup a vlan from the Cisco router with one of my unused vlans that flows throughout the network.  So I designated one of my many vlans to be an “OpenVPN passthrough”.  This will be similar in concept to the No-Mans Land vlan that I have been using for some time.  The “OpenVPN passthrough” vlan will be setup so that you cannot change the Cisco router and you cannot access any other vlan.  I will also punch some ports through the Cisco router to the Wan port of the ER-X.  The OpenVPN setup is shown at https://help.ui.com/hc/en-us/articles/115015971688-EdgeRouter-OpenVPN-Server.  I have found this to be a very easy setup.  I also generated some additional OpenVPN client cents to use with my cell phones, iPads, and laptops.

Network General - Removed Quantum and re-arranged network to cover

After discovering that the Verizon Quantum router had pretty much bit the dust, I replaced the MOCA network with a Motorola MoCA 2.0 adapter and moved the Cisco router into its place.  I am really disgusted with myself on not having done this sooner.  The Cisco is very capable of the throughput speeds that my FIOS connection provides.  In addition, I now have lots of vlan and QoS capability that I did not have before with the network.

I did discover however, when I went on a trip and dropped down a bunch of the equipment, that there are some network components that cannot be taken down without causing problems in other parts of the network.  As I am typing this, my PWS is currently down because I took power away from a necessary component.  So now I am on a mission to make the network efficient to be able to take most of the network down, including servers and the like, but still be able to function with other areas like the Television and Media transport.

So now I am on a mission to rearrange the patch panels and switch setup so that there will not be a hiccup in the future.

Network General - Had major crash in the network

I suffered a major crash in my network last weekend.  What ever happened it borked my PWS Raspberry Pi setup.  That was when I discovered that the network, specifically the Verizon Quantum router, was no longer getting DHCP assigned IP numbers.  I did some tracing and found out that all of my TiVo equipment no longer had IP addresses.

When I went to troubleshoot the Quantum, I discovered that it no longer recognized the FIOS cable that was plugged into it.  I checked everywhere for potential hardware breakages that would explain it but it would come up for a few seconds and then disappear.  That is when I decided to take the Quantum out of the loop.  For one, it was no longer issuing IP addresses from its DHCP server and the TV cable thing.  I ordered a Motorola MOCA 2.0 adapter even though the TiVo Bolt was capable of setting up a MOCA network (I might still use this at a later date though).  The real problem was the fact that the TiVo equipment (Bolt and 2 Minis) were not responding at all and had taken on Bonjour addresses.  The Mini was able to communicate with the Bolt, but could not get back to the TiVo home page to receive updates.  It also appeared that this was causing some issues in using the TiVo equipment.

I then added a vlan behind my Cisco router and moved all of the TiVo equipment there.  When the MOCA adapter came in, I put it on the FIOS cable and connected it to the same vlan as the TiVo equipment.  I then saw that my TiVo equipment had IP addresses and could be updated from the TiVo site.

I determined that the weewx setup on my Raspberry Pi had failed.  It was causing kernel panics.  I then changed out the RPi hardware and setup a new weewx software build and got the PWS back online.

All of my traceback seemed to indicate that the Quantum had undergone a hard failure, no amount of reseting the Quantum seemed to revive it's capabilities.  So I made the decision to phase out the Quantum router.  I was able to get to the outside through the Quantum, but only because my Cisco Router has a manually assigned IP address in the Quantum LAN subnet.  I did some research and it seems that it is a fairly simple matter to take down the Quantum and bring up the Cisco in its place.

Will report back when I get this working.

The Network That Could #1 - Introduction

I have had people ask me what I do with my network at home.  To that, I can only say that I use it as a playground for whatever strikes my fancy.  My job is in engineering and lately it has been more focused on security engineering.  I don't get a lot of hands on at work at my level.  My home network is a way of letting off steam and learning some things in the process.  So here is a simple intro to what I do with my network in case you were interested.

I mostly use my home network for experimentation but I also have parts of the network which are specific to media streaming (TiVo, Plex) and outbound connection.  My "homelab" is rather distributed throughout the house depending on its purpose.  In my home network I have 7 managed switches (Netgear GS108Tv2 / GS116Ev2 / GS108Ev3) spread throughout my house, all connected with each other through a series of "trunk" lines. Each "trunk" line carries multple vlans in a 802.1q sense. Some of the vlans are "patch" vlans which give me the ability to patch an Ethernet connection from one location to another.  I have the switches set to prevent crossover between vlans and isolate the management to a specific vlan that is normally not connected to anything. Ports that are not used are set to a "fake" vlan that goes nowhere out of the switch for security.

I play around a lot with media, Raspberry Pis, hacking, Weather station things, and just learning weird networking things. I have a couple of servers in the network running VMs (not located in the same part of the house) and at any moment I might want to access something across the network and might need a cable or two for some reason. I just change the ports to use one of several predefined "patch" vlans and connect up to the switches. It saves a lot of time trying to pull a new Ethernet cable, especially if it is going from the basement to the attic and on to the roof.

I have one vlan, full of Raspberry Pis and Arduinos, with several ongoing projects: e.g., one is a settup to use for Christmas light switching and another is a midi project in containers that use Raspberry Pis loaded with Docker. The other vlan is being used for some experiments with routing protocols, including Quagga and IPSec within IPSec tunnels for security.

I have a hacking vlan in my home network. There are a lot of VMs and things there that are VERY vulnerable to attack - on purpose, so I can personally learn how to break into them.  This vlan is very isolated from the outside.

I'm also cheap!  I'm using Ubuntu (free) to host VMs under KVM (free) on a <$250 AMD 8core FX with 16GB memory and 1TB drive with a stolen (from another project) cabinet and power supply. I have also been playing with Docker in the same setup. I've got a number of Linux VMs and also Windows 7 and Windows 10 VMs that started out as VMWare VMs.  The Ubuntu box provides a number of pfSense VMs for routing between some vlans.  This is in addition to a Mac Mini server and several Raspberry Pis setup in multiple clusters for experimentation.

Basically, all of this grew out of getting familiar with "networking stuff" and adds to my knowledge on the job as a Systems/Software/Security Engineer.

Project #1 - Adding a Macintosh Server to the Network

I decided to add a Macintosh Server to my Network.  The thought was to be able to connect the Server to one of my televisions to be able to serve up media.