diff --git a/_knowledge-base/backup-vlans.md b/_knowledge-base/backup-vlans.md
new file mode 100644
index 0000000..3ab98d3
--- /dev/null
+++ b/_knowledge-base/backup-vlans.md
@@ -0,0 +1,314 @@
+# VLANs Guide
+
+
+
+### Purpose of VLANs
+
+Separate a network in to smaller segments.
+This can improve securirty, ease of managment,
+reduce unnecessary chatter that can congest larger networks.
+
+### Hardware
+
+Whats required before thinking about vlans.
+
+* **Managed switches** as oppose to cheaper typical *"dumb switches"*,
+ as majority of the configuration of vlans is done on switches.
+ * **HPE/Aruba** - super reliable, easy to manage, enterprise-grade switches
+ that won't break the bank if it's just about 1gbit.
+ * **Mikrotik** or **Ubiquiti** - usually when in need of something
+ special, like 2.5gbit with some sfp+ or poe
+ * **TP-Link** - when just want something cheap, like poe switch for cameras
+* A **router/firewall/gateway** device that supports vlans.
+ This will be the linchpin at the center, with separate settings
+ for each vlan - being their gateway, providing them with separate dhcp,
+ applying firewall rules between them,...
+ * **opnsense** - is what I [use](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/opnsense),
+ installed as a virtual machine, but can be installed on any regular old pc,
+ or a miniPC with two intel NICs.
+ * **Ubiquiti UCG-Ultra** - solid go-to recommendation.
+
+ Reasons...
+ * it is **very easy to configure**.
+ * 100€.
+ * ok hardware - 4x arm cores, 3GB RAM, informative lcd display, usb-c power.
+ * full of features - vlans, wireguard VPN, cloud remote managment,
+ geoblocking, basic IDPS, DNS base adblocking, unifi controller for wifi APs,...
+
+ * **Mikrotik** devices are a good pick, but their configuration can be
+ overwhelming. I gave up and use just their switches.
+
+
+Some basic networking knowledge is required.
+
+You should know about IP addresses, Mac addresses, packets, frames,
+swiches, routers, about existance of first 4 OSI layers,..
+
+* [What is OSI Model | Real World Examples](https://youtu.be/0y6FtKsg6J4)
+* [OSI Model Deep Dive](https://youtu.be/oVVlMqsLdro)
+* [CIDR notation](https://youtu.be/z07HTSzzp3o?t=746)
+* [Layer 2 vs Layer 3 Switches](https://youtu.be/bdNS0K4Bt8U)
+
+lets put here also vlan stuff
+
+* [VLANs Explained Simply](https://youtu.be/C81pyQaJgj8)
+* [vlan theory video](https://youtu.be/MmwF1oHOvmg)
+* [vlan theory video2](https://youtu.be/JszGeQPTo4w)
+* [vlan networkacademy](https://www.networkacademy.io/ccna/ethernet/vlan-concept)
+* [What is VLAN and how it works](https://www.etherwan.com/support/featured-articles/brief-introduction-vlans)
+* [Network Virtualization: Beyond VLANs – Part 1: VLANs](https://infrastructureadventures.wordpress.com/2010/11/13/network-virtualization-beyond-vlans-part-1/)
+* [What is PVID? VLAN explained Quick and Dirty](https://forflukesake.co.za/wp/531/vlan-pvid-explained-quick-and-dirty/)
+---
+---
+
+
+
+### Two types of VLANs
+
+* **Port based**
+ A simple separation of ports on a switch,
+ as if you would cut it in to several smaller switches.
+ This is boring, limiting and generally **useless**,
+ as you would need to deal with extra cables, extra interfaces, extra hardware..
+* **Tag based**
+ The real deal vlan. At layer2 a **vlan tag** is added to frames.
+ It contains a **vlan ID** which is a number between 1 and 4094.
+ These are used to create virtual networks that are separate
+ from each other but share same hardware, same cables.
+ The standard is called **802.1Q**.
+
+
+
+Some aspects:
+
+* **Tags** are added or removed from **frames** at physical ports,
+ when entering or leaving switch.
+* A tag is 4 bytes in size, contains [several pieces of info](https://i.imgur.com/86zeYgG.png),
+ the most important being vlan ID.
