Running from home

Hi ThumbOne - there are a few people running MIAB at home. I got it going without too much trouble, but I was in IT for years and at least know how to spell ssh. Regarding MIAB config and non-standard stuff, it would be nice to tweak the config and setup, but for me it’s even nicer to have stuff just work - it’s infrastructure and I don’t want to have to play with it every day :slight_smile: I can tell you what I did…

Notes: I’m using a Rapsberry Pi 3B+ with an external SSD, running Ubuntu 18.04. It’s a bit underpowered but has been working fine so far. They have a reputation for loosing the SD (boot) card, but I’ve been happy running another one as a piHole DNS and storage server for some time, so I’ll give it a go and can change to more substantial hardware if needed.

#1 Get domain name, fixed IP address and open required ports.

For domains, I use gandi.net - been happy so far.

For a connection, I’m on a cable internet with an ISP (Aussie Broadband) who was very happy to assign me a fixed IP address. With my ISP, the fixed address automatically opened up all ports, I didn’t even need to request port 25. Great to have a sensible ISP :slight_smile: I did check that the static address wasn’t on the blacklists - got lucky and it was a clean address.

Regarding IPv6 and networks: I initially had trouble because the IPv6 address changes on every reboot - security & privacy you know :frowning: I didn’t want to change anything that might get touched by MIAB or subsequent upgrades, and Ubuntu on the Pi seems very poor at IPv6 control (not easy to disable the privacy extensions or IPv6 at boot time!). In the end, I just disable IPv6 before the install - the MIAB install then ignores IPv6 and I don’t care if the address appears/changes later.

#2 Setup "DMZ"

I just have a basic home router (Netgear) and it won’t let me setup multiple isolated subnets. This might have put an end to the whole experiment - no way I’m letting the whole world see everything on my LAN. However I can config a “guest” network which does not have access to the rest of my LAN, and I can designate one address to be a DMZ server which is passed all unexpected traffic. The only negative is the guest network must be wifi - not great for a server but traffic is low.

Watch out I was using a wired connection for initial setup and config, and a wifi connection for the external facing DMZ address. The MIAB DNS server seemed to listen on only one address, randomly, so would work after some installs and after others nslookup would fail. The work around is to disconnect the wired connection before running MIAB install, so it sees only the external facing (DMZ) address.

Raspberry Pi issues A few of things unique to the pi: Configuring to use wifi at boot time requires a little investigation and playing with config files, but is easy enough. The pi has no battery backed RTC. It would often boot with an old time and have trouble with DNS resolution - the fix was to put the IP address of a local time server into /etc/systemd/timesyncd.conf. And be sure to install libffi-dev before running the MIAB install, or the install will fail - right near the end!

#3 Storage

I’ve got the box configured with a moderate sized external SSD, which has partitions for swap, /home, and /var. I hope that moving /var off the pi’s SD card will improve card life - my other similar box uses a ram-disk to minimise /var/log writes.

#4 Install

Very straight forward, as per the instructions. When it’s all going, copy the DNSSEC stuff to gandi, and then ask my ISP to update the reverse DNS entry. That took a little while but no problems.

Now all the checks show greens, and all the spam checkers say 10/10. I’m happy.

2 Likes