Difference between revisions of "HoerupNet"
(→Host timon) |
|||
Line 26: | Line 26: | ||
*Traffic shaping | *Traffic shaping | ||
*Static route: route add -net 192.168.20.0/24 gw 192.168.10.5 | *Static route: route add -net 192.168.20.0/24 gw 192.168.10.5 | ||
− | * DHCP Server | + | *ISC DHCP Server |
**Serves IP addresses as described above | **Serves IP addresses as described above | ||
+ | *bind9 DNS server | ||
*SSH server | *SSH server | ||
**For remote admininistration (only available from internal network) | **For remote admininistration (only available from internal network) |
Revision as of 22:47, 10 November 2008
Description of my personal network
Network diagram
IP Address
The network uses the RFC1918 private IP range 192.168.10.0/24 Theres no local DNS server, all hosts uses upstream ISP dns servers. All hosts get network information from the DHCP server, but some hosts get a fixed address based on MAC address. The dynamic range is 192.168.10.30-100.
Host timon
Timon is the gateway and firewall for the network.
Timon runs the following services
- Firewall
- Homebuild iptables script with source / destination nat and forward filtering
- DNAT
- http->rafiki
- smtp->rafiki
- openvpn->rafiki
- (mldonkey ports)->rafiki
- 443->rafiki:22
- VNC->pumba
- outgoing traffic is SNAT'ed
- Traffic shaping
- Static route: route add -net 192.168.20.0/24 gw 192.168.10.5
- ISC DHCP Server
- Serves IP addresses as described above
- bind9 DNS server
- SSH server
- For remote admininistration (only available from internal network)
- TFTP
- Used For PXE installations.
- SNMP
- cron
- chkrootkit / rkhunter / ntpdate / logrotate / logwatch (logwatch recipient torben@t-hoerup.dk)
- nullmailer
- forwarding local-generated mail to rafiki
- /etc/mailname:timon.t-hoerup.dk
- /etc/nullmailer/remotes:rafiki.t-hoerup.dk
Host Rafiki
Rafiki is the server
(VPN access is regarded as internal network access)
Unless specified otherwise the daemons listens on all network interfaces.
Rafiki runs
- SSH server
- Apache webserver
- With mod_php5, mod_dav_svn, mod_python, mod_proxy
- Hosts all vhosts listed in http://status.t-hoerup.dk/vhosts.php
- Hosts subversion repository
- Wiki
- Pastebin
- SQL webfrontends
- Is reverse proxy for those webservices that has their own http engine (such as mldonkey, and tomcat)
- MySQL
- PostgreSQL
- Mldonkey for file download
- bittorrent
- donkey
- overnet
- basic HTTP
- Squid http proxy
- port 3128
- Non caching
- available to internal network only
- Proftpd
- File transfer - Only available to internal network (from outside scp/sftp should be used)
- Postfix SMTP MTA
- Dovecot IMAPd
- OpenVPN
- TUN / UDP based
- Listens on port 1494
- Uses subnet 192.168.20.0/24 for tunnels
- Full access to 192.168.10.0/24 available via vpn
- Smokeping
- Apache Tomcat
- smsdaemon
- MRTG
- webalizer
- cron
- chkrootkit / rkhunter / ntpdate / logrotate / logwatch (logwatch recipient torben@t-hoerup.dk)
- torben's crontab
- 05 */3 * * * /home/torben/bin/getmail-silent
- 05 05 * * * cp /var/spool/mail/torben /home/torben/Mail/inbox-backup
Access Point
- SSID: hoerup
- Encryption: WPA2-PSK
- Channel: 6