+* **Vlan ID** (VID) is just a number between 1-4094, often picked as
+ multiplies of ten - 10, 20, 30, 40, ... with the ip address pool on that VLAN
+ having it somewhere too.
+ Like vlan30 would be set as 192.168.30.0/24 or 10.30.30.0/24.
+* A **frame** can be tagged only for a **single vlan**,
+ but a port can belong to many vlans.
+* Tagged frames **get dropped** if they would arrive to a regular machine,
+ not configured for vlans.
+
+### The Core concept
+
+The **absofucking essence** of VLANs is a clear understanding of two types
+of ports - untagged and tagged.
+
+
+
+* **Untagged ports**
+ Called untagged because frames coming in to a switch, or leaving the switch
+ through that one port are not tagged. So that the end device can actually
+ communicate without the need to be configured for vlans.
+ While the inbound frames, the ones entering the switch through this port
+ are untagged at the moment of entering, they are tagged once inside the switch
+ according to **PVID** settings for that port, so that they can exit only
+ through other ports tagged with that same VLAN.
+ Untagged ports are **used for end user devices** unaware of vlans - computers,
+ printers, ip cameras, IoT devices,...
+ These are sometimes called **access ports**, as thats cisco term for them.
+ * **PVID** - Port Vlan ID
+ Is a setting on a port. Incoming frames entering switch that are not tagged
+ get tagged with this PVID number.
+ It might feel weird that for an untagged port you are setting both VLAN ID
+ and PVID when VLAN ID should be enough. It feels like duplication of effort...
+ but its there to solve some hybrid cases.
+* **Tagged ports**
+ Tagged frames going in and out of this kind of ports. Tagged port can carry many
+ VLANs simultaneously if set so, or can carry just one.
+ Purpose is to communicate with other vlan aware devices,
+ like other switches, routers, servers/virtual machines, IP telephones,...
+ Of note is that setting a port to **vlan 4095** allows all vlans to traverse,
+ though it can be manufacturer dependent, if its even allowed to set vlan above
+ `4094`.
+ * **Trunk port**
+ A type of tagged port. The term is used for ports that carry multiple vlans,
+ usually the ones connecting switch with another switch or a server or a router,..
+ A tagged port that is not a trunk port would be for example a port that carries
+ just one vlan to a VoIP phone.
+ * **Native vlan**
+ Frames belonging to native vlan leave the trunk port untagged.
+ The initial reason for the existence of this is to allow older dumb switches
+ to be part of the infrastructure, in between two managed ones.
+ [Video.](https://youtu.be/Fmq1E1Qr2W4)
+
+# Setting up VLANs on Routers
+
+
+
+Your vlan aware router wil be the linchpin at the center,
+the gateway to the internet for all vlans, the dhpc server for all vlans,
+the firewall for all vlans,...
+
+#### The usual generic steps
+
+* creating a new interface or a new network with a specific Vlan ID.
+* setting a static IP address / subnet the router will have on that network.
+* setting the dhcp pool for for that network.
+* maybe enable or restrict the traffic through firewall rules
+
+
+OPNsense - Router
+
+
+
+[Isolating Networks in OPNsense](https://youtu.be/TjXkWSjYqlM)
+
+* **Add new VLAN**
+ `Interfaces: Other Types: VLAN`
+ Add; Device = empty; Parent = **LAN**; VLAN tag = `20`; VLAN priority = default;
+ Description = `VLAN20WIFI`
+* **Assign the new VLAN as an interface**
+ `Interfaces: Assignments`
+ Assign a new interface > pick the VLAN from dropbox; Description = `vlan_20_wifi`
+ Enter the newly created interface, Enable it; IPv4 Configuration Type = `Static IPv4`;
+ IPv4 address = `10.20.20.1/24`
+* **Setup dhcp servis on the new interface**
+ `Services: ISC DHCPv4: [VLAN20WIFI]`
+ Enable; From = `10.20.20.50` To = `10.20.20.200`; DNS servers = 10.20.20.1;
+ Gateway = `10.20.20.1`
+* **Firewall rule to enable traffic through**
+ `Firewall: Rules: VLAN20WIFI`
+ Source = `VLAN20WIFI net`; save as default is pass and everything
+
+
+
+* [opnsense video](https://youtu.be/LMJeIUDlrHo)
+* [pfsense video but applicable](https://youtu.be/SsaGeXx2qh0)
+
+If running opnsense as a virtual machine.
