Networking Essentials Archives - Anuj Varma, Hands-On Technology Architect, Clean Air Activist

NGINX as a reverse proxy (for apache or any web server)

Anuj Varma — Thu, 05 Aug 2021 03:56:18 +0000

Reverse Proxies sit in front a web server (or server farm) to better distribute the load to the server (a load balancer in a sense. In fact, all load balancers are reverse proxies, by definition).

In addition, reverse proxies hide the actual web server IPs by exposing their own IP – same as a single IP Load balancer (e.g. F5 load balancers). Read this for all possible uses of reverse proxies

NGINX can be configured as a reverse proxy for apache and other web servers.

HTTP Proxies – Fiddler versus Wireshark

Anuj Varma — Sun, 18 Jul 2021 02:50:43 +0000

Why Proxy your HTTP requests?

Proxying requests providers more control.

The three most common proxies:

- HTTP proxy (so you can close port 80 and 443)
- Internal DNS servers (proxy requests to the outside world)
- Internal Mail server (relays incoming and outgoing mail to the world)

Wireshark vs Fiddler

- Fiddler is http only proxy – Wireshark works for all TCP ports
- What ports need to ALWAYS Open OUTBOUND? There are no ports that need to be opened for full access in your outbound firewall rules.

Summary

This is a quick recap of the benefits of using an http proxy (e.g. Fiddler and Wireshark)

The post HTTP Proxies – Fiddler versus Wireshark appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

Quick ping and telnet tests

Anuj Varma — Fri, 06 Mar 2020 20:52:50 +0000

PING (does not equal internet connectivity)

ping 1.1.1.1 (cloudflare’s dns) –> Should return something like

Reply from 1.1.1.1: bytes=32 time=34ms TTL=55

ping 8.8.8.8 (google’s dns)

Telnet (over port 80 = equals internet connectivity) or CURL over http

telnet yahoo.ca 80  -->> Should return 'Connected'
curl http://www.google.com --> Should return the html content

telnet checkip.dyndns.org 80 –> Should return ‘connected’

Additionally, type

GET / HTTP/1.1HOST: checkip.dyndns.org --> Should return the html content shown below

HTTP/1.1 200 OK
Content-Type: text/html
Server: DynDNS-CheckIP/1.0
Connection: close
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 106

Current IP CheckCurrent IP Address: X.X.X.X

Port 443 Test

wget –no-check-certificate https://

curl -c https:// (-c to ignore expired ssl certificate warnings)

Install Ping (uses ICMP) and Traceroute (uses UDP or ICMP) on Ubuntu

sudo apt install iputils-ping

which ping

/usr/bin/ping
$ ping -c 1 linuxconfig.org

sudo apt-get install traceroute

$ traceroute linuxconfig.org

$ traceroute -I ICMP example.com

The post Quick ping and telnet tests appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

What each octet means – subdividing a network into multiple subnets

Anuj Varma — Thu, 16 Jan 2020 20:26:22 +0000

The Network Part vs. the Host Part

192.168.0 –> Network Part
.0 –> Host Part

A subnet mask of 255.255.255.0 means that the first three octets of the address will be used for the network, and thus our network number is 192.168.1.
This means we can have 254 computers on this network, because the fourth octet is not being used by the network portion of the address

Reserved address ranges for private (non-routed) addresses

10.0.0.0 -> 10.255.255.255
172.16.0.0 -> 172.31.255.255
192.168.0.0 -> 192.168.255.255

Dividing the network into multiple subnetworks

There are two methods for dividing your network into multiple sub networks; One is to simply change your network numbers keeping the same subnet mask. The other is to subnet your network into smaller sub networks.

Option 1 – Keeping the same mask:

Your network could be divided into two or more networks by changing the network portion of the address such as 10.0.1 and 10.0.2 and keeping the same subnet mask.

Example:
192.168.1.0/255.255.255.0
192.168.2.0/255.255.255.0

Doing this would give you two separate networks with 254 hosts per network. This is a very common method of dealing with multiple networks. However, back in the good old days you had to pay for every IP address you used, and if you had 25 computers on your network you probably would not want to pay for 254 addresses! The answer to the problem is…subnetting.

Option 2 – Subnetting a network

Subnetting is when you use bits from the host portion of your address as part of your network number. This let’s you subdivide your network at the cost of host addresses, which is great if you’re paying for every host IP address. It will save you money because you pay for fewer TCP/IP addresses. Confused? Here is where understanding binary is important.

Lets look at a new subnet mask:

255.255.255.224

As you can see in the fourth octet, some of the host portion of this subnet mask is now being used for part of the network address. Which means we are now using some of the binary bits in the fourth octet for our network numbers, and that gives us fewer hosts than our old mask (which gave us 254), but gives us more networks (which is why we call it subnetting).

The post What each octet means – subdividing a network into multiple subnets appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

What is a Certificate Singing Request – CSR ?

Anuj Varma — Wed, 15 Jan 2020 19:00:04 +0000

A CSR is quite literally a request to have a certificate created and digitally signed by a CA.

There are three important parts to a CSR:

Your public key.
The fully-qualified domain name(s) you want your certificate to be used with.
Other information about you and your organization/website (including the legally registered name and the city/state/country where its registered).

