Home | panticz.de

Site to Site IPSec VPN with strongSwan and OpenStack VPNaaS (IPsec)

List

openstack vpn ipsec site connection list
openstack vpn endpoint group list
openstack vpn service list
openstack vpn ipsec policy list
openstack vpn ike policy list

Setup

# install
sudo apt-get install -y strongswan

# Left (Peer client, behind NAT)
Ubuntu Client IP: 212.8.9.10
Ubuntu net: 192.168.178.0/24

OpenStack VPN IP: 217.50.60.70
OpenStack Net: 10.0.1.0/24

Create OpenStack VPN endpoint
http://www.panticz.de/openstack/vpn-fritzbox

/etc/ipsec.conf

# Peer, e.g. FritzBox
VPN_LEFT_IP=$(curl -s ipinfo.io/ip)
VPN_LEFT_NET=$(ip -o -4 a | grep -v ": lo" | cut -d " " -f7)   # e.g 10.0.100.0/24 

# Right (OpenStack VPNaaS)
# OpenStack VPN Service IP:
# VPN_SERVICE_ID=$(openstack vpn service list -c ID -f value)
# openstack vpn service show ${VPN_SERVICE_ID} -c external_v4_ip -f value
VPN_RIGHT_IP=1.2.3.4

# OpenStack subnet netmask
# for eatch subnet
# openstack vpn ipsec site connection list -f json --long | jq -r ".[] | select(.\"VPN Service\" == \"${VPN_SERVICE_ID}\") .\"Local Endpoint Group ID\""
# openstack subnet show ${SUBNET_ID} -c cidr -f value
VPN_RIGHT_NET=10.0.1.0/24 

mv /etc/ipsec.conf /etc/ipsec.conf.org
cat < /etc/ipsec.conf
config setup

conn vpn1
 keyexchange=ikev1
 left=%defaultroute
 leftid=${VPN_LEFT_IP}
 leftsubnet=${VPN_LEFT_NET}
 leftauth=psk
 leftfirewall=yes
 authby=psk
 auto=start
 ike=aes256-sha512-modp1024
 esp=aes256-sha512
 right=${VPN_RIGHT_IP}
 rightsubnet=${VPN_RIGHT_NET}
 rightauth=psk
 ikelifetime=3600s
 keylife=3600s
 type=tunnel
EOF

/etc/ipsec.secrets

Install Mellanox MFT

https://www.mellanox.com/products/adapter-software/firmware-tools

#URL=https://www.mellanox.com/downloads/MFT/mft-4.26.1-3-x86_64-deb.tgz
URL=https://www.mellanox.com/downloads/MFT/mft-4.27.0-83-x86_64-deb.tgz

wget -q ${URL} -P /tmp
tar xzf /tmp/mft-*-x86_64-deb.tgz -C /tmp/

sudo apt install -y gcc make dkms linux-headers-$(uname -r)
/tmp/mft-*-x86_64-deb/install.sh 

mst start

OpenStack: Output VM list with project and domain as JSON file

IFS=$(echo -en "\n\b")

PROJECTS_JSON=$(openstack project list --long -f json)
for PROJECT_JSON in $(echo "${PROJECTS_JSON}" | jq -c '.[]'); do
    PROJECT_ID=$(echo ${PROJECT_JSON} | jq -r .ID)
    PROJECT_NAME=$(echo ${PROJECT_JSON} | jq -r .Name)
    DOMAIN_ID=$(echo ${PROJECT_JSON} | jq -r '."Domain ID"')
    DOMAIN_JSON=$(openstack domain show  ${DOMAIN_ID} -f json)
    DOMAIN_NAME=$(echo ${DOMAIN_JSON} | jq -r .name)

    openstack server list --all-projects --long --project ${PROJECT_ID} --sort-column Name -f json | jq .[] | \
        jq --arg project_name ${PROJECT_NAME} --arg domain_name ${DOMAIN_NAME} '. + {"Project": $project_name, "Domain": $domain_name}'
done | jq --slurp .

script-server (Web UI for scripts)

