Add section summary pages and make single-link admonitions clickable
This commit is contained in:
Djeex
@@ -0,0 +1,2 @@
|
||||
title: Networking
|
||||
icon: i-lucide-network
|
||||
@@ -0,0 +1,71 @@
|
||||
---
|
||||
title: NAT & DHCP
|
||||
description: Learn how NAT, port forwarding, and DHCP work on a home router. Configure fixed IP leases and understand how to expose local services.
|
||||
---
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
|
||||
|
||||
|
||||
|
||||
## What is a "port"?
|
||||
|
||||
Ports are different channels through which your router sends and receives data. This allows multiple services to run simultaneously.
|
||||
When it receives data through a port, your router forwards that data to the machine that:
|
||||
|
||||
- either initiated the request,
|
||||
- or is configured to receive data on a specific port.
|
||||
|
||||
Your router has over 65,000 ports available.
|
||||
|
||||
Some programs and applications are designed to use specific ports. For example, when your network sends data from an HTML page, the router receives it through port 80 (non-secure) or port `443` (secure via SSL).
|
||||
|
||||
So, your router acts as a data dispatcher between the internet and your local machines.
|
||||
|
||||
## Port Forwarding
|
||||
|
||||
Forwarding a `port` means setting a rule that specifies which `source` can send data to which `port` on your router, which will then forward it to a specific `port` on a specific `machine`. The `sources` and `destination machine` are identified by their IP addresses.
|
||||
|
||||
| Variable | Description | Example |
|
||||
|------------------------|---------------------------------------------------------|-------------------------|
|
||||
| `source machine` | IP of the source machine (from the internet) | `All`<br>`123.45.67.89` |
|
||||
| `source port` | Incoming port on the router | `443` |
|
||||
| `destination port` | Port on the destination machine | `3000` |
|
||||
| `destination machine` | IP of the target machine (on your local network) | `192.168.1.50` |
|
||||
|
||||
According to the table:
|
||||
If we remove `All` and keep the IP `123.45.67.89`, all traffic from this IP sent to port `443` on your router will be forwarded to port `3000` on the local IP `192.168.1.50`.
|
||||
|
||||
If we remove the IP and keep `All`, then all traffic from the internet on port `443` will be redirected to port `3000` on `192.168.1.50`.
|
||||
|
||||
This is useful when you have a server that must be accessible from the internet. For instance, a website uses port `80` (non-secure) or `443` (SSL-secured).
|
||||
To make the website accessible, you'll configure your router to redirect the domain request to your local server.
|
||||
Assume your service runs on port `3000` locally (`http://192.168.1.50:3000`), you would redirect all traffic from port `443` on the router to port `3000` on the local server.
|
||||
|
||||
::warning{to="/serveex/core/swag"}
|
||||
|
||||
__Warning:__ If you have multiple services to expose like `subdomain1.mydomain.com` and `subdomain2.mydomain.com`, your router cannot differentiate requests and forward to different ports.
|
||||
You must use a **Reverse Proxy** to route traffic based on the request.
|
||||
::
|
||||
|
||||
## DHCP
|
||||
|
||||
Every time a device connects to your local network, your router assigns it an IP address using DHCP rules.
|
||||
This IP is randomly selected from a predefined pool.
|
||||
At every device reboot, the IP may change, which is problematic if you're forwarding ports, as the target IP may no longer be valid.
|
||||
|
||||
To avoid this, use your router's DHCP server to assign a static IP address.
|
||||
|
||||
Each device has a physical "MAC address".
|
||||
To assign a fixed IP, you must know your device's MAC address (visible in your router when it's connected), and assign it a static IP.
|
||||
This is called a "static DHCP lease."
|
||||
|
||||
That way, your machine's IP never changes and your port forwarding rules remain effective.
|
||||
|
||||
| Variable | Description | Example |
|
||||
|---------------|----------------------------------|---------------------|
|
||||
| `IP` | Fixed local IP to assign | `192.168.1.50` |
|
||||
| `MAC Address` | Physical address of the device | `5E:FF:56:A2:AF:15` |
|
||||
|
||||
For more information, refer to your router's documentation.
|
||||
@@ -0,0 +1,58 @@
|
||||
---
|
||||
title: DNS Zone
|
||||
description: Understand how DNS works, how to read and edit a DNS zone, and how to configure domain names for your self-hosted services.
|
||||
---
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
|
||||
## Introduction
|
||||
|
||||
When you browse a website or use an app, requests are made to one or more domains to fetch content for the page. Your device doesn't know the IP addresses of these servers, so it contacts a _name server_ (Domain Name Server), which responds with the most up-to-date IP address for the domain being requested.
|
||||
|
||||
The DNS zone is like a registry with signposts that direct your requests to the correct destination.
