GTOPIA Blog

Replace Google Fiber box with Ubiquity ERPoe‑5

November 15, 2016
By: Mark
0 Comment
Tech

firewall {
    all-ping enable
    broadcast-ping disable
    ipv6-receive-redirects disable
    ipv6-src-route disable
    ip-src-route disable
    log-martians enable
    name WAN_IN {
        default-action drop
        description "WAN to Internal"
        enable-default-log
        rule 1 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            description "Drop invalid state"
            log enable
            state {
                invalid enable
            }
        }
    }
    name WAN_LOCAL {
        default-action drop
        description "WAN to Router"
        enable-default-log
        rule 1 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                related enable
            }
        }
        rule 2 {
            action drop
            description "Drop invalid state"
            log enable
            state {
                invalid enable
            }
        }
    }
    options {
        mss-clamp {
            interface-type all
            mss 1460
        }
    }
    receive-redirects disable
    send-redirects enable
    source-validation disable
    syn-cookies enable
}
interfaces {
    ethernet eth0 {
        address 192.168.0.1/24
        description "Local Config Port"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth1 {
        description "Google Fiber Jack"
        duplex auto
        poe {
            output 48v
        }
        speed auto
        vif 2 {
            address dhcp
            address dhcpv6
            description "Google Fiber WAN"
            egress-qos 0:3
            firewall {
                in {
                    name WAN_IN
                }
                local {
                    name WAN_LOCAL
                }
            }
        }
    }
    ethernet eth2 {
        description "LAN 0"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth3 {
        description "LAN 1"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    ethernet eth4 {
        description "LAN 2"
        duplex auto
        poe {
            output off
        }
        speed auto
    }
    loopback lo {
    }
    switch switch0 {
        address 10.1.0.1/24
        description "LAN Switch"
        mtu 1500
        switch-port {
            interface eth2
            interface eth3
            interface eth4
        }
    }
}
port-forward {
    auto-firewall enable
    hairpin-nat enable
    lan-interface switch0
    wan-interface eth1.2
}
service {
    dhcp-server {
        disabled false
        hostfile-update enable
        shared-network-name LAN {
            authoritative disable
            subnet 10.1.0.0/24 {
                default-router 10.1.0.1
                dns-server 10.1.0.1
                lease 86400
                start 10.1.0.101 {
                    stop 10.1.0.254
                }
            }
        }
    }
    dns {
        forwarding {
            cache-size 1000
            listen-on switch0
            name-server 2001:4860:4860::8888
            name-server 2001:4860:4860::8844
            name-server 8.8.8.8
            name-server 8.8.4.4
        }
    }
    gui {
        https-port 443
    }
    nat {
        rule 5000 {
            description "Masquerade for WAN"
            log disable
            outbound-interface eth1.2
            protocol all
            type masquerade
        }
    }
    ssh {
        port 22
        protocol-version v2
    }
    upnp2 {
        listen-on switch0
        nat-pmp disable
        secure-mode disable
        wan eth1.2
    }
}
system {
    host-name edgy-loop
    login {
        user ubnt {
            authentication {
                encrypted-password $1$zKNoUbAo$gomzUbYvgyUMcD436Wo66.
                plaintext-password ""
            }
            level admin
        }
    }
    name-server 2001:4860:4860::8888
    name-server 2001:4860:4860::8844
    name-server 8.8.8.8
    name-server 8.8.4.4
    ntp {
        server 0.ubnt.pool.ntp.org {
        }
        server 1.ubnt.pool.ntp.org {
        }
        server 2.ubnt.pool.ntp.org {
        }
        server 3.ubnt.pool.ntp.org {
        }
    }
    offload {
        ipsec enable
        ipv4 {
            forwarding enable
            vlan enable
        }
        ipv6 {
            forwarding disable
        }
    }
    syslog {
        global {
            facility all {
                level notice
            }
            facility protocols {
                level debug
            }
        }
    }
    time-zone America/Chicago
}

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

firewall {

all-ping enable

broadcast-ping disable

ipv6-receive-redirects disable

ipv6-src-route disable

ip-src-route disable

log-martians enable

name WAN_IN {

default-action drop

description "WAN to Internal"

enable-default-log

rule 1 {

action accept

description "Allow established/related"

log disable

state {

established enable

related enable

}

rule 2 {

action drop

description "Drop invalid state"

log enable

state {

invalid enable

}

name WAN_LOCAL {

default-action drop

description "WAN to Router"

enable-default-log

rule 1 {

action accept

description "Allow established/related"

log disable

state {

established enable

related enable

}

rule 2 {

action drop

description "Drop invalid state"

log enable

state {

invalid enable

}

options {

mss-clamp {

interface-type all

mss 1460

}

receive-redirects disable

send-redirects enable

source-validation disable

syn-cookies enable

}

interfaces {

ethernet eth0 {

address 192.168.0.1/24

description "Local Config Port"

duplex auto

poe {

output off

}

speed auto

}

ethernet eth1 {

description "Google Fiber Jack"

duplex auto

poe {

output 48v

}

speed auto

vif 2 {

address dhcp

address dhcpv6

description "Google Fiber WAN"

egress-qos 0:3

firewall {

in {

name WAN_IN

}

local {

name WAN_LOCAL

}

ethernet eth2 {

description "LAN 0"

duplex auto

poe {

output off

}

speed auto

}

ethernet eth3 {

description "LAN 1"

duplex auto

poe {

output off

}

speed auto

}

ethernet eth4 {

description "LAN 2"

