Redesigned network

[Colt45ws]

I was looking for something to do this weekend, so I decided to clean up the router filtering rules a bit.
One thing led to another and before I knew it, I was changing the whole configuration. Ive used 192.168.0/24 since forever like EVERYTHING else. But I was trying to setup a VPN and it was pointed out that isnt very good for connecting through just about anywhere since in all likelihood it is using something in that range. Then the VPN client will run into trouble since it will end up with two interfaces on the same subnet going different places.
After some deliberations, I decided to take the nice 10.32.36/22 block.
10.32.36/24 is infrastructure
10.32.37/24 is spare
10.32.38/24 is VPN
10.32.39/24 is known DHCP clients
Additionally, I took the generic 192.168.1/24 block and am issuing it to "unknown" DHCP clients. Its handled by an additional virtual ethernet interface.
Its not implemented yet, but I plan to do much limiting with traffic from the 192.168.1/24 'unknown' block. HTTP(S)/SNMP/POP only. Also, probably prioritized below other traffic or otherwise rate limited.
Ive also acquired a /48 from my ipv6 tunnel provider. I plan to do much the same with it. Im only using one /64 at the moment. I have not figured out how to separate known/unknown yet.
At the moment my wireless is WPA2-Enterprise and so I don't think I have too much to worry about with drive-by kiddies. But with this setup, if I were to have guests, I could use one of my AP's additional wireless configurations to setup a PSK network along side. Then they would get dumped onto the 'unknown' network and kept segregated from places they dont need to be. Like the whole Windows network with all the shares, etc.

 

[OVERKILL]

Similar to how I have mine setup. I use VLAN's to separate the subnets and have the port on my switch to the AP trunked with different SSID's setup for the various VLAN's.

 

[Colt45ws]

Yeah, I dont have really fancy stuff like that. My switches are consumer level stuff. Same as my AP. So the networks are on the same physical layer. I just have a MAC-VLAN on one of my interfaces for the secondary dumb network.

 

[Colt45ws]

Got it setup with the Cisco SG 200-8!
Code:


Port Usage

1 Modem [8U]

2 AP [16U,32T]

3 Router-A [1U,8T,16T,32T]

4 Router-B [16U]

5 Switch [16U]

6 Computer [16U]

7 Computer [16U]

8 Computer [16U]


VLAN 8 is wan0
VLAN 16 is lan0 and primary lan
VLAN 32 is lan1 secondary 'guest' lan.

I didnt have enough ports to do everything I wanted. I overflowed onto the original switch I had in place. I did it this way with the modem going through the switch because well, why not?
Also, Im going to be changing to a Mini-ITX based router eventually and it only has 2 nics. I like to have one backup 'management' port that is not interfered with, so this setup is necessary. That is the router-b interface and its on a different subnet than the rest of the network.
When I get the bigger brother to this unit, it will take the place of this unit and the unmanaged switch. This one will go to my room then I will be trunking a couple of the VLANs there as well.

 

[Nick R]

See that's a little excessive to me.

My network via poorly drawn MS Paint


My laptops is connected via the 5ghz Band name "Imouto" (Little sister in Japanese)
Everything else is connected to the 2.4ghz Band name "Hivemind"

Network computer names
My desktop: ARCHON
Fileserver: SUPPLYDEPOT
My Laptop: TERRAN
Mom's laptop: OVERLORD
Sisters laptop: HELLION
Brothers laptop: MARAUDER
"adopted" sister laptop: DARKTEMPLAR

Yes, I've named all our computers after Starcraft 2 classes/units.

 

[Colt45ws]

Its not excessive, its awesome. Complex, yes, but thats what makes it fun. Its fun to try these things.
With the separated VLAN I can limit guest access to only a couple of services and slower speeds so they can't hog all the bandwidth.
Using the 192.168.1/24 subnet makes it look pretty generic and again the VLAN comes into play not allowing them to communicate with my PCs.
Guest access security is WPA1/2-PSK-TKIP/CCMP and the pass is the partial MD5 hash of a sentence.

My primary wireless is secured via WPA2-EAP-CCMP with 802.1X authentication via RADIUS that runs on my server. Im not going to say its impossible to crack, but its pretty decent. It uses SSL Certificates to verify identity.

Only the smartphones and the laptops are on the wireless. I ran Cat 5e throughout the house. I dont trust wireless. Unless its a portable machine (where it makes sense) its lazy. I find it too laggy, slow, and dependent on the relationship of the moon to Venus for a reliable connection. Its much better with the newer stuff than the Wireless-G I started with, but I still find it slower and laggier than a hardline.

With the /22 subnet of my primary LAN I can separate things into different /24s. Anything in 10.32.36/24 is infrastructure and 10.32.39/24 are the computers. DHCP only hands out in the 10.32.39/24 range.

I have a IPv6 tunnel through tunnelbroker.net. Its a dedicated IPv6-in-IPv4 tunnel with a routed /64 or /48. I was running a /64 but with the additional guest VLAN I bumped it to the /48. I now use one random /64 for primary VLAN and another /64 for guest VLAN. Addresses are issued through DHCPv6.

I use iptables (and ip6tables) to control exactly what is going to pass through my router. It also handles the NAT on the v4 side. I can also use it to sort into the different outbound data classes I have going. I only have 1mb up so only the Xbox sees the full up. Actually even it only sees 90% of max to prevent buffering. Everything else is limited to 700kbps max though at low priority so if a class higher is using more data it could be as low as 100kbps. I also limit downstream to 90% of max to prevent buffering.

I set that up after the internet became unusable one day due to a large upload. ping times to my server in CA were in the 2 second range. After those changes I was able to drop ping to 250ms max pretty much no matter what Im doing. It limits speed a bit but its a fair tradeoff. For reference, unloaded ping to same server is 80-100ms.

I have my own caching DNS service, but it also runs a local DDNS for my LAN. Makes it very easy to find a machine. If I want to VNC into Laura, all I have to do is open up TightVNC and type 'laura' into the server box. BAM and it connects. No searching the ip range for open VNC servers, or opening up the dhcp lease list and searching for the host name. That was what I was doing before. I could make it all static IPs, but then I have to remember all kinds of numbers and have to type them it. 'laura' is easier to type than '10.32.36.5'.

I mostly name my machines with whatever happens to be my muse at the time naming occurs.
Sarah : Server/Router
Winter : My computer
Luna : My Laptop
Cortana : Brother's Laptop
Octavia : Brother's Gaming tower
Laura : HTPC
Widget : Mom's tower


I recently added the capability for machines to network boot the 'Ultimate Boot CD'. I got tired of losing CDs and USB keys with that iso loaded on so I setup a network boot on my server. With that came Parted Magic; a full Linux OS that I can boot as well.