563 lines
19 KiB
Markdown
563 lines
19 KiB
Markdown
# Network & Firewall Configuration
|
|
|
|
## System Information
|
|
- **Date**: 2025-07-16
|
|
- **Host**: nsntr.ai
|
|
- **OS**: Ubuntu 24.04
|
|
- **Incus Version**: 6.14
|
|
- **Firewall**: UFW + nftables (Incus ACL)
|
|
|
|
## Network Architecture Overview
|
|
|
|
### Network Segmentation Strategy
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────────────────┐
|
|
│ NETWORK ISOLATION ARCHITECTURE │
|
|
├─────────────────────────────────────────────────────────────────────────────────┤
|
|
│ services-net │ 10.10.10.0/24 │ Core services (Traefik, Gitea, Drone) │
|
|
│ development-net │ 10.20.20.0/24 │ Dev containers, staging │
|
|
│ production-net │ 10.30.30.0/24 │ Production containers, client apps │
|
|
│ management-net │ 10.40.40.0/24 │ Admin, monitoring, backup │
|
|
│ incusbr0 │ 10.94.230.0/24 │ Legacy network (ubuntu01 container) │
|
|
└─────────────────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## Network Configuration
|
|
|
|
### Network List
|
|
```
|
|
NAME TYPE MANAGED IPV4 IPV6 STATE
|
|
development-net bridge YES 10.20.20.1/24 none CREATED
|
|
incusbr0 bridge YES 10.94.230.1/24 auto CREATED
|
|
management-net bridge YES 10.40.40.1/24 none CREATED
|
|
production-net bridge YES 10.30.30.1/24 none CREATED
|
|
services-net bridge YES 10.10.10.1/24 none CREATED
|
|
```
|
|
|
|
### Services Network (10.10.10.0/24)
|
|
```yaml
|
|
name: services-net
|
|
type: bridge
|
|
config:
|
|
ipv4.address: 10.10.10.1/24
|
|
ipv4.nat: true
|
|
ipv4.dhcp: true
|
|
ipv4.dhcp.ranges: 10.10.10.50-10.10.10.199
|
|
ipv6.address: none
|
|
ipv6.nat: true
|
|
description: Core services network
|
|
used_by:
|
|
- /1.0/profiles/default?project=services
|
|
security:
|
|
acls: services-acl
|
|
```
|
|
|
|
### Development Network (10.20.20.0/24)
|
|
```yaml
|
|
name: development-net
|
|
type: bridge
|
|
config:
|
|
ipv4.address: 10.20.20.1/24
|
|
ipv4.nat: true
|
|
ipv4.dhcp: true
|
|
ipv4.dhcp.ranges: 10.20.20.50-10.20.20.199
|
|
ipv6.address: none
|
|
ipv6.nat: true
|
|
description: Development environment network
|
|
used_by:
|
|
- /1.0/profiles/default?project=development
|
|
security:
|
|
acls: development-acl
|
|
```
|
|
|
|
### Production Network (10.30.30.0/24)
|
|
```yaml
|
|
name: production-net
|
|
type: bridge
|
|
config:
|
|
ipv4.address: 10.30.30.1/24
|
|
ipv4.nat: true
|
|
ipv4.dhcp: true
|
|
ipv4.dhcp.ranges: 10.30.30.50-10.30.30.199
|
|
ipv6.address: none
|
|
ipv6.nat: true
|
|
description: Production environment network
|
|
used_by:
|
|
- /1.0/profiles/default?project=production
|
|
security:
|
|
acls: production-acl
|
|
```
|
|
|
|
### Management Network (10.40.40.0/24)
|
|
```yaml
|
|
name: management-net
|
|
type: bridge
|
|
config:
|
|
ipv4.address: 10.40.40.1/24
|
|
ipv4.nat: true
|
|
ipv4.dhcp: true
|
|
ipv4.dhcp.ranges: 10.40.40.50-10.40.40.199
|
|
ipv6.address: none
|
|
ipv6.nat: true
|
|
description: Management and monitoring network
|
|
used_by: []
|
|
security:
|
|
acls: management-acl
|
|
```
|
|
|
|
## IP Address Allocation
|
|
|
|
### Static IP Ranges (Reserved)
|
|
```
|
|
Network Range Purpose
|
|
services-net 10.10.10.10-49 Static services
|
|
development-net 10.20.20.10-49 Static dev services
|
|
production-net 10.30.30.10-49 Static prod services
|
|
management-net 10.40.40.10-49 Static management
|
|
```
|
|
|
|
### DHCP Ranges
|
|
```
|
|
Network Range Purpose
|
|
