Debian + Proxmox + VYOS + NAT + IPSec + IPTables = Fun

Michael Dale

I ended up writing this in pages but here is the PDF.

[Download PDF, ~800KB]

Australian Retro Computing

Michael Dale

I've created a forum for Australia Retro Computing

iSCSI for games

Michael Dale

I have a 2012 MacBook Pro with 256GB of storage. Currently I have a 50GB windows partition to play a few games.

Recently I wanted to play the new Wolfenstein game but it requires 40GB of storage!

Unfortunately I just don't have enough storage space on this laptop.

So I have a Synology DS213+ at home with a pair of 3TB drives in Raid 1, this is used for Time Machine backup and backing up my home server.

I decided to see if I could run the game off an iSCSI drive from the DS213+.

I created a standard file based iSCSI Lun (200GB of thin provisioned storage) and then attached it to my Windows 8 bootcamp install.

I then proceeded to to install Wolfenstein directly on to the new drive, I decided to connect my computer via gig ethernet as I was sure that it would be a bottleneck on wifi.

Anyway the game works great (other than the graphics card being a touch slow). In fact based on the cacti graph I think it would work fine on wifi.

After playing about 30 minutes of the game it looks to average about 2-3MB/sec. So am I actually surprised at how low I/O requirements the game needs.

Now I need to be on the local lan to play, but that doesn't matter for me and saving me from spending a bunch of money upgrading the SSD.

I suspect the DS213+ could probably cope with another machine doing a similar thing, the CPU is a bit slow so the new DS415+ would be much better (plus having 4x1GB nics).

Running JunOS 12.1X47 on first gen SRX240H

Michael Dale

So 12.1X47 just came out and no longer supports SRX devices with less than 2GB of ram.

I have a couple of spare Juniper SRX240Hs (so first gen devices with 1GB of ram) and would like to test 12.1X47 in my lab, unfortunately I don't have any 2GB ram devices in my lab.

When trying to install 12.1X47 on the SRX240H you get the following error:

Copying package ...
ERROR: Unsupported platform srx240h for 12.1X47 and higher
ERROR: validate-config: junos/+REQUIRE fails

So I decided to see if I could work around this and trick JunOS into installing on my 240H, I was successful :D

I wouldn't recommend ever using this in production, but I am sure it will work fine for the lab. The only difference between the 240H and the 240H2 is that the H2 has 2GB flash and 2GB ram, CPU is the same.

Now you can actually upgrade the ram in the SRX240H to 2GB, it just uses standard DDR2 PC ram (you just need to find a 2GB stick, I used 800MHz but 667MHz ram should work too).

First Upgrading SRX ram

Take off the SRX case and swap out the ram, easy!

Old Ram:

New Ram:

As you can see the SRX now boots with 2GB of ram:

Second modifying the installer checks

Unfortunately this isn't enough for 12.1X47 to install, the installer checks the model number not the amount of ram.

Copying package ...
ERROR: Unsupported platform srx240h for 12.1X47 and higher
ERROR: validate-config: junos/+REQUIRE fails
WARNING: Current configuration not compatible with /altroot/cf/packages/install-tmp/junos-12.1X47-D10.4-domestic

So it is time to modify junos-srxsme-12.1X47-D10.4-domestic.tgz to work on 240H devices.

I did this on Mac OS but any *nix system will work, it isn't that hard.

1. Go and download junos-srxsme-12.1X47-D10.4-domestic.tgz from Juniper.
2. Extract junos-srxsme-12.1X47-D10.4-domestic.tgz
3. Now all we need to do is edit 2 files.
   1. In the +INSTALL file: Comment out line: 889 -> Error "Unsupported platform $product_model for 12.1X47 and higher" 
   2. In the +REQUIRE file: Comment out line: 889 -> Error "Unsupported platform $product_model for 12.1X47 and higher" 
      To comment out just add a # at the start of the line.
4. Now we need to tar this back into a tgz file.
   1. So from the command line cd into the unzipped folder
   2. Now tar gz everything: tar czf ../junos-srxsme-12.1X47-D10.4-domestic-fixed.tgz *
   3. Once done I changed junos-srxsme-12.1X47-D10.4-domestic-fixed.tgz back to junos-srxsme-12.1X47-D10.4-domestic.tgz, not sure if that matters.
5. Now you can install like any normal firmware upgrade: root> request system software add http://xxx/junos/junos-srxsme-12.1X47-D10.4-domestic.tgz reboot

Done!