+
+
+
+For VLAN aware devices on the network to get through
+
+* Edit the port group with the opnsense VM LAN interface
+ and add VLAN ID = `4095`
+ This will allow all VLANs to get through
+
+For a virtual machine on that ESXI host should be on that VLAN
+
+* Add new port group, to the virtual switch that opnsense uses for LAN
+ Name = `vlan20`; VLAN ID = `20`
+
+Now you can edit a VM or create new one, set its Network Adapter to `vlan20`
+and it should get ip address from the vlan 20 dhcp pool.
+
+This is a good test if stuff works as it should before diving in to configuration
+of VLANs on switches.
+
+
+
+
+
+
+Ubiquiti Unifi - Router
+
+
+
+Disgustingly simple.
+
+Settings > Networks > New Virtual Network
+
+* set `Name`
+* turn off `Auto-Scale Network`
+* set `Gateway IP/Subnet` which sets this routers IP on that vlan
+* set `VLAN ID` = `20`
+* pick if you want guest network or isolation or disable internet access on it
+* `DHCP` set pool range
+
+
+
+# Setting up VLANs on switches
+
+There are three settings for a port:
+
+* **PVID** - applies to all untagged frames **entering**
+ the port - ingress. PVID sets vlanID, let's say to `1`
+ This connects the port with all other ports belonging to that `vlan-1`.
+* **Untagged** - similar to PVID but this setting is applied to the frames
+ **leaving** the port, leaving the switch - egress.
+ The name `untagged` is telling the whole story - the frames are leaving
+ the switch untagged, the tag is removed before they leave...
+ and the fact that the port is untagged for `vlan-1` means the port
+ is connected with all other ports belonging to that `vlan-1`.
+ Usually a port has the same `PVID` and `Untagged` number set.
+* **Tagged** - similar to `untagged`, it is about the frames **leaving**
+ the port, but this setting is saying that the frames leave with specific
+ vlan tag, expecting the device connected to this port to be vlan aware.
+ A port can have both untagged and tagged set.
+
+
+
+What happens immediately after you enable VLANs on a switch?
+
+* Everything should still work as before.
+* All ports switch to be untagged ports. So they strip any vlan tags from
+ outbound frames.
+* PVID on all ports is set to 1, so that incoming frames get tagged as vlan 1,
+ so all ports can communicate with each other.
+
+What happens next is you pick a trunk port, the one communicating with the router
+or a switch through which multiple vlan goes as set it accordingly to belong to
+all vlans.
+Then pick which ports have device that should be together and separated from the
+rest and set their vland and PVID.
+
+
+TP-Link - Switch
+
+
+
+Got [TL-SG108PE](https://www.tp-link.com/us/home-networking/8-port-switch/tl-sg108pe/)
+thats a managed switch with PoE. At the moment the situation
+is that opnsense LAN port is connected to port 7 and testing notebook
+is connected to port 6.
+
+* VLAN > 802.1Q VLAN > set port 7 as tagged and port 6 as untagged.
+* VLAN > 802.1Q PVID Setting > set port 6 with vlan tag 20
+
+Dunno what is the reason there are two settings, they say PVID is setting
+specifically to tags incoming frames that come without any tag... but I cant
+imagine a situation where one would want different number between these two.
+
+
+
+
+MikroTik - Switch
+
+
+
+
+[a vlan guide](https://forum.mikrotik.com/viewtopic.php?t=143620)
+
+* **Bridge** section is where all the settings are happening.
+ This setup is simple layer 2, no routing, not doing anything with interfaces.
+* Have a **bridge**, create a new one if you have clean config
+ Assign all the physical ports to this bridge in **Bridge > Ports**
+* Define **VLANs** in **Bridge > VLANs** that it should handle.
+ Set which ports are tagged and which untagged for that vlan
+ * untagged - **outgoing** frames are normal - access port - PCs, Printers, TVs,..
