Advanced Network Guide

Overview

This guide helps you bypass Carrier-Grade NAT (CGNAT) and other network restrictions when you can't modify port mapping rules or manage multiple rigs with a single public IP. By using a VPS with a public IP and a VPN service like ZeroTier, Tailscale, or Wireguard, you can redirect traffic to your rigs.

Who is this guide for?

Users facing CGNAT or similar network limits
Those unable to change port mapping or forwarding rules due to ISP limitations
Users managing multiple rigs with one public IP

What you will achieve

Set up a secondary SSH service on your VPS
Configure Fail2Ban for SSH security
Establish a VPN connection between your VPS and rigs using ZeroTier
Redirect traffic through the VPN for external rig access
Install and configure Loopin on your rigs

Prerequisites

Important Requirements

A VPS with a direct public IP (static or dynamic with DDNS)
Good to advanced Linux and networking skills
ZeroTier or similar VPN installed on both VPS and rigs
Familiarity with command-line and system configurations
IPv4 only -> DISABLE IPV6 on the rig(s)

Disclaimer

This guide involves advanced network configurations that may affect connectivity and security. Proceed at your own risk. The author is not responsible for any damage, data loss, or security issues. Back up your configurations and understand each step before proceeding.

VPS Configuration Guide

1. Setting Up Secondary SSH Service

Important

Before modifying the SSH configuration, open at least two SSH sessions on your VPS and run htop in each to keep them active. This prevents timeout and ensures you can fix any issues if SSH fails.

a. Install Second SSH Service on Port 2222

# Copy existing SSH configuration
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config_custom

# Edit the custom configuration
sudo nano /etc/ssh/sshd_config_custom
# Comment out 'Port 22' and 'Include /etc/ssh/sshd_config.d/*.conf'
# Add 'Port 2222'

b. Create Systemd Service

Create a new service file:

sudo nano /etc/systemd/system/sshd-custom.service

Add the following content:

[Unit]
Description=OpenBSD Secure Shell server (custom instance on port 2222)
After=network.target

[Service]
ExecStart=/usr/sbin/sshd -D -f /etc/ssh/sshd_config_custom
ExecReload=/usr/sbin/sshd -t
KillMode=process
Restart=on-failure
RestartSec=42s

[Install]
WantedBy=multi-user.target

c. Enable and Start the Service

sudo systemctl daemon-reload
sudo systemctl start sshd-custom.service
sudo systemctl enable sshd-custom.service

2. Configuring Fail2Ban

Create or edit the Fail2Ban configuration:

sudo nano /etc/fail2ban/jail.local

Add the following configuration:

[sshd-2222]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 5
bantime = 10m

Restart and verify Fail2Ban:

sudo systemctl restart fail2ban
sudo fail2ban-client status

3. Network Configuration

a. On the VPS

Enable IP forwarding:

# Edit sysctl.conf
sudo nano /etc/sysctl.conf
# Add: net.ipv4.ip_forward = 1

# Apply changes
sudo sysctl -p

Configure iptables rules:

# Allow necessary ports
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 2222 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 9789 -j ACCEPT

# Configure port forwarding (replace IPs with your actual values)
# SSH Port
sudo iptables -t nat -A PREROUTING -p tcp -d 163.172.xxx.x1 --dport 22 -j DNAT --to-destination 172.28.167.244:22
sudo iptables -t nat -A POSTROUTING -p tcp -d 172.28.167.244 -j MASQUERADE

# Kubernetes Ports
sudo iptables -t nat -A PREROUTING -p tcp -d 163.172.xxx.x1 --dport 10250 -j DNAT --to-destination 172.28.167.244:10250
sudo iptables -t nat -A POSTROUTING -p tcp -d 172.28.167.244 -j MASQUERADE

sudo iptables -t nat -A PREROUTING -p tcp -d 163.172.xxx.x1 --dport 10256 -j DNAT --to-destination 172.28.167.244:10256
sudo iptables -t nat -A POSTROUTING -p tcp -d 172.28.167.244 -j MASQUERADE

# NodePort Range
sudo iptables -t nat -A PREROUTING -p tcp -d 163.172.xxx.x1 --dport 30000:32767 -j DNAT --to-destination 172.28.167.244
sudo iptables -t nat -A POSTROUTING -p tcp -d 172.28.167.244 -j MASQUERADE

# Loopin Port
sudo iptables -t nat -A PREROUTING -p tcp -d 163.172.xxx.x1 --dport 9789 -j DNAT --to-destination 172.28.167.244:9789
sudo iptables -t nat -A POSTROUTING -p tcp -d 172.28.167.244 -j MASQUERADE

b. On the RIG

Configure routing:

# Add default route through VPN
sudo ip route add default via 172.28.99.114 dev <zerotier_interface>

# Enable IP forwarding
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Installing Loopin

Execute these commands on your RIG:

curl -sS -o "./loopin" "https://files.loopin.network/loopin"
sudo chmod +x loopin
sudo ./loopin --code xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Replace the placeholder code with your actual Loopin code.

Additional Notes

ZeroTier Interface: Use ip addr to identify the correct interface name (e.g., zt0)
Route Configuration: Consider redirecting only necessary traffic if you want to optimize network performance
Security: Install Fail2Ban on both VPS and RIG for enhanced security

Advanced Network Guide

Overview​

Prerequisites​

VPS Configuration Guide​

1. Setting Up Secondary SSH Service​

a. Install Second SSH Service on Port 2222​

b. Create Systemd Service​

c. Enable and Start the Service​

2. Configuring Fail2Ban​

3. Network Configuration​

a. On the VPS​

b. On the RIG​

Installing Loopin​