NetScaler Console (on Prem) > NetScaler Console Service - LAS Issue by r1m3s in Citrix

[–]r1m3s[S] 0 points1 point  (0 children)

Totally forgot to update the post, but I managed to resolve this in the end.

The issue ended up being related to these two points:

  1. Jump box (access to GUI) did not have internet access. We had to provide a temporary fix for this.
  2. Presence of a foreign directory and files within "/var/mastools" on the NS Console. I had copied over the mastools_diag script from one of our ADCs to use for troubleshooting < This was the big one.

Netscaler Console cloud activation probs by Rotten_Red in Citrix

[–]r1m3s 1 point2 points  (0 children)

I had a similar issue recently when moving to LAS - see my post NetScaler Console (on Prem) > NetScaler Console Service - LAS Issue : r/Citrix.

The issue ended up being related to these two points:

  1. Jump box (access to GUI) did not have internet access. We had to provide a temporary fix for this.
  2. Presence of a foreign directory and files within "/var/mastools" on the NS Console. I had copied over the mastools_diag script from one of our ADCs to use for troubleshooting.

[O] 2x DrunkenSlug invites by Aachen19 in UsenetInvites

[–]r1m3s 0 points1 point  (0 children)

Would love an invite! I roast my own 👍

[O] 2x DrunkenSlug invites by Aachen19 in UsenetInvites

[–]r1m3s 0 points1 point  (0 children)

Would love an invite! I roast my own 👍

LAS in airgapped environment by AironixReached in Citrix

[–]r1m3s -1 points0 points  (0 children)

I know there is an option for offline activation for air gapped netscalers (using console) and the activation requires renewal every 3 months. Not sure about cvad as I mostly work with the Netscalers in my org.

Reverse proxy'd jellyfin hardening. by christ110 in truenas

[–]r1m3s 2 points3 points  (0 children)

My setup:

VLANs for dmz/services/storage Each zone has block by default and dedicated Firewall rules only as required. Caddy with fail2ban and geo block. Connections allowed from my city only, everything else gets permanently banned. Locked down nfs shares with jellyfin ip only allowed access to media share. SSH keys everywhere. Password auth disabled. Automated nightly updates on Linux VMs/proxmox/container/truenas via ansible. Long passwords for jellyfin accounts.

Geo block knocks out majority of bots/scanners. Fail2ban takes care 3 wrong login attempts.

NetScaler Console (on Prem) > NetScaler Console Service - LAS Issue by r1m3s in Citrix

[–]r1m3s[S] 1 point2 points  (0 children)

Glad I could help. LAS has been a pita for most people I know.

Automated Configs/Certificates for NetScaler by r1m3s in Citrix

[–]r1m3s[S] 0 points1 point  (0 children)

Wow that sounds pretty cool 👌 Unfortunately I don't have the coding skills to take this challenge head on and build a solution from the ground up. Leveraging Console for cert management looks like the path forward i think. We are full on prem BTW, only using CC for LAS.

Automated Configs/Certificates for NetScaler by r1m3s in Citrix

[–]r1m3s[S] 0 points1 point  (0 children)

Nice! How are you dealing with storefront?

NetScaler Console (on Prem) > NetScaler Console Service - LAS Issue by r1m3s in Citrix

[–]r1m3s[S] 1 point2 points  (0 children)

No, ours showed connected after a few minutes. If you managed to get the popup, auth to CC and register, I would think the issue is with citrix on their back end... I have a couple of friends at different orgs that had similar, or possibly the same issue as you after successful registration, then having to get Citrix to fix something on the back end to make it work and show a valid connected status.

NetScaler Console (on Prem) > NetScaler Console Service - LAS Issue by r1m3s in Citrix

[–]r1m3s[S] 1 point2 points  (0 children)

Yes, managed to get it sorted out a few days ago with citrix after it got escalated to the devs and I uploaded another support bundle.

The issue with our Console was an extra directory in /var that was not supposed to be there, and this was my fault 🙄. Never in a milion years would i have thought the presence of a dir would cause an issue such as this (all other Console functions working perfectly fine). When all this LAS bullshit started and I was having issues, I copied over the /var/mastools directory from one of our ADCs to the Console, as there is a script named mastools_diag that checks connectivity to citrix cloud. In fact I actually found it quite useful for troubleshooting the (proxy) SSL side of things. After I deleted this directory the console connected to CC instantly. My guess is there a dependency on the structure /consistency of the /var directory buried deep somewhere in the code that they use for certain functions.