Install

# install reuired packages
apt install -y unzip python3-tornado

# download and instal script-server
mkdir script-server
cd script-server
wget https://github.com/bugy/script-server/releases/download/1.15.2/script-server.zip
unzip script-server.zip
rm script-server.zip

# start script-server
./launcher.py

Add job

# cat ./conf/runners/certgen.json 
{
  "name": "certgen",
  "description": "Request Lets Encrypt certificate",
  "script_path": "/usr/local/bin/certgen",
  "parameters": [
    {
      "name": "Domain",
      "default": "example.com"
    }
  ],
  "output_files": [
      "/home/local/certificates/*${Domain}*"
  ]
}

WebUI
http://SERVER_IP:5000/

Redirect port 5000 to 80

iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-ports 5000

Links
https://github.com/bugy/script-server

Vagrant

Install
https://www.vagrantup.com/downloads.html

# sudo apt install -y jq

URL=$(wget https://checkpoint-api.hashicorp.com/v1/check/vagrant -qO- | jq  -r '"https://releases.hashicorp.com/vagrant/" + .current_version + "/vagrant_" + .current_version + "_x86_64.deb"')
wget ${URL} -qP /tmp
sudo dpkg -i /tmp/${URL##*/}

vagrant --version

Install with Ansible

- name: Get latest vagrant version
  uri:
    url: https://checkpoint-api.hashicorp.com/v1/check/vagrant
  register: release

- set_fact:
    version: "{{ release.json | json_query('current_version') }}"

- name: Install Vagrant
  apt:
    deb: https://releases.hashicorp.com/vagrant/{{ version }}/vagrant_{{ version }}_x86_64.deb
  become: yes

- name: Adding user ubuntu to group libvirt
  user:
    name: ubuntu
    groups: libvirt
    append: yes
  become: yes

- name: Install vagrant-libvirt plugin
  command: sudo -H -u ubuntu vagrant plugin install vagrant-libvirt
  become: yes

CLI

# deploy / start VM
vagrant up

# list VMs
vagrant show

# show VM IPs
vagrant ssh-config

# ssh to VM
vagrant ssh vm1

# stop VM
vagrant halt vm1

# delete ALL VMs
vagrant destroy -f

Images
https://app.vagrantup.com/boxes/search

Vagrant LXD
https://gitlab.com/catalyst-it/devtools/vagrant-lxd

Links
https://www.vagrantup.com/
https://checkpoint-api.hashicorp.com/v1/check/vagrant

topgrade

Install
https://github.com/r-darwish/topgrade/releases/

URL=https://github.com/r-darwish/topgrade/releases/download/v5.5.0/topgrade-v5.5.0-x86_64-unknown-linux-gnu.tar.gz

wget ${URL} -qP /tmp
tar -C /tmp -xzf /tmp/topgrade-v*-x86_64-unknown-linux-gnu.tar.gz
sudo mv /tmp/topgrade /usr/local/sbin

Custom configuration

# ~/.config/topgrade.toml
...
remote_topgrades = ["www.example.com", "db.example.com"]

[git]
repos = [
    "~/git/repository_1",
    "~/git/repository_2"
]
...

Run update

topgrade -cy

Run on specific remote host

topgrade -cy --only remotes --remote-host-limit ".*.example.com"

Links
https://github.com/r-darwish/topgrade
https://github.com/r-darwish/topgrade/releases

Get noisy neighbor VMs

source /etc/kolla/admin-openrc.sh

IFS=$(echo -en "\n\b")

function get_vm_details() {
    LINE=$1

    SERVER_ID=$(echo ${LINE} | cut -d" " -f3)
    SERVER_JSON=$(openstack server show ${SERVER_ID} -f json)
    SERVER_NAME=$(echo ${SERVER_JSON} | jq -r .name)
    SERVER_PROJECT_ID=$(echo ${SERVER_JSON} | jq -r .project_id)
    SERVER_PROJECT_JSON=$(openstack project show ${SERVER_PROJECT_ID} -f json)
    SERVER_PROJECT_NAME=$(echo ${SERVER_PROJECT_JSON} | jq -r .name)