+ * tagged - **outgoing** frames are tagged - trunks - servers, gateways, wifi APs,...
+* Set **PVIDs** for the ports in **Bridge > Ports**
+ PVID is about **incoming untagged** frames entering the switch,
+ what VLAN tag should they get as they move through switch.
+ By default mikrotik switches give tag 1 to all ports.
+* After everything is configured **enable VLAN Filtering** on the bridge itself
+ **Bridge > Bridge > bridge** > VLAN section
+
+
+
+
+
+Ubiquiti Unifi - Switch
+
+
+
+
+
+
diff --git a/_knowledge-base/mounting_network_share_linux.md b/_knowledge-base/mounting_network_share_linux.md
index 287de17..828b448 100644
--- a/_knowledge-base/mounting_network_share_linux.md
+++ b/_knowledge-base/mounting_network_share_linux.md
@@ -1,63 +1,144 @@
-# Mounting Network Shares in Linux
+# Mounting at Boot Network Shares
-possible ways to mount stuff - fstab, autofs, systemd, docker volumes if its for docker
+Many ways to mount - fstab, autofs, systemd, fuse, gvfs,...
+but the current go-to is **systemd mount**.
-possible types of shares
+There are two distinct ways to mount with systemd
-* smb/samba/cifs - the most common share, support on all OS
-* nfs - mostly used between linux machines, bit better performance
-* iSCSI - the share is mounted as a block device as if it was really a disk,
- great performance for small files
+* **mount** service is enabled
+ straight up simple mounting at boot, high expectation that the network share
+ is always available during the boot, it's simple and easy to control
+ order of execution, retries, time outs, easy to debug,
+ best for servers, docker hosts,...
+* **automount** service is enabled
+ the mounting happens at the first demand to access the path,
+ does not wait during boot for the mount to really happen, less predictable,
+ can auto-umount on idle, good for users machines
-More on setup of these shares is in
-[TrueNAS Scale guide.](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/trueNASscale)
-# smb/samba/cifs
+# Samba / SMB / CIFS
[Arch wiki](https://wiki.archlinux.org/title/samba#As_systemd_unit)
on samba systemd mount
-* you will create two files in `/etc/systemd/system`
-* one will have extension `.mount` the other `.automount`
-* the name will be the same for both and it MUST correspond with the planned
- mount path. Slashes `/` being replaced by dashes `-`.
- So if the share should be at `/mnt/mirror` the files are named
- `mnt-mirror.mount` and `mnt-mirror.automount`
-* copy paste the bellow content, edit as you see fit,
- changing description, ip address and path, user and password,..
-* linux command `id` will show your current user `uid` and `gid`
-* after ther changes execute command `sudo systemctl enable mnt-mirror.automount`
- This will setup mounting that does not fail on boot if there are network issues,
- and really mounts the target only on request
+* Have `/mnt/pool` directory ready on the client - `sudo mkdir /mnt/pool`
+* will be creating a mount file in `/etc/systemd/system/`
+ the name MUST correspond with the planned mount location,
+ just slashes `/` are replaced with dashes `-`
+ So if the share should be mounted at `/mnt/pool` the file is:
+ `/etc/systemd/system/mnt-pool.mount`
+ ```ini
+ [Unit]
+ Description=Mount MergerFS Pool or Whatever
+ After=network-online.target
+ Wants=network-online.target
+ # Before=docker.service
-`mnt-mirror.mount`
-```ini
+ [Mount]
+ What=//10.0.19.80/pool
+ Where=/mnt/pool
+ Type=cifs
+ Options=rw,username=bastard,password=aaa,uid=1000,gid=1000,file_mode=0664,dir_mode=0775,vers=3,_netdev
+
+ [Install]
+ WantedBy=multi-user.target
+ ```
+* enable the mount service `sudo systemctl enable mnt-pool.mount`
+* done
+
+### Automount version
+
+If the machine is just an end user PC or a notebook,
+or no service really depends on that share being present straight from boot,
+or a notebook moves between networks and share is not always there...
+we can use automount that mounts the share only when something tries to access
+the path.
