Difference between revisions of "Networking"

From SkullSpace Wiki
Jump to: navigation, search
(LES IP Delegation)
(IP Usage)
Line 411: Line 411:
| | TBD
| ips.intarweb.ca
| ips.intarweb.ca
| ips.intarweb.ca
| sean AT tinfoilhat.ca
| sean AT tinfoilhat.ca
| Skullspace LAN
| Sean Cody
| Sean Cody   
| Sean Cody   
Line 439: Line 439:
| intarweb.ca
| intarweb.ca
| intarweb.ca
| sean AT tinfoilhat.ca
| sean AT tinfoilhat.ca
| Skullspace LAN
| Sean Cody
| Sean Cody  
| Sean Cody  

Revision as of 10:00, 14 April 2018

  • Please keep an updated copy of this page printed out and posted in the server room, so there is access to documentation even if the network / internet is down
  • Also see IT Policies
  • We have many people working with the equipment, remember to attach or tie down anything that could get unplugged/fall/etc. We twice lost internet - first time the router fell and power switch got pressed, second time the power plug was pulled out of main internet switch.
  • this page is finally being updated for Sksp2, old page is at Networking/Old

High-level description

The main router is a RB450G, connected to the main switch (port 2), security switch (4, later), internet feed (3), and other networks later. Main internal switch is a 3Com4924 in the server rack, feeds a GS108T at the lounge PC and a 5-port GigE switch near the meeting table. The main HP AP has SSID skullspace and is mounted on the roof in the middle of the space.

Stupid-High Level Diagram

                              |                   |
                              |     The Tubes     |
                              |    On The Roof    |
                              |                   |
                              +-- ------+---------+
                              +-- ------+-----------+
                              |     LES.net         |
                              |                     |
                              |   |
                                   | fa20            +---------------------+
                     +-------------+---------+       |  Skullspace+Router  |
           fa1+19    |  Skullspace+External  | ether1|       RB450G        |
          +----------+      Cisco 2850       +-------+                     |
          |          | (fa23)| fa21  |       |
          |          +----------------------++       |         |
          |                                 |        +---------------------+
+---------+-----------+                     |                  |ether2
|                     |                     |                  |
|  Rest of External   |                     |                  |
|     PUBLIC/LAN      |                     |        +---------+-------------+      +------------------+
|                     |                     +--------+  Skullspace+Internal  |      |                  |
|   |                              |  3+Com L2 Old Junk    +------+ Rest of Internal |
|                     |                              |                       |      |   INTERNAL/LAN   |
+---------------------+                              +---+-------+-------+---+      |  |
                                                         |       |       |          |                  |
                                                +--------+       |       +--------+ +------------------+
                                                |                |                |
                                         +------+------+  +------+------+  +------+------+
                                         |    WAP+A    |  |    WAP+B    |  |    WAP+C    |
                                         | |  | |  | |
                                         |             |  |             |  |             |
                                         +-------------+  +-------------+  +-------------+

Built using ASCIIFlow - http://asciiflow.com/

Internet feeds

B: Internet from LES.net (wifi-based Ubiquity, tested 94.83mbit down, 96.22mbit up to Speedtest.net Winnipeg)
B: Internet from VOI (wifi-based Ubiquity NB5, tested 60mbit down 40mbit up to Speedtest.net Winnipeg).

Network hardware

  • Mikrotik Routerboard 450G as main router
  • Netgear WNDR3700 router, donated by Project Bismark. It had a problem (routed packets fine but services like DHCP/DNS/web server didn't work) so was taken out of the network to test.
  • Linksys WRT54G2 v1.5 as spare. WAN port may sometime have packet loss.
  • Linksys WRT350N with DD-WRT v24SP2 firmware as a spare. Lent by Stef.
  • Linksys WRT54G v2 with tomato 1.28 firmware as a spare. Lent by Stef.
  • A 3Com 4924 (:A0) as the main switch, by default everything connects here.
  • A 3Com 4924 (:??) a spare switch.
  • 2 D-Link DWL-810+ bridges.
  • Netgear GS108T as the lounge switch.
  • D-Link DWL-7100AP AP.
  • D-Link DES-3224 as a public IP switch, set to management only on port 7 (Telnet, username "D-Link").
  • <strike>A Belkin F5D8236 wireless-N router as spare
  • 3 Cisco Aironet 1100 APs with .B cards and one (:90) with a .G card as spares.
  • Belkin F5D5141-5 switch.
  • Cisco 2950 switches #1 and #2.
  • Mikrotik RB750 (small white box) VOI's router
  • Western Multiplex Tsunami 100 5.8ghz - two links (4x IDU, 2x high ODU, 2x low ODU) unused. Panel antenna loaned from Seccuris.


