Snarf/SnarfCode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
ffc9ab8ab0d996942527d66cbd82bad770132e1e
SnarfCode/docs/DNS_Setup_Plan.md

9.8 KiB
Raw Blame History

Project Blueprint: High-Availability DNS Stack, Network Honeypot & UDM Pro Network Security

1. Executive Summary & Live UDM Pro Topology Assessment

Based on the live UDM Pro controller diagnostics, we have mapped the exact network topography, identified critical security exposures, and tailored the implementation plan.

1.1 Live Network & VLAN Topography

VLAN ID Network Name Subnet / CIDR Gateway IP Active Leases Security Classification
1 LAN 14.44.4.0/25 14.44.4.1 14 / 117 Trusted Internal Clients
2 Management 140.44.44.0/24 140.44.44.1 9 / 51 Out-of-band (iDRAC, Switches, APs)
3 Spacedock 140.44.1.0/24 140.44.1.1 0 / 249 Harvester VM / Hypervisor Tenant
20 Compute 140.44.4.0/25 140.44.4.1 1 / 15 (Static Nodes) Mission-Critical K3s Clusters, Swarm
30 Media 192.168.1.0/25 192.168.1.1 1 / 91 Streaming & Entertainment Devices
40 Storage 14.10.10.0/25 14.10.10.1 2 / 125 Synology NAS (.71, .72) NFS / iSCSI
50 Smart Home 14.4.4.0/25 14.4.4.1 53 / 85 IoT Devices, Gaming Host (14.4.4.15)
60 HA 140.4.4.0/25 140.4.4.1 0 / 7 High-Availability Interconnects
VPN WireGuard / Teleport 192.168.3.0/24 / .2.0/24 UDM Pro Remote Ingress Remote Access

1.2 Critical Security Findings from UDM Pro Diagnostics

  1. Default Security Posture is Allow All:
    • Currently, the UDM Pro routes traffic freely between all subnets without restriction.
    • Risk: The 53 IoT devices in Smart Home (14.4.4.0/25) and Media devices can directly initiate connections to Kubernetes nodes, etcd ports, SSH, and Synology NAS shares in Compute (140.44.4.0/25) and Storage (14.10.10.0/25).
  2. WAN Port Forwarding to Smart Home Host (14.4.4.15):
    • Port forwards for game servers (FS25 ports 8443/10823, Stationeers ports 6443/27015) point directly from WAN (174.106.252.96) to host 14.4.4.15 on the Smart Home VLAN.
    • If an exploit compromises this host, an attacker currently has unhindered lateral access to the entire homelab infrastructure.
  3. DNS Leaks & Lack of Local Filtering:
    • UDM Pro WAN is set to Auto DNS Server (Spectrum ISP DNS 0.0.0.0).
    • No DNS ad/malware filtering or split-horizon DNS caching is currently active across the subnets.

2. High-Availability DNS Stack (Pi-hole + Technitium)

flowchart TD
    subgraph Clients["LAN Clients across all VLANs (VLAN 1, 20, 30, 50, VPN)"]
        Devices["IoT Devices (53), Laptops, Servers, Hypervisors"]
    end

    subgraph UDM["UniFi Dream Machine Pro (140.44.4.1)"]
        DHCP["DHCP Option 6 per VLAN:<br>Primary DNS: 140.44.4.35 (Aerodrome VIP)<br>Secondary DNS: 140.44.4.65 (Spaceport VIP)"]
        NAT["DNS Redirection Rule:<br>Capture port 53 to hardcoded DNS (8.8.8.8) -> Redirect to VIPs"]
    end

    subgraph AeroCluster["Aerodrome K3s Cluster (VLAN 20)"]
        AeroVIP["MetalLB VIP: 140.44.4.35:53 (UDP/TCP)"]
        AeroPihole["Pi-hole Instance 1<br>(Ad-blocking, Caching, FTL rate-limit: 0)"]
        AeroTech["Technitium Instance 1 (Primary Authoritative)<br>(snarfnet.net Zone, Reverse PTR, DNSSEC)"]
        AeroStorage["Longhorn Storage Volume"]
    end

