content.md 8.19 KB
Newer Older
JackV's avatar
JackV committed
1
### Programme
JackV's avatar
JackV committed
2

JackV's avatar
JackV committed
3
4
5
6
7
8
9
* NFtables basics
* How to debug network problems
* Wireguard: easy to setup vpn
* Ansible: how to manange many computers
* Why have servers running at home
* Internet connections technologies
* How to build a linux home router
JackV's avatar
JackV committed
10

JackV's avatar
JackV committed
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
---

## Expected end result
![](assets/talosiannn.jpg)

---

## Enough joking

A lot of what we are going to
cover today has been done in depth
in previous Linux courses  
(links in the relevant sections)  
This talk focuses more on how
all these topics can come together
JackV's avatar
JackV committed
26
27
28

----

JackV's avatar
JackV committed
29
30
31
32
33
# NFtables

---

## NFtables vs IPtables vs firewalld vs others
JackV's avatar
JackV committed
34
35
36
37
38



----

JackV's avatar
JackV committed
39
# Debug network problems
JackV's avatar
JackV committed
40

JackV's avatar
JackV committed
41
---
JackV's avatar
JackV committed
42

JackV's avatar
JackV committed
43
----
JackV's avatar
JackV committed
44

JackV's avatar
JackV committed
45
46
47
# Wireguard
[Link to Slides](https://slides.poul.org/2019/corsi-linux/3c_wireguard.pdf)  
[Link to Video](https://example.org)
JackV's avatar
JackV committed
48

JackV's avatar
JackV committed
49
---
JackV's avatar
JackV committed
50

JackV's avatar
JackV committed
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
### What is a VPN?

A VPN is a piece of software that allows us to access a **Network**
that is not publicly available (**Private**) and which we have
no physical connection to (**Virtual**)

---

### Wireguard

Project started in 2016 to replace OpenVPN, in terms
of security and ease of configuration

Strong Points:
* Minimal codebase, ~40000 loc (originally 4000) vs 600000 for OpenVPN
* Minimal configuration
* Fail-open behavior, if misconfigured no packets are routed

---

### Step 1: Generating a key pair

```bash
wg genkey > privatekey
cat privatekey | wg pubkey > publickey
```

This needs to be done for every __host__ that wants to join the vpn

---

### Write server configuration

```
[Interface]
Address = 192.168.10.1/24
ListenPort = 51820
PrivateKey = kIbuAUUbNZeC18onuKDtUui2Oa+l4/RrsU/sjcVKgmU=

PostUp = nft add rule ip filter FORWARD iifname %i counter accept
PostUp = nft add rule ip nat POSTROUTING oifname eth0 counter masquerade
PostDown = nft del rule ip filter FORWARD iifname %i counter accept
PostDown = nft del rule ip nat POSTROUTING oifname eth0 counter masquerade

[Peer]
PublicKey = yL4ajtwU9a2zP9vyVa5hdB5cSl/deLXv0Ldck1Y/FSU=
AllowedIPs = 192.168.10.2/32
```

---

### Write client configuration

```
[Interface]
Address = 192.168.10.2/24
PrivateKey = CCSq5ngQcIGjKS3qu5woC7tYVQM2zJhJVR4jQ9xrXUY=
DNS = 192.168.10.1

[Peer]
PublicKey = xopK6ZfGT0CAS8g8SXmEZf4Ppp3al5XkDJPCYl5Z8So=
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <server public ip>:51820
```

---

```
wg-quick server.conf
```

```
wg-quick client.conf
```

---

# Done!

---

## Well not so fast

Due to the fail-open nature, it is sometimes difficult to debug
Some debugging techniques are shown in the previous sections.
The linked slides offer a more in-depth explaination of the
configuration that might help to debug problems.

JackV's avatar
JackV committed
139
140
----

JackV's avatar
JackV committed
141
142
143
# Ansible
[Link to Slide](https://slides.poul.org/2019/corsi-linux/4b_ansible/)  
[Link to Video](https://example.org)
Roberto Bochet's avatar
Roberto Bochet committed
144

JackV's avatar
JackV committed
145
---
Roberto Bochet's avatar
Roberto Bochet committed
146
147
148

----

JackV's avatar
JackV committed
149
150
151
# Beyond the cloud

----
JackV's avatar
JackV committed
152

JackV's avatar
JackV committed
153
## Why have a server at home?
JackV's avatar
JackV committed
154

JackV's avatar
JackV committed
155
---
JackV's avatar
JackV committed
156

JackV's avatar
JackV committed
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
### Server@Home

* We have full control on the hardware
* Advanced setups possible
* Is better suited in some scenarios (eg. backup)
* Usually cheaper than a server __*__  
  (eg. storage)

---

### Server

* Usually have better uptime (much closer to 100%)
* Storage has magic underneath
* Usually have higher network bandwidth

---

### What to consider to do cost/benefit

* On cloud servers the entire infrastructure
  is redundant, and if a component breaks the
  cloud provider replaces it free of charge,
  at home you have to pay for replacements
* Magic ratio `kWh/Wy` -> `8.76`
    * High power consumption can lead to an
      expensive bill
JackV's avatar
JackV committed
184
185
186