+
+* disable mount service if already enabled:
+ `sudo systemctl disable mnt-pool.mount`
+* we add another file next to the mount file, named exactly the same,
+ except the extension is `automount`, so here it would be:
+ `/etc/systemd/system/mnt-pool.automount`
+ ```ini
+ [Unit]
+ Description=Mount MergerFS Pool or Whatever
+
+ [Automount]
+ Where=/mnt/pool
+ # TimeoutIdleSec=3600 # Unmount after 1 hour idle
+
+ [Install]
+ WantedBy=multi-user.target
+ ```
+* we enable this automount service:
+ `sudo systemctl enable --now mnt-pool.automount`
+* done
+
+
+### Useful commands
+
+`smbclient -L 10.0.19.11` - list shares mounted from the ip
+`systemctl list-units -t mount --all`
+
+# NFS
+
+[Arch wiki](https://wiki.archlinux.org/title/NFS#As_systemd_unit)
+on NFS systemd mount
+
+All the stuff regarding mount vs automount from Samba section above applies,
+only the content of the systemd unit files changes.
+
+`/etc/systemd/system/mnt-pool.mount`
+```
[Unit]
-Description=3TB truenas mirror mount
+Description=Mount MergerFS Pool or Whatever
+After=network-online.target
+Wants=network-online.target
[Mount]
-What=//10.0.19.11/Mirror
-Where=/mnt/mirror
-Type=cifs
-Options=rw,username=kopia,password=aaa,file_mode=0644,dir_mode=0755,uid=1000,gid=1000
+What=10.0.19.80:/mnt/pool
+Where=/mnt/pool
+Type=nfs
+Options=vers=3
[Install]
WantedBy=multi-user.target
```
-`mnt-mirror.automount`
-```ini
+`/etc/systemd/system/mnt-pool.automount`
+```
[Unit]
-Description=3TB truenas mirror mount
+Description=AutoMount MergerFS Pool or Whatever
+Requires=network-online.target
+After=network-online.target
[Automount]
-Where=/mnt/mirror
+Where=/mnt/pool
+TimeoutIdleSec=0
[Install]
WantedBy=multi-user.target
```
-### Useful commants
-`smbclient -L 10.0.19.11` - list shares mounted from the ip
-`systemctl list-units -t mount --all`
+Enable the mount service: `sudo systemctl enable --now mnt-pool.mount`
+Or for automount `sudo systemctl enable --now mnt-pool.automount`
+
+# Windows Client
+
+### Samba - windows
+
+just mount it or map it as a letter
+
+### NFS - windows
+
+For Windows NFS clients, write access often requires `all_squash`
+with a defined anonuid/anongid, because Windows does not send linux uid/gid
+information. Something like this:
+`/mnt/pool 10.0.19.0/24(rw,async,no_subtree_check,all_squash,anonuid=1000,anongid=1000,fsid=1)`
+
+**Windows Client**
+
+* must be windows pro, not windows home
+* add windows component in the control panel - `Services for NFS` - `Client for NFS`
+* cmd, not powershell - `mount \\10.0.19.80\mnt\pool N:`
diff --git a/_knowledge-base/vlans.md b/_knowledge-base/vlans.md
index c205c98..fb174e1 100644
--- a/_knowledge-base/vlans.md
+++ b/_knowledge-base/vlans.md
@@ -4,8 +4,9 @@
### Purpose of VLANs
-Separation of a network in to smaller segments.
-This can improve securirty, ease of managment, latency in larger networks.
+Separate a network in to smaller segments.
+This can improve securirty, ease of managment,
+reduce unnecessary chatter that can congest larger networks.
### Hardware
@@ -13,13 +14,18 @@ Whats required before thinking about vlans.
* **Managed switches** as oppose to cheaper typical *"dumb switches"*,
as majority of the configuration of vlans is done on switches.
+ * **HPE/Aruba** - super reliable, easy to manage, enterprise-grade switches
+ that won't break the bank if it's just about 1gbit.
+ * **Mikrotik** or **Ubiquiti** - usually when in need of something
+ special, like 2.5gbit with some sfp+ or poe
+ * **TP-Link** - when just want something cheap, like poe switch for cameras
* A **router/firewall/gateway** device that supports vlans.
This will be the linchpin at the center, with separate settings
for each vlan - being their gateway, providing them with separate dhcp,
applying firewall rules between them,...
