From 3e8505929b3c613b6fdab0b105b2a9b8c1e96de6 Mon Sep 17 00:00:00 2001 From: DoTheEvo Date: Sat, 3 Jan 2026 03:07:00 +0100 Subject: [PATCH] update --- _knowledge-base/backup-vlans.md | 314 ++++++++++++++++++ .../mounting_network_share_linux.md | 153 +++++++-- _knowledge-base/vlans.md | 47 ++- 3 files changed, 468 insertions(+), 46 deletions(-) create mode 100644 _knowledge-base/backup-vlans.md diff --git a/_knowledge-base/backup-vlans.md b/_knowledge-base/backup-vlans.md new file mode 100644 index 0000000..3ab98d3 --- /dev/null +++ b/_knowledge-base/backup-vlans.md @@ -0,0 +1,314 @@ +# VLANs Guide + +![tagged_vlan_example_diag](https://i.imgur.com/l5IxAKf.png) + +### Purpose of VLANs + +Separate a network in to smaller segments.
+This can improve securirty, ease of managment, +reduce unnecessary chatter that can congest larger networks. + +### Hardware + +Whats required before thinking about vlans. + +* **Managed switches** as oppose to cheaper typical *"dumb switches"*, + as majority of the configuration of vlans is done on switches.
+ * **HPE/Aruba** - super reliable, easy to manage, enterprise-grade switches + that won't break the bank if it's just about 1gbit. + * **Mikrotik** or **Ubiquiti** - usually when in need of something + special, like 2.5gbit with some sfp+ or poe + * **TP-Link** - when just want something cheap, like poe switch for cameras +* A **router/firewall/gateway** device that supports vlans. + This will be the linchpin at the center, with separate settings + for each vlan - being their gateway, providing them with separate dhcp, + applying firewall rules between them,...
+ * **opnsense** - is what I [use](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/opnsense), + installed as a virtual machine, but can be installed on any regular old pc, + or a miniPC with two intel NICs. + * **Ubiquiti UCG-Ultra** - solid go-to recommendation. +
+ Reasons... + * it is **very easy to configure**. + * 100€. + * ok hardware - 4x arm cores, 3GB RAM, informative lcd display, usb-c power. + * full of features - vlans, wireguard VPN, cloud remote managment, + geoblocking, basic IDPS, DNS base adblocking, unifi controller for wifi APs,... +
+ * **Mikrotik** devices are a good pick, but their configuration can be + overwhelming. I gave up and use just their switches. + +
+

Some basic networking knowledge is required.