|
||||
|
||||
|
||||
|
||||
## The DNS Zone
|
||||
|
||||
When you purchase a domain from a registrar (Cloudflare, OVH, etc.), the registrar assigns you a DNS zone that you can customize.
|
||||
|
||||
You can enter _records_ into this DNS zone to direct requests properly. You can find [more information here](https://help.ovhcloud.com/csm/fr-dns-servers-general-information?id=kb_article_view&sysparm_article=KB0051661).
|
||||
|
||||
Example of a DNS zone for the domain `mydomain.com`:
|
||||
|
||||
```
|
||||
@ IN SOA ns1.dns.me. dns.net. (2024051800 86400 3600 3600000 60)
|
||||
IN NS ns1.dns.me.
|
||||
IN NS ns2.dns.me.
|
||||
IN A 203.0.113.0
|
||||
www IN CNAME mydomain.com
|
||||
sousdomaine IN CNAME mydomain.com
|
||||
```
|
||||
|
||||
In this example:
|
||||
|
||||
- `$TTL 3600` tells global name servers that the records are valid for 1 hour (after which they need to re-check).
|
||||
- `IN SOA ns1.dns.me. dns.net. (...)` indicates `ns1.dns.me` as the primary DNS server, with refresh intervals.
|
||||
- `IN NS` records define the authoritative name servers for the domain.
|
||||
- `IN A 203.0.113.0` means `mydomain.com` points to IP `203.0.113.0`.
|
||||
- `subdomain IN CNAME mydomain.com` means `subdomain.mydomain.com` points to the same destination as `mydomain.com`.
|
||||
|
||||
So, if you want to point `mydomain.com` to your server, you can do it by adding an `A` record pointing to your server's public IP address.
|
||||
|
||||
::warning
|
||||
|
||||
__Warning:__ If your server is hosted at home:
|
||||
- Your public IP is the one assigned to your home router. Make sure it's static, or configure [DDNS](https://aws.amazon.com/fr/what-is/dynamic-dns/).
|
||||
- Make sure you've [set up port 443 forwarding to your server's listening port](/general/networking/nat).
|
||||
::
|
||||
|
||||
If you're adding a subdomain that should also point to your server, use a `CNAME` record pointing to `mydomain.com`.
|
||||
|
||||
::note
|
||||
|
||||
__Why not use an `A` record for the subdomain?__ If your subdomain points to the same server as `mydomain.com`, it's better to use a `CNAME` record because if the server's IP changes, you won’t need to update the subdomain record.
|
||||
::
|
||||
|
||||
Most registrars offer user-friendly interfaces to manage DNS records. Refer to your registrar’s documentation for specific instructions.
|
||||
@@ -0,0 +1,225 @@
|
||||
---
|
||||
title: Samba
|
||||
description: Set up Samba on Debian to share folders over your local network and access them from Windows, macOS, or Linux.
|
||||
---
|
||||
|
||||
|
||||
:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}
|
||||
|
||||
Samba is a protocol that allows access to a folder located on a network drive. It can be configured on macOS, Windows, or Linux.
|
||||
|
||||
There are many tutorials for setting up Samba on Windows or on NAS systems like Synology, but here we focus on Debian.
|
||||
|
||||
|
||||
|
||||
## Create and configure a Shared Network Folder
|
||||
::note
|
||||
|
||||
In this example, we will share the `/video` folder from a remote machine called `remote-machine`. We will access this folder from a machine called `local-machine`. The user connecting to the network drive will be `sambauser`.
|
||||
::
|
||||
|
||||
::steps{level="3"}
|
||||
### Install Samba Server
|
||||
|
||||
```bash [Terminal]
|
||||
sudo apt update && sudo apt upgrade
|
||||
sudo apt install samba smbclient cifs-utils
|
||||
```
|
||||
|
||||
### Create the `/video` Folder
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mkdir /video
|
||||
```
|
||||
|
||||
### Configure the Share
|
||||
|
||||
Now, edit the file `/etc/samba/smb.conf`.
|
||||
|
||||
```bash [Terminal]
|
||||
sudo nano /etc/samba/smb.conf
|
||||
```
|
||||
|
||||
::tip{icon="" to="/serveex/files/file-browser-quantum"}
|
||||
✨ __Tip:__ You can use **File Browser Quantum** to navigate and edit your files instead of using terminal commands.
|
||||
::
|
||||
|
||||
Find the `workgroup` variable and name your workgroup (e.g., `workgroup = WORKGROUP`).