services-net 10.10.10.50-199 Dynamic allocation
|
|
development-net 10.20.20.50-199 Dynamic allocation
|
|
production-net 10.30.30.50-199 Dynamic allocation
|
|
management-net 10.40.40.50-199 Dynamic allocation
|
|
```
|
|
|
|
### Planned Static Assignments
|
|
```
|
|
Service IP Address Network Purpose
|
|
Traefik 10.10.10.10 services-net Reverse proxy
|
|
Gitea 10.10.10.20 services-net Git hosting
|
|
Drone CI 10.10.10.30 services-net CI/CD pipeline
|
|
Monitoring 10.40.40.10 management-net System monitoring
|
|
Backup Services 10.40.40.20 management-net Backup services
|
|
```
|
|
|
|
## Network Creation Commands
|
|
|
|
### 1. Services Network
|
|
```bash
|
|
incus network create services-net
|
|
incus network set services-net ipv4.address=10.10.10.1/24
|
|
incus network set services-net ipv4.nat=true
|
|
incus network set services-net ipv4.dhcp=true
|
|
incus network set services-net ipv4.dhcp.ranges=10.10.10.50-10.10.10.199
|
|
incus network set services-net ipv6.address=none
|
|
```
|
|
|
|
### 2. Development Network
|
|
```bash
|
|
incus network create development-net
|
|
incus network set development-net ipv4.address=10.20.20.1/24
|
|
incus network set development-net ipv4.nat=true
|
|
incus network set development-net ipv4.dhcp=true
|
|
incus network set development-net ipv4.dhcp.ranges=10.20.20.50-10.20.20.199
|
|
incus network set development-net ipv6.address=none
|
|
```
|
|
|
|
### 3. Production Network
|
|
```bash
|
|
incus network create production-net
|
|
incus network set production-net ipv4.address=10.30.30.1/24
|
|
incus network set production-net ipv4.nat=true
|
|
incus network set production-net ipv4.dhcp=true
|
|
incus network set production-net ipv4.dhcp.ranges=10.30.30.50-10.30.30.199
|
|
incus network set production-net ipv6.address=none
|
|
```
|
|
|
|
### 4. Management Network
|
|
```bash
|
|
incus network create management-net
|
|
incus network set management-net ipv4.address=10.40.40.1/24
|
|
incus network set management-net ipv4.nat=true
|
|
incus network set management-net ipv4.dhcp=true
|
|
incus network set management-net ipv4.dhcp.ranges=10.40.40.50-10.40.40.199
|
|
incus network set management-net ipv6.address=none
|
|
```
|
|
|
|
## Project Network Assignments
|
|
|
|
### Network Restrictions
|
|
```bash
|
|
incus project set services restricted.networks.access=services-net
|
|
incus project set development restricted.networks.access=development-net
|
|
incus project set production restricted.networks.access=production-net
|
|
```
|
|
|
|
### Default Profile Updates
|
|
```bash
|
|
incus profile device add default eth0 nic network=services-net name=eth0 --project services
|
|
incus profile device add default eth0 nic network=development-net name=eth0 --project development
|
|
incus profile device add default eth0 nic network=production-net name=eth0 --project production
|
|
```
|
|
|
|
## Firewall Configuration
|
|
|
|
### Multi-Layer Security Architecture
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────────────────┐
|
|
│ LAYER 1: Host Firewall (UFW) │
|
|
│ ├── SSH (22) ✅ │
|
|
│ ├── HTTP (80) ✅ │
|
|
│ ├── HTTPS (443) ✅ │
|
|
│ └── Incus API (8443) ✅ │
|
|
│ │
|
|
│ LAYER 2: Network ACLs (nftables) │
|
|
│ ├── services-acl ✅ │
|
|
│ ├── development-acl ✅ │
|
|
│ └── production-acl ✅ │
|
|
│ │
|
|
│ LAYER 3: Network Isolation │
|
|
│ ├── services-net: Full access ✅ │
|
|
│ ├── development-net: Limited access ✅ │
|
|
