Tiernan's Comms Closet

Geek, Programmer, Photographer, network egineer…

Monthly Archives September 2015

Edge Router, Sophos UTM, DMZ and LAN Networks

September 30, 2015
0 Comments

I have been using an EdgeRouer POE as my main router for most of the network (some of the network still uses PFSense as a router, but thats being removed soon) for the last few weeks, and i am quite happy with it. I also have a second router, a Sophos UTM VM between my first LAN (essentially a DMZ) and my client LAN (there will be more “LANs” over there soon). The Client LAN is NATed between the DMZ and the LAN, which means anything on the LAN i want to access from the DMZ has to be port forwarded… Ideally, not much from the LAN should be accessible though the DMZ, but in my initial setup, stuff like Plex, etc, is…

What i wanted to do was setup a proper firewall between both networks, without the use of NAT… Do do this, i first had to disable th masquerading rules in Sophos:

<img srcset=" https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-masquerading-off.png&width=500 500w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-masquerading-off.png&width=710 710w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-masquerading-off.png&width=1000 1000w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-masquerading-off.png&width=1420 1420w” src=”https://images.tiernanotoole.net/Image/?inputImage=v1530620916%2f20150930-masquerading-off.png&width=500” alt=””>

next, on the EdgeRouter, i added a static route to point at the new network:

<img srcset=" https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-static-route.png&width=500 500w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-static-route.png&width=710 710w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-static-route.png&width=1000 1000w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-static-route.png&width=1420 1420w” src=”https://images.tiernanotoole.net/Image/?inputImage=v1530620916%2f20150930-static-route.png&width=500” alt=””>

And finally, under firewall rules, i allowed what i wanted to allow (in this case, SSH from any DMZ client (not advised) to my Mac Mini).

<img srcset=" https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-firewall-rules.png&width=500 500w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-firewall-rules.png&width=710 710w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-firewall-rules.png&width=1000 1000w, https://images.tiernanotoole.net/Image/?inputImage=v1530620916/20150930-firewall-rules.png&width=1420 1420w” src=”https://images.tiernanotoole.net/Image/?inputImage=v1530620916%2f20150930-firewall-rules.png&width=500” alt=””>

And that, as they say, is that! So far, so good!

Network and HomeLab V.Next (Part 4)

September 16, 2015
0 Comments

So, after some messing, tweaking, and thinking, I have made some progress with the home lab… or at least broken some stuff… I mentioned previously that i had a Ubiqititi networks EdgeRouter POE in the home lab. Originally, the plan was to use a Virtual PFSense box for my core router… Given the power usage of the current PfSense Box (I have 2 MPower Pro’s watching power in the lab) I am now thinking of moving to just the EdgeRouter for, well, edge routing… below is the usage of the ProLiant for the last 12 hours or so:

<img srcset=" https://images.tiernanotoole.net/Image/?inputImage=20150916-proliant-power-usage.PNG&width=500 500w, https://images.tiernanotoole.net/Image/?inputImage=20150916-proliant-power-usage.PNG&width=710 710w, https://images.tiernanotoole.net/Image/?inputImage=20150916-proliant-power-usage.PNG&width=1000 1000w, https://images.tiernanotoole.net/Image/?inputImage=20150916-proliant-power-usage.PNG&width=1420 1420w” src=”https://images.tiernanotoole.net/Image/?inputImage=20150916-proliant-power-usage.PNG&width=500” alt=””>

for the same period, here is the usage for the Edge Router:

<img srcset=" https://images.tiernanotoole.net/Image/?inputImage=20150916-edgerouter-power-usage.PNG&width=500 500w, https://images.tiernanotoole.net/Image/?inputImage=20150916-edgerouter-power-usage.PNG&width=710 710w, https://images.tiernanotoole.net/Image/?inputImage=20150916-edgerouter-power-usage.PNG&width=1000 1000w, https://images.tiernanotoole.net/Image/?inputImage=20150916-edgerouter-power-usage.PNG&width=1420 1420w” src=”https://images.tiernanotoole.net/Image/?inputImage=20150916-edgerouter-power-usage.PNG&width=500” alt=””>

I am also setting up a DMZ for front facing services, and then a LAN for inside facing machines. There will be a firewall (currently thinking Sophos UTM or similar) between the DMZ and the network. Some machines will be able to access the DMZ, and there may be machines allowed into the LAN, but only some things… not even sure if that would be done…

I also need to work out the VLAN side of things. I have currently though of the following VLAN setup:

  • WAN 1 (connected directly to the Cable modem)
  • WAN 2 (again, direct to cable modem)
  • LAN Network
  • DMZ Network
  • VoIP Network
  • IOT (stuff for running the house, like Nest, the MPower devices or the like)
  • Media Network (Plex, Roku, Apple TV, Chrome Cast, etc. Not sure if i need to separate this, but it might be done…)

The current Cisco 3560G switch should do all that, without problems, so no new switch needed… lets see what i can break over the next while…

DevDmBootstrap4 Created by Danny Machal (DevDm.com)