Experience with fresh Nethserver-Installation

Support
1

**NethServer Version:**NethServer release 7.7.1908 (final)
*Kernel Release: 3.10.0-1062.12.1.el7.x86_64
Module: Basic- System

  1. Installation Process: no incidents
  2. Update: no incients
  3. Network Configuration: no incidents
    • enp2s0 (RED): CIDR 192.168.2.5/24 | GW 192.168.2.1
    • enp3s0 (GREEN): CIDR 192.168.3.1/24
  4. Configuration DHCP-Server: no incidents
    • DHCP-Range: 192.168.3.1-192.168.3.254
    • IP-Reservations for all Clients form 192.168.3.10 - 192.168.3.99
    • Gateway 192.168.3.1
    • DNS-Server. 192.168.3.1
    • Lease time: 900
    • Domain: lan.home
  5. global DNS-Forwarder: 8.8.8.8
  6. host name: nethserver2.lan.home
Full System-Information

System: Host: nethserver2.lan.home Kernel: 3.10.0-1062.12.1.el7.x86_64 x86_64 bits: 64 compiler: gcc v: 4.8.5
Console: tty 0 dm: N/A Distro: CentOS Linux release 7.7.1908 (Core)
Machine: Type: Desktop Mobo: NA model: ZBOX-CI327NANO-GS-01 serial: N/A UEFI: American Megatrends v: 5.12 date: 04/26/2018
Memory: RAM: total: 7.65 GiB used: 418.8 MiB (5.3%)
Array-1: capacity: 16 GiB slots: 2 EC: None max module size: 8 GiB note: est.
Device-1: ChannelA-DIMM0 size: 4 GiB speed: 1600 MT/s type: DDR3 detail: synchronous bus width: 64 bits
total: 64 bits manufacturer: Unde part-no: CT51264BF160BJ.M8F serial: E0A025CE
Device-2: ChannelA-DIMM1 size: 4 GiB speed: 1600 MT/s type: DDR3 detail: synchronous bus width: 64 bits
total: 64 bits manufacturer: Unde part-no: CT51264BF160BJ.M8F serial: E0A025D6
CPU: Topology: Quad Core model: Intel Celeron N3450 bits: 64 type: MCP arch: Goldmont rev: 9 L1 cache: 224 KiB
L2 cache: 1024 KiB bogomips: 8755
Speed: 800 MHz min/max: 800/2200 MHz Core speeds (MHz): 1: 800 2: 800 3: 909 4: 800
Flags: 3dnowprefetch acpi aes aperfmperf apic arat arch_capabilities arch_perfmon art bts cat_l2 clflush clflushopt
cmov constant_tsc cx16 cx8 de ds_cpl dtes64 dtherm dts eagerfpu ept erms est flexpriority fpu fsgsbase fxsr ht ibpb
ibrs ida intel_pt intel_stibp lahf_lm lm mca mce md_clear mmx monitor movbe mpx msr mtrr nonstop_tsc nopl nx pae
pat pbe pclmulqdq pdcm pdpe1gb pebs pge pln pni popcnt pse pse36 pts rdrand rdseed rdt_a rdtscp rep_good sdbg sep
sha_ni smap smep spec_ctrl ss sse sse2 sse4_1 sse4_2 ssse3 stibp syscall tm tm2 tpr_shadow tsc tsc_adjust
tsc_deadline_timer tsc_reliable vme vmx vnmi vpid x2apic xgetbv1 xsave xsavec xsaveopt xtopology xtpr
Graphics: Device-1: Intel vendor: ZOTAC driver: i915 v: kernel bus ID: 00:02.0 chip ID: 8086:5a85
Display: web server: N/A driver: i915 tty: 223x51
Message: Unable to show advanced data. Required tool glxinfo missing.
Audio: Device-1: Intel Celeron N3350/Pentium N4200/Atom E3900 Series Audio Cluster driver: snd_hda_intel v: kernel
bus ID: 00:0e.0 chip ID: 8086:5a98
Sound Server: ALSA v: k3.10.0-1062.12.1.el7.x86_64
Network: Device-1: Intel Wireless 3165 driver: iwlwifi v: kernel port: f040 bus ID: 01:00.0 chip ID: 8086:3165
IF: wlp1s0 state: down mac: 0c:54:15:76:c3:2f
Device-2: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet driver: r8169 v: kernel port: e000 bus ID: 02:00.0
chip ID: 10ec:8168
