#LinuxServer

Easy install with sbeteta42's command lines : https://github.com/sbeteta42/ez-debian-server

System Schema

NAT | v WAN -| ==Router== |- LAN (ens35) (ens33) | v Routage = IP_Forwarding NAT rule

SRVLX01 3 Disks (RAID 1) (1 of them is the Spare Disk) 2 Interfaces Ethernet (IP Address Bonding)

Fix IP address | v ==SERVICES (DAEMONS)== __ DHCP __ DNS __ HTTP __ FTP __ SAMBA

IP_STATE (Client)

IP address : 192.168.3.10 255.255.255.0 Gateway : 192.168.3.254 DNS : 1.1.1.1

We're configuring this Debian OS to be the router for this server.

Installing Debian Server on VM and configuring the IP address of the second network card

Add 2 network cards
Edit > Virtual Network Settings
- Add new VMNet2 and make it host-only, disable the DHCP
![[Pasted image 20240326093838.png]]
In the second network, we put the VMNet2 on custom network
![[Pasted image 20240326094130.png]]

To login : root or user / operations

when we do ifconfig we see only one network card. Second has [[127.0.0.1]] (loopback address, it pings back to the host, it's an impossible address, doesn't exist on Windows, just to test the interface connection)

![[Pasted image 20240326095248.png]]

We do ifconfig -a to see the other network card even if it doesn't have an IP address. We'll configure it later
- but this way we have seen the name of it; ==ens35==
- WAN network name is; ==ens33==
We login to the user which doesn't have the root rights.
- to get the root rights we tap su - and we choose a password and pass to the root account
- then we install sudo with apt install sudo
- we install openssh-server and open-vm-tools and tree but we cannot install if the system is not up-to-date
- apt update && apt full-upgrade -y to update everything
- sudo is installed but cannot be used on the user account, we need to configure it with nano. we go to nano /etc/sudoers to configure sudo and give the user ALL rights.
- when in the user account, we do sudo su and we are the root of our own directory.
- ![[Pasted image 20240326101710.png]]
- hostname router to change ???
- we go to /etc/hostname and edit the content, putting router in the text editor
- ``

nano /etc/hosts and edit the 127.0.1.1 and edit it to be router.formation.lan router ![[Pasted image 20240326102706.png]]

we restart the machine and see the router login
and we connect on user@router account
ifconfig -a to see the network cards settings
we go to nano /etc/network/interfaces and note the card names; ens33 and ens35
systemctl restart networking.service
systemctl status networking.service to verify the status
if the second network card still doesn't appear go back to nano /etc/network/interfaces and put auto instead of allow-hotplug
now when we do ifconfig we don't see the first card (ens33), we restart the machine an try again.
we do sudo ifconfig and verify all the cards as in the image following;
![[Pasted image 20240326103921.png]]
sudo nano /etc/sysctl.conf activate the IP routing
go to the page down and remove the # before the net.ipv4.ip_forward=1 line to make IP forwarding active
![[Pasted image 20240326141211.png]]
sudo sysctl -p to make it activ

Then we make a firewall rule:

ens33 is the network card that makes the connection between outside network connection
pass to root account
install iptables with apt install iptables, if it's not found
iptables -t nat -A POSTROUTING -o ens33 -j MASQUERADE
-t for target, -A for add, -j means Joker; to put any command after
iptables-save > /etc/iptables_rules.save to create a file
![[Pasted image 20240326113242.png]]
we go back to nano /etc/network/interfaces and edit
we add post-up iptables-restore < /etc/iptables_rules.save at the last line of the primary network interface
save and exit
systemctl restart networking.service
systemctl status networking.service
Now we go to the client machine and set the IP address whether if it's Linux or Windows.
We put the settings as following
The Gateway is the Router !! ![[Pasted image 20240326134703.png]]
we ping the router, 192.168.3.254
we ping the DNS (1.1.1.1)
we ping a DNS like www.google.fr

Depannage / Troubleshooting

we might have done a mistake, disconnect the card and reconnect do the same for the LAN connection inside the VM check VM Network settings.

systemctl restart networking.service

Connecting the SSH

for rerouting ; iptables -t nat -A PREROUTING -i ens33 -p tcp --dport 22 -j DNAT --to-destionation 192.168.3.101:22

this way we have connect the SSH

And we can connect to the user of the server (user@srvlx01) with a FTP client

![[Pasted image 20240326165147.png]]

Firewall Settings with [[pfSense]]

Setting up pfSense replaces the router VM
Now it's the router and we do the firewall settings on it
We disabled the DHCP settings when installing because we have already put a static IP to our client.
From the client we ping the gateway first !! always
We go the a web browser in the client and go the gateway address (gateway is always the router address)
admin and pfsense for the login credentials in the web browser.
![[Pasted image 20240327103425.png]]
we enter the formation.lan and no DNS needed because automatically done by the main router connected
we choose out timezone
![[Pasted image 20240327103752.png]]
in the next step we remove the tick from the latest 2 options
![[Pasted image 20240327111858.png]]
we're in
![[Pasted image 20240327104159.png]]
we can add widgets

To activate DHCP server : Services > DHCP Server > LAN

![[Pasted image 20240327110857.png]]

Difference between NAT and Firewall Rules NAT : is only for one machine Rules : is for all the network (WAN)

ICMP : Internet Control Message Protocol ?? ==developer==

Authorizing SSH to Srvlx01 through NAT

We add a rule to NAT ![[Pasted image 20240327112458.png]]

installing dhcp to the server though SSH

sudo apt install isc-dhcp-server if user doesn't have the right we add it in nano /etc/sudoers : with user ALL: etc...

sudo nano /etc/dhcp/dhcpd.conf to see the DHCP settings and edit them

Configuring [[DHCP]] Settings

we will send this file into the server with SSH (don't put comments like this in this image) ![[Pasted image 20240327114743.png]]![[Pasted image 20240327122612.png]] no space before the parantheses !

we connect to the WAN address of the firewall/pfSense through the FTP client
and copy the dhcpd.conf file to the router
![[Pasted image 20240327115407.png]]
WAN address is found on the Dashboard (172.16.254.129 in my case)
![[Pasted image 20240327115435.png]]
we will launch the DHCP service / daemon to activate it
to launch the service we enter sudo systemctl start isc-dhcp-server.service
to verify if it's active sudo systemctl status isc-dhcp-server.service
![[Pasted image 20240327123442.png]]

Now we see that it works on the client machine :

![[Pasted image 20240327123524.png]]

DNS Settings on the Server

What to not forget:

bind9 is the program for DNS server in Linux, install with apt install bind9
named is the command to check it's details
Don't forget the "." after the domain like "srvlx01.formation.lan."
systemctl restart named to start the DNS service, status to see the active status.
named-checkconf -z to see the DNS configuration

![[Pasted image 20240327144448.png]]

![[Pasted image 20240327144514.png]]

Troubleshooting:

Sometimes we will not be able to ping www.formation.lan. In this case, we will need to add the nameserver to the /etc/resolv.conf file but we cannot edit it.
To edit it once : sudo chattr -i /etc/resolv.conf
We go to nano /etc/resolv.conf and add nameserver 192.168.3.101 (which is the ip address of the server) to the second line
Save and exit
Then we prevent the editing of the resolv.conf with the command of : sudo chattr =i /etc/resolv.conf

We add the DNS address to the pfSense in System > General Setup as well, because pfsense dont see the domain by default (formation.lan) ![[Pasted image 20240327154542.png]] and disable the settings as following; ![[Pasted image 20240327155156.png]]