(32 intermediate revisions by the same user not shown)
Line 1:
Line 1:
<h1>Jumpbox Remote Access Setup</h1>
= Jumpbox Remote Access Setup =
This guide is to setup a bastion remote desktop server in order to access yolocolo services delivered by ZeroOne Technologies
This guide is to setup a bastion remote desktop server in order to access yolocolo services delivered by ZeroOne Technologies
Requirements:
Requirements:
<ul>
* A Brain to be able to follow documentation
<li>A Brain able to understand follow documentation</li>
* Credentials to Access ZeroOne Tech OpenStack Tenant
<li>Credentials to Access ZeroOne Tech OpenStack Tenant</li>
* Assumes you do not have any existing configuration in ZeroOne Cloud
</ul>
<h2>Setup Networking</h2>
== Setup Networking ==
First we must enable networking and request a public IP address to enable an internet routable VM on openstack
First networking must enabled and request a public IP address to enable an internet routable VM on OpenStack
<h3>Setup “Jumpbox” LAN</h3>
=== “Jumpbox” LAN ===
# Open [https://cloud.zeroone.tech/horizon/project/networks/ Networks - OpenStack Dashboard (zeroone.tech)], You will have at least two networks listed. 1) Being Public and 2) being vlan1XXX. Public is the Public internet hosted by ZeroOne and vlan1XXX is your network local network for your yolo services. if vlan1XXX is not provisioned in your tenant please contact ZeroOne Support using [https://discord.com/channels/1043367431193768006/1043372530666319912 #chat-suport on ZWS Discord]
# [[File:JumboxSetup Step1 1.png|right|Setup LAN Step 1]] Open [https://cloud.zeroone.tech/horizon/project/networks/ Networks - OpenStack Dashboard (zeroone.tech)], You will have at least two networks listed. 1) Being Public and 2) being vlan1XXX. Public is the Public internet hosted by ZeroOne and vlan1XXX is your network local network for your yolo services. if vlan1XXX is not provisioned in your tenant please contact ZeroOne Support using [https://discord.com/channels/1043367431193768006/1043372530666319912 #chat-suport on ZWS Discord] <div style="clear: both"></div>
# [[File:JumboxSetup_Step1_2.png|thumb]] We need to create a network for your “Jumpbox” using the “Create Network” option
# [[File:JumboxSetup_Step1_2.png|right|Setup LAN Step 2]] You need to create a network for your “Jumpbox” using the “Create Network” option <div style="clear: both"></div>
# Name your network (in this case I am using “jumpbox_net”, leaving all other values as default, then click “Next”
# [[File:JumboxSetup Step1 3.png|right|Setup LAN Step 3]] Name your network (in this case I am using “jumpbox_net”, leaving all other values as default, then click “Next” <div style="clear: both"></div>
#Define the IP Scope of this network, by giving it a name and address in CIDR Format. Leave IP Version Defaulted to IPv4 and Gateway Empty (This will be filled out by OpenStack), Then Click on next
# [[File:JumboxSetup Step1 4.png|right|Setup LAN Step 4]] Define the IP Scope of this network, by giving it a name and address in CIDR Format. Leave IP Version Defaulted to IPv4 and Gateway Empty (This will be filled out by OpenStack), Then Click on next <div style="clear: both"></div>
# On the subnet Details Page, Click create leaving all other details default
# [[File:JumboxSetup Step1 5.png|right|Setup LAN Step 5]] On the subnet Details Page, Click create leaving all other details default <div style="clear: both"></div>
----
<div style="clear: both"></div>
=== “Jumpbox” LAN - Router/Gateway ===
Setup Internet Gateway for “Jumpbox” LAN
Setup Internet Gateway for “Jumpbox” LAN
6. Navigate to Routers - OpenStack Dashboard (zeroone.tech) and “Create Router”
