diff options
| -rw-r--r-- | docs/buildnotes/using-a-tank-for-crowd-control.md | 17 | ||||
| -rw-r--r-- | docs/serverdocs/OperationsGuide.md | 2 |
2 files changed, 15 insertions, 4 deletions
diff --git a/docs/buildnotes/using-a-tank-for-crowd-control.md b/docs/buildnotes/using-a-tank-for-crowd-control.md index 09c5299..372a0b6 100644 --- a/docs/buildnotes/using-a-tank-for-crowd-control.md +++ b/docs/buildnotes/using-a-tank-for-crowd-control.md @@ -66,6 +66,19 @@ dnsmasq_enable="YES" gateway_enable="YES" ``` +### Creating a bridge network for the admin lan. + +*Note:* The initial configuration assumed that an external hub would bridge between the admin facing interfaces and the lights out cards on both servers. With the reduction of the colo footprint to a single server this is handled by bridging ibg0 and igb1. +The above /etc/rc.conf is changed by replacing ifconfig_igb0 with the following. + +```sh +#ifconfig_igb0="inet 192.168.31.2 netmask 255.255.255.0" +cloned_interfaces="bridge0" +ifconfig_bridge0="inet 192.168.31.2 netmask 255.255.255.0 addm igb0 addm igb1 up" +ifconfig_igb0="up" +ifconfig_igb1="up" +``` + ### Wireguard setup Wireguard on freebsd is much like wireguard on linux except that instead of iptables the work is done with freebsds packet filter pf. @@ -80,7 +93,7 @@ sysctl -w net.inet.ip.forwarding=1 service pf enable service pflog enable nano /etc/pf.conf -internal_if="igb0" +internal_if="bridge0" wg_net="10.0.0.0/24" scrub in all nat on $internal_if from $wg_net to any -> ($internal_if) @@ -89,7 +102,7 @@ service pf start service pflog start ``` -#### Configure wireguard +#### Configure wireguard Wireguard configuration comes in two pieces the local interface and peers that connect to it. diff --git a/docs/serverdocs/OperationsGuide.md b/docs/serverdocs/OperationsGuide.md index 04dab78..bfdc43d 100644 --- a/docs/serverdocs/OperationsGuide.md +++ b/docs/serverdocs/OperationsGuide.md @@ -15,8 +15,6 @@ The network is divided into 3 segments The host itself does not have any public facing interfaces. It only accessible though the wireguard protected admin lan. The containers, which handle all public facing work do so via an anonymous bridge configuration, allowing them to access the internet directly without allowing external access to the underlying servers.
-
-
### TK2022 Network Config
| | | | | tk2022 ports|
|