Skip to content

Commit 4215e78

Browse files
rguskerbo
rguske
authored and
rbo
committed
added rhel router section
Signed-off-by: Robert Guske <robert.guske@gmail.com>
1 parent 859d9a9 commit 4215e78

File tree

2 files changed

+175
-0
lines changed

2 files changed

+175
-0
lines changed

‎content/my-lab/rhel-router.md‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
---
2+
title: Routing with RHEL
3+
linktitle: Routing with RHEL
4+
description: Routing with RHEL
5+
tags: ['rhel']
6+
---
7+
8+
- [RHEL9 Router Installation](#rhel9-router-installation)
9+
- [`subscription-manager` Setup](#subscription-manager-setup)
10+
- [RHEL9 Router Installation - Network](#rhel9-router-installation---network)
11+
- [Enable IP Forwarding](#enable-ip-forwarding)
12+
- [Configure the Firewall](#configure-the-firewall)
13+
- [Setup DHCP Server](#setup-dhcp-server)
14+
15+
## RHEL9 Router Installation
16+
17+
- Installed basic RHEL9 VM on vSphere
18+
- set hostname
19+
- configure network
20+
- select installation source and destination
21+
- add a new user
22+
- set passwords
23+
24+
### `subscription-manager` Setup
25+
26+
If not already done during installation:
27+
28+
```code
29+
subscription-manager register --org="" --activationkey=""
30+
```
31+
32+
Checkt the repos:
33+
34+
```code
35+
dnf repolist
36+
Updating Subscription Management repositories.
37+
repo id repo name
38+
rhel-9-for-x86_64-appstream-rpms Red Hat Enterprise Linux 9 for x86_64 - AppStream (RPMs)
39+
rhel-9-for-x86_64-baseos-rpms Red Hat Enterprise Linux 9 for x86_64 - BaseOS (RPMs)
40+
```
41+
42+
- needed packages post-install:
43+
44+
```code
45+
dnf install -y \
46+
dnsmasq \
47+
firewalld \
48+
tcpdump \
49+
bind-utils \
50+
vim
51+
```
52+
53+
### RHEL9 Router Installation - Network
54+
55+
VM got configured with three vNICs. Each assigned to a specific Distributed Port-Group in vSphere:
56+
57+
```code
58+
ip -br a
59+
60+
lo UNKNOWN 127.0.0.1/8 ::1/128
61+
ens33 UP 10.32.111.8/20 2620:52:0:2060:250:56ff:fe88:71f7/64 fe80::250:56ff:fe88:71f7/64
62+
ens34 UP 192.168.202.10/24 fe80::2e60:26f7:eca5:3311/64
63+
ens35 UP 192.168.204.10/24 fe80::4659:fe20:d534:9e48/64
64+
```
65+
66+
`ens33` is connected to a DHCP network and has already got an IP assigned.
67+
68+
Network 2 and 3 will be static.
69+
70+
```code
71+
nmcli con add type ethernet ifname ens34 con-name lan2 \
72+
ipv4.method manual ipv4.addresses 192.168.202.10/24
73+
```
74+
75+
```code
76+
nmcli con add type ethernet ifname ens35 con-name lan3 \
77+
ipv4.method manual ipv4.addresses 192.168.204.10/24
78+
```
79+
80+
Activate ncs:
81+
82+
```code
83+
nmcli con up lan2 && nmcli con up lan3
84+
```
85+
86+
### Enable IP Forwarding
87+
88+
Enable IP Forwarding (Mandatory):
89+
90+
```code
91+
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-router.conf \
92+
sysctl --system
93+
```
94+
95+
### Configure the Firewall
96+
97+
Configure Firewall and NAT (firewalld):
98+
99+
RHEL 9 uses nftables via firewalld.
100+
101+
```code
102+
firewall-cmd --permanent --zone=external --add-interface=ens33
103+
firewall-cmd --permanent --zone=internal --add-interface=ens34
104+
firewall-cmd --permanent --zone=internal --add-interface=ens35
105+
```
106+
107+
Enable Masquerading on WAN:
108+
109+
```code
110+
firewall-cmd --permanent --zone=external --add-masquerade
111+
firewall-cmd --permanent --zone=internal --add-masquerade
112+
```
113+
114+
Allow Forwarding Between Zones:
115+
116+
```code
117+
firewall-cmd --permanent --zone=internal --add-forward
118+
```
119+
120+
Configure Policies accordingly:
121+
122+
```code
123+
sudo firewall-cmd --permanent --new-policy=internal-external
124+
sudo firewall-cmd --permanent --policy=internal-external --set-target=ACCEPT
125+
sudo firewall-cmd --permanent --policy=internal-external --add-masquerade
126+
sudo firewall-cmd --permanent --policy=internal-external --add-ingress-zone=internal
127+
sudo firewall-cmd --permanent --policy=internal-external --add-egress-zone=external
128+
sudo firewall-cmd --reload
129+
```
130+
131+
```code
132+
firewall-cmd --reload
133+
```
134+
135+
### Setup DHCP Server
136+
137+
Install and Configure DHCP (dnsmasq). `dnsmasq` is lightweight and ideal for this role.
138+
139+
```code
140+
dnf install -y dnsmasq
141+
```
142+
143+
Configuration
144+
145+
Edit `/etc/dnsmasq.d/router.conf`:
146+
147+
```code
148+
# Network 2
149+
interface=ens34
150+
dhcp-range=ens34,192.168.202.100,192.168.202.150,12h
151+
dhcp-option=ens34,option:router,192.168.202.10
152+
dhcp-option=ens34,option:dns-server,10.32.96.1
153+
154+
# Network 3
155+
interface=ens35
156+
dhcp-range=ens35,192.168.204.100,192.168.204.150,12h
157+
dhcp-option=ens35,option:router,192.168.204.10
158+
dhcp-option=ens35,option:dns-server,10.32.96.1
159+
```
160+
161+
Start and Enable:
162+
163+
```code
164+
systemctl enable --now dnsmasq
165+
```
166+
167+
The leases can be read using `tail -f /var/lib/dnsmasq/dnsmasq.leases`.
168+
169+
Firewall: Allow DHCP Traffic:
170+
171+
```code
172+
firewall-cmd --permanent --zone=internal --add-service=dhcp
173+
firewall-cmd --reload
174+
```

‎mkdocs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,7 @@ nav:
288288

289289
- My Lab notes:
290290
- my-lab/index.md
291+
- RHEL Router: my-lab/rhel-router.md
291292
- Hetzner Storage Box: my-lab/storage-box.md
292293
- Local fedora: my-lab/local-fedora.md
293294
- SSH: my-lab/ssh.md

0 commit comments

Comments
 (0)