ARFNET2 deployment

After the disastrous ISP schism

Masterplan

Stage 1: very safe

• Close all ports
• Nuke (or stop) all old VMs (exclude OPNSense)
• Make DMZ
• Make new basic VMs (cloning deb12 template)
• Open basic ports

Stage 2: new services

• IONOS VPS for mail
• Some new very safe services
• HE IPv6 tunnel
• Own authoritative nameservers for domain zone

Stage 3*: finally

• Another VPS in unknown provider for
  • Tor
  • Reverse-proxying the media library
• PHP on main site with more web services from scratch, hopefully secure
• More new services

Stage 4: DN42

• Make DN42 router VM with bird and wg
• Peer with people
• Bring up BGP sessions
• Services

Stage 5: Telephony - Asterisk - IP phones and ATAs - Trunks; SDF, Tandmx, uwutel, PSTN

Stage 6*: Site B (piso)

• Firewall and switch
• Site to Site wireguard
• Establish telephony

Domain

arf20.com

Registrar: namecheap

Name sever glue records at registrar

Networking

Hardware

                   WAP
                    |
       +-----+   +--------------------------+     +----------------+
ISP ===| ONT |---| DELL switch              |-----| TP-Link switch |
       +-----+   +--------------------------+     +----------------+
                    |        |          |                |
                    |        |          |                |
                 +---------------+  Rest of devices   Living room devices
                 | eno1     eno2 |
                 | server router |
                 +---------------+
                   
- 1000BASE-T
= GPON fiber

12U rack

+--------------+--------+
| drawer       |        |
| drawer       | PDU    |
| patch panel  |        |
| switch       |        |
|              |        |
| ONT, ATA     |        |
| R720         |        |
| R720         |        |
|              |        |
|              |        |
|              |        |
|              | UPS    |
+--------------+--------+

• ONT: CPE Huawei GPON
• switch: DELL PowerConnect 5424
• server: DELL PowerEdge R720 @ 2x E5-2670 + 64GB + (240+120)GB SSD + (4+3x7RAID5)TB HDD
• ATA: Cisco/Linksys PAP2T

DELL PowerConnect 5424 switch

Port assignents

Management

• interface vlan 4: 192.168.4.2/24 gw 192.168.4.1

Public IPs

• AVANZA_STATIC: 2.59.235.35
• AVANZA_CGNAT: dynamic 100.x.x.x
• HE prefixes
  • 2001:470:1f21:125::/64
  • 2600:70ff:f039::/48
• IONOS VPS: 5.250.186.185 2001:ba0:210:d600::1

Gateways

• AVANZA
  • WAN_STATIC: 2.59.235.1
  • WAN_CGNAT: dynamic
• HE v6 tunnel
  • server: 216.66.87.102, 2001:470:1f20:125::1/64
  • client: 2.59.235.35, 2001:470:1f20:125::2

Physical and Logical Networks

Firewall

Interface Rules

• WAN_CGNAT in
  • deny *
• WAN_STATIC in
  • allow v4 from * to {services} –> NAT rules
• DMZ in
  • deny v4 to LAN net
  • allow v4 to firewall
  • allow v4 to * gw WAN_STATIC
  • allow v6 to * gw HE_TUNNELV6
• LAN in
  • allow v4 ICMP to firewall
  • allow v4 IP DNS to firewall
  • allow v4 to DMZ net
  • allow v4 to * gw WAN_CGNAT
  • allow v6 to * gw HE_TUNNELV6
• Wireguard in
  • allow v4+6 to DMZ net
  • allow v4 to * gw WAN_CGNAT
  • allow v6 to * gw HE_TUNNELV6

IPv4 NAT Rules

IPv6 port rules

Hosts

• server - DELL PowerEdge R720 running Proxmox PVE - …
• mail - IONOS VPS running Debian 12 - 5.250.186.185 2001:ba0:210:d600::1
• dark - HostMeNow VPS running Debian 12 - 92.60.77.4

Management

• OPNSense router DMZ.1
• DELL switch DMZ.2
• TP-Link WAP LAN.2
• Proxmox hypervisor DMZ.4
• DELL server iDRAC DMZ.5
• HP printer DMZ.7
• Linksys ATA DMZ.18

server VMs and services

server runs Proxmox PVE.

