Installing Systems on a Simulated Subnet North Carolina System Administrators

Why? ● The server needs a static IP address. ● DHCP address assignment is inappropriate or unavailable. ● Some quasi-permanent configuration is determined by examining subnet number.

Network Install Steps ● DHCP ● TFTP – pxeconfig, kernel, initrd ● DHCP ● DNS ● HTTP – kickstart file ● DHCP ● HTTP/NFS - packages

Network Install Steps (cont'd) ● DNS - “local” ● NIS, kerberos ● NFS - “local”

Two Interfaces ● p35p1: the “default” interface What you'd normally use on the company network Could be wireless Typically configured by company DHCP ● eth0: assigned the address and netmask of the default router on the subnet to be simulated

Hardware Layer ● USB ethernet port plus: ● Dumb switch, or ● Crossover cable ● Unreliable:fancy corporate brouter

Be a Router ● /etc/sysctl.conf: ● net.ipv4.ip_forward = 1 ● Dynamically: ● echo 1 | sudo dd of=/proc/sys/net/ipv4/ip_forward

DHCP ● Limited to simulated subnet only ● kill -STOP `ps -o pid --no-headers -C dnsmasq` ● ISC dhcp

/etc/dhcp/dhcpd.conf option domain-name-servers , ; option domain-name "local.rfmd.com"; # Jumpstart support.. shared-network lan { subnet netmask { option routers ; option broadcast-address ;

dhcpd.conf (cont'd) # Solaris machines... } subnet netmask { option routers ; option broadcast-address ; host bilbo {

dhcpd.conf (cont'd) host bilbo { fixed-address ; hardware ethernet 00:0d:60:1c:00:82; next-server ; filename "linux-install/pxelinux.0"; }

dhcpd.conf (cont'd) } # more hosts... } # subnet } # lan

iptables NAT ● /etc/sysconfig/iptables-config ● IPTABLES_MODULES="nf_conntrack_tftp nf_nat_tftp" ● /etc/modprobe.conf/netfilter.conf ● options nf_conntrack_tftp ports=69

iptables NAT ● /etc/sysconfig/iptables ●... ● *nat ● -A POSTROUTING -m udp -p udp -s /16 -o p35p1 -j SNAT --to-source ● -A POSTROUTING -m tcp -p tcp -s /16 -o p35p1 -j SNAT --to-source ● -A POSTROUTING -s /16 -o p35p1 -j SNAT --to- source ● COMMIT

Proxying “local” servers ● Host route ● sudo ip route add via dev p35p1 ● ARP ● sudo arp -Ds eth0 pub

Debugging: Wireshark ● You're going to miss something Servers Services ● Especially with non-Linux Solaris: ICMP Netmask ● Use wireshark on the second interface (eth0) What happened just before the hang?

The Big Script bash-4.2$ cat virt10.11 #!/bin/bash echo ===routes:before sudo ip route list sudo ip route add via dev p35p1 sudo ip route add via dev p35p1 sudo ip route add via dev p35p1

The Big Script bash-4.2$ cat virt10.11 #!/bin/bash echo ===routes:before sudo ip route list sudo ip route add via dev p35p1 sudo ip route add via dev p35p1 sudo ip route add via dev p35p1

The Big Script sudo ip route add via dev p35p1 sudo ip route add via dev p35p1 echo ===routes:after sudo ip route list echo ===iptables:before sudo iptables -t nat -L -v

The Big Script sudo ip route add via dev p35p1 sudo ip route add via dev p35p1 echo ===routes:after sudo ip route list echo ===iptables:before sudo iptables -t nat -L -v

The Big Script sudo ip route add via dev p35p1 sudo ip route add via dev p35p1 echo ===routes:after sudo ip route list echo ===iptables:before sudo iptables -t nat -L -v

The Big Script [ -f /etc/sysconfig/iptables-normal ] || \ sudo mv /etc/sysconfig/iptables /etc/sysconfig/iptables- normal sudo dd of=/etc/sysconfig/iptables <<'EOIPTABLES' *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0]

The Big Script [ -f /etc/sysconfig/iptables-normal ] || \ sudo mv /etc/sysconfig/iptables /etc/sysconfig/iptables- normal sudo dd of=/etc/sysconfig/iptables <<'EOIPTABLES' *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0]

The Big Script -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -p udp --dport 69 -j ACCEPT -A INPUT -p tcp --dport 22 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT *nat

The Big Script -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -p udp --dport 69 -j ACCEPT -A INPUT -p tcp --dport 22 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT *nat

The Big Script *nat -A POSTROUTING -m udp -p udp -s /16 -o p35p1 -j SNAT --to-source A POSTROUTING -m tcp -p tcp -s /16 -o p35p1 -j SNAT --to-source A POSTROUTING -s /16 -o p35p1 -j SNAT --to- source COMMIT

