Edge Router, Sophos UTM, DMZ and LAN Networks

Posted on 30 September 2015.

I have been using an EdgeRouer POE as my main router for most of the network (some of the network still uses PFSense as a router, but thats being removed soon) for the last few weeks, and i am quite happy with it. I also have a second router, a Sophos UTM VM between my first LAN (essentially a DMZ) and my client LAN (there will be more “LANs” over there soon). The Client LAN is NATed between the DMZ and the LAN, which means anything on the LAN i want to access from the DMZ has to be port forwarded… Ideally, not much from the LAN should be accessable though the DMZ, but in my initial setup, stuff like Plex, etc, is…

What i wanted to do was setup a proper firewall between both networks, without the use of NAT… Do do this, i first had to disable th masquerading rules in Sophos:

Masquerading Off

next, on the EdgeRouter, i added a static route to point at the new network:

static route

And finally, under firewall rules, i allowed what i wanted to allow (in this case, SSH from any DMZ client (not adviced) to my Mac Mini).

firewall rules

And that, as they say, is that! So far, so good!

Network and HomeLab V.Next (Part 4)

Posted on 16 September 2015.

So, after some messing, tweaking, and thinking, I have made some progress with the home lab… or at least broken some stuff… I mentioned previously that i had a Ubiqititi networks EdgeRouter POE in the home lab. Originally, the plan was to use a Virtual PFSense box for my core router… Given the power usage of the current PFSense Box (I have 2 MPower Pro’s watching power in the lab) I am now thinking of moving to just the EdgeRouter for, well, edge routing… below is the usage of the Priliant for the last 12 hours or so:

Proliant Power Usage

for the same period, here is the usage for the Edge Router:

EdgeRouter POE Power Usage

I am also setting up a DMZ for front facing services, and then a LAN for inside facing machines. There will be a firewall (currently thinking Sophos UTM or simular) between the DMZ and the network. Some machines will be able to access the DMZ, and there may be machines allowed into the LAN, but only some things… not even sure if that would be done…

I also need to work out the VLAN side of things. I have currently though of the following VLAN setup:

  • WAN 1 (connected directly to the Cable modem)
  • WAN 2 (again, direct to cable modem)
  • LAN Network
  • DMZ Network
  • VoIP Network
  • IOT (stuff for running the house, like Nest, the MPower devices or the like)
  • Media Network (Plex, Roku, Apple TV, Chrome Cast, etc. Not sure if i need to seperate this, but it might be done…)

The current Cisco 3560G switch should do all that, without problems, so no new switch needed… lets see what i can break over the next while…

Windows Server 2012 R2 returning to The GodBoxV2

Posted on 23 August 2015.

After a few months of running Sabayon Linux on the GodboxV2, i am going back to Windows Server. Back around October of last year, i installed Windows 10 Preview on the GodBoxV2, and, well, there where issues with graphics drivers, etc. Then, some time after, i cant remember off hand when, i moved to Sabayon Linux. Its based on Gentoo but has a lot of the components pre-built. Gentoo is a “Build from scratch” sort of OS. You get a basic kernel and a basic set of compoents, but you build everything else from scratch… including rebuilding the kernel if you want. Sabayon, on the other hand has all that mostly prebuilt, though you can still use Gentoo’s Portage to build stuff yourself.

Anyway, for the last few months, all was going mostly well… but I miss Windows. And, given i have pretty much always ran a server OS on my main workstations, I am heading back to Server 2012R2. I was tempted by 2016, but its still very early days… Maybe i will run it as a VM for a while, but we will see…

ZFS Home storage pool

Posted on 10 August 2015.

Over the weekend, my BTRFS pool for my /home directory on Linux failed… Not sure what happened, but it made me do something i wanted to do for a while: Build a ZFS pool for my home dir.

First things first, the pool consists of 4 2Tb hard drives and 1 128Gb SSD. Its setup in RAIDZ1 (equivilent of RAID 5) and then the SSD is set for caching.

To create the pool i ran

zpool create home raidz sda sde sdf sdg

then, to add the cache drive

zpool add home cache sdd

the pool (in my case) got mounted to /home, and then i restored my backup to it. to do some tests, i can the following…

614MB/s write and 5.3GB a second read is nothing to be sniffed at! :)

Ubiquiti EdgeRouter PoE in the lab

Posted on 05 August 2015.

Today, my Ubiquiti EdgeRouter POE arrived in the house. I got it hooked up to both UPC connections (as secondary connections) and all seems to be working grand. Some notes i wanted to put up here:

  • out of the box, the install was quite simple. set my ethernet connection to a static ip in the 192.168.1.x/24 range, using as gateway and dns, and then point at for admin. login (ubit for both username and password) and heay presto. I was asked did i agree to the license, and then im in.
  • by default, NAT is off… i turned it on, and enabled DNS and was able to surf.
  • I also noticed the software was out of date… Oddly, there did not seem to be an option to update automatically, but you can manually download the tar and upload it, which i did.
  • so far, so good… not sure yet if i will be using it as my main router, but it may end up being a VoIP router.

Finally, speed test result below:

Speed Test Result

More Ubiquiti stuff arriving tomorrow… will post more stuff then.


Geek, From Dublin, Ireland. What more can i say?

Contact Details

Tiernan OToole
Twitter: @tiernano
Irish Ph: +353-1-555-1245
UK Ph: +44-845-869-2488
US Ph/SMS: +1-404-806-9387
Skype: tiernanotoole