Network Setup Walkthrough: ISP, HQ and BR Routers with GRE Tunnel and OSPF
English with a size of 7.7 KBNetwork Setup Walkthrough
ISP
1. Isp_br-rtr – 172.16.2.1/28, Isp_hr-rtr – 172.16.1.1/28, rename the device (поменять имя).
2. Edit /etc/sysctl.conf with nano, uncomment the # line, run sysctl -p, then reboot.
HQ-RTR
1. Isp_hr-rtr – 172.16.1.2/28, gateway 172.16.1.1, DNS 1.1.1.1
2. hq-rtr_hq-cli (VLAN 200) – ens38.200, parent ens38, VLAN ID 200, address 192.168.100.65/28
3. VLAN 999 – ens39.999, parent ens39, VLAN ID 999, address 192.168.100.81/29
4. VLAN 100 – ens37.100, parent ens37, VLAN ID 100, address 192.168.100.1/26, rename the connection (поменять имя)
5. Edit /etc/sysctl.conf with mcedit, uncomment the # line, run sysctl -p, then reboot.
BR-RTR
1. isp_br-rtr – 172.16.2.2/28, gateway 172.16.2.1, DNS 1.1.1.1
2. br-rtr_br-srv – 192.168.200.1/27, rename the connection (поменять имя)
3. Edit /etc/sysctl.conf with mcedit, uncomment the # line, run sysctl -p, then reboot.
HQ-SRV
1. VLAN 100 – ens34.100, parent ens34, VLAN ID 100, address 192.168.100.2/26, gateway 192.168.100.1, DNS 1.1.1.1, rename the connection (поменять имя), then reboot.
BR-SRV
1. br-rtr_br-srv – 192.168.200.2/27, gateway 192.168.200.1, DNS 192.168.100.2, search domain au-team.irpo, rename the connection (поменять имя), then reboot.
HQ-CLI
1. VLAN 200 – ens34.200, parent ens34, VLAN ID 200, address 192.168.100.66/28, gateway 192.168.100.65, DNS 1.1.1.1, rename the connection (поменять имя), reboot.
ISP, HQ-RTR, BR-RTR (same steps on each)
1. Edit /etc/nftables/nat.nft with mcedit.
2. Set elements = { "vibro0", "ens34" }, and after the ip saddr line add oifname @masq_interfaces jump do_masquerade.
3. Edit /etc/sysconfig/nftables.conf with mcedit, uncomment the line, and add include "/etc/nftables/nat.nft".
4. Run systemctl enable --now nftables.service.
5. Test connectivity with ping -c 4 1.1.1.1.
HQ-SRV, BR-SRV (same steps on each)
1. Create the user: useradd sshuser -u 2026 -U, set password passwd sshuser (password: P@ssw0rd).
2. Add to wheel group: usermod -aG wheel sshuser.
3. Edit /etc/sudoers with mcedit: comment out the existing wheel line, uncomment the wheel line below it, and make sure the two lines sit at the same level with ALL etc.
4. Test: su sshuser, then sudo -i.
HQ-RTR, BR-RTR
1. Create the user: useradd net_admin -U, set password passwd net_admin (password: P@ssw0rd).
2. Add to wheel group: usermod -aG wheel net_admin.
3. Edit /etc/sudoers with mcedit: comment out the existing wheel line, uncomment the wheel line below it, and keep the two lines at the same level with ALL etc.
4. Test: su sshuser, then sudo -i.
HQ-SRV, BR-SRV
1. Edit /etc/selinux/config, set SELINUX=permissive.
2. Run setenforce 0.
3. Edit /etc/ssh/sshd_config.
4. Set Port 2026, AllowUsers sshuser, Banner /etc/banner, MaxAuthTries 2.
5. Edit /etc/banner and add the line Authorized access only!
6. Run systemctl restart sshd.
HQ-CLI
1. Connect: ssh [email protected] -p 2026, then type yes.
HQ-RTR
1. In nmtui, choose Add, then IP tunnel. Set type GRE, device name tun0, parent ens34, local 172.16.1.2, remote 172.16.2.2, address 10.10.0.1/30.
2. Run nmcli connection modify GRE ip-tunnel.ttl 64.
BR-RTR
1. In nmtui, choose Add, then IP tunnel. Set type GRE, device name tun0, parent ens34, local 172.16.2.2, remote 172.16.1.2, address 10.10.0.2/30.
2. Run nmcli connection modify GRE ip-tunnel.ttl 64.
Tunnel verification
HQ-RTR: ping -c 4 10.10.0.2
BR-RTR: ping -c 4 10.10.0.1
OSPF with FRR
HQ-RTR
1. Install FRR: dnf install frr -y.
2. Edit /etc/frr/daemons with mcedit and set ospfd=yes.
3. Run systemctl enable --now frr.
4. Open the shell with vtysh, then enter configure terminal.
5. Configure OSPF: router ospf, network 192.168.100.0/26 area 0, network 192.168.100.64/28 area 0, network 192.168.100.80/29 area 0, network 10.10.0.0/30 area 0, area 0 authentication, exit.
6. Configure the tunnel interface: interface tun0, ip ospf authentication, ip ospf authentication-key password, exit, exit.
7. Run write, exit, then reboot.
BR-RTR
1. Install FRR: dnf install frr -y.
2. Edit /etc/frr/daemons with mcedit and set ospfd=yes.
3. Run systemctl enable --now frr.
4. Open the shell with vtysh, then enter configure terminal.
5. Configure OSPF: router ospf, network 192.168.200.0/27 area 0, network 10.10.0.0/30 area 0, area 0 authentication, exit.
6. Configure the tunnel interface: interface tun0, ip ospf authentication, ip ospf authentication-key password, exit, exit.
7. Run write, exit, then reboot.
Wait 20–30 seconds for OSPF to converge.
OSPF verification
HQ-RTR: run ipr (the route should appear as the last line of the OSPF section), then ping -c 4 192.168.200.2.
BR-RTR: run ipr (the route should appear on lines 4–6 of the OSPF section), then ping -c 4 192.168.100.2.
OSPF recovery procedure
If OSPF does not start, run the following steps in order, first on HQ-RTR and BR-RTR, then repeat for each subsequent step:
1. systemctl disable frr
2. reboot
3. Ping the peer: ping -c 4 10.10.0.2 (HQ-RTR) or ping -c 4 10.10.0.1 (BR-RTR).
4. systemctl enable frr
5. reboot, then wait 5–10 seconds.
6. systemctl restart frr, wait 20–30 seconds, then check with ip -r.
On all machines
hq_cli
1. Click the three red squares on the desktop.
2. Click Third party, then Yandex. Accept, then click the red squares again.
3. In the bottom corner, click the three red squares. Under Internet / Yandex, tick "Set Yandex" and click OK only.
hq-rtr
1. Install Webmin: dnf install webmin -y.
hq_cli
1. Open the browser and go to 192.168.100.1:10000.
2. Details: make an exception.
3. Log in with user root and password toor.
Time zone
1. Run timedatectl set-timezone Europe/Samara, then timedatectl status to verify.