Sometimes we want to test software or do remote monitoring and testing that you may not want to pay a premium to do, or maybe you just want to do it as a hobby. In this post I will share some tips on where to find dirt-cheap providers of virtual servers (VPS).
I strongly advise against placing any production or critical workflows on any of these; use for testing or fun.
Continue readingI wanted to document my Microsoft Azure saga in getting a public IPv6 address to work in a virtual machine without a load balancer in front of it. My needs were pretty simple and straightforward I wanted a virtual server that had a static IPv4 and IPv6 public addresses so that I can monitor my home network and other websites.
You would think this would be pretty easy, a few clicks and done? That wasn’t my experience on Azure and setting this up isn’t easy nor straightforward. Below is how to get it done, if this helps you – you can buy me a coffee or beer.
Continue readingPosted in Blog, Cloud, Linux, Technology, Troubleshooting, Virtualization
Tagged azure, cloud, dual stack, ipv6, networking, virtual server, virtualization, vm, vmnet
Due to built-in security of LXC, trying to setup a tunnel interface inside a container is by blocked by default.
ERROR: Cannot open TUN/TAP dev /dev/net/tun
To allow this for a specific container in Proxmox, we need to make a few tweaks to allow this interface to work in a specific container (we don’t want to allow all containers to be able to setup a tunnel – hackers can hide their tracks using it).
How to do this:
ADD these lines to /etc/pve/lxc/<container-id>.conf
lxc.cgroup.devices.allow = c 10:200 rwm
lxc.hook.autodev = sh -c "modprobe tun; cd ${LXC_ROOTFS_MOUNT}/dev; mkdir net; mknod net/tun c 10 200; chmod 0666 net/tun"
Quick post to note how I determined and then fixed the internet access issue I was having when I installed OPNsense on Proxmox.
OPNsense virtual machine is configured with VirtiO network drivers.
Other than the obvious “I can’t access anything on the internet” or can’t reach external IP addresses problem I looked at troubleshooting via nmap – because the devices on the network could ping externally (8.8.8.8) and also resolve DNS requests.
In a broken state you may see ‘tcpwrapper’ when testing a known host serving HTTP, like so:
root@test:~# nmap -p 80 -sV 216.58.194.206
Starting Nmap 7.40 ( https://nmap.org ) at 2018-11-17 17:54 UTC
Nmap scan report for sfo03s01-in-f206.1e100.net (216.58.194.206)
Host is up (0.010s latency).
PORT STATE SERVICE VERSION
80/tcp open tcpwrapped
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.91 seconds
To fix this issue, ensure that “Disable hardware checksum offload” is enabled in the OPNsense interface, then reboot the firewall for changes to take effect.
After a reboot, doing another test via nmap will actually respond with HTTP fingerprints, as expected and internet is back.
root@test:~# nmap -p 80 -sV 216.58.194.206
Starting Nmap 7.40 ( https://nmap.org ) at 2018-11-17 18:00 UTC
Nmap scan report for sfo03s01-in-f14.1e100.net (216.58.194.206)
Host is up (0.0096s latency).
PORT STATE SERVICE VERSION
80/tcp open http gws
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port80-TCP:V=7.40%I=7%D=11/17%Time=5BF0574C%P=x86_64-pc-linux-gnu%r(Get
SF:Request,8A7A,"HTTP/1\.0\x20200\x20OK\r\nDate:\x20Sat,\x2017\x20Nov\x202
SF:018\x2018:00:43\x20GMT\r\nExpires:\x20-1\r\nCache-Control:\x20private,\
SF:x20max-age=0\r\nContent-Type:\x20text/html;\x20charset=ISO-8859-1\r\nP3
SF:P:\x20CP=\"This\x20is\x20not\x20a\x20P3P\x20policy!\x20See\x20g\.co/p3p
SF:help\x20for\x20more\x20info\.\"\r\nServer:\x20gws\r\nX-XSS-Protection:\
SF:x201;\x20mode=block\r\nX-Frame-Options:\x20SAMEORIGIN\r\nSet-Cookie:\x2
SF:01P_JAR=2018-11-17-18;\x20expires=Mon,\x2017-Dec-2018\x2018:00:43\x20GM
SF:T;\x20path=/;\x20domain=\.google\.com\r\nSet-Cookie:\x20NID=146=0dp1WLb
SF:UhFIr1MIVwhAglx_4O6x-0eJHrmYFTov9a3oFxE2-lZSUI_9mmKBFXQZjYbjKbSRiirLZ-U
SF:cfybTiNQR_vmHD2MY4RBHP-hj4K7oyQX4lXuCgrSU7ESRXiX2Jn0qwoLWvvEItnC2hgDHEb
SF:oLJffQrfiEazdGDp5XppPU;\x20expires=Sun,\x2019-May-2019\x2018:00:43\x20G
SF:MT;\x20path=/;\x20domain=\.google\.com;\x20HttpOnly\r\nAccept-Ranges:\x
SF:20none\r\nVary:\x20Accept-Encoding\r\n\r\n<!doctype\x20html><html\x20it
SF:emscope=\"\"\x20itemtype=\"http://schema\.org/WebPage\"\x20lang=\"en\">
SF:<head><meta\x20content=\"Search\x20the\x20world's\x20information,\x20in
SF:cluding\x20webpages,\x20images,\x20videos\x20and\x20more\.\x20Google\x2
SF:0has\x20ma")%r(HTTPOptions,71B,"HTTP/1\.0\x20405\x20Method\x20Not\x20Al
SF:lowed\r\nAllow:\x20GET,\x20HEAD\r\nDate:\x20Sat,\x2017\x20Nov\x202018\x
SF:2018:00:44\x20GMT\r\nContent-Type:\x20text/html;\x20charset=UTF-8\r\nSe
SF:rver:\x20gws\r\nContent-Length:\x201592\r\nX-XSS-Protection:\x201;\x20m