│ └── production-net: Strict access ✅ │
|
|
└─────────────────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
### Host Firewall (UFW)
|
|
```bash
|
|
# Enable UFW
|
|
ufw --force enable
|
|
|
|
# Allow essential services
|
|
ufw allow ssh
|
|
ufw allow 8443/tcp comment "Incus API"
|
|
ufw allow 80/tcp comment "HTTP"
|
|
ufw allow 443/tcp comment "HTTPS"
|
|
```
|
|
|
|
### Current UFW Status
|
|
```
|
|
Status: active
|
|
|
|
To Action From
|
|
-- ------ ----
|
|
22/tcp ALLOW Anywhere
|
|
8443/tcp ALLOW Anywhere # Incus API
|
|
80/tcp ALLOW Anywhere # HTTP
|
|
443/tcp ALLOW Anywhere # HTTPS
|
|
22/tcp (v6) ALLOW Anywhere (v6)
|
|
8443/tcp (v6) ALLOW Anywhere (v6) # Incus API
|
|
80/tcp (v6) ALLOW Anywhere (v6) # HTTP
|
|
443/tcp (v6) ALLOW Anywhere (v6) # HTTPS
|
|
```
|
|
|
|
## Network ACL Configuration
|
|
|
|
### ACL List
|
|
```
|
|
NAME DESCRIPTION USED BY
|
|
development-acl 1
|
|
production-acl 1
|
|
services-acl 1
|
|
```
|
|
|
|
### Services ACL (services-acl)
|
|
```yaml
|
|
name: services-acl
|
|
description: ""
|
|
egress:
|
|
- action: allow
|
|
destination: 10.20.20.0/24
|
|
description: Access to development
|
|
state: enabled
|
|
- action: allow
|
|
destination: 10.30.30.0/24
|
|
description: Access to production
|
|
state: enabled
|
|
ingress:
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "22"
|
|
description: SSH
|
|
state: enabled
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "80"
|
|
description: HTTP
|
|
state: enabled
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "443"
|
|
description: HTTPS
|
|
state: enabled
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "3000"
|
|
description: Gitea
|
|
state: enabled
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "8000"
|
|
description: Drone
|
|
state: enabled
|
|
```
|
|
|
|
### Development ACL (development-acl)
|
|
```yaml
|
|
name: development-acl
|
|
description: ""
|
|
ingress:
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "22"
|
|
description: SSH
|
|
state: enabled
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "3000-9000"
|
|
description: Dev ports
|
|
state: enabled
|
|
- action: allow
|
|
source: 10.10.10.0/24
|
|
description: Services access
|
|
state: enabled
|
|
```
|
|
|
|
### Production ACL (production-acl)
|
|
```yaml
|
|
name: production-acl
|
|
description: ""
|
|
ingress:
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "22"
|
|
description: SSH
|
|
state: enabled
|
|
- action: allow
|
|
protocol: tcp
|
|
destination_port: "80,443"
|
|
description: HTTP/HTTPS
|
|
state: enabled
|
|
- action: allow
|
|
source: 10.10.10.0/24
|
|
description: Services access only
|
|
state: enabled
|
|
- action: drop
|
|
source: 10.20.20.0/24
|
|
description: Block development
|
|
state: enabled
|
|
```
|
|
|
|
## ACL Creation Commands
|
|
|
|
### 1. Create ACLs
|
|
```bash
|
|
incus network acl create services-acl
|
|
incus network acl create development-acl
|
|
incus network acl create production-acl
|
|
```
|
|
|
|
### 2. Services ACL Rules
|
|
```bash
|
|
# Ingress rules
|
|
incus network acl rule add services-acl ingress action=allow protocol=tcp destination_port=22 description="SSH"
|
|
incus network acl rule add services-acl ingress action=allow protocol=tcp destination_port=80 description="HTTP"
|
|
incus network acl rule add services-acl ingress action=allow protocol=tcp destination_port=443 description="HTTPS"
|
|
