Add a simple router template (#216)
* Add simple router example --------- Co-authored-by: Jip-Hop <2871973+Jip-Hop@users.noreply.github.com>
This commit is contained in:
Jon C. Thomason
GitHub
parent
13f8a670b1
commit
742a70b3d0
|
|
@ -0,0 +1,44 @@
|
|||
# Router Jail Template
|
||||
|
||||
Host a subordinate LAN using nftables and dnsmasq for DHCP, DNS, routing, and netboot infrastructure.
|
||||
```
|
||||
router laptop desktop
|
||||
| | |
|
||||
+-- LAN --+-------+
|
||||
|
|
||||
{ TrueNAS SCALE }
|
||||
|
|
||||
+-----+-----+-- LAN2 --+------+------+-------+
|
||||
| | | | | | |
|
||||
RPi1 RPi2 RPi3 NUC01 NUC02 NUC03 CrayYMP
|
||||
```
|
||||
*Example usage*: deploy a flock of headless/diskless Raspberry Pi worker nodes for Kubernetes; each netbooting into an iSCSI or NFS root volume.
|
||||
|
||||
## Setup
|
||||
|
||||
Use the TrueNAS SCALE administrative UI to create a network bridge interface. Assign to that bridge a physical interface that's not shared with the host network.
|
||||
|
||||
Use the `dnsmasq-example.conf` file as a starting point for your own dnsmasq settings file(s). Copy or mount them inside `/etc/dnsmasq.d/` within the jail.
|
||||
|
||||
Optional: place assets in the mounted `/tftp/` directory for netbooting clients.
|
||||
|
||||
Optional: attach more jails to this same bridge to host e.g. a K3s control plane, an nginx load balancer, a PostgreSQL database...
|
||||
|
||||
Check out the [config](./config) template file. You may provide it when asked during `./jlmkr.py create` or, if you have the template file stored on your NAS, you may provide it directly by running `./jlmkr.py create --start --config /mnt/tank/path/to/router/config myrouterjail`.
|
||||
|
||||
## Additional Resources
|
||||
|
||||
There are as many reasons to host LAN infrastructure as there are to connect a LAN. This template can help you kick-start such a leaf network, using a TrueNAS jail as its gateway host.
|
||||
|
||||
For those specifically interested in *netbooting Raspberry Pi*, the following **external** links might help you get started.
|
||||
|
||||
* [Network Booting a Raspberry Pi 4 with an iSCSI Root via FreeNAS][G1]; the title says it all
|
||||
* [Raspberry Pi Network Boot Guide][G2] covers more Raspberry Pi models; written for Synology users
|
||||
* [pi_iscsi_netboot][s1] and [prep-netboot-storage][s2] are scripts showing preparation of boot assets and iSCSI root volumes
|
||||
|
||||
Good luck!
|
||||
|
||||
[G1]: https://shawnwilsher.com/2020/05/network-booting-a-raspberry-pi-4-with-an-iscsi-root-via-freenas/
|
||||
[G2]: https://warmestrobot.com/blog/2021/6/21/raspberry-pi-network-boot-guide
|
||||
[s1]: https://github.com/tjpetz/pi_iscsi_netboot
|
||||
[s2]: https://gitlab.com/jnicpon/rpi-prep/-/blob/main/scripts/prep-netboot-storage.fish?ref_type=heads
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
# See also:
|
||||
# <https://github.com/Jip-Hop/jailmaker/tree/main/templates/router>
|
||||
#
|
||||
startup=0
|
||||
gpu_passthrough_intel=0
|
||||
gpu_passthrough_nvidia=0
|
||||
# Turning off seccomp filtering improves performance at the expense of security
|
||||
seccomp=1
|
||||
|
||||
# Use bridge networking to provide an isolated network namespace
|
||||
# Alternatively use --network-macvlan=eno1 instead of --network-bridge
|
||||
# Ensure to change br0 to the HOST interface name you want to use
|
||||
# and br1 to the SECONDARY interface name you want to prepare
|
||||
# Substitute your own dnsmasq.d and TFTP dataset bindings
|
||||
systemd_nspawn_user_args=--network-bridge=br0
|
||||
--network-veth-extra=ve-router-1:vee-1
|
||||
--resolv-conf=bind-host
|
||||
--system-call-filter='add_key keyctl bpf'
|
||||
--bind=/mnt/pool/subnet/dnsmasq.d:/etc/dnsmasq.d
|
||||
--bind-ro=/mnt/pool/subnet/tftpboot:/tftp
|
||||
|
||||
# Script to run on the HOST before starting the jail
|
||||
