Networking

I’ve been a fan of HTTP and caching since my dial-up modem.

Skip to today where google returns HTTPS sites higher in its search results. Its could also be possible that you cannot trust a man in the middle HTTP cache any longer either right? :)

SSL certs have traditionally been expensive, but say welcome to lets encrypt which provides a free way of securing all of your websites. If you haven’t heard of it check it out here - https://letsencrypt.org/

Just built a pfsense router on  a pc engine to replace my aging 7390 fritzbox…. Very very awesome and fast!

Perfect for UFB (ultra fast broadband) here in New Zealand - FTTH has arrived :)

I’m currently running these services on it (2 x 1GHZ cpu, 4GB RAM, 16GB msata SSD);

• dhcpd - DHCP server
• miniupnpd - UPnP server
• ntpd - NTP server
• squid - Transparent Proxy & Reverse Proxy
• snort - IDS (Intrusion Detection System) / IPS (Intrusion Prevention System)
• ssd - SSH server
• unbound - DNS Server
• ipsec - IPsec VPN (site to site VPN)
• openvpn - Open VPN (client VPN)

Check these links for some great advise…

I had the above issue after a squid upgrade and after changing from http_port 3128 transparent to http_port 3128 intercept.

Add “http_port 8080” line to squid.config to avoid this message, if you are not already using that port.

The changes in security require that a separate port be setup for forwarding proxy requests

i only have vdsl at home and host my website via it… the following graphs shows when nginx started serving faster than the vdsl connection could handle (which is about 9Mbits)

ngnix with cache enabled, gzip enabled and set to 6

http://loadimpact.com/load-test/sigtar.com-6a246200e28f354c64582cf2c0b6ce46

ngnix with cache enabled, gzip enabled and set to 9 (maximum)

http://loadimpact.com/load-test/sigtar.com-1422b3e7250c4e3acb7868177f2b2056

ngnix with cache disabled, gzip enabled and set to 9 (maximum)

http://loadimpact.com/load-test/sigtar.com-19561e7422e24f35fb557c662d20beac

Previously to take down this wordpress site all you needed to do was hold down F5 for about 20 seconds then the site would take about 5 mins to recover.

There were a few factors causing this and quite a few different methods to solving the problem. Wordpress itself is run on php / apache, apache has an evasive mod which can block certain IPs depending on the defined abusive behavior (typical DDOS attack). Since i like to run a few websites behind a single IP i looked at fixing the issue closer to the perimeter….

I use angry IP scanner in windows, linux has a good util for port scanning an ip range called nmap;

Grab nmap from usual repositories

sudo nmap -sP 192.168.9.0/24 (will show hosts up and resolve mac addresses to vendors)

sudo nmap -v -sT 192.168.9.0/24 (will show hosts up and the various open ports)

sudo nmap -v -sT 192.168.9.104 (will show particular host and the various open ports)

Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-12 11:48 NZST Initiating ARP Ping Scan at 11:48 Scanning 192.168.9.104 [1 port] Completed ARP Ping Scan at 11:48, 0.00s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 11:48 Completed Parallel DNS resolution of 1 host. at 11:48, 0.00s elapsed Initiating Connect Scan at 11:48 Scanning win2012-veeam.fritz.box (192.168.9.104) [1000 ports] Discovered open port 111/tcp on 192.168.9.104 Discovered open port 445/tcp on 192.168.9.104 Discovered open port 3389/tcp on 192.168.9.104 Discovered open port 135/tcp on 192.168.9.104 Discovered open port 139/tcp on 192.168.9.104 Discovered open port 49155/tcp on 192.168.9.104 Discovered open port 1063/tcp on 192.168.9.104 Discovered open port 2049/tcp on 192.168.9.104 Discovered open port 3260/tcp on 192.168.9.104 Completed Connect Scan at 11:48, 4.21s elapsed (1000 total ports) Nmap scan report for win2012-veeam.fritz.box (192.168.9.104) Host is up (0.00059s latency). Not shown: 991 filtered ports PORT STATE SERVICE 111/tcp open rpcbind 135/tcp open msrpc 139/tcp open netbios-ssn 445/tcp open microsoft-ds 1063/tcp open kyoceranetdev 2049/tcp open nfs 3260/tcp open iscsi 3389/tcp open ms-wbt-server 49155/tcp open unknown MAC Address: 00:50:56:9C:68:FA (VMware)

# svccfg svc:> select dns/client svc:/network/dns/client> setprop config/search = astring: \ (“us.company.com” “eu.company.com” “companya.com” “companyb.com” “company.com” ) svc:/network/dns/client> setprop config/nameserver = net_address: \ ( 138.2.202.15 138.2.202.25 ) svc:/network/dns/client> select dns/client:default svc:/network/dns/client:default> refresh svc:/network/dns/client:default> validate svc:/network/dns/client:default> select name-service/switch svc:/system/name-service/switch> setprop config/host = astring: “files dns” svc:/system/name-service/switch> select system/name-service/switch:default svc:/system/name-service/switch:default> refresh svc:/system/name-service/switch:default> validate svc:/system/name-service/switch:default> # svcadm enable dns/client # svcadm refresh name-service/switch # grep host /etc/nsswitch.conf hosts: files dns # cat /etc/resolv.conf # # opyright (c) 2011, Oracle and/or its affiliates. All rights reserved. #

