Small Restaurant Network Redesign
-
First...
AD needs to go, as does the QNAP as the storage device. Neither makes any sense here. AD is just adding risk, not value. Those should be "just removed."
For storage, something like DropBox would be fine, but is costly on a month to month basis. Since there is a central site here, and presumably a little hardware that the Windows system is currently running on, I think running NextCloud there makes sense. It's free and we know how dead simple it is to install. That'll replace AD and the QNAP, all at once. And it will remove the need for the VPN with it. All in one move.
Nextcloud will be easier to use and manage, more reliable for everyone, and start saving a lot of money right away.
With this, I believe, there is no need for any Windows Server licensing, Windows CAL licensing, NAS device, or VPNs.
-
Second step, remove all of the Cisco routers that are potentially compromised. The VAR is pretty clearly not to be trusted and has made claims that the Cisco routers and switches aren't powerful enough for 300Kb/s of VoIP traffic. So whether he's an idiot or has actually sabotaged the network does not matter. What matters is getting all of the expensive Cisco gear, and the access from that unscrupulous vendor, out of there.
Ubiquiti ERLs at all four sites would be best. (They've actually done one site already, so this is moving forward.) This is about $450 total (it's not in the US, so prices are a little higher.) There is no need for VPNs, so just the most basic setup is all that is needed. Nothing more. Cheap, quick, and easy. Once the Cisco routers and switches are gone, the old VAR has no hold over them.
-
Next I'd add a UNMS to the main site, on the same server hardware as the NextCloud instance. Simple visibility and remote management of the remote offices. This isn't needed, but it's free, so a nice extra project.
-
The only piece that isn't super obvious is... what would be the best access method for remote management of the three non-HQ restaurant PCs? There are only a few machines, so maybe some service has a free tier that would cover this?
Or set up OpenVPN on the ERLs there and use that from the IT manager's workstation to connect ad hoc to a site to access the PCs over RDP? Or even simpler, just open RDP but IP lock it only to the four sites. RDP isn't that insecure on its own, people like to say that but it's mostly a myth. But add IP firewall locking to just the four restaurant or HQ sites and it's just as secure as any VPN, but really simplified.
-
And, of course, deploying free SodiumSuite to the handful of PCs would give a little simplified visibility into the network. Doesn't replace anything there already, but gives a few RMM-like features that you might as well have once going this route.
-
@scottalanmiller said in Small Restaurant Network Redesign:
The only piece that isn't super obvious is... what would be the best access method for remote management of the three non-HQ restaurant PCs? There are only a few machines, so maybe some service has a free tier that would cover this?
Or set up OpenVPN on the ERLs there and use that from the IT manager's workstation to connect ad hoc to a site to access the PCs over RDP? Or even simpler, just open RDP but IP lock it only to the four sites. RDP isn't that insecure on its own, people like to say that but it's mostly a myth. But add IP firewall locking to just the four restaurant or HQ sites and it's just as secure as any VPN, but really simplified.
ZeroTier?
-
@fateknollogee said in Small Restaurant Network Redesign:
@scottalanmiller said in Small Restaurant Network Redesign:
The only piece that isn't super obvious is... what would be the best access method for remote management of the three non-HQ restaurant PCs? There are only a few machines, so maybe some service has a free tier that would cover this?
Or set up OpenVPN on the ERLs there and use that from the IT manager's workstation to connect ad hoc to a site to access the PCs over RDP? Or even simpler, just open RDP but IP lock it only to the four sites. RDP isn't that insecure on its own, people like to say that but it's mostly a myth. But add IP firewall locking to just the four restaurant or HQ sites and it's just as secure as any VPN, but really simplified.
ZeroTier?
Duh, of course. Thank you. No idea why that didn't occur to me.
-
@scottalanmiller said in Small Restaurant Network Redesign:
@fateknollogee said in Small Restaurant Network Redesign:
@scottalanmiller said in Small Restaurant Network Redesign:
The only piece that isn't super obvious is... what would be the best access method for remote management of the three non-HQ restaurant PCs? There are only a few machines, so maybe some service has a free tier that would cover this?
