TARDIS Project

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Network Structure ======

We divide our network into 2 vLANs:

  * Managed (1) - Hosts where only the admins have root access
  * [[https://netbox.tardisproject.uk/ipam/vlans/1/|Unmanaged (2)]] - Hosts where any other user have root access.

===== Managed =====

In our managed vLAN, we have [[https://netbox.tardisproject.uk/ipam/ip-ranges/1/|a few other subnets]] for things like k8s, but our main one is ''192.168.0.0/24''. 

For convenience when writing firewall rules, we further divide this into 3 prefixes:

  * [[https://netbox.tardisproject.uk/ipam/prefixes/1/|192.168.0.0-63]] - Core services, on hosts only admins can log into
  * [[https://netbox.tardisproject.uk/ipam/prefixes/1/|192.168.0.64-127]] - Auxiliary services, on hosts only admins can log into
  * [[https://netbox.tardisproject.uk/ipam/prefixes/5/|192.168.0.128-255]] - User-accessible machines

Note that no matter the prefix, the subnet is still the same (/24).

===== Unmanaged =====

We put these on a seperate vLAN to prevent IP/ARP spoofing attacks, and some other LAN attacks that are possible with root.

Any unmanaged host must use the [[https://netbox.tardisproject.uk/ipam/ip-ranges/9/|unmanaged]] subnet, and must go through the [[https://netbox.tardisproject.uk/ipam/ip-addresses/24/|router's port on that vLAN]] in order to access anything outside that vLAN. This is so we can monitor/firewall traffic.