Advanced Networking¶

The requirements are:

• 1x Ethernet connection (LAN)
• 1x Supported USB WiFi adapter or onboard WiFi. This may vary depending on device and available WiFi drivers/modules. However, common adapters (e.g.: Atheros) should be fine.

Use the following credentials to initially connect devices to your hotspot.

• SSID = DietPi-HotSpot
• Access Key = dietpihotspot

Some hotspot settings can be changed to adopt to various circumstances. The main settings of the WiFi hotspot reside in the DHCP configuration file /etc/dhcp/dhcpd.conf and can be edited. The DHCP server configuration options are manifold and can be checked out e.g. via the man pages of isc-dhcp-server.
Below there are some basic settings described.

Change WiFi settings (SSID/Key/Channel)

Once installed, you can change the WiFi HotSpot settings (SSID/Key/Channel) at any time:

1. Run dietpi-config
2. Navigate to Networking Options: Adapters, then select WiFi
3. Whilst in this menu, it is highly recommended you set the Country Code to your country. Depending on your country regulations, this could allow for channels 12/13 and increased power output (range) for the hotspot

Change hotspot subnet address

The WiFi hotspot offer the WiFi clients IP settings within a certain IP subnet (see lower part of graphics):

The default values for these subnet settings are:

• IP address of WiFi hotspot: 192.168.42.1
• Subnet mask: 255.255.255.0
• DHCP range: 192.168.42.10 .. 192.168.42.250

If these settings shall be changed, the following files need to be adjusted:

• /etc/dhcp/dhcp.conf
• /etc/network/interfaces
• /etc/iptables.ipv4.nat

These changes should be followed by a reboot to activate the settings (this is an easy way compared to restart the relevant services by hand).

For example, the default contents of the WiFi setting area within the file /etc/network/interfaces is:

# WiFi
allow-hotplug wlan0
iface wlan0 inet static
address 192.168.42.1
netmask 255.255.255.0
#gateway 192.168.0.1
#dns-nameservers 9.9.9.9 149.112.112.112
wireless-power off

As can be seen, the address 192.168.42.1 would need to be changed.

These setting changes can be done by hand or via a shell line using this command
(exemplary changing IP addresses from 192.168.42.x to 192.168.43.x):

sed -i 's/192\.168\.42\./192.168.43./g' /etc/dhcp/dhcpd.conf /etc/network/interfaces /etc/iptables.ipv4.nat

Change DHCP lease time settings

The DHCP lease time denotes the time how long an IP address is bound to a DHCP client: DHCP-assigned IP addresses are typically not permanent and expire after a certain time. This time is called DHCP lease time.
This lease time can be set, so that an IP address is not dedicated to a device forever and is available for other devices too, when needed.

The lease time is set via the entry default-lease-time within the configuration file /etc/dhcp/dhcpd.conf.

There are many further setting options around the lease behaviour, for details e.g. see man pages of isc-dhcp-server.

The default-lease-time time of the isc-dhcp-server is 43200 seconds (12 hrs). Depending of the usage situation of the WiFi hotspot, a different setting might fit better.
Typical good practice values are:

• Internet cafe: 1 hour resp. 3600 seconds
• Guest networks in an office: 8 hours resp. 28800 seconds
• Wireless devices at trusted networks / at home: 24 hours .. 1 week resp. 86.400 .. 604.800 seconds
• (Cable connected devices / LAN: 8 days resp. 691.200 seconds)

The status of the WiFi hotspot can be evaluated with these commands:

• systemctl status isc-dhcp-server hostapd
  

• journalctl -u isc-dhcp-server
  

  resp.

  journalctl -u isc-dhcp-server -u hostapd -u ifup@wlan0
  

Additionally, DHCP leases can be monitored via the file /var/lib/dhcp/dhcpd.leases.

The WiFi HotSpot can be combined with AdGuard Home resp. Pi-hole. To do this, the DHCP server needs to know the IP address of the Ad-Blocker system and announces it as the DNS server for the WiFi area.