Or set up OpenVPN on the ERLs there and use that from the IT manager's workstation to connect ad hoc to a site to access the PCs over RDP? Or even simpler, just open RDP but IP lock it only to the four sites. RDP isn't that insecure on its own, people like to say that but it's mostly a myth. But add IP firewall locking to just the four restaurant or HQ sites and it's just as secure as any VPN, but really simplified.
ZeroTier?
Duh, of course. Thank you. No idea why that didn't occur to me.
Haha, I figured you probably just forgot ZT.
Not to thread-jack, but I'm looking forward to using the new ZeroTier Edge devices -
Also, do they need to be PCI Compliant?
-
@scottalanmiller said in Small Restaurant Network Redesign:
There is a Windows Server somewhere in this mix providing Active Directory to 15 users.
Is this Windows Server here only for providing AD?
Is this hardware good enough to be used as a KVM host?
I assume the plan is to convert this box & run NC, UNMS etc as vm's. -
@fateknollogee said in Small Restaurant Network Redesign:
@scottalanmiller said in Small Restaurant Network Redesign:
There is a Windows Server somewhere in this mix providing Active Directory to 15 users.
Is this Windows Server here only for providing AD?
Correct
-
@fateknollogee said in Small Restaurant Network Redesign:
Is this hardware good enough to be used as a KVM host?
If it can run Windows at all, we can presume so
-
@scottalanmiller said in Small Restaurant Network Redesign:
For storage, something like DropBox would be fine, but is costly on a month to month basis. Since there is a central site here, and presumably a little hardware that the Windows system is currently running on, I think running NextCloud there makes sense. It's free and we know how dead simple it is to install. That'll replace AD and the QNAP, all at once. And it will remove the need for the VPN with it. All in one move.
-
What are the requirements?
- Is Windows a requirement?
- Is remote access to each PC needed?
- Does SodiumSuite yet provide the functionality of inputting Salt commands on the minions?
- Is central management of each Ubiquity needed?
Phones seem okay as those are already hosted somewhere.
Ciscos replaced with Ubiquiti makes sense as you suggested.
Using their existing Windows server to host NC also makes sense as you suggested.
What exactly does ZeroTier allow you to do, and how does it work? Their website isn't very descriptive in what it provides.
-
ZT is a software defined network software. It basically creates a VPN between all devices and gives all machine access to all other machines in that network directly.
-
@tim_g said in Small Restaurant Network Redesign:
What are the requirements?
- Is Windows a requirement?
I believe so, but only on the desktop.
-
@tim_g said in Small Restaurant Network Redesign:
What exactly does ZeroTier allow you to do, and how does it work? Their website isn't very descriptive in what it provides.
It's technically a VPN, but it's a SDN built using VPN tech. The important piece here is just that it gives a single IP range for the machines, not that it has VPN functionality. It just deals with the access portions and addressing.
I'm not sure I'd do it, though, just doing the RDP with port locking seems like it might be better.
-
@tim_g said in Small Restaurant Network Redesign:
- Is central management of each Ubiquity needed?
No, just a freebie bonus.
-
@scottalanmiller said in Small Restaurant Network Redesign:
@tim_g said in Small Restaurant Network Redesign:
I'm not sure I'd do it, though, just doing the RDP with port locking seems like it might be better.
Remote Utilities has an RDP mode and is free for commercial use for up to 10 computers.
-
@scottalanmiller said in Small Restaurant Network Redesign:
@fateknollogee said in Small Restaurant Network Redesign:
@scottalanmiller said in Small Restaurant Network Redesign:
The only piece that isn't super obvious is... what would be the best access method for remote management of the three non-HQ restaurant PCs? There are only a few machines, so maybe some service has a free tier that would cover this?
Or set up OpenVPN on the ERLs there and use that from the IT manager's workstation to connect ad hoc to a site to access the PCs over RDP? Or even simpler, just open RDP but IP lock it only to the four sites. RDP isn't that insecure on its own, people like to say that but it's mostly a myth. But add IP firewall locking to just the four restaurant or HQ sites and it's just as secure as any VPN, but really simplified.
ZeroTier?
Duh, of course. Thank you. No idea why that didn't occur to me.
If you want ad-hoc full network connectivity instead of point to point, EdgeOS fully supports L2TP with IPSEC.
