Is it possible to configure UCS server with two network interfaces to work with two separated and different networks? For example, I’d like to have local network without access to Internet on eth0 and access only for UCS server to Internet on eth1.
Thanks in advance.
Yes, its possible, we are currently using the exact same setup. First define an external domain, then define another network (e.g. external) and link it to the external domain, and then simply assign a second network card to the host using the “external” network: This works completely without using the command line, simply by using the web interface…
From my experience, I would not build such a setup any more, because it also has disadvantages. In my opinion, the disadvantages of this setup outweigh the apparent advantages, so consider carefully.
Due to the dualhomed setup we have problems with the monitoring using Nagios/Icinga, with the standard routes and of course security issues, because a computer with external IP needs an additional external firewall. Due to some special constraints we have this under control, but today I would prefer to simply define different network zones and then assign the computers to exactly one zone. I would use a router to connect the different zones and use a firewall to allow only exactly the desired network traffic.
Of course, this proposal is a bit more complicated in the initial setup compared to a dual-homed setup, but it is much easier to maintain during operation and of course also safer.
Do you want to read more? This old but still excellent Linux Journal Article may be helpful.
Looking for an easy-to-use firewall at enterprise level? Then I recommend OPNsense.
Viel Spass (have fun)
Lutz
But how to define external domain in UCS? Can’t find the right place.
Hey,
log in to the UMC (“System and domain settings”), go to “System” → “Network settings” → click on the interface to edit if it’s already listen.
Kind regards,
mosu
I think I miss smth…
I do have two network interfaces eth0 and eth1 in my “UMC” → “System” → “Network settings”.
Eth0 is Dynamic (DHCP) and it takes address from router connected to Internet. Adress is from DHCP and it is 192.168.1.10 for example.
Eth1 is static (address is 10.0.0.10).
Global settings are:
Gateway is 10.0.0.200, Domain name server IP are 10.0.0.10 and 192.168.1.1.
Primary network interface is Eth1.
When I open AppCenter I get error: Name or service not known. This is probably due to the DNS settings of my server. This sure is because my UCS server cannot resolve internet addresses. My UCS server knows only one gateway in this configuration. Where in UCS can I route this?
I just would like to have intranet with no Internet connection while second network interfaces will be used only by server to manage updates and install applications. With no ip_forward it should be quite safe. What did I miss?
adjust your gateway: 10.0.0.200 is your internal net and will not work.
But I have also corporate intranet behind the local intranet gateway. When I switch gateway I will loose access to it.
in that case you have to set routes to the internal network, see Configuring static routes
Congrat: you faced one of the disadvantages of a dual-homed setup: you have to care regarding routes.