----

JackV's avatar
JackV committed
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
# How to pick the hardware

---

### Storage technologies summary

|   | €/GB | Velocita R/W | Longevità |
| - |:---- |:------------ |:--------- |
| HDD | Low | Medium | Medium<br>(3-5 anni) |
| SSD | Medium | High | High<br>(20+ anni) |
| SD/eMMC | High | Medium-Low | Short<br>(1-2 anni)|
| Cloud | - | Internet Speed | Infinite |

---

## SBC ARM/Router

<img src="assets/rpi4.jpg" style="max-height: 30%">

* Cost: 20-100€
* Computing power: Medium-Low
* Storage: scarce (eccetto usb 3)
* Power consumption: > 10W

---

## Things to consider before buying

* Ethernet maximum speed (100 vs 1000)
* How the ethernet chip is connected to the SoC
* How the USB ports are connected to the SoC
* CPU computing power
* RAM quantity
* Bootable storage (SD/eMMC vs USB 3/SATA)
* Mainline linux support

---

## Why you shouldn't buy a RPi

* 1-3 have usb ports behind an hub
* 1-3 have ethernet behind an usb adapter<br>(guess where it is attached?)
* Wifi tends to be very crappy without
  an u.FL connector and a proper antenna
* Computing power is generally poorer than
  competitors for the same price point
* RPi linux distributions tend to come with
  a lot of propietary broadcom blobs

---

## Laptop/Entry-level desktop

*foto portatile nizzo*  
*foto router antisgamo*

* Cost: 50-200€
* Computing power: Medium-High
* Storage: sufficent
* Power consumption: 10-50W

---

## High-End Desktop/Server

*Foto server ribis here*

* Cost: 100-2000€
* Computing power: High
* Storage: sufficent-plenty (SAN)
* Power Consuption: 200-2000W
* Pros: no house heating costs

---

## I need to crunch numbers, what should I do?

* Use a low-power device to trigger [Wake on LAN](https://en.wikipedia.org/wiki/Wake-on-LAN) for a more powerful device
* Use a combination of Home+Cloud
* Use spot/preemptible cloud VMs<br>(this depends on the workload)

----

# Internet connection technologies

---

How do we connect to the internet?  

3 main technologies:  

* *DSL
* GPON (fiber)
* Ethernet

---

## *DSL

< Foto doppino telefonico >

* Encompasses various technologies (ADSL/VDSL/VDSL2)
* All of them use a copper medium (telephone line) to transmit data
* Phone line length and EMF interference *matter* on transmission speed

---

## Router options for *DSL

* Lantiq-based routers ( [list](https://openwrt.org/docs/techref/targets/lantiq) )
* No one else since the DSL chipset is usually custom-made and manufacturers don't relase the source code
* Some routers allow enough configuration to be ISP-neutral, but that comes at a
  cost of old software
* In theory _Modem Libero_ should allow the use of old ISP routers, but I wouldn't hold my breath on that

---

JackV's avatar
JackV committed
304
## GPON (fiber)
JackV's avatar
JackV committed
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333

< foto filo fibra >

* New technology used for FTTH (1 GB/s internet)
* There is a direct optical link between the end user and the ISP
* Since the transmission is optical, no interference!
* Optic fiber crimping has some tooling costs (~200€)

---

## ONTs

< foto ONT padella >
< foto ONT stick >

A ONT is a device that bridges a fiber link to ethernet  
(allowing us to use any device we want as a router)  
AFAIK there is no ONT with OpenWRT support

---

## Raw Ethernet

< foto cavo eth >

Some provides (eg. Eolo) use alternative transmission mediums,
usually these will have an ordinary ethernet cable attached
to a mundane wifi router

JackV's avatar
JackV committed
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
----

# Deploying a FOSS router at home

---

## Materials needed:

* A device to interface with your internet
* Some ethernet cables (crimping tools recommended)
* A device with 2+ ethernet ports (1 works on some setups but don't)
* WiFi device

---

## Small digression: Modem Libero

At the end of 2018 the AGCOM (italian telecomunications agency) approved
a set of rules that force ISP to provide appropiate means to allow consumers
to choose their own router (ONT are still part of the ISP's network)  
Obtaining the various settings for connecting to the ISP's network varies
by difficulty and amount of call centers you have to contact based on the ISP you pick  
_(there was also a clause that allowed consumers to have a vendor-neutral firmware
at the end of the contract, but everyone seems to have forgotten about that)_

---

## Connecting to the ISP

There are 2 main ways in which you connect to ISPs

* PPPoE over VLAN: used by basically everyone
* DHCP over raw ethernet: used only by Fastweb

Obviously neither methods is within spec, both use some *slight*
change in protocol parameters, which may need some fiddling

---

## IPv6

Currently (April 2020), only 2 ISPs provide IPv6 connectivity

* Fastweb: via [6rd](https://en.wikipedia.org/wiki/IPv6_rapid_deployment)
* Telecom Italia: via a separate PPPoE connection

However do note that both these tunnels might not support the full bandwidth

---

## What software to use?

* ppp for connecting to PPPoE
* Systemd-networkd for managing connections  
  (only network manager that supports most ISPs configurations fully)