incus network acl rule add services-acl ingress action=allow protocol=tcp destination_port=3000 description="Gitea"
|
|
incus network acl rule add services-acl ingress action=allow protocol=tcp destination_port=8000 description="Drone"
|
|
|
|
# Egress rules
|
|
incus network acl rule add services-acl egress action=allow destination=10.20.20.0/24 description="Access to development"
|
|
incus network acl rule add services-acl egress action=allow destination=10.30.30.0/24 description="Access to production"
|
|
```
|
|
|
|
### 3. Development ACL Rules
|
|
```bash
|
|
incus network acl rule add development-acl ingress action=allow protocol=tcp destination_port=22 description="SSH"
|
|
incus network acl rule add development-acl ingress action=allow protocol=tcp destination_port=3000-9000 description="Dev ports"
|
|
incus network acl rule add development-acl ingress action=allow source=10.10.10.0/24 description="Services access"
|
|
```
|
|
|
|
### 4. Production ACL Rules
|
|
```bash
|
|
incus network acl rule add production-acl ingress action=allow protocol=tcp destination_port=22 description="SSH"
|
|
incus network acl rule add production-acl ingress action=allow protocol=tcp destination_port=80,443 description="HTTP/HTTPS"
|
|
incus network acl rule add production-acl ingress action=allow source=10.10.10.0/24 description="Services access only"
|
|
incus network acl rule add production-acl ingress action=drop source=10.20.20.0/24 description="Block development"
|
|
```
|
|
|
|
### 5. Apply ACLs to Networks
|
|
```bash
|
|
incus network set services-net security.acls=services-acl
|
|
incus network set development-net security.acls=development-acl
|
|
incus network set production-net security.acls=production-acl
|
|
```
|
|
|
|
## Security Matrix
|
|
|
|
### Network Access Control
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────────────────┐
|
|
│ SOURCE │ DESTINATION │ PORTS │ STATUS │ PURPOSE │
|
|
├─────────────────────────────────────────────────────────────────────────────────┤
|
|
│ Internet │ Host │ 22,80,443 │ ✅ ALLOW │ Admin & Web │
|
|
│ Services │ Development │ All │ ✅ ALLOW │ CI/CD deployment │
|
|
│ Services │ Production │ All │ ✅ ALLOW │ Production deploy │
|
|
│ Development │ Production │ All │ ❌ BLOCK │ Environment isolation│
|
|
│ Development │ Internet │ All │ ✅ ALLOW │ Updates & packages │
|
|
│ Production │ Internet │ All │ ✅ ALLOW │ Updates & packages │
|
|
└─────────────────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
### Port Access Summary
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────────────────┐
|
|
│ NETWORK │ ALLOWED PORTS │ RESTRICTIONS │
|
|
├─────────────────────────────────────────────────────────────────────────────────┤
|
|
│ services-net │ 22,80,443,3000,8000 │ Full access to dev/prod │
|
|
│ development-net │ 22,3000-9000 │ Services access only │
|
|
│ production-net │ 22,80,443 │ Services access only, block dev │
|
|
│ management-net │ Not configured yet │ To be configured │
|
|
└─────────────────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## Network Routing
|
|
|
|
### Current Routes
|
|
```
|
|
10.10.10.0/24 dev services-net proto kernel scope link src 10.10.10.1
|
|
10.20.20.0/24 dev development-net proto kernel scope link src 10.20.20.1
|
|
10.30.30.0/24 dev production-net proto kernel scope link src 10.30.30.1
|
|
10.40.40.0/24 dev management-net proto kernel scope link src 10.40.40.1
|
|
```
|
|
|
|