IF: enp2s0 state: up speed: 1000 Mbps duplex: full mac: 00:01:2e:90:f0:67
IP v4: 192.168.2.5/24 scope: global broadcast: 192.168.2.255
IP v6: fd65:3544:2664:1:201:2eff:fe90:f067/64 type: mngtmpaddr dynamic scope: global
IP v6: 2003:d1:bf42:b24:201:2eff:fe90:f067/64 type: mngtmpaddr dynamic scope: global
IP v6: fe80::201:2eff:fe90:f067/64 scope: link
Device-3: Realtek RTL8111/8168/8411 PCI Express Gigabit Ethernet driver: r8169 v: kernel port: d000 bus ID: 03:00.0
chip ID: 10ec:8168
IF: enp3s0 state: up speed: 1000 Mbps duplex: full mac: 00:01:2e:90:f0:68
IP v4: 192.168.3.1/24 scope: global broadcast: 192.168.3.255
IP v6: fe80::201:2eff:fe90:f068/64 scope: link
WAN IP: No WAN IP data found. Connected to the web? SSL issues?
Drives: Local Storage: total: 168.92 GiB used: 2.16 GiB (1.3%)
ID-1: /dev/sda vendor: Transcend model: TS120GMTS420S size: 111.79 GiB speed: 6.0 Gb/s serial: E875100508 rev: 0A0
temp: 62 C scheme: GPT
ID-2: /dev/sdb type: USB vendor: Transcend model: JetFlash Transcend 64GB size: 57.13 GiB speed:
serial: 08ONFICOEBXJ1WDR rev: 1100 scheme: MBR
Message: No Optical or Floppy data was found.
RAID: Message: No RAID data was found.
Partition: ID-1: / size: 102.79 GiB used: 1.99 GiB (1.9%) fs: xfs dev: /dev/dm-0 label: N/A
uuid: 3cac34fd-a971-411a-8985-c7f366b77a58
ID-2: /boot size: 1014.0 MiB used: 162.9 MiB (16.1%) fs: xfs dev: /dev/sda2 label: N/A
uuid: efb81bbb-0995-49e6-89fd-ebd1330b53b9
ID-3: /boot/efi size: 199.8 MiB used: 11.0 MiB (5.5%) fs: vfat dev: /dev/sda1 label: N/A uuid: C87C-CC34
ID-4: swap-1 size: 7.75 GiB used: 0 KiB (0.0%) fs: swap dev: /dev/dm-1 label: N/A
uuid: 2a0b3750-de2e-4737-951f-890f80864480
Unmounted: ID-1: /dev/sda3 size: 110.59 GiB fs: lvm2_member label: N/A uuid: 5RBQoq-Ze1G-KbEK-gQbb-8z0y-VkgD-W2wxoi
ID-2: /dev/sdb1 size: 1.08 GiB fs: iso9660 label: nethserver uuid: 2019-10-07-15-03-21-00
USB: Hub: 1-0:1 info: Full speed (or root) Hub ports: 8 rev: 2.0 speed: 480 Mb/s chip ID: 1d6b:0002
Device-1: 1-5:2 info: Intel type: Bluetooth driver: btusb interfaces: 2 rev: 2.0 speed: 12 Mb/s chip ID: 8087:0a2a
Device-2: 1-6:3 info: Realtek 3-in-1 (SD/SDHC/SDXC) Card Reader type: Mass Storage driver: usb-storage
interfaces: 1 rev: 2.0 speed: 480 Mb/s chip ID: 0bda:0153 serial: 20120926571200000
Hub: 1-7:4 info: Apple Hub in Aluminum Keyboard ports: 3 rev: 2.0 speed: 480 Mb/s chip ID: 05ac:1006
Device-3: 1-7.2:5 info: Apple Aluminium Keyboard (ISO) type: Keyboard,HID driver: apple,usbhid interfaces: 2
rev: 2.0 speed: 1.5 Mb/s chip ID: 05ac:0250
Device-4: 1-7.3:6 info: Microsoft type: Mouse driver: hid-generic,usbhid interfaces: 1 rev: 2.0 speed: 1.5 Mb/s
chip ID: 045e:00d2
Hub: 2-0:1 info: Full speed (or root) Hub ports: 7 rev: 3.0 speed: 5 Gb/s chip ID: 1d6b:0003
Device-5: 2-4:2 info: Transcend Information JetFlash type: Mass Storage driver: usb-storage interfaces: 1 rev: 3.1
speed: 5 Gb/s chip ID: 8564:1000 serial: 08ONFICOEBXJ1WDR
Sensors: System Temperatures: cpu: 41.0 C mobo: N/A
Fan Speeds (RPM): N/A
Info: Processes: 160 Uptime: 47m Init: systemd v: 219 runlevel: 3 target: multi-user.target Compilers: gcc: N/A
Shell: bash v: 4.2.46 running in: tty 0 inxi: 3.0.37

