88 lines
3.5 KiB
Markdown
88 lines
3.5 KiB
Markdown
# Test plan
|
|
|
|
Run the stages in order — each depends on the previous one.
|
|
|
|
## 0. Host plumbing (on the VPS)
|
|
|
|
```bash
|
|
sysctl net.ipv4.ip_forward # = 1
|
|
wg show wg0 # both peers: recent "latest handshake"
|
|
ping -c3 172.31.255.2 # Trochalakis WG box
|
|
ping -c3 172.31.255.3 # Oswald WG box
|
|
ping -c3 <TROCH_DC1_IP> # AHDC01 across the tunnel
|
|
ping -c3 <OSWALD_DC_IP> # AH-OSWLDC across the tunnel
|
|
```
|
|
|
|
## 1. Technitium DNS (on the VPS)
|
|
|
|
```bash
|
|
docker compose logs technitium-init # "Technitium AD forwarder zones OK."
|
|
# AD SRV record via conditional forward (the money query):
|
|
dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
|
|
dig @127.0.0.1 ahdc01.ad.atlashorizon.net +short
|
|
dig @127.0.0.1 ah-oswldc.ad.oswaldtheotter.net +short
|
|
dig @127.0.0.1 -x <TROCH_DC1_IP> +short # reverse zone
|
|
dig @127.0.0.1 google.com +short # public recursion
|
|
```
|
|
|
|
Web console: from a VPN client or site host, `http://172.31.8.1:5380`
|
|
(or `http://172.31.255.1:5380` over the site tunnels) — verify the six
|
|
conditional-forwarder zones exist. Must NOT load from the public IP.
|
|
|
|
## 2. Duo Auth Proxy (on the VPS)
|
|
|
|
```bash
|
|
docker compose logs duo-authproxy # connectivity tool output: LDAPS bind
|
|
# to both DCs OK, Duo API reachable
|
|
# End-to-end RADIUS (expect a push to your phone, then Access-Accept):
|
|
apt-get install -y freeradius-utils
|
|
radtest '<aduser>' '<adpassword>' 127.0.0.1:1812 10 "$RADIUS_SECRET"
|
|
# Negative: wrong password -> immediate Access-Reject, no push.
|
|
```
|
|
|
|
This stage proves the **LDAP bind** leg independently of OpenVPN.
|
|
|
|
## 3. Full client connect (from outside, e.g. phone hotspot)
|
|
|
|
1. Import a built `.ovpn`, connect with AD username + password → approve
|
|
the Duo push → connected.
|
|
2. `ipconfig /all`: address in `172.31.8.0/24`, DNS `172.31.8.1`, suffix
|
|
`ad.atlashorizon.net`.
|
|
3. DNS through the tunnel:
|
|
`nslookup -type=SRV _ldap._tcp.dc._msdcs.ad.atlashorizon.net`
|
|
4. Reachability, one host per site:
|
|
`ping ahdc01.ad.atlashorizon.net` and `ping ah-oswldc.ad.oswaldtheotter.net`
|
|
5. AD actually works: `dir \\ad.atlashorizon.net\SYSVOL` then `klist`
|
|
(Kerberos tickets present, no NTLM fallback).
|
|
6. Passcode-append fallback: reconnect using `password,<passcode>` from the
|
|
Duo app — must succeed with no push.
|
|
|
|
## 4. Routing correctness
|
|
|
|
- On AHDC01, Security log 4624/4768 for the test user shows the **real**
|
|
client IP (`172.31.8.x`), not a NAT address — confirms routed (no
|
|
masquerade) design.
|
|
- From the client: `tracert <TROCH_DC1_IP>` → first hop `172.31.8.1`.
|
|
- From a DC at each site: `tracert 172.31.8.x` → leaves via the **local**
|
|
WG box (no path through the other site = no asymmetric routing).
|
|
- From a Trochalakis host: `tracert <oswald LAN IP>` still uses the direct
|
|
site-to-site tunnel (RackNerd never appears).
|
|
|
|
## 5. Exposure check (from any outside box)
|
|
|
|
```bash
|
|
nmap -sU -p 53,1194,51820 <racknerd_public_ip> # 53 must NOT respond
|
|
nmap -sT -p 22,53,636,1812,5380,7505 <racknerd_public_ip> # only 22 open
|
|
# If the VPS has a public IPv6 address, repeat over v6:
|
|
nmap -6 -sT -p 22,53,5380 <racknerd_public_ipv6> # only 22 open
|
|
```
|
|
|
|
## 6. Persistence
|
|
|
|
```bash
|
|
docker compose down && docker compose up -d --build # survives cleanly
|
|
# Technitium zones must still exist afterwards (state in /opt/technitium/config)
|
|
dig @127.0.0.1 _ldap._tcp.dc._msdcs.ad.atlashorizon.net SRV +short
|
|
reboot # then: wg show, docker compose ps, re-run stage 3 quick connect
|
|
```
|