The corresponding file is /etc/dhcp/dhcpd.conf, the entry option domain-name-servers has to be set to your Ad-Blocker IP address.
In the following there are three examples given starting from the following base dhcpd.conf content:

authoritative;
#default-lease-time 43200;
#max-lease-time 86400;

subnet 192.168.42.0 netmask 255.255.255.0 {
    range 192.168.42.10 192.168.42.250;
    option broadcast-address 192.168.42.255;
    option routers 192.168.42.1;
    option domain-name "local";
    option domain-name-servers 9.9.9.9, 149.112.112.112;
}

1. AdGuard Home runs on the same DietPi system as the WiFi HotSpot runs. Then the “subnet” section contents has to be changed to

   subnet 192.168.42.0 netmask 255.255.255.0 {
       range 192.168.42.10 192.168.42.250;
       option broadcast-address 192.168.42.255;
       option routers 192.168.42.1;
       option domain-name "local";
       # AdGuard Home runs on the localhost (with IP address 192.168.42.1)
       option domain-name-servers 192.168.42.1;
   }
   

2. Pi-hole runs in the subnet the (superimposed) LAN connection belongs to. Depending on the LAN subnet (e.g. 192.168.178.0/24) the “subnet” section contents might be changed to

   subnet 192.168.42.0 netmask 255.255.255.0 {
       range 192.168.42.10 192.168.42.250;
       option broadcast-address 192.168.42.255;
       option routers 192.168.42.1;
       option domain-name "local";
       # Pi-hole runs on the LAN (with IP address 192.168.178.2)
       option domain-name-servers 192.168.178.2;
   }
   

3. Pi-hole runs in the subnet the WiFi connection belongs to. Depending on the WiFi HotSpot subnet (e.g. 192.168.42.0/24) the “subnet” section contents might be changed to

   subnet 192.168.42.0 netmask 255.255.255.0 {
       range 192.168.42.10 192.168.42.250;
       option broadcast-address 192.168.42.255;
       option routers 192.168.42.1;
       # Pi-hole runs on the WiFi subnet (with IP address 192.168.42.250)
       option domoption domain-name-servers 192.168.42.250;
   }
   

The requirements are:

• 1x Ethernet connection
• 1x Supported USB WiFi adapter or onboard WiFi. This may vary depending on device and available WiFi drivers/modules. However, common adapters (e.g.: Atheros) should be fine.

These are identical to the WiFi HotSpot credentials.

To verify that the traffic is being routed through Tor you can check the following:
On the connected WiFi device, go to the following URL: https://check.torproject.org

Tor service logs can be viewed with the following command:

journalctl -t tor

After installation, you need to manually modify the haproxy.cfg to best fit your network requirements. Check the configuration manual here.

systemctl stop haproxy
nano /etc/haproxy/haproxy.cfg
systemctl start haproxy    

The stats web interface is accessible via port 1338:

• URL = http://<your.IP>:1338
• Prometheus metrics = http://<your.IP>:1338/metrics
• Username = admin
• Password = <yourGlobalSoftwarePassword> (default: dietpi)

The simplest way to load balance network traffic to multiple servers is to use layer 4 (transport layer) load balancing. Load balancing this way will forward user traffic based on IP range and port.

The user accesses the load balancer, which forwards the user’s request to the web-backend group of backend servers. Whichever backend server is selected will respond directly to the user’s request.

Help text extracted from the tutorial: An Introduction to HAProxy and Load Balancing Concepts

A high availability (HA) setup is an infrastructure without a single point of failure. It prevents a single server failure from being a downtime event by adding redundancy to every layer of your architecture. A load balancer facilitates redundancy for the backend layer (web/app servers), but for a true high availability setup, you need to have redundant load balancers as well.

Here is a diagram of a basic high availability setup:

Help text extracted from the tutorial: An Introduction to HAProxy and Load Balancing Concepts

Aside from proxies, frp also has a few dashboards that you can use to monitor it.

• Admin UI (Client): http://<your.IP>:7400
• Dashboard (Server): http://<your.IP>:7500
  • User name: admin
  • Password: <yourGlobalSoftwarePassword> (default: dietpi)

Depending on whether you have installed as client, server, or both, there will be only the configuration files for that component.

• Client: /etc/frp/frpc.ini
• Server: /etc/frp/frps.ini

Note: You will need root access to edit these files. You can also edit the client configuration file using Admin UI.