# [[File:JumboxSetup Step2 1.png|right]] Navigate to [https://cloud.zeroone.tech/horizon/project/routers/ Routers - OpenStack Dashboard (zeroone.tech)] and “Create Router” <div style="clear: both"></div>
# [[File:JumboxSetup Step2 2.png|right]] Name your router and set the External Network to “Public”, then click create. <div style="clear: both"></div>
# [[File:JumboxSetup Step2 3.png|right]] Open your router detail <div style="clear: both"></div>
# [[File:JumboxSetup Step2 4.png|right]] View Interfaces for your router and add an interface <div style="clear: both"></div>
# [[File:JumboxSetup Step2 5.png|right]] Select the subnet the Gateway is for, in this case the “jumpbox_subnet”, An IP address will assigned by openstack then click submit <div style="clear: both"></div>
This Gateway enables:
* LAN => WAN NAT to enable internet access from [[YoloColo:Jumpbox#“Jumpbox”_LAN|“Jumpbox” LAN]] connected instances
* WAN => LAN [https://www.techtarget.com/searchnetworking/definition/Port-Address-Translation-PAT Port Address Translation (PAT)] to allow WAN connections made from WAN Addresses to Instances like [[YoloColo:Jumpbox#Create_-_Windows_Instance|Jumpbox Instance]] using a Floating IP Address as per [[YoloColo:Jumpbox#Request_a_Floating_(Public)_IP_for_Jumpbox|Request a Floating (Public) IP for Jumpbox]] and [[YoloColo:Jumpbox#Associate_Floating_IP|Associate Floating IP]] <div style="clear: both"></div>
----
<div style="clear: both"></div>
=== Security Group for remote access ===
# [[File:JumboxSetup Step3 1.png|right]] Now navigate to [https://cloud.zeroone.tech/horizon/project/security_groups/ Security Groups - OpenStack Dashboard (zeroone.tech)] and create a security group <div style="clear: both"></div>
# [[File:JumboxSetup Step3 2.png|right]] Give it a useful name, in this case it is to allow you to remotely access your “Jumphost” then create. <div style="clear: both"></div>
# [[File:JumboxSetup Step3 3.png|right]] With the Security Group created we can now add rules, add a rule. <div style="clear: both"></div>
# [[File:JumboxSetup Step3 4.png|right]] Set the rule type to RDP and enter the source IP of where you will be receiving RDP Requests. If you are unsure of what your IP Address in CIDR Format is you can use services such as [https://myip.wtf WTF is my IP?!?!?? / https://myip.wtf]. You can also use 0.0.0.0/0 but this would allow anyone to attempt to connect to your “Jumpbox” on RDP which can be a BadIdea™ , then “add”. Note if you intend to use a Linux Jumpbox, select SSH for the Rule instead <div style="clear: both"></div>
[[File:JumboxSetup Step3 5.png|right]] ''Note on Security Group Rules:'' Can had multiple and apply multiple to Compute Instances. As a result I will remove default rules from my Security Groups to allow for layering of rulesets. You will see this later, as a result my reset for allow-RDP looks like: <div style="clear: both"></div>
7. Name your router and set the External Network to “Public”, then click create.
----
8. Open your router detail
<div style="clear: both"></div>
=== Request a Floating (Public) IP for Jumpbox ===
# [[File:JumboxSetup Step4 1.png|right|File:JumboxSetup Step4 1.png]] Navigate to [https://cloud.zeroone.tech/horizon/project/floating_ips/ Floating IPs - OpenStack Dashboard (zeroone.tech)] and “Allocate IP to Project” <div style="clear: both"></div>
# [[File:JumboxSetup Step4 2.png|right]] Give the IP A description, then complete the allocation by then clicking “Allocate IP” <div style="clear: both"></div>
9. View Interfaces for your router and add an interface
----
<div style="clear: both"></div>
10. Select the subnet the Gateway is for, in this case the “jumpbox_subnet”, An IP address will assigned by openstack then click submit
