F1HF0


Unico networking
----------------

    -- I know men. They will not stop until they kill all of you.
    -- To die, you've got to be alive first.

    Automata, 2014, 1:11:48

Notes:

  0. add NIC to machine in vbox -- internal network (default intnet).

  1. turn eth1 down to apt-get something:

    ifconfig eth1 down

  2. copy-paste in xterm: beginning -- left mouse click,
     end -- right mouse click,
     or select with drag (feets to screen).
     Select is copy.

Prerequisites:

  apt-get install inetutils-inetd \
                  tftpd-hpa pxelinux isc-dhcp-server dnsmasq

Steps:

  1. Second NIC to internal network.
  2. DHCP server on eth1.
  3. ufw Masquerade.
  4. tftpd on eth1, PXEboot.
  5. SSH hole in UFW.

Useful commands:

  ifconfig
  route -n

Step I. 2 NIC

  # dmesg | grep eth
  # ifconfig

Add interface eth1:

  # vi /etc/network/interfaces

    auto eth1
    iface eth1 inet static
    address 172.16.0.1
    netmask 255.255.255.0
    network 172.16.0.0
    broadcast 172.16.0.255

  # /etc/init.d/networking restart
  # ifconfig


Step II. DHCPD on ETH1.

Edit configuration file

  # vi /etc/default/isc-dhcp-server

  DHCPDARGS="eth1"

  # vi /etc/dhcp/dhcpd.conf

  option domain-name-servers 192.168.1.254;

  default-lease-time 86400;
  max-lease-time 604800;

  authoritative;

  subnet 172.16.0.0 netmask 255.255.255.0 {
          range 172.16.0.10 172.16.0.49;
          filename "pxelinux.0";
          option subnet-mask 255.255.255.0;
          option broadcast-address 172.16.0.255;
          option routers 172.16.0.1;
  }

Workaround to unended isc-dhcp-server installation

  # touch /etc/init.d/isc-dhcp-server6
  # apt-get autoremove

Start DHCP server

  # service isc-dhcp-server start

Now check on slave (one NIC on ETH0, internal network (intnet)):

  # ifconfig


Step III. ufw Masquerade

On Gateway:
-----------

In /etc/ufw/before.rules, before *filter row:

  # NAT table rules: eth0 to NAT network IP 10.0.2.15
  #                  eth1 to INTERNAL network IP 172.16.0.1

  *nat
  :POSTROUTING ACCEPT [0:0]

  # Forward traffic through eth0 - Change to match you out-interface
  -A POSTROUTING -s 172.16.0.0/24 -o eth0 -j MASQUERADE

  # don't delete the 'COMMIT' line or these nat table rules won't
  # be processed
  COMMIT

On Slave:
---------

In /etc/network/interfaces

  # The primary network interface
  auto eth0
  iface eth0 inet dhcp

ifconfig: 172.16.0.10 on eth0

route -n:
Destination   Gateway      Genmask         Flags Metric Ref Use Iface
0.0.0.0       172.16.0.1   0.0.0.0         UG    0      0   0   eth0
172.16.0.0    0.0.0.0      255.255.255.0   U     0      0   0   eth0

  root@unico:~# nslookup neti.ee
!!!    =====
  Server:         192.168.1.254
  Address:        192.168.1.254#53

  Non-authoritative answer:
  Name:   neti.ee
  Address: 195.50.209.246

  root@unicoslave:~# ping neti.ee
  ping: unknown host neti.ee
  root@unicoslave:~# ping 195.50.209.246
  PING 195.50.209.246 (195.50.209.246) 56(84) bytes of data.
  64 bytes from 195.50.209.246: icmp_seq=2 ttl=58 time=23.0 ms


Step IV. TFTP/BOOTP -- PXEBoot

In /etc/inetd.conf

  ..
  #:BOOT: Tftp service is provided primarily for booting.  Most sites
  # run this only on machines acting as "boot servers."
  tftp           dgram   udp     wait    root  /usr/sbin/in.tftpd /usr/sbin/in.tftpd -s /var/lib/tftpboot
  ..

Then restart

  # /etc/init.d/inetutils-inetd restart

  # netstat -uap
  Active Internet connections (servers and established)
  Proto Recv-Q Send-Q Local Addr.  Foreign Addr.  State  PID/Prog. name
  udp   0      0                                         *:tftp

In /etc/dhcp/dhcpd.conf

  ...
          option routers 172.16.0.1;
          filename "pxelinux.0";
          next-server 172.16.0.1;
  }

where next-server is IP of our PXE server.

Then restart

  # /etc/init.d/isc-dhcp-server restart

Contents of the /var/lib/tftpboot

  -rw-r--r--  1 root root     116520 янв.  17 20:40 ldlinux.c32
  -rw-r--r--  1 root root      25372 янв.  17 20:36 memdisk
  -rw-r--r--  1 root root      42960 янв.  17 19:19 pxelinux.0
  -rw-r--r--  1 root root    1474560 нояб. 18  1999 winb95b.IMA
  drwxr-xr-x  2 root root       4096 янв.  17 20:36 pxelinux.cfg

where

  cp /usr/lib/syslinux/modules/bios/ldlinux.c32 .
  cp /usr/lib/syslinux/memdisk .

  # bootdisk.com
  wget -c http://1gighost.com/ed/jamiephiladelphia/boot95b.exe
  unzip boot95b.exe
  rm boot95b.exe

  output: winb95b.IMA

  cp /usr/lib/PXELINUX/pxelinux.0 .
  cat /var/lib/tftpboot/pxelinux.cfg/default

  output: default memdisk initrd=winb95b.IMA

  # ufw allow proto udp from 172.16.0.0/24 to any port 69
  # cat /lib/ufw/user.rules | grep 69
  output:
  ### tuple ### allow udp 69 0.0.0.0/0 any 172.16.0.0/24 in
  -A ufw-user-input -p udp --dport 69 -s 172.16.0.0/24 -j ACCEPT

Now in Oracle VM VirtualBox Manager (for slave machine).

   System -> Boot Order
   [v] Network

Boot.


Step V. SSH hole in UFW

Next set up a very basic firewall [3]. This one will:

  ...
  sudo ufw allow ssh

Now from UnicoSlave (virtualbox internal network)

  ssh -l virtu 172.16.0.1


Step VI. DNSMasq

  # apt-get install dnsmasq
  # ufw allow out 53/tcp
  # ufw allow out 53/udp

  # cat /etc/dnsmasq.conf | grep ^[^#]
  server=/localnet/172.16.0.1
  address=/rate.ee/127.0.0.1

(to be continued..)


Links
-----

  https://www.howtoforge.com/ubuntu_pxe_install_server
  https://gist.github.com/kimus/9315140
  https://forum.manjaro.org/index.php?topic=1371.0
  http://www.syslinux.org/wiki/index.php/MEMDISK
  http://wernerstrydom.com/2014/05/25
  /automatically-installing-ubuntu-server-14-04-tftp/
  http://serverfault.com/questions/475468
  /where-does-ufw-uncomplicated-firewall-save-command-line-rules-to
  https://www.digitalocean.com/community/tutorials
  /how-to-setup-a-firewall-with-ufw-on-an-ubuntu-and-debian-cloud-server