  1. no dedicated DNS-Server Configuration

  2. Installation of Firewall Module v. 3.8.5: no incidents

  3. Firewall Objects: exits without any dedicated Configuration

    image
    image.png762×178 12.9 KB

    …and so on

  4. Configuration WAN via Speedtest

  5. Firewall test: Blocking HTTPS from MecPro to RED: successful: no access to internet via browser

    image
    image.png1210×70 9.53 KB

  6. test Time based blocking:

  • creating a time role (next 10 Minutes)
  • created firewall rule
    image
    image.png1274×79 9.92 KB

    Result: NS closes and opens the connections like defined

12: test NDPI-based blocking

Result: full access to youtube.com and possibility to play youtube videos.:face_with_raised_eyebrow:

That is not the expected behavior.

  1. Testing Webproxy
  • Installation ob Webproxy
  • Installation of Webfilter
  • Enabling Servies: ufdb, c-icap, clamd@squidclamav, squid
  • adding the…
Youtube related DOMAIN LIST

ggpht.com
youtu.be
ytimg.com
googlevideo.com
youtubei.googleapis.com
youtube.googleapis.com
youtube.com
youtube.de
youtube.ad
youtube.ae
youtube.al
youtube.am
youtube.as
youtube.at
youtube.az
youtube.ba
youtube.be
youtube.bf
youtube.bg
youtube.bi
youtube.bj
youtube.bs
youtube.bt
youtube.by
youtube.ca
youtube.cat
youtube.cd

…to the global BLACKLIST
result: full access to youtube

Same test with other domain names: same result

Looks definitely like a bug
Correction: Experience with fresh Nethserver-Installation

can anyone take this test again?
14. testing Webfilter with custom category with same domain names like before
image
result: full access to youtube and the additional domains
Correction: Experience with fresh Nethserver-Installation

Now I have done what I could and documented what I have done. Now its your part - open fire.

EOF

1 Like
2

From your Nethserver terminal, do you get a response if you ping Hot-Mamma.localdomain?

Trying to confirm if only my silly Neth installs have this from their default install from the ISO or if my setups are just off.

3

yes, cold-Mamma.localdomain too :smirk:
Beause in my opinion its a ping from localhost to localhost

1 Like
4

I knew i wasn’t crazy! Thank you for confirming this for me. Where in the heck is this being defined in the ISO install? To me, this isn’t a big deal but for sure isn’t the most professional thing I’ve come across but funny still.

5

Additional note to Step 13 and 14:
I forgot to switch the Proxy Mode to “Transparent SSL”.
After doing that, the blocking of the defined Domains works with one exception.
If I want to open one site on nethserver.org comes a certificates error but the domain is not blocked.

image
image.jpg1116×1162 190 KB