 + +You should know about IP addresses, Mac addresses, packets, frames, +swiches, routers, about existance of first 4 OSI layers,.. + +* [What is OSI Model | Real World Examples](https://youtu.be/0y6FtKsg6J4) +* [OSI Model Deep Dive](https://youtu.be/oVVlMqsLdro) +* [CIDR notation](https://youtu.be/z07HTSzzp3o?t=746) +* [Layer 2 vs Layer 3 Switches](https://youtu.be/bdNS0K4Bt8U) + +lets put here also vlan stuff + +* [VLANs Explained Simply](https://youtu.be/C81pyQaJgj8) +* [vlan theory video](https://youtu.be/MmwF1oHOvmg) +* [vlan theory video2](https://youtu.be/JszGeQPTo4w) +* [vlan networkacademy](https://www.networkacademy.io/ccna/ethernet/vlan-concept) +* [What is VLAN and how it works](https://www.etherwan.com/support/featured-articles/brief-introduction-vlans) +* [Network Virtualization: Beyond VLANs – Part 1: VLANs](https://infrastructureadventures.wordpress.com/2010/11/13/network-virtualization-beyond-vlans-part-1/) +* [What is PVID? VLAN explained Quick and Dirty](https://forflukesake.co.za/wp/531/vlan-pvid-explained-quick-and-dirty/) +--- +--- + +
+ +### Two types of VLANs + +* **Port based**
+ A simple separation of ports on a switch, + as if you would cut it in to several smaller switches. + This is boring, limiting and generally **useless**, + as you would need to deal with extra cables, extra interfaces, extra hardware.. +* **Tag based**
+ The real deal vlan. At layer2 a **vlan tag** is added to frames. + It contains a **vlan ID** which is a number between 1 and 4094. + These are used to create virtual networks that are separate + from each other but share same hardware, same cables.
+ The standard is called **802.1Q**. + +![frame_pic](https://i.imgur.com/pUq92ky.png) + +Some aspects: + +* **Tags** are added or removed from **frames** at physical ports, + when entering or leaving switch. +* A tag is 4 bytes in size, contains [several pieces of info](https://i.imgur.com/86zeYgG.png), + the most important being vlan ID. +* **Vlan ID** (VID) is just a number between 1-4094, often picked as + multiplies of ten - 10, 20, 30, 40, ... with the ip address pool on that VLAN + having it somewhere too.
+ Like vlan30 would be set as 192.168.30.0/24 or 10.30.30.0/24. +* A **frame** can be tagged only for a **single vlan**, + but a port can belong to many vlans. +* Tagged frames **get dropped** if they would arrive to a regular machine, + not configured for vlans. + +### The Core concept + +The **absofucking essence** of VLANs is a clear understanding of two types +of ports - untagged and tagged. + +![tagged_untagged_traffic](https://i.imgur.com/snTxTyf.gif) + +* **Untagged ports**
+ Called untagged because frames coming in to a switch, or leaving the switch + through that one port are not tagged. So that the end device can actually + communicate without the need to be configured for vlans.
+ While the inbound frames, the ones entering the switch through this port + are untagged at the moment of entering, they are tagged once inside the switch + according to **PVID** settings for that port, so that they can exit only + through other ports tagged with that same VLAN.
+ Untagged ports are **used for end user devices** unaware of vlans - computers, + printers, ip cameras, IoT devices,...
+ These are sometimes called **access ports**, as thats cisco term for them. + * **PVID** - Port Vlan ID
+ Is a setting on a port. Incoming frames entering switch that are not tagged + get tagged with this PVID number.
+ It might feel weird that for an untagged port you are setting both VLAN ID + and PVID when VLAN ID should be enough. It feels like duplication of effort... + but its there to solve some hybrid cases. +* **Tagged ports**
+ Tagged frames going in and out of this kind of ports. Tagged port can carry many + VLANs simultaneously if set so, or can carry just one. + Purpose is to communicate with other vlan aware devices, + like other switches, routers, servers/virtual machines, IP telephones,...
+ Of note is that setting a port to **vlan 4095** allows all vlans to traverse, + though it can be manufacturer dependent, if its even allowed to set vlan above + `4094`.
+ * **Trunk port**
+ A type of tagged port. The term is used for ports that carry multiple vlans, + usually the ones connecting switch with another switch or a server or a router,..
+ A tagged port that is not a trunk port would be for example a port that carries + just one vlan to a VoIP phone. + * **Native vlan**
+ Frames belonging to native vlan leave the trunk port untagged. + The initial reason for the existence of this is to allow older dumb switches + to be part of the infrastructure, in between two managed ones. + [Video.](https://youtu.be/Fmq1E1Qr2W4) + +# Setting up VLANs on Routers + +![vlan_pic_with_dhcp](https://i.imgur.com/nV27IlD.png) + +Your vlan aware router wil be the linchpin at the center, +the gateway to the internet for all vlans, the dhpc server for all vlans, +the firewall for all vlans,... + +#### The usual generic steps + +* creating a new interface or a new network with a specific Vlan ID. +* setting a static IP address / subnet the router will have on that network. +* setting the dhcp pool for for that network. +* maybe enable or restrict the traffic through firewall rules + +
+