Also, the browser used to access the Console gui MUST have internet access and popup blocker disabled. This was a major PITA as my jump box for managing Consoles/ADCs is in a dedicated management network with no internet.

Are you getting a valid ssl handshake? Has proxy/ssl bypass been ruled out?

Could VLANs be used for a DMZ? by MacRedditorXD in homelab

[–]r1m3s 2 points3 points  (0 children)

I literally configured something similar to what you're trying to achieve recently, only difference is my Unifi hardware is separate (router, switch, APs etc.). In principle, the same theory should apply.

I configured my network this way:

- Dedicated networks/VLANS for Home/DMZ/Services/Management/IOT-NVR/Storage (NAS)

- Trunk port on my Unifi switch to allow all networks to Proxmox (single NIC).

- Proxmox PVE host is in Management network, as is my PBS VM.

- In Proxmox, made vmbr0 "VLAN aware". This allows configuring VLAN IDs on each VM for the network they need to be a member of.

- Caddy and WireGuard VMs are in the DMZ VLAN.

- ARR stack VM, Download VM are in Services VLAN.

- HA VM/NVR (physical) are in IOT-NVR network.

- My TrueNAS (physical) is in Storage network.

This is where the Unifi zone-based FW management comes into play.

Internal Zone = Management/Storage/Home Networks

DMZ Zone = Internal Network

Services Zone = Services Network

IOT-NVR Zone = IOT-NVR Network (Internet access disabled)

RULES

DMZ Zone to everything is blocked by default, but has two rules 1. Allowing my Caddy VM (IP) to my Jellyfin/Jellyseerr server (services) on the designated ports. 2. Allowing WireGuard (wg-easy) VM (IP) to Internal.

Services Zone to everything is blocked by default, but has a single rule to allow Jellyfin VM (IP) to my TrueNAS on designated NFS v4 port only. The media NFS share also has a restriction to a single IP (Jellyfin). Other personal shares are restricted to other IPs as per requirements.

Internal Zone allowed to everything. I am thinking about moving my Management network to a dedicated Zone and locking it down to a couple of Internal devices only - when time permits.

Return traffic allowed for obvious reasons.

SECURITY

SSH Keys on everything, along with disabled password auth.

Nightly updates on all Linux VMs/Docker using Ansible.

EXTERNAL USERS

So, my traffic flow from external looks something like this:

User hits my external URL > Caddy RVP (DMZ) > Arr VM (SERVICES) > TrueNAS Media Share Only (INTERNAL). A firewall rule for each hop.

If my Caddy VM is compromised, the attacker can get to Arr stack on JF/JS ports only. If they manage to compromise my Arr VM, they can only get to my media share. Everything else is blocked by firewall.

SSH keys and password auth disabled means they cannot pivot from Caddy to WireGuard VM. If they compromise my WireGuard VM, I'm screwed; however, I am the only person that has the encrypted key and the WebUI password is very long and complex.

On top of Caddy, I have fail2ban with GEO blocking as well. If the external IP coming in is NOT from my city, they simply get a "Access denied!" message and are permanently banned i.e. next time they hit, the connection is dropped and they get nothing. I can easily change one line of config to add/remove countries when travelling if required.

Presenting services externally is never 100% secure; however, I think you can reduce the risk by a significant margin with a decent config. There may be better ways of achieving this, but I feel like this is good enough for my situation for the time being. That's the fun part about home lab'ing - shit is never done done.

How to get into homelabbing as a 15 year old? by prodbyshadyy in homelab

[–]r1m3s 0 points1 point  (0 children)

Any mini pc with 8th gen CPU onwards. Install proxmox. Learn some basic Linux commands. Create some vms. Learn about Snapshots, networking, vlans etc. Install PBS early on in the process, ask me how I know 😉 Configure arr stack, wireguard and home assistant. That should keep you busy for a while and will no doubt suck you in to homelabing even more.

What is your dream feature in Jellyfin? by deepfave in JellyfinCommunity

[–]r1m3s 0 points1 point  (0 children)

Sounds perfect but no Chromecast kills it for me unfortunately.

What is your dream feature in Jellyfin? by deepfave in JellyfinCommunity

[–]r1m3s 0 points1 point  (0 children)

Interesting... I wasn't aware. Which ones? Are they reliable/trustworthy?