SF:ode=block\r\nX-Frame-Options:\x20SAMEORIGIN\r\n\r\n<!DOCTYPE\x20html>\n
SF:<html\x20lang=en>\n\x20\x20<meta\x20charset=utf-8>\n\x20\x20<meta\x20na
SF:me=viewport\x20content=\"initial-scale=1,\x20minimum-scale=1,\x20width=
SF:device-width\">\n\x20\x20<title>Error\x20405\x20\(Method\x20Not\x20Allo
SF:wed\)!!1</title>\n\x20\x20<style>\n\x20\x20\x20\x20\*{margin:0;padding:
SF:0}html,code{font:15px/22px\x20arial,sans-serif}html{background:#fff;col
SF:or:#222;padding:15px}body{margin:7%\x20auto\x200;max-width:390px;min-he
SF:ight:180px;padding:30px\x200\x2015px}\*\x20>\x20body{background:url\(//
SF:www\.google\.com/images/errors/robot\.png\)\x20100%\x205px\x20no-repeat
SF:;padding-right:205px}p{margin:11px\x200\x2022px;overflow:hidden}ins{col
SF:or:#777;text-decoration:none}a\x20img{border:0}@media\x20screen\x20and\
SF:x20\(max-width:772px\){body{background:none;margin-top:0;max-width:none
SF:;padding");
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 52.89 seconds
root@test:~#
Posted in Proxmox, Virtualization
Tagged firewall, networking, opnsense, troubleshooting
In my new homelab migration to Proxmox I came across a bug that will prevent you from being able to mount all your ZFS mount points and be a pain in the ass even more if you host containers in that folder.
Continue reading
Posted in Linux, Proxmox, Technology, Troubleshooting, Virtualization
Tagged containers, proxmox, zfs
A follow-up to my last post dealing with unprivileged port access on linux containers.
This time, I have a couchpotato container that I want to change its default port from 5050 to port 80, so that it is as simple as http://mycouch/ to access from the local network.
Continue reading
Posted in Linux, Proxmox, Virtualization
Tagged authbind, containers, couchpotato, debian, linux
As I work on my homelab migration from FreeNAS into Linux containers, I need to move my freebsd jails to LXC.
In *nix any usage of well-known ports (aka 1024 or less) requires special privileges or a kernel setting. In FreeBSD a simple sysctl net.inet.ip.portrange.reservedhigh =1 was enough to allow the BSD jail to use any port on the jail.
On LXC, I had to figure out how to do the same thing and its quite different. My environment is a debian stretch LXC container but should work on other linux versions.
# apt-get install libcap2-bin
# setcap 'cap_net_bind_service=+ep' /usr/bin/transmission-daemon
In the example above, the binary /usr/bin/transmission-daemon is now able to open any port, or port 80 http in my case all while running a service as a non-root user.
Hopefully these helps folks out there, the answer took some digging but I already had an idea on what was needed thanks to my FreeBSD experience in zones 🙂
Posted in Linux, Troubleshooting, Virtualization
Tagged containers, debian, networking, proxmox
By default, installing Proxmox with ZFS during the installation process will force you to use the entire disk for the root zpool. For most installs this is good enough. However, I like to do things differently sometimes.
I have a pair of Samsung 840 Pro 256GB SSDs that I wanted to use for my new homelab that I am currently building (moving from vmware to proxmox). You may be wondering why I want to install the operating system on a partition instead of an entire disk. Several reasons:
Continue reading
Posted in Guides, Linux, Proxmox, Technology, Virtualization
My faithful Lenovo TS440 home server has reached its peak potential as I have maxed out the 32gb memory limit of the Intel E3 v3 architecture.
My needs for more CPU power and memory is driven by the idea of hyperconvergence. Which means I use a single machine to be my router/firewall, VPN gateway, network storage as well as virtual machine host.
Those themes have been part of my home network design since 2010 or so, today’s hot technologies are focusing on containers (LXC), Docker, etc. So I need a more powerful server in order to be able to expand my playground into those technologies. The 32gb maximum on my old server is simply not enough when you have 5 different VMs that consume almost all your memory resources (windows 10 VM, OSX one and my FreeNAS one being the top users of 75%+). Continue reading
Posted in Blog, Technology, Virtualization
Tagged homelab, hyperconverged, openvswitch, proxmox, supermicro
I have been a big fan and user of vmware ESXi for years, I started playing with it since circa 2008. The bare metal hypervisor and its easy to use GUI on Windows makes virtualization management extremely easy.
However in the past couple of years the free version of esxi has moved to HTML5 web management, and in the latest ESXi version the Windows client (vSphere client) requires you to pay for a license a run a central vcenter server/vm in order to manage via GUI (non-web).