|
||||
|
||||
Then scroll to the end of the file and add the following configuration:
|
||||
|
||||
```properties [smb.conf]
|
||||
[video]
|
||||
comment = Video folder
|
||||
path = /video
|
||||
writable = yes
|
||||
guest ok = no
|
||||
valid users = @smbshare
|
||||
force create mode = 770
|
||||
force directory mode = 770
|
||||
inherit permissions = yes
|
||||
```
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
### Done !
|
||||
::
|
||||
|
||||
### Create a Samba User and Group
|
||||
|
||||
Since we're using a secured share, we need to create a user and group to access it remotely.
|
||||
|
||||
::steps{level="3"}
|
||||
### Create the group
|
||||
|
||||
```bash [Terminal]
|
||||
sudo groupadd smbshare
|
||||
```
|
||||
|
||||
Give the group control over the `/video` folder:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo chgrp -R smbshare /video
|
||||
```
|
||||
|
||||
Set inherited permissions:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo chmod 2775 /video
|
||||
```
|
||||
### Create the user
|
||||
|
||||
Now add a no-login user: this user cannot log into the server but can access Samba.
|
||||
|
||||
```bash [Terminal]
|
||||
sudo useradd -M -s /sbin/nologin sambauser
|
||||
```
|
||||
|
||||
Add the user to the `smbshare` group:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo usermod -aG smbshare sambauser
|
||||
```
|
||||
|
||||
Set a Samba password:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo smbpasswd -a sambauser
|
||||
```
|
||||
|
||||
### Enable the Samba account
|
||||
|
||||
```bash [Terminal]
|
||||
sudo smbpasswd -e sambauser
|
||||
```
|
||||
### Done !
|
||||
::
|
||||
|
||||
## Accessing a Shared Folder
|
||||
|
||||
::steps{level="3"}
|
||||
### Install Required Packages
|
||||
|
||||
```bash [Terminal]
|
||||
sudo apt update && sudo apt upgrade
|
||||
sudo apt install cifs-utils
|
||||
```
|
||||
|
||||
### Create the Mount Destination
|
||||
|
||||
We will create a folder on our local machine where the remote `/video` folder will be mounted, e.g. `/mnt/video`.
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mkdir /mnt/video
|
||||
```
|
||||
|
||||
### Prepare the .credentials File
|
||||
|
||||
To avoid typing our username and password every time, create a `.credentials` file storing the login info.
|
||||
|
||||
Create it in the `/smb` folder:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mkdir /smb
|
||||
sudo nano /smb/.credentials
|
||||
```
|
||||
|
||||
Write:
|
||||
|
||||
```properties [.credentials]
|
||||
username=smbuser
|
||||
password=password
|
||||
```
|
||||
|
||||
* `smbuser`: the user we created on the `remote-machine`
|
||||
* `password`: the password set earlier
|
||||
|
||||
Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.
|
||||
|
||||
Set proper file permissions:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo chmod 600 /smb/.credentials
|
||||
```
|
||||
|
||||
### Mount the Shared Folder
|
||||
::warning
|
||||
__Warning:__ If you're using ufw as firewall, you need to add a rule to allow your remote server to access to your share.
|
||||
```bash [Terminal]
|
||||
sudo ufw allow from <your-remote-ip> to any app Samba
|
||||
```
|
||||
::
|
||||
Now mount the folder:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mount -t cifs -o credentials=/smb/.credentials //remote-ip/video /mnt/video
|
||||
```
|
||||
|
||||
Replace `remote-ip` with your `remote-machine`'s IP address.
|
||||
|
||||
Verify the mount:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mount -t cifs
|
||||
```
|
||||
|
||||
You’ll see details confirming the mount is successful.
|
||||
|
||||
Now you can access the `/video` folder of the `remote-machine` from your `local-machine`!
|
||||
|
||||
### (Optional) Auto-mount on Boot
|
||||
|
||||
By default, shares aren't auto-mounted after reboot. To automate this, edit the `/etc/fstab` file.
|
||||
|
||||
First, back it up:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo cp /etc/fstab /etc/fstab.bak
|
||||
```
|
||||
|
||||
Then add the mount configuration line:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo echo //remote-ip/video /mnt/video cifs _netdev,nofail,credentials=/smb/.credentials,x-systemd.automount,x-systemd.device-timeout=15 0 0 >> /etc/fstab
|
||||
```
|
||||
|
||||
Reboot the machine:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo reboot
|
||||
```
|
||||
|
||||
After rebooting, verify the mount:
|
||||
|
||||
```bash [Terminal]
|
||||
sudo mount -t cifs
|
||||
```
|
||||
### And done!
|
||||
::
|
||||
|
||||
::tip
|
||||
__Unmount the Shared Folder__
|
||||
|
||||
```bash [Terminal]
|
||||
sudo umount -t cifs /mnt/video
|
||||
```
|
||||
::
|
||||
Reference in New Issue
Block a user