=== Networking Setup - Summary ===
Setup a Security Group for remote access
11. Now navigate to Security Groups - OpenStack Dashboard (zeroone.tech) and create a security group
12. Give it a useful name, in this case it is to allow you to remotely access your “Jumphost” then create.
13. With the Security Group created we can now add rules, add a rule.
14. Set the rule type to RDP and enter the source IP of where you will be receiving RDP Requests. If you are unsure of what your IP Address in CIDR Format is you can use services such as WTF is my IP?!?!?? found at https://myip.wtf. You can also use 0.0.0.0/0 but this would allow anyone to attempt to connect to your “Jumpbox” on RDP which can be a BadIdeaTM , then “add”. Note if you intend to use a Linux Jumpbox, select SSH for the Rule instead
Note on Security Group Rules: Can had multiple and apply multiple to Compute Instances. As a result I will remove default rules from my Security Groups to allow for layering of rulesets. You will see this later, as a result my reset for allow-RDP looks like:
Request a Floating IP
15. Navigate to Floating IPs - OpenStack Dashboard (zeroone.tech) and “Allocate IP to Project”
16. Give the IP A description, then complete the allocation by then clicking “Allocate IP”
This completes the Networking Required for Setting up to have a Jumpbox on ZeroOne Cloud to access Yolocolo Services you can see the network layout at Network Topology - OpenStack Dashboard (zeroone.tech)
This completes the Networking Required for Setting up to have a Jumpbox on ZeroOne Cloud to access Yolocolo Services you can see the network layout at Network Topology - OpenStack Dashboard (zeroone.tech)
Compute Instance Setup
----
Launching a New Windows Instance
<div style="clear: both"></div>
1. Navigate to Instances - OpenStack Dashboard (zeroone.tech) and Launch an Instance
== Compute Instance Setup ==
This section covers the creation and access to a Windows VM to allow access to you YoloColo Network
2. Name you Instance then click next
=== Create - Windows Instance ===
# [[File:JumboxSetup Step5 1.png|right]] Navigate to [https://cloud.zeroone.tech/horizon/project/instances/ Instances - OpenStack Dashboard (zeroone.tech)] and “Launch Instance” <div style="clear: both"></div>
# [[File:JumboxSetup Step5 2.png|right]] Name you Instance then click next <div style="clear: both"></div>
3. For Source, Change to Image, you can then search for Windows to show available Windows Server 2022 Standard Image which you can then select (DO NOT SELECT “vGPU edition” unless approved by Management for vGPU resource access), Volume Size will now be the minimum size to accept image. You can increase volume size, but not make smaller that Image. Then next
# [[File:JumboxSetup Step5 3.png|right]] For Source, Change to Image, you can then search for Windows to show available Windows Server 2022 Standard Image which you can then select '''(DO NOT SELECT “vGPU edition” unless approved by Management for vGPU resource access)''', Volume Size will now be the minimum size to accept image. You can increase volume size, ''but not make smaller that Image''. Then next <div style="clear: both"></div>
# [[File:JumboxSetup Step5 4.png|right]] Set the “Flavor” or Size of the VM. In this case I am using a “z1.gs.small” as the Windows Image needs a Minimum RAM allocation of 4096MB, then next <div style="clear: both"></div>
# [[File:JumboxSetup Step5 5.png|right]] Allocate the Network we create for this in the [[YoloColo:Jumpbox#“Jumpbox”_LAN|“Jumpbox” LAN Setup]] instructions above to this instance. Then next. '''''NOTE:''''' ''Do not add you vlan1XXX network at this step, as it does not have internet access available and will resolute in this VM not being deployed correctly'' <div style="clear: both"></div> <br> ‌
4. Set the “Flavor” or Size of the VM. In this case I am using a “z1.gs.small” as the Windows Image needs a Minimum RAM allocation of 4096MB, then next
# Skip Network Ports. No Changes required here <div style="clear: both"></div> <br> ‌
# [[File:JumboxSetup Step5 6.png|right]] Allocate the Security Group created in [[YoloColo:Jumpbox#Security_Group_for_remote_access|Security Group for remote access]] for Allowing RDP Connections to this device. ''You will see as per my comments in [[YoloColo:Jumpbox#Security_Group_for_remote_access|Security Group for remote access]] when creating the security group I have the “default” allow we traffic group then the second security group to “allow” RDP connections.'' Then Next. <div style="clear: both"></div>