    subgraph SpaceCluster["Spaceport K3s Cluster (VLAN 20)"]
        SpaceVIP["MetalLB VIP: 140.44.4.65:53 (UDP/TCP)"]
        SpacePihole["Pi-hole Instance 2<br>(Ad-blocking, Caching, FTL rate-limit: 0)"]
        SpaceTech["Technitium Instance 2 (Secondary Authoritative)<br>(Zone Transfer AXFR/IXFR from Primary)"]
        SpaceStorage["Longhorn Storage Volume"]
    end

    subgraph Upstream["Encrypted Upstream Resolvers"]
        DoH["DNS-over-HTTPS (Quad9 / Cloudflare / Mullvad)"]
    end

    Devices -->|DNS Queries (UDP/TCP 53)| DHCP
    DHCP -->|Primary| AeroVIP
    DHCP -.->|Secondary / Failover| SpaceVIP
    AeroVIP --> AeroPihole
    SpaceVIP --> SpacePihole
    AeroPihole -->|Recursive / Local Lookups| AeroTech
    SpacePihole -->|Recursive / Local Lookups| SpaceTech
    AeroTech <==>|Automatic Zone Sync (AXFR)| SpaceTech
    AeroTech -->|Encrypted DoH| DoH
    SpaceTech -->|Encrypted DoH| DoH
    AeroPihole --- AeroStorage
    AeroTech --- AeroStorage
    SpacePihole --- SpaceStorage
    SpaceTech --- SpaceStorage

2.1 Addressing the Rate-Limiting & Sluggishness Issue

  1. FTL Rate Limit Bypass: Set FTLCONF_RATE_LIMIT=0 so local bursts (such as 53 Smart Home devices polling simultaneously) are never throttled.
  2. Technitium Engine: Replaces single-threaded Unbound with a high-performance .NET 9 asynchronous resolver capable of servicing tens of thousands of queries per second with sub-millisecond RAM caching.
  3. High Availability: MetalLB VIPs on Aerodrome (140.44.4.35) and Spaceport (140.44.4.65) allow continuous service even during node reboots or maintenance.
  4. Authoritative Split-Horizon: Technitium will authoritatively host the internal snarfnet.net forward zone and reverse PTR zones (4.44.140.in-addr.arpa, 4.4.14.in-addr.arpa, 10.10.14.in-addr.arpa), eliminating slow mDNS or external lookup delays.

3. Network Honeypot & UDM Pro Firewall Hardening

flowchart LR
    subgraph WAN_Threats["External & Lateral Threats"]
        Internet["Public Internet"]
        CompromisedIoT["Compromised IoT / Host (e.g. 14.4.4.15)"]
    end

    subgraph UDM_FW["UDM Pro Firewall Rules (LAN IN)"]
        Rule1["Rule 1: Allow Established & Related"]
        Rule2["Rule 2: Allow DNS (Port 53 to .35 & .65)"]
        Rule3["Rule 3: Allow NTP (Port 123 to .11 & .44)"]
        Rule4["Rule 4: Drop IoT -> Compute (VLAN 50 -> 20)"]
        Rule5["Rule 5: Drop IoT -> Storage (VLAN 50 -> 40)"]
        Rule6["Rule 6: Drop Media -> Compute (VLAN 30 -> 20)"]
    end

    subgraph HoneypotNet["Honeypot Decoy (VLAN 50 / Decoy IP 14.4.4.99)"]
        OpenCanary["OpenCanary Honeypot<br>(Simulating SSH:22, HTTP:80, SMB:445, RDP:3389)"]
    end

    subgraph AlertSystem["Alerting & Audit Pipeline"]
        Gotify["Gotify Push Notification<br>(Instant alert to your phone)"]
        Zabbix["Zabbix Security Audit Log"]
    end

    CompromisedIoT -.->|Probes decoy IP| OpenCanary
    OpenCanary -->|High Priority Webhook| Gotify
    OpenCanary -->|Syslog Event| Zabbix
    CompromisedIoT -->|Blocked by Rule 4| UDM_FW