Runs A1+B1: from rack to wiring area on top of bathrooms, A2+B2 from wiring area on top of bathrooms to pole in front of classroom. One will be used to feed wifi AP. C+D: from rack to next to a couch in lounge area. A wire goes under the nearby door to the wiring area of the space next door and above a window for the temporary garbage-cam. E+F+G: from rack to area behind rear black desk.


  • terminate ethernet lines correctly in a panel once we're sure server room is stable
  • label networking equipment (IPs etc) and servers, update this page for the latter
  • put read-only and full-access passwords on devices

Wireless Networks

skullspace = main SSID, usual password skullspace_rear: linksys G router in the server rack, as a backup.

New IP Ranges

  • 172.30.4.x = testing/reserved for later use
  • 172.30.5.x = half Security/Management network half VPNs
  • 172.30.6.x = Main network DHCP .100-.240 router .1 network gear .10-.29 printers .30-.39 VMs, servers .40-.99 VPNs .241-254
  • 172.30.7.x = CTF Network DHCP ??? router .1

Internal IP usage

Check these

Legacy IPs

  • Micro-tik Router
  • noel, alex's linux container on vmsrv
  • kyle, a linux container on vmsrv
  • stefen, a linux container on vmsrv
  • Samsung CLP-310N printer
  • Cisco 2950 switch
  • Netgear GS108T workshop switch
  • Cisco 4924 Switch-1 (main)
  • Cisco 4924 Switch-2
  • DES-3224
  • vmsrv
  • Who took this and didn't document?
  • not in use, but don't use
  • Skullhost on vmsrv
  • iscsi server on vmsrv
  • Kenny servers
  • VPN server on vmsrv - contact Jay or Alex
  • Ben's server
  • Driftnet laptop
  • open for use
  • Pablodraw VM - http://picoe.ca/pablodraw/ for the client.

Current 172.30/16

  • Micro-tik Router
  • SkullSpace-External (Cisco 2850 Switch)
  • SkullSpace-Internal (Cisco 2850 Switch)
  • WAP-A (UniFI AP Management IP) - MAC = 0418D64E8BDE
  • WAP-B (UniFI AP Management IP) - MAC = 0418D64E8AED
  • WAP-C (UniFI AP Management IP) - MAC = 0418D64E8AE4
  • intarweb.ca (Sean's server, inside interface)
  • (new, ask Alex W about this) UniFI AP Controller - VM on vmsrv.skullspace.ca
  • esx.intarweb.ca
  • ips.intarweb.ca
  • latest Ubuntu graphical shell service on vmsrv
  • Mark's temporary project ips
  • UniFI AP Controller (Container on vmsrv)
  • Jay Bots (Container on vmsrv)
  • Jarred's VM on vmsrv
  • Ben's VM on vmsrv
  • vmsrv
  • Mark's test router
  • Chris Otto Servers
  • Main router DHCP space
  • VPN IPs
    • - sean VPN IP (sean cody)
    • - cchilds VPN IP
    • - jordansamulaitis VPN IP
    • - gygar VPN IP
    • - nwild VPN IP
    • - cstanners-router VPN IP
    • - odin VPN IP
    • - cstanners VPN IP
  • Micro-tik Router (WIFI VLAN)
  • Virtual Machine Server (vmsrv) LAN
    • vmsrv
    • Mark private ubuntu vpn
    • Mark private project ubuntu (Container on vmsrv)
  • TheLEDSign LAN
    • The Sign
    • The controlling container (vmsrv)
  • Mark project private Point to Point link LAN

IP Usage

LES IP Delegation

Allocation ( Gateway, RESERVED for LES.net usage.
Allocation 2605:e200:c212::/48
2605:e200:c201:2::4 Gateway
DNS1:  2605:e200:53:2::

