Networking and 1U Colocation

EddieJennings

@jaredbusch said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

To manage my host over the Internet, I'd have a NAT rule that would direct SSH traffic to VM in item three.

Never.

Use ZeroTier on your host. In the instance that it fails, use the colo's KVM to fix it.

I’ve heard of ZeroTier. Time to learn something about it.

JaredBusch

@eddiejennings said in Networking and 1U Colocation:

@jaredbusch said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

To manage my host over the Internet, I'd have a NAT rule that would direct SSH traffic to VM in item three.

Never.

Use ZeroTier on your host. In the instance that it fails, use the colo's KVM to fix it.

I’ve heard of ZeroTier. Time to learn something about it.

Here you go.
https://www.zerotier.com/

https://mangolassi.it/topic/16853/installing-zerotier-on-fedora

scottalanmiller

@eddiejennings said in Networking and 1U Colocation:

@jaredbusch said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

To manage my host over the Internet, I'd have a NAT rule that would direct SSH traffic to VM in item three.

Never.

Use ZeroTier on your host. In the instance that it fails, use the colo's KVM to fix it.

I’ve heard of ZeroTier. Time to learn something about it.

Very good product.

AdamF

@jaredbusch said in Networking and 1U Colocation:

@travisdh1 said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

I'm thinking through this topology a bit further:

Eth0 on host passes traffic via macvtap to FirewallVM (100.100.100.2/30).

Isolated network connects FirewallVM to the rest of the guest VM.

Isolated network connects one of the guest VMs to the host VM.

To manage my host over the Internet, I'd have a NAT rule that would direct SSH traffic to VM in item three. Once connected to that VM, then I'd SSH from there to my host -- basically making that guest VM jump box.

VyOS has ssh built in.... just saying.

Umm WTF? Open SSH to the world? On your router? Fuck that.

Your direct, to the point responses, often have me LOLing.

EddieJennings

Here's an updated diagram.

I'm wondering about how to do updates on the KVM host. Since there will be only one NIC with an connection to the colo's network, and that NIC is attached to the FirewallVM, it seems that the KVM host will have to have a way to send / receive traffic to / from the FirewallVM to have an Internet connection. Perhaps one alternative would be to setup a VM that acts like a repository for the updates I'd get through dnf and the KVM host would talk to that VM to get its software updates.

The other thing I'm thinking about is how I'm going to use Virt-Manager with my KVM host. Methinks this might be where ZeroTier would come in. I could connect to the "VM for managing the host" which would have Virt-Manager installed.

JaredBusch

@eddiejennings said in Networking and 1U Colocation:

Here's an updated diagram.

I'm wondering about how to do updates on the KVM host. Since there will be only one NIC with an connection to the colo's network, and that NIC is attached to the FirewallVM, it seems that the KVM host will have to have a way to send / receive traffic to / from the FirewallVM to have an Internet connection. Perhaps one alternative would be to setup a VM that acts like a repository for the updates I'd get through dnf and the KVM host would talk to that VM to get its software updates.

The other thing I'm thinking about is how I'm going to use Virt-Manager with my KVM host. Methinks this might be where ZeroTier would come in. I could connect to the "VM for managing the host" which would have Virt-Manager installed.

Just add a NIC on you LAN network. Keep it normally disabled. Enable and run updates.

Or just not be super paranoid and just have it on the LAN always.

EddieJennings

@jaredbusch said in Networking and 1U Colocation:

Or just not be super paranoid and just have it on the LAN always.

Ha!

JaredBusch

@eddiejennings said in Networking and 1U Colocation:

@jaredbusch said in Networking and 1U Colocation:

Or just not be super paranoid and just have it on the LAN always.

Ha!

It is no different in that way than one in your office.

In fact you will need a way to the internet for ZeroTier to come online.

StorageNinja

@scottalanmiller said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

@scottalanmiller said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

@aaronstuder said in Networking and 1U Colocation:

What are the specs of the server?

Intel Xeon CPU Quad Core X3430 2.4GHz
32 GB RAM
Two 2 TB SATA drives in RAID 1

Could be worth calling xByte and getting something a little beefier.

I'll give it some thought. I need to think through how I intend to use it beyond just building and destroying VMs just to tinker. Might start a "spec my server" thread.

Your CPU is fine, but 64GB of RAM might be worthwhile.

That CPU dates back to when I began my IT career. I'm fairly certain Intel hasn't released Meltdown/Spectre Microcode patches for it.

Obsolesce

@storageninja said in Networking and 1U Colocation:

@scottalanmiller said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

@scottalanmiller said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

@aaronstuder said in Networking and 1U Colocation:

What are the specs of the server?

Intel Xeon CPU Quad Core X3430 2.4GHz
32 GB RAM
Two 2 TB SATA drives in RAID 1

Could be worth calling xByte and getting something a little beefier.

I'll give it some thought. I need to think through how I intend to use it beyond just building and destroying VMs just to tinker. Might start a "spec my server" thread.

Your CPU is fine, but 64GB of RAM might be worthwhile.

That CPU dates back to when I began my IT career. I'm fairly certain Intel hasn't released Meltdown/Spectre Microcode patches for it.

Dell says a BIOS update for that stuff is in progress, other x10's have been patched:

http://www.dell.com/support/article/us/en/04/sln308588/microprocessor-side-channel-vulnerabilities-cve-2017-5715-cve-2017-5753-cve-2017-5754-impact-on-dell-emc-products-dell-enterprise-servers-storage-and-networking-?lang=en

EddieJennings

Experimented with this tonight, so I figured share what I did. I was curious to see if I could access the iDRAC web interface without exposing iDRAC to the Internet.