The post What is a Certificate Singing Request – CSR ? appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

DNS servers for your VPN connection

Anuj Varma — Tue, 14 Jan 2020 21:09:45 +0000

Most VPN services that you can pay for will be configured to redirect all of your IP traffic through the VPN tunnel. (In openvpn, the server option is “redirect-gateway”.) This will include DNS traffic.
You may or may not be assigned a dns server through a vpn based on

a) which vpn implementation you are using
b) which OS you are using.

TESTING your VPN Connection

Test by opening up a cli and typing in “nslookup localhost” and looking at the top entry (Windows). Do this BEFORE and AFTER you connect to the VPN Server to see if the dns servers changed.

The post DNS servers for your VPN connection appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

Restoring Deleted AD Sites, Zones and Objects

Anuj Varma — Mon, 30 Sep 2019 17:05:06 +0000

Restoring an entire Deleted Site

https://blogs.technet.microsoft.com/askds/2010/08/12/using-ad-recycle-bin-to-restore-deleted-dns-zones-and-their-contents-in-windows-server-2008-r2/

Running the Powershell commands, you may see some errors (‘could not add object, as it is in use..’) . Just Ignore these

(Quick) Restoring a Deleted AD Zone

Get-ADObject -Filter {displayName -eq “mylocal.site”} -IncludeDeletedObjects | Restore-ADObject

Restore a Deleted AD Object

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd379509(v=ws.10)?redirectedfrom=MSDN

Restoring an entire Deleted Site

https://blogs.technet.microsoft.com/askds/2010/08/12/using-ad-recycle-bin-to-restore-deleted-dns-zones-and-their-contents-in-windows-server-2008-r2/

Restoring a Deleted AD Zone

Get-ADObject -Filter {displayName -eq “mylocal.site”} -IncludeDeletedObjects | Restore-ADObject

Audit Trail on Domain Controller – DNS Events Audit

Event viewer>Applications and Services logs>Microsoft>windows>DNS-Server>Audit

If you do not see a DNS-server component, enable DNS record auditing manually.

Right-click DNS Server, point to View, and then click “Show Analytic and Debug Logs“. Right-click Analytical and then click on Properties. Confirm the “Enable logging” check box is selected.

The post Restoring Deleted AD Sites, Zones and Objects appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

Testing whether a client is part of an AD

Anuj Varma — Mon, 30 Sep 2019 14:32:43 +0000

Say your AD Site is ‘AVARMA’ – and you are trying to figure out if the following IP address is assigned to that site

Doing this on the local client

“gpresult /r” or “NLTEST /dsgetsite“

Doing this on any AD computer

Test whether it is part of the domain –

nltest /DSADDRESSTOSITE: (Hit Enter)
nltest /DSADDRESSTOSITE:10.10.1.104

Retrieve the site-subnet mapping for ‘10.10.1.104’ from ‘\\DC01.DOMAIN.COM’.

10.10.10.100 AVARMA 10.10.10.0/24

This will tell you whether it is assigned to the AD site AVARMA – and the appropriate subnet mapping

Audit Trail on Domain Controller – DNS Events Audit

Event viewer>Applications and Services logs>Microsoft>windows>DNS-Server>Audit

If you do not see a DNS-server component, enable DNS record auditing manually.

Restoring an entire Deleted Site

https://blogs.technet.microsoft.com/askds/2010/08/12/using-ad-recycle-bin-to-restore-deleted-dns-zones-and-their-contents-in-windows-server-2008-r2/

Restoring a Deleted AD Zone

Get-ADObject -Filter {displayName -eq “mylocal.site”} -IncludeDeletedObjects | Restore-ADObject

Restore a Deleted AD Object

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd379509(v=ws.10)?redirectedfrom=MSDN

The post Testing whether a client is part of an AD appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

Active Directory Domain Basics

Anuj Varma — Mon, 22 Jul 2019 16:50:29 +0000

Active Directory domains are grouped in a tree structure; a group of Active Directory trees is known as a forest, which is the highest level of organization within Active Directory.

Active Directory domains can be identified using a DNS name, which can be the same as an organization’s public domain name, a sub-domain or an alternate version (which may end in .local). While Group Policy can be applied to an entire domain, it is typical to apply policies to sub-groups of objects known as organizational units (OUs). All object attributes, such as usernames, must be unique within a single domain and, by extension, an OU.

The post Active Directory Domain Basics appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.

Kubeadm – Bootstrap a kubernetes cluster

Anuj Varma — Tue, 16 Jul 2019 02:06:11 +0000

Building a cluster through various steps – kubeadm is the preferred way to start up a cluster. In the following order, kubeadm

Kubeadm init
Pre Flight Checks – Pull container images and check for available host resources
Creates a Certificate Authority
Generates Kubeconfig Files
Generate Static Pod Manifests – for Control Plane Pods
Starts up the Control Plane
Taints the Master (System Pods on master node)
Generates a Bootstrap Token
Starts Add On Pods: DNS and Kube Proxy

The post Kubeadm – Bootstrap a kubernetes cluster appeared first on Anuj Varma, Hands-On Technology Architect, Clean Air Activist.