* **opnsense** - is what I [use](https://github.com/DoTheEvo/selfhosted-apps-docker/tree/master/opnsense),
installed as a virtual machine, but can be installed on any regular old pc,
- or a miniPC with two NICs.
+ or a miniPC with two intel NICs.
* **Ubiquiti UCG-Ultra** - solid go-to recommendation.
Reasons...
@@ -29,15 +35,14 @@ Whats required before thinking about vlans.
* full of features - vlans, wireguard VPN, cloud remote managment,
geoblocking, basic IDPS, DNS base adblocking, unifi controller for wifi APs,...
- * **Mikrotik** devices are a good pick, but their configuration can be
+ * **Mikrotik** devices are a good pick, but their configuration can be
overwhelming. I gave up and use just their switches.
-
Some basic networking knowledge is required.
-You should know about IP addresses, Mac addresses, packets, frames,
-swiches, routers, about existance of first 4 OSI layers,..
+You should know about IP addresses, Mac addresses, packets, **frames**,
+swiches, routers, about existance of the first 4 OSI layers,..
* [What is OSI Model | Real World Examples](https://youtu.be/0y6FtKsg6J4)
* [OSI Model Deep Dive](https://youtu.be/oVVlMqsLdro)
@@ -46,6 +51,7 @@ swiches, routers, about existance of first 4 OSI layers,..
lets put here also vlan stuff
+* [VLANs Explained Simply](https://youtu.be/C81pyQaJgj8)
* [vlan theory video](https://youtu.be/MmwF1oHOvmg)
* [vlan theory video2](https://youtu.be/JszGeQPTo4w)
* [vlan networkacademy](https://www.networkacademy.io/ccna/ethernet/vlan-concept)
@@ -83,13 +89,15 @@ Some aspects:
multiplies of ten - 10, 20, 30, 40, ... with the ip address pool on that VLAN
having it somewhere too.
Like vlan30 would be set as 192.168.30.0/24 or 10.30.30.0/24.
+* A **frame** can be tagged only for a **single vlan**,
+ but a port can belong to many vlans.
* Tagged frames **get dropped** if they would arrive to a regular machine,
not configured for vlans.
### The Core concept
The **absofucking essence** of VLANs is a clear understanding of two types
-of ports - untagged and tagged.
+of traffic - untagged and tagged.
@@ -120,7 +128,7 @@ of ports - untagged and tagged.
`4094`.
* **Trunk port**
A type of tagged port. The term is used for ports that carry multiple vlans,
- usually the ones connecting two switches, or a switch and a router.
+ usually the ones connecting switch with another switch or a server or a router,..
A tagged port that is not a trunk port would be for example a port that carries
just one vlan to a VoIP phone.
* **Native vlan**
@@ -140,7 +148,7 @@ the firewall for all vlans,...
#### The usual generic steps
* creating a new interface or a new network with a specific Vlan ID.
-* setting what IP address / subnet the router will have on that network.
+* setting a static IP address / subnet the router will have on that network.
* setting the dhcp pool for for that network.
* maybe enable or restrict the traffic through firewall rules
@@ -218,6 +226,25 @@ Settings > Networks > New Virtual Network
# Setting up VLANs on switches
+There are three settings for a port:
+
+* **PVID** - applies to all untagged frames **entering**
+ the port - ingress. PVID sets vlanID, let's say to `1`
+ This connects the port with all other ports belonging to that `vlan-1`.
+* **Untagged** - similar to PVID but this setting is applied to the frames
+ **leaving** the port, leaving the switch - egress.
+ The name `untagged` is telling the whole story - the frames are leaving
+ the switch untagged, the tag is removed before they leave...
+ and the fact that the port is untagged for `vlan-1` means the port
+ is connected with all other ports belonging to that `vlan-1`.
+ Usually a port has the same `PVID` and `Untagged` number set.
+* **Tagged** - similar to `untagged`, it is about the frames **leaving**
+ the port, but this setting is saying that the frames leave with specific
+ vlan tag, expecting the device connected to this port to be vlan aware.
+ A port can have both untagged and tagged set.
+
+
+
What happens immediately after you enable VLANs on a switch?
* Everything should still work as before.