Skip to content

Project 1: Network Redundancy

Jump to bottom
Miles Cummings edited this page Jan 29, 2024 · 20 revisions

Project 1: Network Redundancy

Network

image

  1. Update net adapters + boot VMs
  2. VyOS VyOS1 Commands
configure
set system host-name vyos1-miles
set interfaces ethernet eth0 address 10.0.17.12/24
set interfaces ethernet eth0 description SEC440-WAN
set interfaces ethernet eth1 address 10.0.5.2/24
set interfaces ethernet eth1 description MILES-LAN
set interfaces ethernet eth2 address 10.0.6.2/24
set interfaces ethernet eth2 description MILES-OPT

set nat destination rule 10 description "Allow HTTP to LAN"
set nat destination rule 10 destination address 10.0.17.102
set nat destination rule 10 destination port 80
set nat destination rule 10 inbound-interface eth0
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 10.0.5.100
set nat destination rule 10 translation port 80

set nat destination rule 20 description "Allow SSH to LAN"
set nat destination rule 20 destination address 10.0.17.102
set nat destination rule 20 destination port 22
set nat destination rule 20 inbound-interface eth0
set nat destination rule 20 protocol tcp
set nat destination rule 20 translation address 10.0.5.100
set nat destination rule 20 translation port 22

set nat source rule 10 description 'Allow NAT from LAN to WAN'
set nat source rule 10 outbound-interface eth0
set nat source rule 10 source address 10.0.5.0/24
set nat source rule 10 translation address masquerade

set service dns forwarding allow-from 10.0.5.0/24
set service dns forwarding listen-address 10.0.5.1
set service dns forwarding system
set protocols static route 0.0.0.0/0 next-hop 10.0.17.2
set system name-server 10.0.17.2

set high-availability vrrp group wangroup2 vrid 152
set high-availability vrrp group wangroup2 interface eth0
set high-availability vrrp group wangroup2 address 10.0.17.102/24
set high-availability vrrp group wangroup2 priority 200
set high-availability vrrp group langroup0 vrid 10
set high-availability vrrp group langroup0 interface eth1
set high-availability vrrp group langroup0 address 10.0.5.1/24
set high-availability vrrp group langroup0 priority 200
set high-availability vrrp group optgroup0 vrid 20
set high-availability vrrp group optgroup0 interface eth2
set high-availability vrrp group optgroup0 address 10.0.6.1/24
set high-availability vrrp group optgroup0 priority 200


commit
save

VyOS2 Commands

configure
set system host-name vyos2-miles
set interfaces ethernet eth0 10.0.17.72/24
set interfaces ethernet eth0 description SEC440-WAN
set interfaces ethernet eth1 10.0.5.3/24
set interfaces ethernet eth1 description MILES-LAN
set interfaces ethernet eth2 10.0.6.3/24
set interfaces ethernet eth2 description MILES-OPT

set nat destination rule 10 description "Allow HTTP to LAN"
set nat destination rule 10 destination address 10.0.17.102
set nat destination rule 10 destination port 80
set nat destination rule 10 inbound-interface eth0
set nat destination rule 10 protocol tcp
set nat destination rule 10 translation address 10.0.5.100
set nat destination rule 10 translation port 80

set nat destination rule 20 description "Allow SSH to LAN"
set nat destination rule 20 destination address 10.0.17.102
set nat destination rule 20 destination port 22
set nat destination rule 20 inbound-interface eth0
set nat destination rule 20 protocol tcp
set nat destination rule 20 translation address 10.0.5.100
set nat destination rule 20 translation port 22

set nat source rule 10 description 'Allow NAT from LAN to WAN'
set nat source rule 10 outbound-interface eth0
set nat source rule 10 source address 10.0.5.0/24
set nat source rule 10 translation address masquerade

set service dns forwarding allow-from 10.0.5.0/24
set service dns forwarding listen-address 10.0.5.1
set service dns forwarding system
set protocols static route 0.0.0.0/0 next-hop 10.0.17.2
set system name-server 10.0.17.2

set high-availability vrrp group wangroup2 vrid 152
set high-availability vrrp group wangroup2 interface eth0
set high-availability vrrp group wangroup2 address 10.0.17.102/24
set high-availability vrrp group wangroup2 priority 100
set high-availability vrrp group langroup0 vrid 10
set high-availability vrrp group langroup0 interface eth1
set high-availability vrrp group langroup0 address 10.0.5.1/24
set high-availability vrrp group langroup0 priority 100
set high-availability vrrp group optgroup0 vrid 20
set high-availability vrrp group optgroup0 interface eth2
set high-availability vrrp group optgroup0 address 10.0.6.1/24
set high-availability vrrp group optgroup0 priority 100

commit
save
  1. Workstations

Web01:

  • Boot the VM, and run nmtui to change the network settings. Set the IP configuration to manual. Correspond the networking information with the diagram above.

xUbuntu-WAN

  • Boot the VM and log into champuser. Run sudo adduser <new user> and go through the user creation process. Then, run sudo usermod -aG sudo <new user>. Now, log out and log into your new account. Run sudo deluser champuser` to delete the default user. You may need to kill a process in order to do so.
  • Go to networking and enter the networking information associated with this box. The gateway and DNS will just be 10.0.17.2, but you have a unique IP for this box.
  • You should be able to ping google via hostname if everything works properly.

xUbuntu-LAN

  1. Web Server - Apache
  2. SSH MFA on Web01 (Google Auth)

Clone this wiki locally