The Big Script *nat -A POSTROUTING -m udp -p udp -s /16 -o p35p1 -j SNAT --to-source A POSTROUTING -m tcp -p tcp -s /16 -o p35p1 -j SNAT --to-source A POSTROUTING -s /16 -o p35p1 -j SNAT --to- source COMMIT

The Big Script EOIPTABLES sudo systemctl restart iptables.service echo ===iptables:after sudo iptables -t nat -L -v echo ===eth0:before sudo ip addr show dev eth0 set - `sudo ip addr show dev eth0 scope global` prevaddr=${17}

The Big Script EOIPTABLES sudo systemctl restart iptables.service echo ===iptables:after sudo iptables -t nat -L -v echo ===eth0:before sudo ip addr show dev eth0 set - `sudo ip addr show dev eth0 scope global` prevaddr=${17}

The Big Script EOIPTABLES sudo systemctl restart iptables.service echo ===iptables:after sudo iptables -t nat -L -v echo ===eth0:before sudo ip addr show dev eth0 set - `sudo ip addr show dev eth0 scope global` prevaddr=${17}

The Big Script EOIPTABLES sudo systemctl restart iptables.service echo ===iptables:after sudo iptables -t nat -L -v echo ===eth0:before sudo ip addr show dev eth0 set - `sudo ip addr show dev eth0 scope global` prevaddr=${17}

The Big Script EOIPTABLES sudo systemctl restart iptables.service echo ===iptables:after sudo iptables -t nat -L -v echo ===eth0:before sudo ip addr show dev eth0 set - `sudo ip addr show dev eth0 scope global` prevaddr=${17}

The Big Script sudo ip addr del $prevaddr dev eth0 sudo ip addr add /16 dev eth0 echo ===eth0:after sudo ip addr show dev eth0 echo ===arp:before sudo arp -a

The Big Script sudo ip addr del $prevaddr dev eth0 sudo ip addr add /16 dev eth0 echo ===eth0:after sudo ip addr show dev eth0 echo ===arp:before sudo arp -a

The Big Script sudo ip addr del $prevaddr dev eth0 sudo ip addr add /16 dev eth0 echo ===eth0:after sudo ip addr show dev eth0 echo ===arp:before sudo arp -a

The Big Script sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub echo ===arp:after sudo arp -a

The Big Script sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub sudo arp -Ds eth0 pub echo ===arp:after sudo arp -a

The Big Script echo ===start dns sudo kill -STOP `ps -o pid --no-headers -C dnsmasq` sudo systemctl start dhcpd.service echo ===start routing echo 1 | sudo of=/proc/sys/net/ipv4/ip_forward

The Big Script echo ===start dns sudo kill -STOP `ps -o pid --no-headers -C dnsmasq` sudo systemctl start dhcpd.service echo ===start routing echo 1 | sudo of=/proc/sys/net/ipv4/ip_forward

Questions ?

BONUS: Solaris ok boot net:dhcp - install /etc/dhcp/dhcpd.conf: # Jumpstart Support option space SUNW; option SUNW.root-mount-options code 1 = text; option SUNW.root-server-ip-address code 2 = ip-address; option SUNW.root-server-hostname code 3 = text;

BONUS: Solaris option SUNW.root-path-name code 4 = text; option SUNW.swap-server-ip-address code 5 = ip-address; option SUNW.swap-file-path code 6 = text; option SUNW.boot-file-path code 7 = text; option SUNW.posix-timezone-string code 8 = text; option SUNW.boot-read-size code 9 = unsigned integer 16;

BONUS: Solaris option SUNW.install-server-ip-address code 10 = ip- address; option SUNW.install-server-hostname code 11 = text; option SUNW.install-path code 12 = text; option SUNW.sysid-config-file-server code 13 = text; option SUNW.JumpStart-server code 14 = text; option SUNW.terminal-name code 15 = text;

BONUS: Solaris # Solaris Jumpstart Grub support option space Site; option Site.Grubmenu code 150 = text;

BONUS: Solaris host bombadil { fixed-address ; hardware ethernet 00:03:BA:2A:67:82; next-server valar; filename "0A0B0978.SUN4U"; option host-name "bombadil"; vendor-option-space SUNW; option SUNW.root-server-ip-address ;

BONUS: Solaris option SUNW.root-server-hostname "valar"; option SUNW.root-path-name "/jumpstart/Live/OS/Solaris_10.0_07- 06/Solaris_10/Tools/Boot"; option SUNW.sysid-config-file-server " :/jumpstart/Live/Sysidcfg/Solaris_10/Greensb oro"; option SUNW.JumpStart-server " :/jumpstart/Live"; option SUNW.install-server-hostname "valar";

BONUS: Solaris option SUNW.install-server-ip-address ; option SUNW.install-path "/jumpstart/Live/OS/Solaris_10.0_07-06"; }