-
Notifications
You must be signed in to change notification settings - Fork 0
Capstone Implementation Weekly Reflection
This week, I made excellent progress, starting with formally joining the DN42 network. I completed the registration process, including reserving an ASN and IPv4 and IPv6 address space. I also began the process of setting up infrastructure, specifically provisioning the Supermicro server with Proxmox and deploying RTR servers onto it, which will enable the router to validate route origins to help prevent BGP route hijacking. There is still more work to be done on this front, including deploying the other services like DNS. I also identified several good starting peers with whom I can connect once the router is set up, but at this point I am blocked by not having access to the Protectli which I will install VyOS on, which will hopefully be resolved this coming week. I also do not know whether I will receive access to a public IP, which is essential to start sprint 2, when I will set up my first peer.
One of the major learnings this week was simply understanding how ROA actually works. Route Origin Authorization involves the use of a cache server which downloads route signatures (typically, this file contains signatures proving the ownership of individual netblocks by their associated ASNs, but DN42 has opted not to use that feature), then uses an RPKI to Router (RTR) server which consumes the database to allow the router to check incoming route advertisements and ensure they come from the correct ASN.
Minus a few hiccups getting Proxmox installed, primarily to do with the IPMI but also with bugs in Proxmox's ZFS install, I did not encounter any issues completing this week's tasks. As a result of not having access to the Protectli, I did shuffle around some objectives. Until the router is available, I will continue working on the supporting services, including DNS and an API to scrape the registry and build the RPKI database. Once it is available, these may be pushed back to accomodate for setting it up in preparation for peering. Regardless, sprint 1 is currently on track.
Despite being blocked on a couple of external dependencies, I made some strides in regards to planning and setting up the necessary infrastructure for next Sprint's actual joining to the network. During the beginning of the week, I began working on IP address assignments and planning firewall rules and zones for the Production Network. This document gradually evolved as I weighed the pros and cons of segmenting the network further or decreasing the complexity of the rules.
I also set up a "staging" VyOS virtual machine, which allowed me to run the necessary commands to configure the router without actually having access to the Protectli. Once in my posession, I will be able to copy and paste the commands in to set up most of the necessary services and interface configurations. It also allowed me to experiment further with different services and firewall setups, so that the configuration can be more or less complete and optimized by the time I have access to the router. I have yet to figure out what is hopefully a simple issue with SLAAC for distributing IPv6 addresses, but otherwise the configuration is functional so far.
Using the staging router, I've also prepared the supporting services and networks for deployment, as well as setting up the Proxmox networks to bridge with the router. The staging router is able to reach both RTR servers running on Proxmox, and I can even VPN in using an address from my DN42 allocation, although it of course is not routed to the rest of the DN42 network, so this isn't useful yet. I'm still on track for this sprint, although somewhat concerned that there doesn't appear to be any progress getting a public IP yet.
This week unfortunately had the slowest progress of the entire sprint, but it was not without its successes. I continued to be blocked by several dependencies, though at this point the Protectli is available and Leahy Center is an option for a public IP if needed. I finished some of the last required firewall configurations, at least in the staging environment, meaning it will take much less time to set up the Protectli when I get my hands on it. Part of this involved fixing the SLAAC issue, which turned out to be a simple firewalling issue preventing router advertisements from escaping.
I've also set up a Linux Mint management box, giving me a desktop environment accessible through the Proxmox SPICE console to remotely administer devices using SSH or a web browser. Because it is a management box, however, it does not currently have access to DN42, nor do I plan to add that functionality, since the network will be accessed by Wireguard VPN.
Unfortunately, due to the hold-ups on the router and public IP, I will have to get these set up at the beginning of Sprint 2 instead. This should not prevent me from connecting to the first peer soon, but it may result in some other supporting services like DNS being pushed back further.
Once again, I made little progress this week. While the public IP should be authorized soon, I've made the decision to transition to a virtual router since the Protectli fell through due to it being a barebones model, at least for the time being. I've also made the decision to work on the DNS servers ahead of time, before connecting to a peer. They will be practically useless until I do peer, but I can hopefully get a partially working server within a few days.
I'll also be updating the networking topology of the Proxmox hypervisor prior to connecting, since I had originally set up vSwitches for an external physical router. I'll need to know more about the physical topology and/or VLANs used in order to properly hook up the router to the outside world.