Networking
Find a file
2024-11-07 21:24:44 +01:00
docs feat: switch to openwrt 2024-11-03 18:43:15 +01:00
openwrt/etc/config feat(dhcp): static ip configuration 2024-11-07 21:24:44 +01:00
tailscale docs: tailscale acl example 2024-11-03 23:06:34 +01:00
terraform feat: more subnet documentation and ipv6 change 2024-11-05 19:51:03 +01:00
.envrc feat: initial deployment 2024-11-02 19:53:21 +01:00
.gitignore feat: initial deployment 2024-11-02 19:53:21 +01:00
devbox.json feat: initial deployment 2024-11-02 19:53:21 +01:00
devbox.lock feat: initial deployment 2024-11-02 19:53:21 +01:00
justfile docs: tailscale acl example 2024-11-03 23:06:34 +01:00
LICENSE Initial commit 2024-11-02 14:27:31 +00:00
README.md feat(dhcp): static ip configuration 2024-11-07 21:24:44 +01:00

network.tjo.cloud

Handling networking between nodes and between virtual machines.

Architecture

WAN interface either represents an actual public interface (on Hetzner) or an interface in home LAN that has port-forwarded ports to it from home router.

LAN interface is an ordinary lan network.

ingress.tjo.cloud has port-forwarded all public ports to it (22, 25, 80, 443, 587 etc.). No other VM is accessible from the internet.

network.tjo.cloud establishes Tailscale VPN connection between other network.tjo.cloud VMs. Using subnet routing it makes it possible that each VM can connect to all other VMs on any Proxmox host.

Subnets

We are using 10.0.0.0/16 range for IPv4 as well as fd74:6a6f:0::/48 for IPv6.

Designations

Host IPv4 IPv6
reserved 10.0.0.0/20 fd74:6a6f:0:0000::/52
batuu 10.0.16.0/20 fd74:6a6f:0:1000::/52
jakku 10.0.32.0/20 fd74:6a6f:0:2000::/52
nevaroo 10.0.48.0/20 fd74:6a6f:0:3000::/52
10.0.64.0/20 fd74:6a6f:0:4000::/52
10.0.80.0/20 fd74:6a6f:0:5000::/52
10.0.96.0/20 fd74:6a6f:0:6000::/52
10.0.112.0/20 fd74:6a6f:0:7000::/52
10.0.128.0/20 fd74:6a6f:0:8000::/52
10.0.144.0/20 fd74:6a6f:0:9000::/52
10.0.160.0/20 fd74:6a6f:0:a000::/52
10.0.176.0/20 fd74:6a6f:0:b000::/52
10.0.192.0/20 fd74:6a6f:0:c000::/52
10.0.208.0/20 fd74:6a6f:0:d000::/52
10.0.224.0/20 fd74:6a6f:0:e000::/52
10.0.240.0/20 fd74:6a6f:0:f000::/52

Each subnet gives us 4096 IP addresses per host.

Per host designations

Use IPv4 IPv6
Virtual Machines 10.0.(y+0).0/22 fd74:6a6f:0:y000::/54
Kubernetes 10.0.(y+4).0/22 fd74:6a6f:0:y400::/54
10.0.(y+8).0/22 fd74:6a6f:0:y800::/54
10.0.(y+12).0/22 fd74:6a6f:0:yc00::/54

Each section gives us 1024 IP addresses.

Setting up new Host

1. Add new device to terraform.tfvars.

2. Manually configure vmbr0 and use import to import it.

3. Deploy terraform.

4. Set Password (see bitwarden)

5. Setup Tailscale.

Ref: https://github.com/adyanth/openwrt-tailscale-enabler

opkg update
opkg install ca-bundle kmod-tun iptables-nft kmod-ipt-conntrack kmod-ipt-conntrack-extra kmod-ipt-conntrack-label kmod-ipt-nat kmod-nft-nat
/etc/init.d/tailscale start
/etc/init.d/tailscale enable

# Batuu
tailscale up --accept-routes --advertise-routes=10.0.16.0/20,fd74:6a6f:0:1000::/52 --accept-dns=false --ssh
# Jakku
tailscale up --accept-routes --advertise-routes=10.0.32.0/20,fd74:6a6f:0:2000::/52 --accept-dns=false --ssh
# Nevaroo
tailscale up --accept-routes --advertise-routes=10.0.48.0/20,fd74:6a6f:0:3000::/52 --accept-dns=false --ssh

6. Configure.

Once tailscale is up and manually configured (see the config files for guide). We can use automated way of maintaining config.

just deploy-config batuu 10.0.16.1 fd74:6a6f:0:1000::
just deploy-config jakku 10.0.32.1 fd74:6a6f:0:2000::
just deploy-config nevaroo 10.0.48.1 fd74:6a6f:0:3000::

Static Internal IP Addresses

Any VM that requires a static IP, can add it's configuration to openwrt/etc/config/dhcp.

TODO

Use gitops for tailscale ACL.

Current version is an snapshot in time, more as an example then actual version used.

IPv6 Connectivity.

As we assign private ipv6 addresses, we would have to ise ipv6 nat to translate those to real ipv6 addresses.