OPNsense - Router

 + +![opnsense_int](https://i.imgur.com/fz67oJj.png) + +[Isolating Networks in OPNsense](https://youtu.be/TjXkWSjYqlM) + +* **Add new VLAN**
+ `Interfaces: Other Types: VLAN`
+ Add; Device = empty; Parent = **LAN**; VLAN tag = `20`; VLAN priority = default; + Description = `VLAN20WIFI` +* **Assign the new VLAN as an interface**
+ `Interfaces: Assignments`
+ Assign a new interface > pick the VLAN from dropbox; Description = `vlan_20_wifi`
+ Enter the newly created interface, Enable it; IPv4 Configuration Type = `Static IPv4`; + IPv4 address = `10.20.20.1/24` +* **Setup dhcp servis on the new interface**
+ `Services: ISC DHCPv4: [VLAN20WIFI]`
+ Enable; From = `10.20.20.50` To = `10.20.20.200`; DNS servers = 10.20.20.1; + Gateway = `10.20.20.1` +* **Firewall rule to enable traffic through**
+ `Firewall: Rules: VLAN20WIFI`
+ Source = `VLAN20WIFI net`; save as default is pass and everything + +
+ +* [opnsense video](https://youtu.be/LMJeIUDlrHo) +* [pfsense video but applicable](https://youtu.be/SsaGeXx2qh0) + +
If running opnsense as a virtual machine.
 + +![esxi](https://i.imgur.com/uvpF8KC.png) + +For VLAN aware devices on the network to get through + +* Edit the port group with the opnsense VM LAN interface + and add VLAN ID = `4095`
+ This will allow all VLANs to get through + +For a virtual machine on that ESXI host should be on that VLAN + +* Add new port group, to the virtual switch that opnsense uses for LAN
+ Name = `vlan20`; VLAN ID = `20` + +Now you can edit a VM or create new one, set its Network Adapter to `vlan20` +and it should get ip address from the vlan 20 dhcp pool. + +This is a good test if stuff works as it should before diving in to configuration +of VLANs on switches. + +
+ +
+ +
+

Ubiquiti Unifi - Router

 + +![opnsense_int](https://i.imgur.com/8pPHuX4.png) + +Disgustingly simple. + +Settings > Networks > New Virtual Network + +* set `Name` +* turn off `Auto-Scale Network` +* set `Gateway IP/Subnet` which sets this routers IP on that vlan +* set `VLAN ID` = `20` +* pick if you want guest network or isolation or disable internet access on it +* `DHCP` set pool range + +
+ +# Setting up VLANs on switches + +There are three settings for a port: + +* **PVID** - applies to all untagged frames **entering** + the port - ingress. PVID sets vlanID, let's say to `1` + This connects the port with all other ports belonging to that `vlan-1`. +* **Untagged** - similar to PVID but this setting is applied to the frames + **leaving** the port, leaving the switch - egress. + The name `untagged` is telling the whole story - the frames are leaving + the switch untagged, the tag is removed before they leave... + and the fact that the port is untagged for `vlan-1` means the port + is connected with all other ports belonging to that `vlan-1`.
+ Usually a port has the same `PVID` and `Untagged` number set. +* **Tagged** - similar to `untagged`, it is about the frames **leaving** + the port, but this setting is saying that the frames leave with specific + vlan tag, expecting the device connected to this port to be vlan aware.
+ A port can have both untagged and tagged set. + + + +What happens immediately after you enable VLANs on a switch? + +* Everything should still work as before. +* All ports switch to be untagged ports. So they strip any vlan tags from + outbound frames. +* PVID on all ports is set to 1, so that incoming frames get tagged as vlan 1, + so all ports can communicate with each other. + +What happens next is you pick a trunk port, the one communicating with the router +or a switch through which multiple vlan goes as set it accordingly to belong to +all vlans.
+Then pick which ports have device that should be together and separated from the +rest and set their vland and PVID. + +
+

TP-Link - Switch

 + +![tplink_switch](https://i.imgur.com/u0INJ4C.gif) + +Got [TL-SG108PE](https://www.tp-link.com/us/home-networking/8-port-switch/tl-sg108pe/) +thats a managed switch with PoE. At the moment the situation +is that opnsense LAN port is connected to port 7 and testing notebook +is connected to port 6. + +* VLAN > 802.1Q VLAN > set port 7 as tagged and port 6 as untagged. +* VLAN > 802.1Q PVID Setting > set port 6 with vlan tag 20 + +Dunno what is the reason there are two settings, they say PVID is setting +specifically to tags incoming frames that come without any tag... but I cant +imagine a situation where one would want different number between these two. + +
+ +
+

