Network

From NURDspace

Layer 2 overview

Below you can find the structure of the network as of 06-05-2022. Fat lines are 2 x 1GE LACP trunks Layer 2 overview 06-05-2022.svg

Layer 3 overview

we have a single-vlan flat network. Due to legacy, three different prefixes live on this vlan:

  • 10.208.11.0/24 (gateway 10.208.11.1)
  • 10.208.30.0/24 (gateway 10.208.30.1)
  • 10.208.42.0/23 (gateway 10.208.42.1)

This has the issue that traffic between the vlans will always be routed via the gateway, leading to unneeded roundtrips. A project is underway to simplify this, see Network/Renumbering

IP addresses

  • 10.208.30.0/24 is used for static allocations. Register your ip's in IPAM.
  • 10.208.42.0/23 is used for dynamic allocations using DHCP

DNS

search nurd.space lan.nurd.space vm.nurd.space management.nurd.space router.nurd.space dhcp.nurd.space
nameserver 10.208.30.254

Layer 3 simplification

In order to reduce the unnescecary roundtrips via the edgerouter, we need to flatten the networks into a single prefix. The proposal for this is to move to 10.208.28.0/22. This prefix would be used as follows (With the gateway living on 10.208.30.1):

  • 10.208.28.1 .. 10.208.29.255 DHCP
  • 10.208.30.1 .. 10.208.30.255 Static clients
  • 10.208.31.0 .. 10.208.30.254 reserved

Management

Network management administrative interfaces

You can manage our devices using the URLs below:

Product URL User Used for Notes
Edgerouter Lite https://gateway.lan.nurd.space:8443/ ubnt Routing and NATting towards internet
Aruba core switch http://core-sw.lan.nurd.space admin Main switch in the space
Access points https://10.208.43.254:4343/ admin Virtual controller for WIFI
Proxmox erratic https://erratic.lan.nurd.space:8006/ root Deploy LXC/KVM instances on our hypervisor
Erratic IPMI https://erratic-bmc.lan.nurd.space/ ADMIN Remote management of erratic
Synology https://harmony.lan.nurd.space:5001/ nurds Used for backups and storage Has a different password due to pwd requirements. Ask in the bofh channel.
IPAM ip+dns https://ipam.nurd.space/ ldap IP and DNS registration
LibreNMS http://librenms.vm.nurd.space/ nurds Network device metrics
Weathermap http://weathermap.vm.nurd.space Network traffic map
Smokeping http://smokeping.vm.nurd.space Network latency measurements
Icinga2 https://monitor.vm.nurd.space/ admin Monitoring service

Virtual machine

We support hosting multiple virtual machines, using both the KVM and the LXC model. These are deployed using proxmox. We have introduced the 'managed vm', which is a vm which adheres to nurdspace standards. For more information, see the ManagedVM and the Ansible pages.

VPN tunnels

We support Roadwarrior and Site-to-Site VPN tunnels, using Wireguard and OpenVPN. Contact someone from the BOFH team to discuss the possibilities and get connected.

Backups

We do daily full backups of managed systems. More details can be found on the Backup page.

Network discovery

In order to make devices available for discovery, a couple of protocols can be enabled. Note that this only applies to physical systems, not VM/LXCs.

LLDP

The first one of these is lldp (Link-Layer Discovery Protocol). This protocol communicates device attributes to connected peers via ethernet frames. Lldp is enabled on all networking devices. Enabling these should only be done for systems that are physically connected to the network (eg, using an ethernet cable or wifi). Under debian, this is done as follows:

apt install lldpd
systemctl enable --now lldpd


SNMP

The second protocol to enable is snmp (Simple Network Management Protocol). This protocol allows a device to be queried for various network and host metrics, and allowing us to keep a precise count of per-device traffic rates. But above all, this gives us shiney graphs ^_^

First, install the required daemons and MIBs:

apt install snmp snmpd snmp-mibs-downloader
download-mibs

Next, configure snmpd for use. Edit /etc/snmp/snmpd.conf and set the following two administrative fields:

sysLocation    NURDspace,MODIFY_LOCATION_WITHIN_NURDSPACE
sysContact     Admins <bofh@nurdspace.nl>

Next, make sure that snmpd can listen on all ip addresses and can be queried using the default community

#agentaddress  127.0.0.1,[::1] # ADD A HASH IN FRONT OF THIS LINE
rocommunity  public default
rocommunity6 public default

Finally, enable snmpd and perform a testrun to verify if it is working:

systemctl enable --now snmpd
root@erratic:~# snmpwalk -v2c -c public localhost
iso.3.6.1.2.1.1.1.0 = STRING: "Linux erratic.lan.nurd.space 5.15.30-2-pve #1 SMP PVE 5.15.30-3 (Fri, 22 Apr 2022 18:08:27 +0200) x86_64"
iso.3.6.1.2.1.1.2.0 = OID: iso.3.6.1.4.1.8072.3.2.10
iso.3.6.1.2.1.1.3.0 = Timeticks: (8715381) 1 day, 0:12:33.81
iso.3.6.1.2.1.1.4.0 = STRING: "Admins <bofh@nurdspace.nl>"
iso.3.6.1.2.1.1.5.0 = STRING: "erratic.lan.nurd.space"
iso.3.6.1.2.1.1.6.0 = STRING: "NURDspace,Bar"
...

Per-device port inventory

All devices which are not in librenms need to have documentation for their ports. You can fill this in below:

Fritzbox gamershok

Port Description
0
1
2 To Edgerouter Lite keuken
3

Netgear keuken

Port Description
0 To Dell
1
2
3
4
5
6 Slabbar
7
8 Kodi

Phone rookhok

Port Description
0 To Aruba
1 To Switch rookhok

Switch Rookhok

Port Description
0
1
2
3 Pi Rookhok
4 To phone rookhok

Netgear Bar

Port Description
0 VRCade
1 TickTack
2
3 Switch 3d printer hoek
4
5
6
7 To Aruba

Switch 3d printer hoek

Port Description
0 Printer 3
1 Printer PC
2
3
4 To netgear bar

Zaal 1 switch

Device settings

Hostname nurds-sw-01

Port settings

Port Description
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23