### Gateway Configuration
|
|
```
|
|
Network Gateway NAT Status
|
|
services-net 10.10.10.1 Enabled
|
|
development-net 10.20.20.1 Enabled
|
|
production-net 10.30.30.1 Enabled
|
|
management-net 10.40.40.1 Enabled
|
|
```
|
|
|
|
## Monitoring & Troubleshooting
|
|
|
|
### Network Diagnostics
|
|
```bash
|
|
# Check network status
|
|
incus network list
|
|
incus network show <network-name>
|
|
|
|
# Check ACL configuration
|
|
incus network acl list
|
|
incus network acl show <acl-name>
|
|
|
|
# Check routing
|
|
ip route show
|
|
ip addr show
|
|
|
|
# Check firewall status
|
|
ufw status verbose
|
|
iptables -L -n
|
|
```
|
|
|
|
### Log Monitoring
|
|
```bash
|
|
# UFW logs
|
|
tail -f /var/log/ufw.log
|
|
|
|
# Incus logs
|
|
journalctl -u incus -f
|
|
|
|
# Network interface logs
|
|
dmesg | grep -i network
|
|
```
|
|
|
|
### Performance Monitoring
|
|
```bash
|
|
# Network statistics
|
|
incus network info <network-name>
|
|
cat /proc/net/dev
|
|
ss -tuln
|
|
|
|
# Bridge statistics
|
|
brctl show
|
|
bridge link show
|
|
```
|
|
|
|
## Security Best Practices
|
|
|
|
### Implemented Security Measures
|
|
1. **Network Segmentation**: Isolated environments
|
|
2. **Defense in Depth**: Multiple firewall layers
|
|
3. **Principle of Least Privilege**: Minimal required access
|
|
4. **Traffic Control**: Controlled inter-network communication
|
|
5. **Attack Surface Reduction**: Limited exposed ports
|
|
6. **Audit Trail**: All firewall rules documented
|
|
|
|
### Security Enhancements (Planned)
|
|
1. **Container-level firewalls** (iptables in containers)
|
|
2. **Service mesh security** (mTLS between services)
|
|
3. **Rate limiting** (fail2ban, nginx limits)
|
|
4. **Monitoring & alerting** (firewall logs, intrusion detection)
|
|
5. **SSL/TLS certificates** (Let's Encrypt automation)
|
|
6. **VPN access** for remote administration
|
|
7. **Network monitoring** (traffic analysis, anomaly detection)
|
|
|
|
## Backup & Recovery
|
|
|
|
### Network Configuration Backup
|
|
```bash
|
|
# Export network configurations
|
|
incus network export <network-name> > <network-name>.yaml
|
|
|
|
# Export ACL configurations
|
|
incus network acl export <acl-name> > <acl-name>.yaml
|
|
|
|
# Backup UFW rules
|
|
ufw status numbered > ufw-rules-backup.txt
|
|
```
|
|
|
|
### Recovery Procedures
|
|
```bash
|
|
# Import network configuration
|
|
incus network import <network-name>.yaml
|
|
|
|
# Restore ACL configuration
|
|
incus network acl import <acl-name>.yaml
|
|
|
|
# Restore UFW rules
|
|
ufw --force reset
|
|
# Then reapply rules from backup
|
|
```
|
|
|
|
## Maintenance Commands
|
|
|
|
### Regular Maintenance
|
|
```bash
|
|
# Check network health
|
|
incus network list
|
|
incus network acl list
|
|
|
|
# Update firewall rules if needed
|
|
ufw status
|
|
ufw reload
|
|
|
|
# Monitor network performance
|
|
incus network info <network-name>
|
|
```
|
|
|
|
### Troubleshooting Commands
|
|
```bash
|
|
# Test connectivity
|
|
ping <target-ip>
|
|
telnet <target-ip> <port>
|
|
|
|
# Check DNS resolution
|
|
nslookup <hostname>
|
|
dig <hostname>
|
|
|
|
# Check routing
|
|
traceroute <destination>
|
|
mtr <destination>
|
|
```
|
|
|
|
---
|
|
**Generated**: 2025-07-16 02:35:52 UTC
|
|
**Status**: Network and firewall configuration complete
|
|
**Security Level**: Multi-layer protection active
|
|
**Next**: Service container deployment with network assignments
|