Now this process still leaves the SRX 240H with only 1GB of flash, but even with a dual root partition there is still 100M+ free space on the primary mount point.

That should be fine for now, you might need to use external logging or a usb flash drive in future though.

I am interested to know if this process works on 1GB ram devices, as these changes might allow JunOS X47 it install on them. Although I would recommend 2GB ram. 

JunOS 12.1X47, first gen SRX devices are no longer supported

Michael Dale

ERROR: Unsupported platform srx210h for 12.1X47 and higher

This is the error that you will get if you try and install 12.1X47 on a Juniper SRX 210H (or 100B, 100H or any "first gen" srx).

From reading:

http://www.juniper.net/techpubs/en_US/junos12.1x47/information-products/topic-collections/release-notes/12.1x47/index.html?topic-87511.html

"Note: Upgrading to Junos OS Release 12.1X47-D10 or later is not supported on the J Series devices or on the low-memory versions of the SRX100 and SRX200 lines."

I thought maybe it would just be the base memory devices e.g SRX100B or SRX210B but it looks like any SRX device with 512MB or 1GB ram are not supported.

This is a shame as for example the SRX110H devices weren't that old and supported removable/upgradable CF cards. Even the SRX240B2 is not supported! You need 2GB of ram.

The ASA5505 is good example of a device designed to last. Pity I like JunOS so much!

I have a couple of SRX240Hs, these allow you to upgrade the ram (standard DDR2), so I wonder if an upgraded 240H will work.

DN42

Michael Dale

Now connected to DN42.net!

Happy to peer if anyone else wants to connect. Currently running vyos and can do OpenVPN or IPsec+Gre.

Based in Sydney.

Networking Lab

Michael Dale

 My current networking lab setup for testing a new network design including OSPF, BGP & IPsec route based VPNs.

From top to bottom:

• The imposter, a Ubiquiti EdgeRouter Lite!
• Juniper SSG 5 (extended license )
• Juniper SRX 100 (base memory )
• Juniper SSG 20 (not currently being used)
• Juniper SRX 110H (older 1GB ram model)
• Juniper SRX 210H-POE (pretty old slow beast with 1GB ram and a lowly 400MHz CPU). I still run a standard 210H at home, one day I'll get the 210H2....

Debian 7

Michael Dale

Yay Debian 7 is out.

Nothing too major to report, I've only updated one VM at this stage (was very easy).

PHP 5.4 is nice to have. I'll be rolling out a number of upgrades and new VMs with it in the coming weeks so I'll see how it goes.

For servers (PHP Web Servers, MySQL, DNS, Subversion etc) Debian is my current favourite OS. It is so easy to manage and upgrade.

My current break down of operating systems is:

• Mac OS for desktop/laptop
• ESXi for VMs (actually running Hyper-V at home)
• Debian for most servers (where the software doesn't require windows).
• Windows 2008 R2 & SBS 2011 for small business servers, terminal servers & required apps
• Windows 7/8 for business workstations
• FreeBSD for ZFS storage. Although I really need to see if I can do Debian + ZFS as I really like Debian.

103.24.132.0/23 & 2406:bf00::/32

Michael Dale

Future home.

New Server

Michael Dale

We're about to replace (or add not sure yet) a server in the data centre.

The previous servers are 1RU ASUS Quad Xeons with 16GB Ram (photo). They were okay for the price but pretty cheap machines.

The new one is a Dell *shock*

• Dell R420 (still 1RU)
• Dual PSU
• 32GB Ram (supports up to 384GB, yeah my old computer had 384MB of ram)
• 2x Hex Core Xeon with HT (so 24 logical cores). 15MB of L3 cache on each chip!
• Space for 8 2.5" HDDs.
• H710P 1GB Raid Controller (will be using Raid 10).
• iDrac 7 Enterprise (this is pretty cool compared to the very basic system in the ASUS).

Just doing some final testing and waiting for Debian 7 before I install it. This plus the new subnets should make the setup pretty sweet.