    echo "${LINE} ${SERVER_NAME} ${SERVER_PROJECT_NAME}"
}

for COMPUTE_NODE in $(openstack compute service list --service nova-compute -c Host -f value | sort); do
    echo "# ${COMPUTE_NODE}"

    echo "VMs by CPU usage"
    OUTPUT="$(ssh ${COMPUTE_NODE} ps -eo pid,%cpu,cmd --sort="-%cpu" --no-headers | head -5 | grep -o -P '^[0-9]?.*(?<=-uuid ).*(?= -smbios)\b' | awk '{ print $1,$2,$NF }')"
    for LINE in ${OUTPUT}; do
        get_vm_details "${LINE}"
    done

    echo "VMs by RAM usage"
    OUTPUT="$(ssh ${COMPUTE_NODE} ps -eo pid,size,cmd --sort="-size" --no-headers | head -5 | grep -o -P '^[0-9]?.*(?<=-uuid ).*(?= -smbios)\b' | awk '{ print $1,$2,$NF }')"
    for LINE in ${OUTPUT}; do
        get_vm_details "${LINE}"
    done

    echo
done

Ubuntu 25.04 Plucky Puffin LTS

Schedule
https://wiki.ubuntu.com/PluckyPuffin/ReleaseSchedule

ReleaseNotes
https://wiki.ubuntu.com/PluckyPuffin/ReleaseNotes

Known issues
https://wiki.ubuntu.com/FocalFossa/ReleaseNotes#Known_issues

Download
Releases: https://releases.ubuntu.com/releases/25.04
Cloud image (minimal): https://cloud-images.ubuntu.com/minimal/daily/focal/current/focal-minimal-cloudimg-amd64.img
Netboot: http://archive.ubuntu.com/ubuntu/dists/focal/main/installer-amd64/current/images/netboot/mini.iso
Torrent: http://releases.ubuntu.com/20.04/ubuntu-20.04-desktop-amd64.iso.torrent

Repository

echo "deb http://de.archive.ubuntu.com/ubuntu focal main restricted universe multiverse" \
    sudo tee /etc/apt/sources.list.d/ubuntu-focal.list
echo "deb http://de.archive.ubuntu.com/ubuntu focal-updates main restricted universe multiverse" \
    sudo tee /etc/apt/sources.list.d/ubuntu-focal-updates.list

# v2
deb [arch=amd64] http://de.archive.ubuntu.com/ubuntu focal main restricted universe multiverse
deb [arch=amd64] http://de.archive.ubuntu.com/ubuntu focal-updates main restricted universe multiverse
deb [arch=amd64] http://de.archive.ubuntu.com/ubuntu focal-security main restricted universe multiverse
deb [arch=amd64] http://de.archive.ubuntu.com/ubuntu focal-backports main restricted universe multiverse

sudo apt update

DEP

Workarounds

# skip disk check
fsck.mode=skip

# Install and configure python2 as default
sudo apt install -y python-is-python2

# set python3 as default
apt install -y python-is-python3

# Install PIP 2 under Ubuntu 20.04
wget https://bootstrap.pypa.io/2.7/get-pip.py -qO- | python2

Reenable hle and rtm CPU flags
https://bugs.launchpad.net/ubuntu/+source/libvirt/+bug/1853200
https://unix.stackexchange.com/questions/43539/what-do-the-flags-in-proc-cpuinfo-mean
https://access.redhat.com/articles/tsx-asynchronousabort

Mellanox ConnectX-3 Pro UEFI iPXE boot

Device Type:      ConnectX3Pro
  Part Number:      MCX312B-XCC_Ax
  Description:      ConnectX-3 Pro EN network interface card; 10GigE; dual-port SFP+; PCIe3.0 x8 8GT/s; RoHS R6
  PSID:             MT_1200111023
  PCI Device Name:  /dev/mst/mt4103_pci_cr0
  Port1 MAC:        ec0d9a00aab1
  Port2 MAC:        ec0d9a00aab2
  Versions:         Current        Available    
     FW             2.42.5000      N/A          
     PXE            3.4.0752       N/A

Flash UEFI firmware
Request UEFI firmware from support@mellanox.com
http://www.panticz.de/mellanox/firmware-update

