Network

From Hackerspace Brussels
Jump to: navigation, search

Moving to a new place will involve rebuilding the network, nearly from scratch.

The Gate will be our core router, but it will need some small modifications and updates

Here is how it is/will be laid out

Contents

[edit] Address pools

We have the following pools allocated to us:

IPv4: 172.22.33.0/24 (dn42) 172.23.187.0/24 (dn42) 192.168.222.0/24 (management)
IPv6: 2001:6f8:147f::/48 (SixXS)

And here is how we'll divide it:

VLAN ID Tape color Bridge name (on Gate) Description Active (Y/N) IPv4 range IPv6 range Infos
Green/Yellow Trunk Trunk lines - Only for devices understanding 802.1Q
DN42 VPN links 172.22.33.0/27 Address pool used for DN42 VPNs
1 Red br-mgmt Management LAN Y 192.168.222.0/24 2001:6f8:147f:222::/64 Devices web interfaces: should be accessible only from wired LAN (VLAN 10, 11 and 12)
3 eth5.3 Wireless Antwerpen WAN N
4 Green br-srv Servers LAN Y 172.22.33.32/27 2001:6f8:147f:4::/64 Quiet LAN for fixed services (SIP phones, network printers,...)
5 ???? Emergency WAN N DHCP client In case there is no internet (broken VDSL), this is where you plug your source of interwebs to share in the space
6 br-v6 IPv6 only LAN N n/a 2001:6f8:147f:6::/64 IPv6 only network segment, for testings :-)
7 br-fed SpaceFED N 172.22.33.96/27 2001:6f8:147f:7::/64 PROJECT :-)
8 br-wifiwpa WiFi WPA Y 172.23.187.0/25 2001:6f8:147f:8::/64 One subnet for all access points (SSID: hsbxl), enables AP roaming
9 br-wifiopen Open WiFi Y 172.23.187.128/26 2001:6f8:147f:9::/64 Locked down subnet open to everybody, including neighbours (SSID: hsbxl-public)
10 br-0 Ground floor LAN N 172.22.33.128/27 2001:6f8:147f:10::/64 NOT ACTIVE YET
11 br-1 1st floor LAN N 172.22.33.160/27 2001:6f8:147f:11::/64 NOT ACTIVE YET
12 br-2 2nd floor LAN N 172.22.33.192/27 2001:6f8:147f:12::/64 NOT ACTIVE YET
13 br-3 3rd floor LAN Y 172.22.33.65/27 2001:6f8:147f:13::/64
20 wan-0 VDSL uplink N This is a failed project
21 wan-1 Secondary uplink (Numericable ?) N This is a project
22 wan-2 N This is a project
42 br-lan HSBXL old LAN config (waiting for migration to multiple VLANs) Y 172.22.33.129/25 2001:6f8:147f:42::/64
Members VPN N 172.22.33.64/27 PROJECT :-)
n/a Yellow n/a PA system wiring Y n/a n/a Althrough this is CAT5E cabling, those cables are used to connect the speakers to the amplifier. SOME LINES HAVE 100V ON THEM BE CAREFUL !!!

[edit] Why dividing the network like that ? Would everything in the same block be easier to manage ?

Of course it is !!

But since it's a hackerspace, people are very tempted in experimenting with stuff, and they should. :-)

Having 4 floors and the wifi in the same network will be a pain to debug in case the network go down or act funny because someone put a rogue DHCP server, announce an invalid or funky RA, made an ethernet loop, bridged two segments, use a crappy switch/hub, or is spoofing the gateway.

The worst that can happen with that setup is the wifi going down, or one floor misbehaving without interfering with the others.

Divide To Conquer, and let people play and experiment without any fear.

[edit] Tape color ?

Some cables coming out of the wall have colored tape on them. This is a visual code to help you recognize to which network segment you're connecting to. Different segments have different purposes here in the space.

[edit] DNS

The domain space.hackerspace.be is delegated to the various LANs in the space. No name separation to keep things easy. It is totally automatic on IPv4 with a couple of exceptions (dynamic update via DHCP)

IPv6 still on the TODO list.

[edit] Hardware

Since we have 66 cables reaching the networking cabinet, we're forced to have several switches.

  • 1 ToughSwitch to collect and supply all wifi devices and the IP phone near the fridge
  • 2 Cisco Catalyst 9250 managed switch to dispatch the subnets across the floors
  • 1 unmanaged fanless switch for the top floor
  • 1 temporary 5 ports switch in the basement to handle space infrastructure

[edit] WiFi

  • One WRT54GS/GL are broadcasting the HSBXL SSID. Powered by it's own power brick.
  • Four (soon five) Unifis are broadcasting the HSBXL and HSBXL-PUBLIC (ground floor and garden), Powered by the ToughSwitch.
  • One nanostation is our Wireless Antwerpen link (down for the moment: no mast), Powered by the ToughSwitch.

  • create subpages to document our network infrastructure
  • please remove passwds when posting configs...
Network/IPv6Network/IPv6/OpenWRT
Network/IPv6/tunnelsNetwork/MonitoringNetwork/switches