Quartz 5

R-HQ

3 min read

HOSTNAMEDNS RECORD(S)IPV4 ADDRESSIPV6 ADDRESS
R-HQ(none)10.10.10.1/24,
10.10.20.1/24,
10.10.30.1/24,
198.51.100.2/29,
198.51.100.17/30		2001:db8:39:1::2/64,
2001:db8:39:4::1/64
Allowed options: - FRRouting (recommended) with OSPFv2 for IPv4 and OSPFv3 for IPv6, or - FRRouting with BGP for IPv4 and IPv6.

Install and configure an NTP server on R‑HQ and R‑BR, synchronized to ntp.skylink.dk. - Synchronize all HQ machines to R‑HQ. - Synchronize BR‑SRV to R‑BR.

R‑HQ is the edge router and firewall of the HQ site.

  1. NAT requirement (IPv4): HQ internal networks must not reach the Internet with private addressing. ▪ Use source NAT pool: 198.51.100.64/26.
  2. Firewall requirement (IPv4): public services of HQ must be accessible from the Internet on IPv4. ▪ Configure the firewall using nftables. ▪ Default policy: drop incoming. ▪ Allow only the minimal traffic required for the services to work. ▪ Public services in HQ: DNS, mail, web, CRL (see DMZ tasks).
  3. Ensure a secure channel between HQ and BRANCH. ▪ Implement a site‑to‑site VPN between R‑HQ and R‑BR. ▪ You may choose the technology (WireGuard or IPsec), but inter‑site traffic must be encrypted.
  4. Configure remote access VPN for remote workers. ▪ VPN must be accessible on IPv4 and IPv6. ▪ VPN clients must access the same resources as HQ clients (LAN + shared services).

Настройка

hostnamectl hostname R-HQ
timedatectl set-timezone Europe/Stockholm
 
vi /etc/resov.conf.head
	search aarhus.vikingtoys.dk
	domain aarhus.vikingtoys.dk
	nameserver 10.10.20.11
 
vi /etc/network/interfaces
	auto ens3
	iface ens3 inet static
		address 198.51.100.2/29
	iface ens3 inet6 static
		address 2001:db8:39:1::2/64
		
	auto ens4
	iface ens4 inet static
		address 198.51.100.17/30
	iface ens4 inet6 static
		address 2001:db8:39:4::1/64
		
		
	auto ens5
	iface ens5 inet static
		address 10.10.10.1/24
		
	auto ens6
	iface ens6 inet static
		address 10.10.20.1/24
		
	auto ens7
	iface ens7 inet static
		address 10.10.30.1/24
	
 
sysctl net.ipv4.ip_forward=1 >> /etc/sysctl.d/test.conf # це типо на уровне ядро, будет диномически для всего включатся
sysctl net.ipv4.conf.all.forwarding=1 >> /etc/sysctl.d/test.conf # це типо для интерфейсов которые при загруке были
sysctl net.ipv6.conf.all.forwarding=1 >> /etc/sysctl.d/test.conf
sysctl -p /etc/sysctl.d/test.conf

OSPF

apt install frr -y
 
vi /etc/frr/daemons
	ospfd=yes
	ospf6d=yes
 
service frr start
service frr status
 
 
vtysh
	conf t
		router ospf
			network 198.51.100.0/29 area 0
			network 198.51.100.16/30 area 0
		router ospf6
			ospf6 router-id 2.2.2.2
			exit
		int ens3
			ipv6 ospf6 area 0
		int ens4
			ipv6 ospf6 area 0
			exit
		exit
	clear ipv6 ospf6 process
	do wr
 
# мб перезапустить че-нить демона или устройство

chrony

apt install chrony -y
 
vi /etc/chrony/chrony.conf
	server ntp.skylink.dk
	bindacqdevice ens5
	bindacqdevice ens6
	bindacqdevice ens7
	allow all
 
service chrony start

DHCP

apt install isc-dhcp-relay -y
	10.10.10.21 10.10.10.22
	ens5 ens7

NFTABLES

nft add table nat
nft add chain nat postrouting '{type nat hook postrouting priority 100;}'
nft add rule nat postrouting oifname { ens3, ens4 } masquerade
 
nft add chain nat prerouting '{ type nat hook prerouting priority 100; }'
nft add rule nat prerouting iifname { ens3, ens4 } tcp dport { 53 } dnat 10.10.20.11
nft add rule nat prerouting iifname { ens3, ens4 } udp dport { 53 } dnat 10.10.20.11
nft add rule nat prerouting iifname { ens3, ens4 } tcp dport { 80, 443, 8080 } dnat 10.10.20.12
nft add rule nat prerouting iifname { ens3, ens4 } tcp dport { 143, 587, 993, 25 } dnat 10.10.20.12 
 
echo "flush ruleset" > /etc/nftables.conf
nft list ruleset >> /etc/nftables.conf

WireGuard

apt install wireguard
 
man wg | grep Interface] -A 8 > wg0.conf
man wg | grep tee > gen_key.sh
 
 
--> vi /etc/wireguard/wg0.conf
==============================
	[Interface]
	Address = 10.30.10.1/24
	ListenPort = 51820
	privatekey = <Server private key>
	
	[Peer]
	publickey = <Client-BR public key>
	endpoint = 198.51.100.18:51820
	allowedips = 10.20.10.0/24, 10.20.30.0/24, 10.30.10.2/32
	[Peer]
	publickey = <Client-HOME public key>
	allowedips =  10.30.10.3/32
==============================
 
systemctl enable wg-quick@wg0
systemctl start wg-quick@wg0

Graph View