All VMs are Debian 12 (templated) with wazuh agent

proxmox DMZ.4 (hypervisor)

• SSH
• Proxmox management interface :8006
• smartmon + node exporter :9100
• sensor exporter*
• NUT - Network UPS TOols daemon (and proper UPS)*

router DMZ.1

• (routing/firewalling)
• SSH
• DHCP
• unbound DNS
• OpenVPN
• WireGuard
• IPsec
• ntopng :3000
• telegraf - note: editing config via webfig breaks (timeout and unbound config)

nas DMZ.6

RAID attached here (with the grey stuff) (local only)

• SSH
• NFS
• Samba SMB*
• MiniDLNA*
• FTP
• qBittorrent-nox
• jellyfin
• nginx
• mpd :8000

web DMZ.9

• SSH
• cerbot
• nginx (status at :8080)
• fastcgi PHP
• mariadb SQL
• nginx-prometheus-exporter :9113
• prometheus :9090
• telegraf
• influxdb :8086
• grafana :3000
  • Proxmox
  • nginx
  • iDRAC
• zabbix*
• netbox*
• fcgiwrap
• git-http-backend - git smart http server CGI
• gitd - git daemon
• cgit - web frontend for git
• phpBB - forum software
• Jekyll - blog static site generator thing
• opentracker? - bittorrent tracker*
• gophernicus - gopher server*
• photoprism - photo shit
• squid - http proxy server :3128

secure DMZ.10

• SSH
• wazuh*
• vaultwarden :8000

game DMZ.11

• SSH
• waterfall (minecraft reverse proxy) :25565
  • mclobby (auth)
  • minepau*
• panaland mc modded :25566
• css dedicated server :27015

comm DMZ.12

• SSH
• cerbot
• unrealircd - IRC
• synapse - matrix
• postgresql - DB for synapse
• pantalaimon - encrypt matterbridge traffic to matrix
• matterbridge - bridge channels with different protocols
  • discord
  • matrix
  • irc
  • xmpp
• prosody - XMPP
• coturn - TURN server for matrix and xmpp
• asterisk - VoIP SIP PBX
• hblink :54000
• hbmon :8080 :9000 wesocket

Dialplan

• 1xxx -> users
• 2xxx -> services
• 8xxxxxxx -> tandmx
• 733xxxx -> SDF
• 0119xxxxxxx -> uwutel
• xxxxxx -> regional PSTN
• xxxxxxxxx -> national PSTN
• 00x! -> international PSTN

misc (Deb12 LXC) DMZ.13

• SSH
• iperf3
• bind9 - master authoritative nameserver for arf20.com zone NS1
  • public recursive*
• INN2 - NNTP USENET server with SDF peering
• Discord servers
  • gDebrid (gookie)
• squid - HTTP proxy
• microsocks - SOCKS5 proxy

t2 (T/2 SDE build box) DMZ.15

pubnix (OpenBSD 7.5) DMZ.16

• SSH

cucm (Cisco Unified Communications Manager) DMZ.19

callbox DMZ.20

• Amarisoft Callbox

dn42 DMZ.21

• (ip forward)
• wireguard
• bird eBGP daemon
• bind9 master arfnet.dn42

dn42-services DMZ.23

• bind9 slave
• nginx reverse proxy

| vhost | webroot/proxy | comment

arfnet.dn42 | http://192.168.4.9 | ARFNET in DN42

open5gs DMZ.22

Remote gNodeB

• Open5GC
• Kamailio
• OAI?

mail (ARFNET-IONOS VPS) 5.250.186.185 2001:ba0:210:d600::1

• SSH
• certbot
• postfix - MTA smtpd, submission, submissions config
• dovecot - imapd
• opendkim
• opendmarc
• bind9 - slave authoritative nameserver NS2
• mlmmj - mailing list manager
  • installed to /usr/local/bin/mlmmj-webarchiver.sh and /etc/mlmmj-webarchiver
• mlmmj-webarchiver - mailing list archiver

proxy (ARFNET-HOSTMENOW VPS) 92.60.77.4

• SSH
• IPsec tunnel
• nginx reverse proxy to nas

yero-debian VPS DMZ.192 (yero)

• SSH
• mariadb
• FiveM SuperioresRP

exo-debian VPS DMZ.195 (exo)

• SSH
• netbox

loofa-debian VPS DMZ.196 (loofa)

• SSH
• ?

*TODO

Internal Name and Number Assignation Table

DMZ IPv4s and IPv6 ends in the same way

Site-B:PiSoNet

DNS

Public domain zone

HE v6 rDNS zone

IONOS rDNS zone

Custom ARFNET software

• cstims: client, service, ticket and invoice management system
• lists: mailing list browser
• status: status monitor