3.1 Network Honeypot Deployment

  • Tool: OpenCanary (lightweight, zero false-positives).
  • Placement:
    • Assigned a decoy IP on the Smart Home subnet (e.g., 14.4.4.99) where the gaming port forwards exist.
    • Emulates vulnerable services: SSH (22), Telnet (23), Web admin (80/8080), SMB (445), and RDP (3389).
  • Alerting:
    • When any internal device attempts a port scan or lateral connection to 14.4.4.99, OpenCanary immediately sends a critical push notification to Gotify (gotify.snarfnet.net) and generates an alert in Zabbix.

3.2 UDM Pro Firewall Rules Matrix (LAN IN)

We will define firewall groups on the UDM Pro:

  • RFC1918_Subnets: All internal private ranges (140.44.0.0/16, 14.0.0.0/8, 192.168.0.0/16).
  • K8s_DNS_VIPs: 140.44.4.35, 140.44.4.65.
  • NTP_Servers: 140.44.4.11, 14.4.4.44.
Order Rule Name Type Source Destination Action Purpose
2001 Allow Established/Related LAN IN Any Any (State: Established, Related) ACCEPT Essential return traffic
2002 Allow Cluster DNS LAN IN All VLANs K8s_DNS_VIPs (Port: 53 UDP/TCP) ACCEPT Clients resolve DNS
2003 Allow Cluster NTP LAN IN All VLANs NTP_Servers (Port: 123 UDP) ACCEPT Chrony time sync
2004 Allow Trusted to All LAN IN VLAN 1 (LAN), VLAN 20 (Compute) RFC1918_Subnets ACCEPT Admins & servers access all VLANs
2005 Isolate SmartHome to Compute LAN IN VLAN 50 (Smart Home) VLAN 20 (Compute) DROP Block IoT pivoting into K8s
2006 Isolate SmartHome to Storage LAN IN VLAN 50 (Smart Home) VLAN 40 (Storage) DROP Protect Synology NAS from IoT
2007 Isolate Media to Compute LAN IN VLAN 30 (Media) VLAN 20 (Compute) DROP Block media devices from cluster
2008 Isolate Guest Network GUEST IN Guest Network RFC1918_Subnets DROP Restrict guest traffic to Internet only

4. Phased Implementation Roadmap

Phase 1: Teardown Lingering Stubs

  • Cleanly delete orphaned, broken deployments and services in infra (Aerodrome) and infrastructure (Spaceport):
    • Remove deployment/pihole, deployment/technitium-dns, and non-functional NodePort services.

Phase 2: Deploy Dual-Cluster Pi-hole + Technitium

  • Create Longhorn storage volumes on both clusters for persistent configs and blocklists.
  • Deploy Aerodrome Primary Stack:
    • Technitium on internal port 5353.
    • Pi-hole with MetalLB LoadBalancer VIP 140.44.4.35:53 (UDP & TCP).
  • Deploy Spaceport Secondary Stack:
    • Technitium on internal port 5353 configured for AXFR zone transfers from Aerodrome.
    • Pi-hole with MetalLB LoadBalancer VIP 140.44.4.65:53 (UDP & TCP).
  • Populate snarfnet.net local records and reverse PTR zones.

Phase 3: Network Honeypot Deployment

  • Deploy containerized OpenCanary with virtual listener on 14.4.4.99.
  • Configure webhook bridge to Gotify server (140.44.4.70) for immediate push notification upon any probe.

Phase 4: UDM Pro Network Configuration & Policy Hardening

  • Configure DHCP Scope DNS servers on UDM Pro for all VLANs:
    • Primary: 140.44.4.35
    • Secondary: 140.44.4.65
  • Set UDM Pro WAN DNS to 140.44.4.35 & 140.44.4.65 (or Quad9 fallback).
  • Apply LAN IN firewall rule matrix on UDM Pro to enforce strict VLAN isolation.
Reference in New Issue View Git Blame Copy Permalink