Install MFT
http://www.panticz.de/install-mellanox-mft

Flash firmware

flint -y -d /dev/mst/mt4103_pci_cr0 -i firmware fw-ConnectX3Pro-rel-2_42_5000-MCX312B-XCC_Ax-FlexBoot-3.4.752-UEFI-14.11.46.bin b

Device Type:      ConnectX3Pro
  Part Number:      MCX312B-XCC_Ax
  Description:      ConnectX-3 Pro EN network interface card; 10GigE; dual-port SFP+; PCIe3.0 x8 8GT/s; RoHS R6
  PSID:             MT_1200111023
  PCI Device Name:  /dev/mst/mt4103_pci_cr0
  Port1 MAC:        ec0d9a00aab1
  Port2 MAC:        ec0d9a00aab2
  Versions:         Current        Available    
     FW             2.42.5000      N/A          
     PXE            3.4.0752       N/A          
     UEFI           14.11.0046     N/A

Fix iPXE boot issue (recompile ipxe.efi) when connected to LACP swith port
http://www.panticz.de/ipxe/compile

# disable NET_PROTO_LACP
diff --git a/src/config/general.h b/src/config/general.h
index 3c14a2cd..d860f450 100644
--- a/src/config/general.h
+++ b/src/config/general.h
@@ -38,7 +38,6 @@ FILE_LICENCE ( GPL2_OR_LATER_OR_UBDL );
 #undef NET_PROTO_IPV6          /* IPv6 protocol */
 #undef NET_PROTO_FCOE          /* Fibre Channel over Ethernet protocol */
 #define        NET_PROTO_STP           /* Spanning Tree protocol */
-#define        NET_PROTO_LACP          /* Link Aggregation control protocol */

# compile
make bin-x86_64-efi/ipxe.efi

# deploy ipxe.efi
scp /tmp/ipxe/src/bin-x86_64-efi/ipxe.efi tftp.example.com:/tftpboot/

Yamaha RX-D485 / RX-V485

Yamaha Web Control
Live demo: http://yamaha.panticz.de/
Repository: https://github.com/panticz/yamaha-web-control

API

curl -q http://192.168.178.4/YamahaExtendedControl/v1/system/getFeatures  | jq .

Control
# Volume Up / Down
http://192.168.178.4/YamahaExtendedControl/v1/main/setVolume?volume=up&step=5
http://192.168.178.4/YamahaExtendedControl/v1/main/setVolume?volume=down&step=5

# Change input
http://192.168.178.4/YamahaExtendedControl/v1/main/prepareInputChange?input=usb
http://192.168.178.4/YamahaExtendedControl/v1/main/setInput?input=net_radio
http://192.168.178.4/YamahaExtendedControl/v1/main/setInput?input=server
http://192.168.178.4/YamahaExtendedControl/v1/main/setInput?input=spotify

# Power
http://192.168.178.4/YamahaExtendedControl/v1/main/setPower?power=on
http://192.168.178.4/YamahaExtendedControl/v1/main/setPower?power=standby

# Get Device info
http://192.168.178.4/YamahaExtendedControl/v1/system/getDeviceInfo

# Get Available Device Features
http://192.168.178.4/YamahaExtendedControl/v1/system/getFeatures

# Get Network Status
http://192.168.178.4/YamahaExtendedControl/v1/system/getNetworkStatus

# Get Function Status (e.g.: Auto Power Standby)
http://192.168.178.4/YamahaExtendedControl/v1/system/getFuncStatus

# Get Location info and zone list (device)
http://192.168.178.4/YamahaExtendedControl/v1/system/getLocationInfo

# Get zone info (device|zone)
http://192.168.178.4/YamahaExtendedControl/v1/main/getStatus

# Get Sound Program List (device|zone)
http://192.168.178.4/YamahaExtendedControl/v1/main/getSoundProgramList

Allow access data from your reciver (CORS exception)
# firefox
https://addons.mozilla.org/en-US/firefox/addon/cross-domain-cors/
# chrome / chromium
https://chrome.google.com/webstore/detail/cross-domain-cors/mjhpgnbimicffchbodmgfnemoghjakai