View source for Sown-gw

Sown-gw is SOWN's Gateway server.

It has a [[cpu::Intel(R) Xeon(R) CPU X3360 @ 2.83GHz]] processor with [[memory::4GiB]] of memory and a [[harddrive::149GiB]] Western Digital SATA hard disk.  It has [[networkinterfaces::2x Broadcom NetXtreme BCM5721 Gigabit Ethernet and 4x Intel 82575GB Gigabit Ethernet]] network interfaces.  It is housed within a [[case::1U Rackmount]] case located in [[location::59/1245]] ([[coordinates::50°56'14.96"N,1°23'52.01"W]]).

The server has a power consumption of ?W at boot, ?W idle and ?W when turned off.

= Installed Software =

The server's operating system is [[Operating system::Ubuntu 18.04 LTS (64-bit)]] running on [[Kernel::Linux Kernel 4.15.0-xx (x86_64)]].

The server also has the following software installed on it:
{{ServerSoftwareList}}

= Services Provisioned =
* [[Provisions service::Firewall]]
* [[Provisions service::Routing]]
* [[Provisions service::DNS slave]]




=Network=

This server is connected to the SOWN VLAN, with the IP addresses:
* [[sownipv4::10.5.0.252]]
* [[sownipv6::2001:630:d0:f700:&#58;252]]
Its DNS name is:
* [[sowndns::gw.sown.org.uk]]
* [[sowndns::ns1.sown.org.uk]]
* it also has the following cnames
* [[has_cname::backup1.sown.org.uk]]
Its MAC address is [[sownmac::00:22:19:d5:9e:3a]] on its [[sowninterface::eth0]] interface and is connected to port [[sownport::b59-l1-cat1/GigabitEthernet5/0/30]] with a yellow network cable.


This server is also connected to an ECS DMZ VLAN, with the IP addresses:
* [[ecsipv4::152.78.189.44]]
Its DNS name is:
* [[ecsdns::sown-gw.ecs.soton.ac.uk]]
Its MAC address is [[ecsmac::00:22:19:d5:9e:3b]] on its [[ecsinterface::eth1]] interface and is connected to port [[ecsport::b59-l1-cat1/GigabitEthernet5/0/29]] with a yellow network cable.


This server is connected to the SOWN uplink VLAN with the IP addresses:
* [[uplinkipv4::152.78.103.236]]
* [[uplinkipv6::2001:630:d0:505&#59;:1:5032]]
Its MAC address is [[uplinkmac::00:1b:21:38:d8:18]] on its [[uplinkinterface::eth2]] interface and connected to port [[uplinkport::b59-l1-cat1/GigabitEthernet5/0/18]] with a  network cable of unknown colour.
The DNS name on uplink is:
* [[uplinkdns::hfc-sown-gw.net.soton.ac.uk]]


This server has its [[DRAC]] connected over [[IPMI]] with the IP address:
* [[ipmiipv4::10.5.0.188]]
It has the DNS name:
Its MAC address is [[ipmimac::00:22:19:d5:9e:3a]] on its [[ipmiinterface::eth0:ipmi]] interface and connected to port [[ipmiport::b32-l3-sown/GigabitEthernet/0/30]] with a white network cable.
The DNS name for its DRAC is:
* [[ipmidns::gw-ipmi.sown.org.uk]]

The WakeOnLAN capability of this server is [[WakeOnLAN::supported on eth0 and eth1 but not enabled on either]].

 
==Installing the Firewall==

From the backup, restore ''/etc/default/firewall4'', ''/etc/default/firewall6'' and ''/etc/init.d/firewall''

Ensure that references to ''iptables'' and ''ip6tables'' in the code have the correct path in ''/etc/init.d/firewall''

To test the v4 firewall run: ''iptables-restore --test /etc/default/firewall4''

To test the v6 firewall run: ''ip6tables-restore --test /etc/default/firewall6''

Ensure the firewall will start on boot: ''update-rc.d firewall defaults''

To start the firewall run: ''/etc/init.d/firewall''


=Bespoke Service Checks=
; CONNTRACK4 : This checks that the IPv6 firewall allows requests from SOWN VLAN only servers, in this case [[Sown-monitor-new]] can make an http request to www.google.co.uk.  If it cannot or the page returned does not contain the word 'Google' it returns <span style="color: red;">CRITICAL</span>.
; CONNTRACK6 : This checks that the IPv4 firewall allows requests from SOWN VLAN only servers, in this case [[Sown-monitor-new]] can make an http request to www.google.co.uk.  If it cannot or the page returned does not contain the word 'Google' it returns <span style="color: red;">CRITICAL</span>.
; FIREWALL4 : This checks the IPv4 firewall is running.  The firewall has canary check that blocks any TCP traffic being sent from [[Sown-monitor-new]] to 152.78.189.252 (skoll.ecs.soton.ac.uk).  If it can make a successful IPv4 HTTP request to skoll.ecs.soton.ac.uk, then this check returns <span style="color: red;">CRITICAL</span>.
; FIREWALL6 : This checks the IPv6 firewall is running.  The firewall has canary check that blocks any TCP traffic being sent from [[Sown-monitor-new]] to 2001:630:d0:f104::80f (skoll.ecs.soton.ac.uk).  If it can make a successful IPv6 HTTP request to skoll.ecs.soton.ac.uk, then this check returns <span style="color: red;">CRITICAL</span>.
; FORWARD4 : This checks that the IPv4 firewall allows ping requests from SOWN VLAN only servers, in this case [[Sown-monitor-new]] can ping 193.63.94.20 (ns0.ja.net).  This reports <span style="color: red;">CRITICAL</span> if it cannot or latency is greater than 5 seconds and  <span style="color: orange;">WARNING</span> if packet loss is greater than or equal to 80% or latency is greater than 3 seconds.
; FORWARD6 : This checks that the IPv6 firewall allows ping requests from SOWN VLAN only servers, in this case [[Sown-monitor-new]] can ping 2001:630:0:9::14 (ns0.ja.net).  This reports <span style="color: red;">CRITICAL</span> if it cannot or latency is greater than 5 seconds and  <span style="color: orange;">WARNING</span> if packet loss is greater than or equal to 80% or latency is greater than 3 seconds.




[[Category:Server]]