# Load kernel module and config kernel settings required for podman
|
||||
pre_start_hook=#!/usr/bin/bash
|
||||
set -euo pipefail
|
||||
echo 'PRE_START_HOOK'
|
||||
echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
modprobe br_netfilter
|
||||
echo 1 > /proc/sys/net/bridge/bridge-nf-call-iptables
|
||||
echo 1 > /proc/sys/net/bridge/bridge-nf-call-ip6tables
|
||||
modprobe iptable_nat
|
||||
modprobe iptable_filter
|
||||
|
||||
# Script to run on the HOST after starting the jail
|
||||
# For example to attach to multiple bridge interfaces
|
||||
post_start_hook=#!/usr/bin/bash
|
||||
set -euo pipefail
|
||||
echo 'POST_START_HOOK'
|
||||
ip link set dev ve-router-1 master br1
|
||||
ip link set dev ve-router-1 up
|
||||
#ip link set dev eth2 master br1
|
||||
|
||||
# Only used while creating the jail
|
||||
distro=debian
|
||||
release=bookworm
|
||||
|
||||
# Install and configure within the jail
|
||||
initial_setup=#!/usr/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
# Catch up on updates
|
||||
apt-get update && apt-get full-upgrade -y
|
||||
|
||||
# Configure worker LAN interface with static IP
|
||||
sh -c 'cat <<EOF > /etc/systemd/network/80-container-vee-1.network
|
||||
[Match]
|
||||
Virtualization=container
|
||||
Name=vee-1
|
||||
|
||||
[Network]
|
||||
DHCP=false
|
||||
Address=10.3.14.202/24
|
||||
EOF'
|
||||
systemctl restart systemd-networkd.service
|
||||
|
||||
# Configure routing from LAN clients
|
||||
apt-get install nftables -y
|
||||
nft add table nat
|
||||
nft add chain nat prerouting { type nat hook prerouting priority 0 \; }
|
||||
nft add chain nat postrouting { type nat hook postrouting priority 100 \; }
|
||||
nft add rule nat postrouting masquerade
|
||||
mkdir -p /etc/nftables.d
|
||||
nft list table nat >/etc/nftables.d/nat.conf
|
||||
( echo ; echo 'include "/etc/nftables.d/*.conf"' ) >>/etc/nftables.conf
|
||||
|
||||
# Install dnsmasq alongside local resolver
|
||||
sed -i -e 's/^#DNSStubListener=yes$/DNSStubListener=no/' /etc/systemd/resolved.conf
|
||||
systemctl restart systemd-resolved.service
|
||||
apt-get install dnsmasq -y
|
||||
sed -i -e 's/^#DNS=$/DNS=127.0.0.1/' /etc/systemd/resolved.conf
|
||||
systemctl restart systemd-resolved.service
|
||||
systemctl restart dnsmasq.service
|
||||
|
|
@ -0,0 +1,50 @@
|
|||
# customize and place this file inside /etc/dnsmasq.d
|
||||
|
||||
# serve only Raspberry Pi network; don't backfeed to the host LAN
|
||||
no-dhcp-interface=host0
|
||||
interface=vee-1
|
||||
bind-interfaces
|
||||
|
||||
# designated upstream query servers
|
||||
server=1.1.1.1
|
||||
server=1.0.0.1
|
||||
|
||||
# pirate TLD for the Democratic Republic of Raspberry Pi
|
||||
domain=pi,10.3.14.0/24
|
||||
|
||||
# enable DHCP services
|
||||
dhcp-authoritative
|
||||
dhcp-rapid-commit
|
||||
dhcp-range=10.3.14.101,10.3.14.199
|
||||
|
||||
# meet the 'berries
|
||||
dhcp-host=e4:5f:01:da:da:b1,rpi1,10.3.14.11,infinite,set:rpi
|
||||
dhcp-host=e4:5f:01:da:da:b2,rpi2,10.3.14.12,infinite,set:rpi
|
||||
dhcp-host=e4:5f:01:da:da:b3,rpi3,10.3.14.13,infinite,set:rpi
|
||||
dhcp-host=e4:5f:01:da:da:b4,rpi4,10.3.14.14,infinite,set:rpi
|
||||
dhcp-host=e4:5f:01:da:da:b5,rpi5,10.3.14.15,infinite,set:rpi
|
||||
dhcp-host=e4:5f:01:da:*:*,set:rpicube
|
||||
|
||||
# PXE
|
||||
dhcp-option-force=66,10.3.14.202
|
||||
# magic number
|
||||
dhcp-option-force=208,f1:00:74:7e
|
||||
# config filename
|
||||
dhcp-option-force=209,configs/common
|
||||
# path prefix
|
||||
dhcp-option-force=210,/boot/
|
||||
# reboot time (i -> 32 bit)
|
||||
dhcp-option-force=211,30i
|
||||
|
||||
dhcp-boot=bootcode.bin
|
||||
|
||||
#dhcp-match=set:ipxe,175
|
||||
#dhcp-boot=tag:ipxe,http://boot.netboot.xyz/ipxe/netboot.xyz.efi
|
||||
|
||||
# TFTP
|
||||
enable-tftp
|
||||
tftp-root=/tftp
|
||||
|
||||
#debugging
|
||||
#log-queries
|
||||
#log-dhcp
|
||||
Loading…
Reference in New Issue