5. Allocate the Network we create for this in the instructions above to this instance. Then next.
# [[File:JumboxSetup Step5 7.png|right]] We can now create the private key to secure the password for this machine, if you already have a private key, you can import it or otherwise we will create one now, click on “Create Key Pair”, give it a name and type of SSH '''(YOU MUST SAVE THIS KEY AS WE CANNNOT RECOVER IT AND WITHOUT IT YOU CANNNOT ACCESS THIS VM AND IT WILL NEED TO BE RECREATED)'''
## [[File:JumboxSetup Step5 8.png|right]] PLEASE NOTE: OpenStack and ZeroOne '''DO NOT''' store this private keys if you do not save it cannot be recovered, additionally if you do not store or share it appropriately we are not responsible for any unauthorized access to your instances. Treat your SSH keys like you would treat your password. <div style="clear: both"></div>
6. Skip Network Ports. No Changes required here
# [[File:JumboxSetup Step5 9.png|right]] With the Key Pair defined we can now “Launch” <div style="clear: both"></div>
----
<div style="clear: both"></div>
=== Wait ===
[[File:JumboxSetup Step5 9a.png|right]] We must wait for the Instance to complete building after we Launch as we the last step before continuing. This will take 5-10 minutes to complete, grab a coffee, tea, monster, beer, rum or other beverage of choice but to remember to drink and compute under the influence safely <div style="clear: both"></div>
----
<div style="clear: both"></div>
=== Associate Floating IP ===
We can then Allocate the Previously requested Floating IP we requested in [[YoloColo:Jumpbox#Request_a_Floating_(Public)_IP_for_Jumpbox|Request a Floating (Public) IP for Jumpbox]]
# Click on the options dropdown on the line for your created [[YoloColo:Jumpbox#Create_-_Windows_Instance|Jumpbox Instance]] and select "Associate Floating IP" <div style="clear: both"></div>
# [[File:JumboxSetup Step6 2.png|right]] Select the floating IP Address you requested and it will be assigned to the network interface & IP address of the jumpbox on the created jumpbox LAN <div style="clear: both"></div>
What is step does sets up [https://www.techtarget.com/searchnetworking/definition/Port-Address-Translation-PAT Port Address Translation (PAT)] though the router created in [[YoloColo:Jumpbox#“Jumpbox”_LAN_-_Router|“Jumpbox” LAN - Router/Gateway]] which also acts as the LAN NAT Gateway which enables internet access to your [[YoloColo:Jumpbox#Create_-_Windows_Instance|Jumpbox Instance]] <div style="clear: both"></div>
----
<div style="clear: both"></div>
=== Retreive Instance Password ===
Due to issues with how to getting a password safely sent to the instance at setup time, OpenStack instead randomly generates the password and securely encrypts it with your public key setup in [[YoloColo:Jumpbox#Create_-_Windows_Instance|Create Instance - Step 8]], As previously noted if you have an issue with the private key, we will be unable to recover your password to access this Instance <div style="clear: both"></div>
# Click on the options dropdown on the line for your created [[YoloColo:Jumpbox#Create_-_Windows_Instance|Jumpbox Instance]] and select "Retreive Password" <div style="clear: both"></div>
# [[File:JumboxSetup Step7 2.png|right]] Upload or Copy/Paste your SSH Private key to decrypt your Password
7. Allocate the Security Group created for Allowing RDP Connections to this device. You will see as per my note when creating the security group I have the “default” allow we traffic group then the second security group to “allow” RDP connections. Then Next.
