Establish the Pi Network

Our first Design Project is to build our Pi network and install the required software onto the devices. Our network consists of the following:

Name	Device	IP
fw01	Netgate firewall	DHCP, 192.168.1.1
pi-hub	Raspberry Pi	192.168.1.50
management-pi	Raspberry Pi	192.168.1.51

Our first is to configure a local LAN using the Pis and the switch, and to configure the firewall. This goal will be complete when both the Pi-Hub and the Management-Pi can access the internet and each other, and firewall rules are in place.

Our second goal is to install Mykodo and Cockpit on Pi-Hub and Management-Pi, respectfully. This goal will be completed when these software applications are accessible.

Configuration Documentation

FW01 (SJ)

Initial Configuration

• Using a hard connection between my laptop and the NetGate's LAN port, I utilized the PFSense web configuration wizard by browsing to 192.168.1.1.

• Logged in using default PFSense credentials.
• Changed the Admin Password.
• Configured the WAN interface to use a DHCP address, while the LAN is set to use static addresses within the 192.168.1.0/24 network scheme (See table above).
• Named the device FW01 and set up a basic domain, hydro.lan.

• Enabled DNS resolving using the WAN interface.
• Kept the rest of the configuration defaults.
• Used the Web interface to Update the PFSense software to the latest stable version.

VPN Configuration

• Configured the NetGate to support VPN connections using OpenVPN.
• Created a CA on PFSense
  • System -> Certificate Manager -> CA
  • Selected "Add", filled in required information.

• Created an OpenVPN server certificate

  • System -> Certificate Manager -> Certificates
  • Selected "Add"
  • Set Method to "Create an internal Certificate"
  • Filled in required information
  • Set Certificate Type to "Server Certificate"

• Configured OpenVPN

  • VPN -> OpenVPN -> Servers
  • Selected the "Wizards" tab.
  • Set Type of Server to "Local User Access"
  • Select the created CA
  • Select the created certificate.
  • Set the Tunnel Network Address to 10.0.8.0/24, to give VPN users a pool of available addresses.
  • Selected the "Redirect Gateway" option
  • Set the Local Network to 192.168.1.0/24
  • Selected the option to create firewall rules for VPN.

• Created OpenVPN Client
  • VPN -> OpenVPN -> Clients
  • Selected Add
  • Under General Information, inputed FW01's IP as the Server Host
  • Set a VPN username and password.
  • Under Advanced Settings, selected IPv4 only for Gateway creation.

• Installed required packages
  • System -> Package Manager -> Available Packages
  • Searched for OpenVPN and installed the openvpn-client-export package.
    • NOTE: This required an update to the latest possible Pfsense software patch.
• Added VPN user
  • System -> User Manager -> Users
  • Add new user
  • Matched Username and Password to account created with the VPN Clinet
  • Selected to create a new user certificate.

• Exported User settings
  • VPN -> OpenVPN
  • Selected the "Client Export" Tab
  • Selected the Current Windows Installer 64bit option
  • Ran the .exe on my computer to install OpenVPN with preconfigured settings.

Firewall Rules

• Firewall rule creation process:
  • Firewall -> Rules
  • Select Add
  • Select rule type (Pass, Block, Reject)
  • Fill out required information (Protocol, Source, Destination, etc)
  • Select Save
• Created Rules:
  • WAN
    • Block Private Networks
    • Block bogon networks
    • Block ICMP
    • Block all TCP inbound to LAN
    • Pass OpenVPN packets
    • Block SSH from outside LAN
    • Pass HTTPS packets
  • LAN
    • Allow port 80 and 443 traffic out.

PI-Hub & Management PI

• I hard connected to the Pis using a separate KVM setup.
• For Installation:
  • Raspbian
  • Install
• In the Pi Configuration Menu:
  • Changed the Hostname to PI-Hub or PI-Management
  • Changed the password
  • Enabled SSH and VNC
• In CLI from VPN SSH
  • Installed dnsutils (sudo apt-get dnsutils) to verify DNS was functioning properly.
  • Created an admin user for both connor and I.
    • sudo adduser sjohnson
    • sudo visudo
      • Add users under sudo section.
  • Ran ping tests to verify connection:
    • FW01
    • Pis between each other
    • Pis to google.com

VNC Viewer

Setup

• I created a new email and VNC account for Connor and I to access the Pis from outside the Champlain network.
• Using VNC installation software, Connor and I installed VNC in our devices.
• On each PI, I signed in to the VNC account, and enabled Cloud access.
• From out VNC Viewer apps, we could now connect remotely to our Pis.

Hardware Update (4/01/2022)

• Over the course of the project, the Netgate device stopped functioning properly, and we were forced to implement a Mikrotik hAp mini router into the environment to serve as a firewall, Wi-Fi provider, and network gateway for our growing environment network. The router was configured using the basic Mikrotik setup wizard, and the same firewall rules mentioned above were implemented. Optimally, the Netgate Router would be used in a replication effort, using the instructions above.