I’ve tried using a share for time machine before, but due to the nature of how time machine works it eventually consumed all the spare space that is available on that particular share.

bring on zfs quotas… (my drive on my mini mac is 100GB, so 200GB should be enough for a few variations)

zfs set quota=200G unprotected/timemachine

This adds a artificial limit to your zfs filesystem, making sure that time machine does not consume more than 200 gigabytes of space.

There is a bug in the tg3 driver on the ESXi hosts (1gbit broadcom cards in the new hosts). If the network card is put under load and netqueue is enabled it will sometimes decide to drop all traffic. Essentially i’ve disabled netqueue and the problems have gone away…. as per this vm kb :

http://kb.vmware.com/kb/2035701

The isues will present themselves as log entires like so;

2012-11-19T18:58:52.137Z cpu17:4155)<6>tg3 : vmnic8: RX NetQ allocated on 1 2012-11-19T18:58:52.138Z cpu17:4155)<6>tg3 : vmnic8: NetQ set RX Filter: 1 [00:50:56:71:46:87 0] 2012-11-19T18:58:52.138Z cpu17:4155)<6>tg3 : vmnic7: RX NetQ allocated on 1 2012-11-19T18:58:52.138Z cpu17:4155)<6>tg3 : vmnic7: NetQ set RX Filter: 1 [00:50:56:71:46:87 0] 2012-11-19T18:59:12.139Z cpu21:4155)<6>tg3 : vmnic4: NetQ remove RX filter: 1 2012-11-19T18:59:12.139Z cpu21:4155)<6>tg3 : vmnic4: Free NetQ RX Queue: 1 2012-11-19T18:59:22.137Z cpu24:4155)<6>tg3 : vmnic4: RX NetQ allocated on 1 2012-11-19T18:59:22.138Z cpu24:4155)<6>tg3 : vmnic4: NetQ set RX Filter: 1 [00:50:56:71:46:87 0] 2012-11-19T18:59:42.138Z cpu21:4155)<6>tg3 : vmnic7: NetQ remove RX filter: 1 2012-11-19T18:59:42.138Z cpu21:4155)<6>tg3 : vmnic7: Free NetQ RX Queue: 1 2012-11-19T18:59:42.140Z cpu21:4155)<6>tg3 : vmnic4: NetQ remove RX filter: 1 2012-11-19T18:59:42.140Z cpu21:4155)<6>tg3 : vmnic4: Free NetQ RX Queue: 1 2012-11-19T19:00:02.139Z cpu28:4155)<6>tg3 : vmnic8: NetQ remove RX filter: 1

You might be able to do this via “host profiles” but if you do not have the licensing for it, this is the alternative. Very handy if you have over 50 or so port groups. It can be re-run to add to additional hosts as needed.

Install powercli, run the following to obtain your current list of virtual port groups off existing host;

Get-VirtualPortGroup -VirtualSwitch vSwitch0 -VMHost esx-01

Grab the output and place into CSV file or copy straght into Excel…

Very good article here - http://networkingnerd.net/2011/02/02/when-is-a-trunk-not-a-trunk/

Particuly like setting of Native vLAN and tagged networks over an HP trunk;

So, if HP refers to an uplink carrying multiple VLANs are a tagged port, then does HP have a “trunk”? In fact they do. In HPvania, a trunk is a logical construct that aggregates multiple ports into one logical link. For those of you that might be out there scratching your heads about this one, this means that when you “trunk” a group of ports on an HP switch, you are creating one LACP link from up to four individual ports. This kind of configuration should look like this:

Great guide here - http://www.classhelper.org/articles/reverse-proxy-server-squid-debian/installing-squid-proxy-server.shtml

I’ve modified slightly for Ubuntu, but almost identical.

apt-get install squid cp /etc/squid3/squid.conf /etc/squid3/squid.bak rm /etc/squid3/squid.conf nano /etc/squid/squid.conf

http_port 80 defaultsite=www.yoursite.com vhost forwarded_for on refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern . 0 20% 4320 cache_peer 192.168.0.13 parent 80 0 no-query no-digest originserver name=web1 acl sites_web1 dstdomain www.yoursite.com yoursite.com cache_peer_access web1 allow sites_web1 cache_peer 192.168.0.14 parent 80 0 no-query no-digest originserver name=web2 acl sites_web2 dstdomain www.anothersite.com anothersite.com cache_peer_access web2 allow sites_web2 acl all src 0.0.0.0/0.0.0.0 acl manager proto cache_object acl localhost src 127.0.0.1/255.255.255.255 acl to_localhost dst 127.0.0.0/8 acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 443 # https acl Safe_ports port 1025-65535 # unregistered ports acl CONNECT method CONNECT http_access allow sites_web1 http_access allow sites_web2 http_access allow manager all http_access allow manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports #http_access deny all access_log /var/log/squid3/access.log cache_mgr [email protected]