duplex auto

poe {

output off

}

speed auto

}

loopback lo {

}

switch switch0 {

address 10.1.0.1/24

description "LAN Switch"

mtu 1500

switch-port {

interface eth2

interface eth3

interface eth4

}

port-forward {

auto-firewall enable

hairpin-nat enable

lan-interface switch0

wan-interface eth1.2

}

service {

dhcp-server {

disabled false

hostfile-update enable

shared-network-name LAN {

authoritative disable

subnet 10.1.0.0/24 {

default-router 10.1.0.1

dns-server 10.1.0.1

lease 86400

start 10.1.0.101 {

stop 10.1.0.254

}

dns {

forwarding {

cache-size 1000

listen-on switch0

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

name-server 8.8.8.8

name-server 8.8.4.4

}

gui {

https-port 443

}

nat {

rule 5000 {

description "Masquerade for WAN"

log disable

outbound-interface eth1.2

protocol all

type masquerade

}

ssh {

port 22

protocol-version v2

}

upnp2 {

listen-on switch0

nat-pmp disable

secure-mode disable

wan eth1.2

}

system {

host-name edgy-loop

user ubnt {

authentication {

encrypted-password $1$zKNoUbAo$gomzUbYvgyUMcD436Wo66.

plaintext-password ""

}

level admin

}

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

name-server 8.8.8.8

name-server 8.8.4.4

ntp {

server 0.ubnt.pool.ntp.org {

}

server 1.ubnt.pool.ntp.org {

}

server 2.ubnt.pool.ntp.org {

}

server 3.ubnt.pool.ntp.org {

}

offload {

ipsec enable

ipv4 {

forwarding enable

vlan enable

}

ipv6 {

forwarding disable

}

syslog {

global {

facility all {

level notice

}

facility protocols {

level debug

}

time-zone America/Chicago

}

Simple SSSD Configuration with eDirectory on SUSE

November 10, 2016
By: Mark
0 Comment
SUSE Linux, Tech, Uncategorized

Two Factor Authentication is a lofty goal for any linux administrator. If you’re lucky enough to have access to an NetIQ eDirectory server, hardware based two factor authentication is closer than you think. Tutorial on how to use SSSD (pronounced Triple “S” D) as a cross Linux platform (RHEL, SLES, Ubuntu, et. al) authentication agent […]

Extract Presented Certificate using openssl

October 13, 2016
By: Mark
0 Comment
Uncategorized

openssl s_client -connect 192.168.211.21:636 \
< /dev/null 2>/dev/null \
| openssl x509 -text -in /dev/stdin

openssl s_client -connect 192.168.211.21:636 \

< /dev/null 2>/dev/null \

| openssl x509 -text -in /dev/stdin

Difference Between DER and PEM Certificate Encoding

March 25, 2014
By:
0 Comment
Uncategorized

There are two main methods for encoding certificate data. DER = Binary encoding for certificate data PEM = The base64 encoding of the DER encoded certificate, with a header and footer lines added. DER DER: (Distinguished Encoding Rules) is a subset of BER encoding providing for exactly one way to encode an ASN.1 value. DER […]

Add Certificate to JAVA keystore (cacerts)

March 19, 2014
By:
0 Comment
Java, Public Key Infrastructure ( PKI ), Tech

Requirements: Have keytool installed (Installed as a part of the jre) Have your certificate local (either pem or der format) Know where your keystore is

/usr/java/jre1.7.0/bin/keytool -importcert -trustcacerts -noprompt \
-alias custom-root-ca \
-storepass changeit \
-file /etc/ssl/certs/CERT.pem \
-keystore /usr/java/jre1.7.0/lib/security/cacerts

/usr/java/jre1.7.0/bin/keytool -importcert -trustcacerts -noprompt \

-alias custom-root-ca \

-storepass changeit \

-file /etc/ssl/certs/CERT.pem \

-keystore /usr/java/jre1.7.0/lib/security/cacerts

Add SDK to SLES without YaST

January 9, 2014
By:
0 Comment
SUSE Linux, Tech

Add “Pool” Repository zypper ar -t rpm-md <<URL>> zypper in -t product sle-sdk suse-register zypper refs zypper lr

Setting up Java with Mozilla the Right way on OpenSuse

March 1, 2013
By:
0 Comment
Uncategorized

Install Java from Oracle Setup the plugin with this command sudo /usr/sbin/update-alternatives –install /usr/lib64/browser-plugins/javaplugin.so javaplugin /usr/java/default/lib/amd64/libnpjp2.so 3 –slave /usr/bin/javaws javaws /usr/java/default/bin/javaws

Developing a Windows 7 SP1 Image

January 12, 2013
By:
0 Comment
Tech

Step 1 – Software Needed Get a Windows 7 SP1 installation media. For this article I’ll be using a Windows 7 SP1 Enterprise 32 bit version of Windows. The Windows® Automated Installation Kit (AIK) for Windows® 7 http://www.microsoft.com/download/en/confirmation.aspx?id=5753 This file downloads as: KB3AIK_EN.iso The Windows Automated Installation Kit (AIK) Supplement for Windows 7 SP1 is […]

Baby Girl

January 12, 2013
By:
0 Comment
Uncategorized

PFX (p12) Certificate Conversion

January 19, 2012
By:
1 Comment
Personal, Public Key Infrastructure ( PKI ), Tech

Commands Used to Convert PFX or P12 certificates to plain text pem encoded certificates.