----
<div style="clear: both"></div>
=== Connect Instance to your YoloColo Network ===
8. We can now create the private key for this machine, if you already have a private key, you can import it or otherwise we will create one now, click on “Create Key Pair”, give it a name and type of SSH (YOU MUST SAVE THIS KEY AS WE CANNNOT RECOVER IT AND WITHOUT IT YOU CANNNOT ACCESS THIS VM AND IT WILL NEED TO BE RECREATED)
This will your Jumpbox Instance to access Network Services setup on your YoloColo LAN
# Click on the options dropdown on the line for your created [[YoloColo:Jumpbox#Create_-_Windows_Instance|Jumpbox Instance]] and select "Attach Interface" <div style="clear: both"></div>
# [[File:JumboxSetup Step8 2.png|right]] You can now set the IP address for the instance on the YoloColo Network, if you do not set "Fixed IP Address" one will be automatically set from the network defined from the network defined for your YoloColo LAN. If you do choice to set an IP Address do not use an IP Address below .10 as these are reserved for Openstack Services. <div style="clear: both"></div>
# [[File:JumboxSetup Step8 3.png|right]] You will now have two Networks available in your remote desktop, you may need to set the IP Address on this interface, if this is required, this must be the EXACT IP address as shown in the [https://cloud.zeroone.tech/horizon/project/instances/ Instances - OpenStack Dashboard (zeroone.tech)] for your yolocolo network <div style="clear: both"></div>
9. With the Key Pair defined we can now “Launch”
----
<div style="clear: both"></div>
10. We can then Allocate the Previously requested Floating IP
= Summary =
If you have any issues with this article please contact ZeroOne Support using [https://discord.com/channels/1043367431193768006/1043372530666319912 #chat-suport on ZWS Discord]
11. Retrieve the Password, you will be then prompted for the previously generated SSH key. As previously noted if you have an issue with the private key, we will be unable to recover your password to access this Instance
12. After Approx 5 minutes Instance should then be available to remote access using the windows remote desktop client with the username Administrator and the password decrypted above
13. Lastly we can attach the Instance to the YoloColo Network by using “Attach Interface”, when using the option you will have the option to set an IP Address for this instance, if you do not one will be assigned for you, but do not use an IP Address below .10 as these are reserved for Openstack Services.
You will now have two Networks available in your remote desktop
Latest revision as of 03:10, 1 February 2025
Jumpbox Remote Access Setup
This guide is to setup a bastion remote desktop server in order to access yolocolo services delivered by ZeroOne Technologies
Requirements:
A Brain to be able to follow documentation
Credentials to Access ZeroOne Tech OpenStack Tenant
Assumes you do not have any existing configuration in ZeroOne Cloud
Setup Networking
First networking must enabled and request a public IP address to enable an internet routable VM on OpenStack
“Jumpbox” LAN
Setup LAN Step 1 Open Networks - OpenStack Dashboard (zeroone.tech), You will have at least two networks listed. 1) Being Public and 2) being vlan1XXX. Public is the Public internet hosted by ZeroOne and vlan1XXX is your network local network for your yolo services. if vlan1XXX is not provisioned in your tenant please contact ZeroOne Support using #chat-suport on ZWS Discord
Setup LAN Step 2 You need to create a network for your “Jumpbox” using the “Create Network” option
Setup LAN Step 3 Name your network (in this case I am using “jumpbox_net”, leaving all other values as default, then click “Next”
Setup LAN Step 4 Define the IP Scope of this network, by giving it a name and address in CIDR Format. Leave IP Version Defaulted to IPv4 and Gateway Empty (This will be filled out by OpenStack), Then Click on next
Setup LAN Step 5 On the subnet Details Page, Click create leaving all other details default
Give it a useful name, in this case it is to allow you to remotely access your “Jumphost” then create.