MikroTik - Switch

 + +![mikrotik_switch](https://i.imgur.com/FMpl9TA.gif) + + +[a vlan guide](https://forum.mikrotik.com/viewtopic.php?t=143620) + +* **Bridge** section is where all the settings are happening.
+ This setup is simple layer 2, no routing, not doing anything with interfaces. +* Have a **bridge**, create a new one if you have clean config
+ Assign all the physical ports to this bridge in **Bridge > Ports** +* Define **VLANs** in **Bridge > VLANs** that it should handle.
+ Set which ports are tagged and which untagged for that vlan + * untagged - **outgoing** frames are normal - access port - PCs, Printers, TVs,.. + * tagged - **outgoing** frames are tagged - trunks - servers, gateways, wifi APs,... +* Set **PVIDs** for the ports in **Bridge > Ports**
+ PVID is about **incoming untagged** frames entering the switch, + what VLAN tag should they get as they move through switch. + By default mikrotik switches give tag 1 to all ports. +* After everything is configured **enable VLAN Filtering** on the bridge itself
+ **Bridge > Bridge > bridge** > VLAN section + +
+ + +
+

Ubiquiti Unifi - Switch

 + +![unifi_switch](https://i.imgur.com/Lf2UIY3.png) + + + +
diff --git a/_knowledge-base/mounting_network_share_linux.md b/_knowledge-base/mounting_network_share_linux.md index 287de17..828b448 100644 --- a/_knowledge-base/mounting_network_share_linux.md +++ b/_knowledge-base/mounting_network_share_linux.md @@ -1,63 +1,144 @@ -# Mounting Network Shares in Linux +# Mounting at Boot Network Shares -possible ways to mount stuff - fstab, autofs, systemd, docker volumes if its for docker +Many ways to mount - fstab, autofs, systemd, fuse, gvfs,...
+but the current go-to is **systemd mount**. -possible types of shares +There are two distinct ways to mount with systemd -* smb/samba/cifs - the most common share, support on all OS -* nfs - mostly used between linux machines, bit better performance -* iSCSI - the share is mounted as a block device as if it was really a disk, - great performance for small files +* **mount** service is enabled
+ straight up simple mounting at boot, high expectation that the network share + is always available during the boot, it's simple and easy to control + order of execution, retries, time outs, easy to debug, + best for servers, docker hosts,... +* **automount** service is enabled
+ the mounting happens at the first demand to access the path, + does not wait during boot for the mount to really happen, less predictable, + can auto-umount on idle, good for users machines -More on setup of these shares is in -[TrueNAS Scale guide.](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/trueNASscale) -# smb/samba/cifs +# Samba / SMB / CIFS [Arch wiki](https://wiki.archlinux.org/title/samba#As_systemd_unit) on samba systemd mount -* you will create two files in `/etc/systemd/system` -* one will have extension `.mount` the other `.automount` -* the name will be the same for both and it MUST correspond with the planned - mount path. Slashes `/` being replaced by dashes `-`.
- So if the share should be at `/mnt/mirror` the files are named - `mnt-mirror.mount` and `mnt-mirror.automount` -* copy paste the bellow content, edit as you see fit, - changing description, ip address and path, user and password,.. -* linux command `id` will show your current user `uid` and `gid` -* after ther changes execute command `sudo systemctl enable mnt-mirror.automount` - This will setup mounting that does not fail on boot if there are network issues, - and really mounts the target only on request +* Have `/mnt/pool` directory ready on the client - `sudo mkdir /mnt/pool` +* will be creating a mount file in `/etc/systemd/system/`
+ the name MUST correspond with the planned mount location, + just slashes `/` are replaced with dashes `-`
+ So if the share should be mounted at `/mnt/pool` the file is:
+ `/etc/systemd/system/mnt-pool.mount` + ```ini + [Unit] + Description=Mount MergerFS Pool or Whatever + After=network-online.target + Wants=network-online.target + # Before=docker.service -`mnt-mirror.mount` -```ini + [Mount] + What=//10.0.19.80/pool + Where=/mnt/pool + Type=cifs + Options=rw,username=bastard,password=aaa,uid=1000,gid=1000,file_mode=0664,dir_mode=0775,vers=3,_netdev + + [Install] + WantedBy=multi-user.target + ``` +* enable the mount service `sudo systemctl enable mnt-pool.mount` +* done + +### Automount version + +If the machine is just an end user PC or a notebook, +or no service really depends on that share being present straight from boot, +or a notebook moves between networks and share is not always there... +we can use automount that mounts the share only when something tries to access +the path. + +* disable mount service if already enabled: + `sudo systemctl disable mnt-pool.mount` +* we add another file next to the mount file, named exactly the same, + except the extension is `automount`, so here it would be:
+ `/etc/systemd/system/mnt-pool.automount` + ```ini + [Unit] + Description=Mount MergerFS Pool or Whatever + + [Automount] + Where=/mnt/pool + # TimeoutIdleSec=3600 # Unmount after 1 hour idle + + [Install] + WantedBy=multi-user.target + ``` +* we enable this automount service: + `sudo systemctl enable --now mnt-pool.automount` +* done + + +### Useful commands + +`smbclient -L 10.0.19.11` - list shares mounted from the ip
+`systemctl list-units -t mount --all` + +# NFS + +[Arch wiki](https://wiki.archlinux.org/title/NFS#As_systemd_unit) +on NFS systemd mount + +All the stuff regarding mount vs automount from Samba section above applies, +only the content of the systemd unit files changes. + +`/etc/systemd/system/mnt-pool.mount` +``` [Unit] -Description=3TB truenas mirror mount +Description=Mount MergerFS Pool or Whatever +After=network-online.target +Wants=network-online.target [Mount] -What=//10.0.19.11/Mirror -Where=/mnt/mirror -Type=cifs -Options=rw,username=kopia,password=aaa,file_mode=0644,dir_mode=0755,uid=1000,gid=1000 +What=10.0.19.80:/mnt/pool +Where=/mnt/pool +Type=nfs +Options=vers=3 [Install] WantedBy=multi-user.target ``` -`mnt-mirror.automount` -```ini +`/etc/systemd/system/mnt-pool.automount` +``` [Unit] -Description=3TB truenas mirror mount +Description=AutoMount MergerFS Pool or Whatever +Requires=network-online.target +After=network-online.target [Automount] -Where=/mnt/mirror +Where=/mnt/pool +TimeoutIdleSec=0 [Install] WantedBy=multi-user.target ``` -### Useful commants -`smbclient -L 10.0.19.11` - list shares mounted from the ip -`systemctl list-units -t mount --all` +Enable the mount service: `sudo systemctl enable --now mnt-pool.mount`
+Or for automount `sudo systemctl enable --now mnt-pool.automount` + +# Windows Client + +### Samba - windows + +just mount it or map it as a letter + +### NFS - windows + +For Windows NFS clients, write access often requires `all_squash` +with a defined anonuid/anongid, because Windows does not send linux uid/gid +information. Something like this:
+`/mnt/pool 10.0.19.0/24(rw,async,no_subtree_check,all_squash,anonuid=1000,anongid=1000,fsid=1)` + +**Windows Client** + +* must be windows pro, not windows home +* add windows component in the control panel - `Services for NFS` - `Client for NFS` +* cmd, not powershell - `mount \\10.0.19.80\mnt\pool N:` diff --git a/_knowledge-base/vlans.md b/_knowledge-base/vlans.md index c205c98..fb174e1 100644 --- a/_knowledge-base/vlans.md +++ b/_knowledge-base/vlans.md @@ -4,8 +4,9 @@ ### Purpose of VLANs -Separation of a network in to smaller segments.
-This can improve securirty, ease of managment, latency in larger networks. +Separate a network in to smaller segments.
+This can improve securirty, ease of managment, +reduce unnecessary chatter that can congest larger networks. ### Hardware @@ -13,13 +14,18 @@ Whats required before thinking about vlans. * **Managed switches** as oppose to cheaper typical *"dumb switches"*, as majority of the configuration of vlans is done on switches.
+ * **HPE/Aruba** - super reliable, easy to manage, enterprise-grade switches + that won't break the bank if it's just about 1gbit. + * **Mikrotik** or **Ubiquiti** - usually when in need of something + special, like 2.5gbit with some sfp+ or poe + * **TP-Link** - when just want something cheap, like poe switch for cameras * A **router/firewall/gateway** device that supports vlans. This will be the linchpin at the center, with separate settings for each vlan - being their gateway, providing them with separate dhcp, applying firewall rules between them,...
* **opnsense** - is what I [use](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/opnsense), installed as a virtual machine, but can be installed on any regular old pc, - or a miniPC with two NICs. + or a miniPC with two intel NICs. * **Ubiquiti UCG-Ultra** - solid go-to recommendation.
Reasons... @@ -29,15 +35,14 @@ Whats required before thinking about vlans. * full of features - vlans, wireguard VPN, cloud remote managment, geoblocking, basic IDPS, DNS base adblocking, unifi controller for wifi APs,...
- * **Mikrotik** devices are a good pick, but their configuration can be + * **Mikrotik** devices are a good pick, but their configuration can be overwhelming. I gave up and use just their switches. -