The solution I used seemed simple enough. I created another NIC in a VM, and set it to be bridged to the 2nd NIC on the host via macvtap. I gave the NIC a static IP. On the host, I connected the iDRAC port to the 2nd NIC using a crossover cable, and added an appropriate static IP in the DRAC settings. I connected to my VM via ScreenConnect (which for now is how I'll be connecting remotely to my management VM), and was able to browse to the iDRAC web page.

I don't plan on doing this when I ship my server off, but I was curious to see if I could do it and make it work.

black3dynamite

@eddiejennings said in Networking and 1U Colocation:

Experimented with this tonight, so I figured share what I did. I was curious to see if I could access the iDRAC web interface without exposing iDRAC to the Internet.

The solution I used seemed simple enough. I created another NIC in a VM, and set it to be bridged to the 2nd NIC on the host via macvtap. I gave the NIC a static IP. On the host, I connected the iDRAC port to the 2nd NIC using a crossover cable, and added an appropriate static IP in the DRAC settings. I connected to my VM via ScreenConnect (which for now is how I'll be connecting remotely to my management VM), and was able to browse to the iDRAC web page.

I don't plan on doing this when I ship my server off, but I was curious to see if I could do it and make it work.

What about setting up ZeroTier bridge VM?

EddieJennings

@black3dynamite said in Networking and 1U Colocation:

@eddiejennings said in Networking and 1U Colocation:

Experimented with this tonight, so I figured share what I did. I was curious to see if I could access the iDRAC web interface without exposing iDRAC to the Internet.

The solution I used seemed simple enough. I created another NIC in a VM, and set it to be bridged to the 2nd NIC on the host via macvtap. I gave the NIC a static IP. On the host, I connected the iDRAC port to the 2nd NIC using a crossover cable, and added an appropriate static IP in the DRAC settings. I connected to my VM via ScreenConnect (which for now is how I'll be connecting remotely to my management VM), and was able to browse to the iDRAC web page.

I don't plan on doing this when I ship my server off, but I was curious to see if I could do it and make it work.

What about setting up ZeroTier bridge VM?

ZeroTier is my next thing to try. I wanted to do my little iDrac experiment, and I had screenconnect handy. Connecting to my management VM via ZeroTier is probably the best way to go.

Reid Cooper

@eddiejennings ZT is some slick stuff. You'll like it a lot. @adam-ierymenko

travisdh1

@reid-cooper said in Networking and 1U Colocation:

@eddiejennings ZT is some slick stuff. You'll like it a lot. @adam-ierymenko

Yep. When a VPN is needed, it's the easiest/quickest solution I've found.

EddieJennings

@travisdh1 said in Networking and 1U Colocation:

@reid-cooper said in Networking and 1U Colocation:

@eddiejennings ZT is some slick stuff. You'll like it a lot. @adam-ierymenko

Yep. When a VPN is needed, it's the easiest/quickest solution I've found.

One use I'm considering is installing it on my KVM host so I can manage it from home via SSH without having to do additional firewall configuration.

travisdh1

@eddiejennings said in Networking and 1U Colocation:

@travisdh1 said in Networking and 1U Colocation:

@reid-cooper said in Networking and 1U Colocation:

@eddiejennings ZT is some slick stuff. You'll like it a lot. @adam-ierymenko

Yep. When a VPN is needed, it's the easiest/quickest solution I've found.

One use I'm considering is installing it on my KVM host so I can manage it from home via SSH without having to do additional firewall configuration.

FreePBX is what I use it for currently. Just makes so I don't have to arse with setting up dynamic DNS services from the 5 different places I typically work from, let alone all the other random places I end up.

EddieJennings

My final networking challenge is making sure my host is configured to be able to talk to the outside world. This is the current version of the topology.

The question becomes how to configure a default route on the host that sends traffic to virbr1.

I notice in /etc/sysconfig/network-scripts/ there are no scripts for the virtual interfaces. I could use ip route add default via 192.168.1.1; however, that will not survive a reboot.

When I run nmcli I see the bridge (virbr1) with the IP it was assigned via virsh net-edit, since when creating the the network in Virt-Manager it assigned an address of 192.168.1.1, and I wanted the LAN interface on the VyOS firewall to have 192.168.1.1.

Methinks the solution is likely with using nmcli.

JaredBusch

Honestly, if it were me, I would just add a NIC on the LAN to your host and let it reside on your LAN like everything else.

I know other things were mentioned and recommended out of paranoid security concerns, but realistically, that is mitigating such a small risk, that I generally find it not to be worth the effort.

The thought exercise has to be gone through to determine that though.

EddieJennings

@jaredbusch said in Networking and 1U Colocation:

Honestly, if it were me, I would just add a NIC on the LAN to your host and let it reside on your LAN like everything else.

I know other things were mentioned and recommended out of paranoid security concerns, but realistically, that is mitigating such a small risk, that I generally find it not to be worth the effort.

The thought exercise has to be gone through to determine that though.

There is a gap of understanding. The LAN interface of the VyOS VM is connected to virbr1. For the host, do you mean create an interface and [attach] it to virbr1? Or do you mean assigning an IP address to virbr1?

This is how the virtual networks appear on the host (from nmcli).

virbr0: connected to virbr0
	"virbr0"
	bridge, 52:54:00:55:91:EB, sw, mtu 1500
	inet4 192.168.122.1/24

virbr1: connected to virbr1
	"virbr1"
	bridge, 52:54:00:BF:E7:FB, sw, mtu 1500