IP DNS Use Contact used by? reason for public IP and notes TBD LES.net Network porting AT les DOT net all machines required by network design TBD LES.net Gateway porting AT les DOT net all machines required by network design TBD LES.net RESERVED porting AT les DOT net all machines required by network design TBD LES.net RESERVED porting AT les DOT net all machines required by network design TBD Skullspace Router it AT skullspace.ca Skullspace LAN TBD ns1.skullspace.ca it AT skullspace.ca Skullspace DNS vmsrv.skullspace.ca Virtual Machine Server vmsrv mark AT markjenkins DOT ca VM server open to all members. Running an http proxy to allow this one IP address to host many web servers, and doing TCP port forwarding to allow many different virtual servers to share this one IP address ripe.skullspace.ca RIPE Probe colin AT insecure DASH complexity DOT ca shell.skull.space shell.skull.space mark AT markjenkins DOT ca Shell accounts for all members. Being able to bind to port 22 vs having some other port forwarded by vmsrv.skullspace.ca will make this much easier to get users for. Plus, Mak has brought with him a many users from his own system where he used to have his own users with shell accounts. They're already used to port 22 and a different hostname pointing here. Leaving that alone will help keep them. That old system was taking up it's own IP address anyway. mail.skull.space SkullMail email forwarding service mark AT markjenkins DOT ca nessus.skullspace.ca SkullSpace Nessus scanner alexwebr at gmail dot com If it shared an IP with other infrastructure, tools like Fail2Ban could block more than intended
IP DNS Use Contact used by? reason for public IP and notes broot.ca Personal webserver, Git, DNS, mail Alex Weber <alexwebr@gmail.com> Nothing. Can be moved elsewhere if we need IP space back. Makes life easier if it has its own IP. If Sksp infrastructure needs an IP, this can go. loki.madcowlabs.com loki.madcowlabs.com cotto at ieee point org Chris's Server Experimental development project server library.skullspace.ca The Evergreen server for the (experimental) SkullSpace library Alex (alexwebr@gmail.com) SkullSpace Uses Websockets, and Websockets need a legitimate SSL certificate? Temporarily in use by Mark, to host edit.solidarityeconomy.us Mark Jenkins mark@markjenkins.ca ips.intarweb.ca ips.intarweb.ca sean AT tinfoilhat.ca Sean Cody Sean Cody amsler.ca Production Appserver / Personal Webspace edwinguy_gmail Skullspace LAN Edwin Amsler intarweb.ca intarweb.ca sean AT tinfoilhat.ca Sean Cody Sean Cody TBD LES.net Broadcast LES.net all machines required by network design

VOI IP Delegation

VOI gave us (mask, (mask as well as 2604:4280:1:c0de::/64, you must reserve IPs here before using them. You'll need to plug into the new VOI-Static switch, currently a Cisco in the 'top' rack.

IP DNS Use Contact used by? reason for public IP and notes TBD VOI router VOI all machines required by network design
Richard's Server rjr point work at gmail development server, potentially Starbound server
Fwd: h49-skullspace.winnipeg.voinetworks.net.
Rev: h49-skullspace.winnipeg.voinetworks.net.
VOI Mikrotik RB750? router VOI Networks now required by network design
Sksp Main Router it@skullspace.ca 2604:4280:1:c0de::53
Fwd: ns1.skullspace.ca (Pending)
Rev: ns1.skullspace.ca (Pending)
2604:4280:1:c0de::80 - Relay/Proxy v6 to v4 for www.skullspace.ca (testing)
2604:4280:1:c0de::81 - Relay/Proxy v6 to v4 for wiki.skullspace.ca (testing)
SKSP DNS it@skullspace.ca 2014-10-08 Skullspace Primary DNS Server
Fwd: <several>
Rev: mail.nepharia.org
Vobster Nepharia Services mak@kolybabi.com and dave@ysarro.com 2012-02-17 Runs DNS, SMTP/IMAP, OpenVPN, Asterisk, SSH & IRC, and HTTP for Nepharia and its associated domains.
Fwd: <several>
Rev: mail.skullspace.ca
Vobster SkullSpace Services mak@kolybabi.com and dave@ysarro.com 2012-02-17 Runs DNS, SMTP/IMAP, SSH & IRC, and HTTP for SkullSpace.
Fwd: ctf.skullspace.ca
Rev: ctf.skullspace.ca
Vobster CTF Services mak@kolybabi.com and dave@ysarro.com 2013-04-09
Edwin Amsler edwinguy at gmail dot calm 2015-02-23
Colin / Jeremy FreeBSD server phoul@insecure-complexity.com 2013-10-01
Rev: 2604:4280:1:c0de::314
Fwd: intarweb.ca
Sean's server. sean _at_ tinfoilhat _dot_ ca 2013-09-27 L2TP etc.
Colin's project server CStanners @ gmail Occasional IPv6, VPN services and testing
Ben's server ben@benbergman.ca 2012-12-18 http/ssh/vpn/other
Fwd: dangerzone.skullspace.ca
Rev: dangerzone.skullspace.ca
The Danger Zone ctfadmin@ 2012-06-01 The home of the SkullSpace Teaching CTF.


All members currently have full access to all devices. Later it may be a good idea to have different full-access passwords for all devices restricted to NetOps and by request, and the read-only password being publically known among our members.