Kliment Andreev

AWS: Web Servers in HA config behind Application Load Balancer and Web Application Firewall (WAF)

klimenta — Wed, 10 Aug 2022 21:02:31 +0000

As the title says, I’ll create two web servers in a private subnet, put an Application Load Balancer in front and protect the content with Web Application Firewall (WAF). In addition, I’ll create a bastion host so I can access the web servers using SSH. Web Servers are not reachable from the Internet.

Elastic IP

First thing to do is to create an Elastic IP for the NAT gateway. NAT gateway is needed if you want to give the Web Servers Internet access so they can be patched. Go to Elastic IPs under Network & Security in EC2 menu and click on Allocate Elastic IP address in the top right corner. Accept the defaults and click Allocate.

VPC

We’ll create a VPC with two public and two private subnets. Minimum two public subnets are needed for the Application Load Balancer. You can’t create an ALB with one public subnet.

This is just a sample. The original blog post is here.

Azure: Migrate VMware VMs and physical servers using Azure Migrate: Server Assessment and Server Migration

klimenta — Mon, 06 Jun 2016 11:27:56 +0000

If you have some on-prem workloads (either virtual or physical servers) and you want to migrate them to Azure, this post might be for you. I’ll describe how to migrate these servers in Azure using Azure Migrate and Azure Site Recovery. These tools (actual VMs) will have to be installed in your on-prem environment and they’ll do the heavy lifting for you. Before I begin, there are some pre-requisites. You’ll need a valid Azure subscription, supported VMware vCenter (v5.5 and above) and resources to install two VMs. On my ESXi host, using thin provisioned storage, I needed 8 CPUs, 32GB RAM and 20GB-80GB thin provisioned storage for Azure Migrate: Server Assessment and 8CPUs, 32GB RAM and 40GB disk for Azure Migrate: Server Migration tool. It will take much more space if you have a lots of VMs. I have about 15. You’ll also need a VNET(s) and subnet(s) where you’ll migrate the VMs.
I’ll configure that first. I’ll give you an example of how to migrate a two-tier Windows application (web server + MS SQL server) and a WordPress server running on two CentOS 7 servers.

Azure VNET/subnet

Log to your Azure subscription and create a resource group for the migration. I’ll name mine rgMigration.

Then create a new VNET and a subnet where you’ll migrate your VMs. You can use the same subnets as on-prem but only if you don’t have a ExpressRoute or VPN between on-prem and Azure. In my case, I have a VPN between my home-lab and Azure, so I have to choose a different subnet. I named my VNET vnetMigration and the subnet subServers.

Azure Migrate

Once completed, in the Azure portal in the middle upper search field, start typing migrate and select Azure Migrate.

You’ll be presented with different options to migrate data, SQL, servers etc. Choose this one that says migrate servers.

Click on Add tool(s).

You’ll be prompted to choose the subscription, the resource group, name the project and choose the region. Use whatever suits your needs and click Next.

This is just a sample. The original post is here.

pfSense: Mobile VPN clients (Windows 10, iPhone, Ubuntu Linux, Mac OS X, Android, Linux CLI and FreeBSD)

klimenta — Mon, 06 Jun 2016 11:27:49 +0000

Lately, I was playing with pfSense trying to access my internal resources from outside (mostly my Plex server) so I made this tutorial on how to access my home network. I’ve used the official howto from pfSense, but it’s a little bit outdated and it doesn’t cover Linux/FreeBSD non-GUI, so there are some changes that I’ve made. I’ll be using IPsec IKEv2 AES256/SHA256/MSChapV2/DH14 on the pfSense side (strongSwan IPsec implementation) and the clients will use various VPN clients.
There are a lot of different versions of VPN IPsec implementation, so even the slightest updates can make the VPN fail. I’ll write the version of the server/client for each configuration, so you’ll know that it works. If you are using different versions of the OS or the client, it might not work. I will use only one pfSense config for all mobile clients. Unfortunately, pfSense does not support multiple mobile clients configs as of 2.4.2.
How this works? Each client will receive a certificate and a username and a password. The certificate is the same for all clients, but the username/password is not.

pfSense 2.4.2

In order for the VPN config to work we’ll need a Certificate Authority (CA) and a server certificate. If you have them already, then you can skip the following three parts, if not, I’ll show you how to create them.

pfSense FQDN

Check your FQDN first under System | General Setup. This is what I have as FQDN and I’ll use this FQDN later in my certificate and in my client’s config.

pfSense CA (Certificate Authority)

From the pfSense menu go to System | Cert. Manager. Click on Add and then you can choose to Import an existing Certificate Authority or Create an internal Certificate Authority. In my home lab I already have an existing CA (see this link on how to create your own CA), but for this post, I’ll create a new CA. Enter a Descriptive Name for the CA and choose to Create an internal Certificate Authority.

Under the Internal Certificate Authority section , fill out the values that suit your home/lab/company. In my case, I used 2048 for Key length (bits) and sha256 for Digest Algorithm. Enter the Lifetime of the CA, I used 3650 days which is 10 years and fill out the rest of the form. Make sure to use your FQDN for the Common Name. For example, my pfSense box has an external IP assigned to the WAN interface which is 1.2.3.4. Also, somewhere in my DNS, I resolve this IP to mysweethome.mysweetdomain.com. You have to put mysweethome.mysweetdomain.com for Common Name.

This is just a sample. The original post is here.