Some basic networking knowledge is required.

 -You should know about IP addresses, Mac addresses, packets, frames, -swiches, routers, about existance of first 4 OSI layers,.. +You should know about IP addresses, Mac addresses, packets, **frames**, +swiches, routers, about existance of the first 4 OSI layers,.. * [What is OSI Model | Real World Examples](https://youtu.be/0y6FtKsg6J4) * [OSI Model Deep Dive](https://youtu.be/oVVlMqsLdro) @@ -46,6 +51,7 @@ swiches, routers, about existance of first 4 OSI layers,.. lets put here also vlan stuff +* [VLANs Explained Simply](https://youtu.be/C81pyQaJgj8) * [vlan theory video](https://youtu.be/MmwF1oHOvmg) * [vlan theory video2](https://youtu.be/JszGeQPTo4w) * [vlan networkacademy](https://www.networkacademy.io/ccna/ethernet/vlan-concept) @@ -83,13 +89,15 @@ Some aspects: multiplies of ten - 10, 20, 30, 40, ... with the ip address pool on that VLAN having it somewhere too.
Like vlan30 would be set as 192.168.30.0/24 or 10.30.30.0/24. +* A **frame** can be tagged only for a **single vlan**, + but a port can belong to many vlans. * Tagged frames **get dropped** if they would arrive to a regular machine, not configured for vlans. ### The Core concept The **absofucking essence** of VLANs is a clear understanding of two types -of ports - untagged and tagged. +of traffic - untagged and tagged. ![tagged_untagged_traffic](https://i.imgur.com/snTxTyf.gif) @@ -120,7 +128,7 @@ of ports - untagged and tagged. `4094`.
* **Trunk port**
A type of tagged port. The term is used for ports that carry multiple vlans, - usually the ones connecting two switches, or a switch and a router.
+ usually the ones connecting switch with another switch or a server or a router,..
A tagged port that is not a trunk port would be for example a port that carries just one vlan to a VoIP phone. * **Native vlan**
@@ -140,7 +148,7 @@ the firewall for all vlans,... #### The usual generic steps * creating a new interface or a new network with a specific Vlan ID. -* setting what IP address / subnet the router will have on that network. +* setting a static IP address / subnet the router will have on that network. * setting the dhcp pool for for that network. * maybe enable or restrict the traffic through firewall rules @@ -218,6 +226,25 @@ Settings > Networks > New Virtual Network # Setting up VLANs on switches +There are three settings for a port: + +* **PVID** - applies to all untagged frames **entering** + the port - ingress. PVID sets vlanID, let's say to `1` + This connects the port with all other ports belonging to that `vlan-1`. +* **Untagged** - similar to PVID but this setting is applied to the frames + **leaving** the port, leaving the switch - egress. + The name `untagged` is telling the whole story - the frames are leaving + the switch untagged, the tag is removed before they leave... + and the fact that the port is untagged for `vlan-1` means the port + is connected with all other ports belonging to that `vlan-1`.
+ Usually a port has the same `PVID` and `Untagged` number set. +* **Tagged** - similar to `untagged`, it is about the frames **leaving** + the port, but this setting is saying that the frames leave with specific + vlan tag, expecting the device connected to this port to be vlan aware.
+ A port can have both untagged and tagged set. + + + What happens immediately after you enable VLANs on a switch? * Everything should still work as before.