< back to projects

Highly available BGP-driven Home Lab Network

#networking#bgp#cloud
CR-01
ASN: 65000
Public IP: Static
SITE-A-RTR-01
ASN: 65400
CR Tunnel IP: 10.99.1.1
SITE-B-RTR-01
ASN: 65400
CR Tunnel IP: 10.99.1.3
IPsec over WAN
iBGP Peering
IPsec over WAN
eBGP Peering
CR Tunnel IP Addresses (for BGP)
10.99.1.0/31 for xfrm-site-a
10.99.1.2/31 for xfrm-site-b
Routing Rules
tcp: [ingress-public-ip]:80 ➤ 10.98.0.1:80
tcp: [ingress-public-ip]:443 ➤ 10.98.0.1:443
tcp/udp: [ingress-public-ip]:53 ➤ 10.98.0.2:53
Some-Web-Server
IP Address: (DHCP)
ASN: 65400
Advertise Service IP: 10.98.0.1
Some-Web-Server
IP Address: (DHCP)
ASN: 65400
Advertise Service IP: 10.98.0.1
iBGP peering to 10.254.254.4
iBGP peering to 10.254.254.4
Can failover/migrate at any point with no network reconfiguration needed,
automatic upstream network reconvergence
Sits on Transit/Local server VLAN
Some-DNS-01
IP Address: (DHCP)
ASN: 65400
Advertise Service IP: 10.98.0.2
Some-DNS-02
IP Address: (DHCP)
ASN: 65400
Advertise Service IP: 10.98.0.3
IPsec over WAN
eBGP Peering
Internet Client

A multi-site overlay that gives self-hosted services a stable public IP without handing DNS or ingress off to a third party. A cloud VPS acts as a BGP/IPsec hub that DNATs straight through to whichever site is currently advertising a service IP, with dynamic routing handling migrations and failover between sites.

Posts

  1. Engineering a solution to a long term home lab problem

This post outlines the basic setup of the overlay network, it’s a long read, however it goes in depth into the reasons why the overlay was provisioned the way it was.

  1. Building up High-Availability DNS Name Servers

I setup an Authoritative Anycast DNS service for several domains that I own, including homeblab.com. I cover setting up ECMP and Anycast service IPs, and health check scripts to drive BIRD into withdrawing routes if DNS services crash or become unavailable.

  1. Enabling DNSSEC on homeblab.com [pt.1]

I prepared the homeblab.com domain for DNSSEC and touched on potential security implications of DNSSEC in regards to “Zone Walking” or Subdomain Enumeration and respective mitigations.

  1. Fixing DNS cluster name servers

Fixing a slight oversight when provisioning the homeblab.com zone in the Technitium DNS cluster, which involved removing the zone from the cluster catalog, setting up Transfer, Notify and Secondary Zones on the DNS servers.

Roadmap

  • BGP monitoring
  • Reverse proxy servers
  • Completing HA: 2nd CR in a different US region