With the Security Group created we can now add rules, add a rule.
Set the rule type to RDP and enter the source IP of where you will be receiving RDP Requests. If you are unsure of what your IP Address in CIDR Format is you can use services such as WTF is my IP?!?!?? / https://myip.wtf. You can also use 0.0.0.0/0 but this would allow anyone to attempt to connect to your “Jumpbox” on RDP which can be a BadIdea™ , then “add”. Note if you intend to use a Linux Jumpbox, select SSH for the Rule instead
Note on Security Group Rules: Can had multiple and apply multiple to Compute Instances. As a result I will remove default rules from my Security Groups to allow for layering of rulesets. You will see this later, as a result my reset for allow-RDP looks like:
Give the IP A description, then complete the allocation by then clicking “Allocate IP”
Networking Setup - Summary
This completes the Networking Required for Setting up to have a Jumpbox on ZeroOne Cloud to access Yolocolo Services you can see the network layout at Network Topology - OpenStack Dashboard (zeroone.tech)
Compute Instance Setup
This section covers the creation and access to a Windows VM to allow access to you YoloColo Network
For Source, Change to Image, you can then search for Windows to show available Windows Server 2022 Standard Image which you can then select (DO NOT SELECT “vGPU edition” unless approved by Management for vGPU resource access), Volume Size will now be the minimum size to accept image. You can increase volume size, but not make smaller that Image. Then next
Set the “Flavor” or Size of the VM. In this case I am using a “z1.gs.small” as the Windows Image needs a Minimum RAM allocation of 4096MB, then next
Allocate the Network we create for this in the “Jumpbox” LAN Setup instructions above to this instance. Then next. NOTE:Do not add you vlan1XXX network at this step, as it does not have internet access available and will resolute in this VM not being deployed correctly
Skip Network Ports. No Changes required here
Allocate the Security Group created in Security Group for remote access for Allowing RDP Connections to this device. You will see as per my comments in Security Group for remote access when creating the security group I have the “default” allow we traffic group then the second security group to “allow” RDP connections. Then Next.
We can now create the private key to secure the password for this machine, if you already have a private key, you can import it or otherwise we will create one now, click on “Create Key Pair”, give it a name and type of SSH (YOU MUST SAVE THIS KEY AS WE CANNNOT RECOVER IT AND WITHOUT IT YOU CANNNOT ACCESS THIS VM AND IT WILL NEED TO BE RECREATED)
PLEASE NOTE: OpenStack and ZeroOne DO NOT store this private keys if you do not save it cannot be recovered, additionally if you do not store or share it appropriately we are not responsible for any unauthorized access to your instances. Treat your SSH keys like you would treat your password.
With the Key Pair defined we can now “Launch”
Wait
We must wait for the Instance to complete building after we Launch as we the last step before continuing. This will take 5-10 minutes to complete, grab a coffee, tea, monster, beer, rum or other beverage of choice but to remember to drink and compute under the influence safely
Due to issues with how to getting a password safely sent to the instance at setup time, OpenStack instead randomly generates the password and securely encrypts it with your public key setup in Create Instance - Step 8, As previously noted if you have an issue with the private key, we will be unable to recover your password to access this Instance
Click on the options dropdown on the line for your created Jumpbox Instance and select "Attach Interface"
You can now set the IP address for the instance on the YoloColo Network, if you do not set "Fixed IP Address" one will be automatically set from the network defined from the network defined for your YoloColo LAN. If you do choice to set an IP Address do not use an IP Address below .10 as these are reserved for Openstack Services.
You will now have two Networks available in your remote desktop, you may need to set the IP Address on this interface, if this is required, this must be the EXACT IP address as shown in the Instances - OpenStack Dashboard (zeroone.tech) for your yolocolo network
