Quartz 5

R-BR

2 min read

HOSTNAMEDNS RECORD(S)IPV4 ADDRESSIPV6 ADDRESS
R-BR(none)10.20.10.1/24,
10.20.30.1/24,
198.51.100.10/29,
198.51.100.18/30		2001:db8:39:2::10/64,
2001:db8:39:4::2/64
Allowed options: - FRRouting (recommended) with OSPFv2 for IPv4 and OSPFv3 for IPv6, or - FRRouting with BGP for IPv4 and IPv6.

Install and configure an NTP server on R‑HQ and R‑BR, synchronized to ntp.skylink.dk. - Synchronize all HQ machines to R‑HQ. - Synchronize BR‑SRV to R‑BR.

  1. NAT requirement (IPv4): Branch networks must not reach the Internet with private addressing. ▪ Use source NAT pool: 198.51.100.128/26.
  2. Firewall requirement (IPv4): public services of the BRANCH site must be accessible from the Internet on IPv4. ▪ Configure the firewall using nftables. ▪ Default policy: drop incoming. ▪ Allow only the minimal traffic required for the services to work. ▪ Public services hosted in the Branch: DNS + WEB.
  3. Ensure a secure channel between HQ and BRANCH (site‑to‑site VPN with R‑HQ).

Настройка

hostnamectl hostname R-BR
timedatectl set-timezone Europe/Stockholm
 
vi /etc/resov.conf.head
	search odense.vikingtoys.dk
	domain odense.vikingtoys.dk
	nameserver 10.20.10.11
 
vi /etc/network/interfaces
	auto ens3
	iface ens3 inet static
		address 198.51.100.10/29
	iface ens3 inet6 static
		address 2001:db8:39:2::10/64
		
	auto ens4
	iface ens4 inet static
		address 198.51.100.18/30
	iface ens4 inet6 static
		address 2001:db8:39:4::2/64
		
		
	auto ens5
	iface ens5 inet static
		address 10.20.10.1/24
		
	auto ens6
	iface ens6 inet static
		address 10.20.30.1/24
 
sysctl net.ipv4.ip_forward=1 >> /etc/sysctl.d/test.conf # це типо на уровне ядро, будет диномически для всего включатся
sysctl net.ipv4.conf.all.forwarding=1 >> /etc/sysctl.d/test.conf # це типо для интерфейсов которые при загруке были
sysctl net.ipv6.conf.all.forwarding=1 >> /etc/sysctl.d/test.conf
sysctl -p /etc/sysctl.d/test.conf

OSPF

apt install frr -y
 
vi /etc/frr/daemons
	ospfd=yes
	ospf6d=yes
 
service frr start
service frr status
 
 
vtysh
	conf t
		router ospf
			network 198.51.100.8/29 area 0
			network 198.51.100.16/30 area 0
		router ospf6
			ospf6 router-id 3.3.3.3
			exit
		int ens3
			ipv6 ospf6 area 0
		int ens4
			ipv6 ospf6 area 0
			exit
		exit
	clear ipv6 ospf6 process
	do wr
 
# мб перезапустить че-нить демона или устройство

chrony

apt install chrony -y
 
vi /etc/chrony/chrony.conf
	server ntp.skylink.dk
	bindacqdevice ens5
	bindacqdevice ens6
	allow all
 
service chrony start

WireGuard

apt install wireguard
 
--> vi /etc/wireguard/wg0.conf
==============================
	[Interface]
	Address = 10.30.10.2/24
	ListenPort = 51820
	privatekey = <Client-BR private key>
	
	[Peer]
	publickey = <Server-HQ public key>
	endpoint = 198.51.100.18:51820
	allowedips = 10.10.10.0/24, 10.10.20.0/24, 10.10.30.0/24, 10.30.10.0/24
==============================
 
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

DHCP

apt install isc-dhcp-relay -y
	10.20.10.11
	ens5 ens6

Graph View