Some really good info at this site : http://kennethvanditmarsch.wordpress.com/2009/11/04/understanding-hp-flex-10-mappings-with-vmware/

A bit more around his finding during some tests : http://kennethvanditmarsch.wordpress.com/2009/12/04/testing-scenarios-vmware-hp-c-class-infrastructure/

You’ll need these two packages installed;

SUNWdhcs, SUNWdhcm

First ensure that the DHCP service is running. Go into the “services” gui and tick the box to enable the DHCP server.

now from commandline run…

dhcpmgr

1. From edit menu choose “network wizard”, step through the wizard (defautls are o.k i you have a fixed IP already assigned to your opensolaris box)
2. From edit menu choose “address wizard”

If you step through the wizard (the following is an example of what i have choosen)

There are some good windows web proxies about. The only problem with them is they sometimes dont natively act as a transparent proxy. i.e. typically you’ll need to set your client machines to a specific IP and port.

I’ve used squid historically when setting up transparent proxies (mainly since it actually has a transparent mode) and this has worked well. Recently i thought i’d have a go at some of the windows solutions to see how they pan out.

There are some really good products out there in the market at the moment…

Exinda - low cost, really good QOS / prioitisation and visibility. Falls short on acceleration (at the moment) Riverbed - One of the key players in the acceleration market. Optimized algorithms for specific traffic. Silver Peak - Relatively new, work well as a capture all acceleration device with QOS / prioritisation included.

One to watch - traffic squeezer. I’m always a fan of open source getting into new technologies, and this project seems to be a good start. Its still early days but I’m hopeful this will take off and become a contender in the future ahead.

Great article on setting up connection between HP & Cisco….

http://evilrouters.net/2011/08/12/configure-lacp-between-hp-procurve-and-cisco-catalyst-switches/

 

Want to propergate vLan information across multiple switches?

Easy in the Cisco world…  Just use VTP - configure a server switch and  your away… (it also has its risks if you introduce another server switch with a lower ID)

What does HP have?  – GVRP (MVRP newer iteration).

http://en.wikipedia.org/wiki/Multiple_Registration_Protocol

Multiple VLAN Registration Protocol (MVRP), which replaced GARP VLAN Registration Protocol (GVRP), is a standards-based Layer 2 network protocol, for automatic configuration of VLAN information on switches. It was defined in the 802.1ak amendment to 802.1Q-2005.

HP GbE2c Ethernet Blade Switch for HP c-Class BladeSystem User Guide Click here to view the “HP GbE2c Ethernet Blade Switch for HP c-Class BladeSystem User Guide” (http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c00701541/c00701541.pdf) HP GbE2c Layer 2/3 Ethernet Blade Switch for c-Class BladeSystem User Guide Click here to go to the “HP GbE2c Layer 2/3 Ethernet Blade Switch for c-Class BladeSystem User Guide” (http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c00865010/c00865010.pdf)

http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00700745/c00700745.pdf

Crosslinks

http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00816246/c00816246.pdf

Steps to setup MPIO round robin and DSM with P4000 / Lefthand nodes

This example is windows 2008 with 2 x 1gbit nics

1. Install HP DSM driver onto windows 2008  (this should also install MPIO feature on windows 2008)
2. Setup 2 x IP’s on windows host - storage subnet (used with MPIO)
   1. Confirm you can ping target from both (enable one at a time - ensure there is no routing on your other nics)
3. Provision storage and allow server read / write access to windows server (via initiator name)
4. Open iSCSI on windows 2008
5. Put in IP of target in discovery tab
6. On first tab confirm that iSCSI drive is presented to host
7. Click “connect” - check both auto-connect and use MPIO
   1. click advanced - chose MS iSCSI initiator, choose first IP and target IP. Click o.k. / o.k
   2. click advanced - chose MS iSCSI initiator, choose second IP and target IP. Click o.k. / o.k
   3. Repeat above per additional Nic
8. Confirm via “devices” that there is x (as many targets as nics) targets per disk
   1. Within devices choose MPIO - change from vendor specific to “round robin”
      1. Note : read / write access to LUN is required when using “round robin” MPIO opposed to the default “vendor specific” which works with read only access. Else you will get an error - “not supported”
   2. Repeat above per “device”
9. Confirm on Lefthand / P4000 CMC that the LUN has one connection per initiator Nic, and that each connection also has its DSM children (visible in CMC if working).

Confirm that the connection are as expected…