Run the network services (DNS, VPN, mail, failover)

$ run as a normal user# run as root (or with sudo)

Skills in this chapter

Network services — 5

BIND — DNS server

rndc controls the BIND name server; named-checkconf and named-checkzone test changes before the reload.

#named-checkconf -z
#named-checkzone lab.local /var/named/lab.local.zone
#rndc reload lab.local
$dig @192.168.122.2 web1.lab.local +short

Security checklist:

Limit allow-recursion and allow-transfer; no open resolver.
Raise the SOA serial on every change.

11.2

WireGuard — fast modern VPN

wg and wg-quick build encrypted tunnels with small configs: one key pair per peer, AllowedIPs as routes and access list.

#wg genkey | tee server.key | wg pubkey > server.pub
#systemctl enable --now wg-quick@wg0
#wg show

Security checklist:

Private keys stay on their host (600); one key per device.
Check AllowedIPs carefully.

11.3

OpenVPN — classic TLS VPN

openvpn builds tunnels with a certificate per client (easy-rsa); works over TCP/443 through strict firewalls.

#systemctl enable --now openvpn-server@vpn
#./easyrsa revoke laptop-hosam && ./easyrsa gen-crl

Security checklist:

tls-crypt, modern ciphers, crl-verify; keep the CA key offline.

11.4

Postfix — mail relay

postconf configures Postfix, the standard mail server on RHEL; on app servers it usually relays mail to a smart host over TLS.

#postconf -e 'inet_interfaces = loopback-only' 'relayhost = [smtp.example.com]:587'
#postqueue -p
$dig +short TXT _dmarc.example.com

Security checklist:

Never an open relay; sasl_passwd with rights 600.
SPF, DKIM and DMARC for your domains.

11.5

keepalived — failover IP

keepalived moves a virtual IP between two servers with VRRP, so HAProxy or nginx stays reachable when one server dies.

#keepalived -t -f /etc/keepalived/keepalived.conf
#ip -br addr show eth0
#journalctl -u keepalived | grep -E "MASTER|BACKUP"

Security checklist:

Unique virtual_router_id; allow VRRP only between the nodes.
In public clouds use the cloud load balancer instead.

At work

In the home lab, run BIND for lab.local, WireGuard for access from outside, and two HAProxy nodes with keepalived in front of the k3s API — the same pattern as a small company network.

All commands in this chapter