IIG lab VLAN in CIIRC

rtime server acts as DHCP, DNS and TFTP server for the IIG_lab VLAN in CIIRC (IP addresses 10.35.95.*). If your device is not on this VLAN, you can ask the IT department to reconfigure your Ethernet socket to be on this VLAN.

Advantages of the IIG_lab VLAN:

You can have static IP address – ask Michal Sojka to get one.
All assigned IP addresses (static or dynamic) get two DNS entries in the local DNS: «hostname» and «hostname».rtime.ciirc.cvut.cz (note that both names are not "visible" outside of IIG_lab VLAN):
- «hostname» can be used to easily contact your device from the local network
- The fully qualified name makes it easy to access your device over the SSH from the internet. Just add the following to your ~/.ssh/config:
```
Host *.rtime.ciirc.cvut.cz
     ProxyJump «your_login»@rtime.ciirc.cvut.cz
     # or if you only have an account on the ritchie server
     # ProxyJump «your_login»@ritchie.ciirc.cvut.cz
```
Your device can boot from network

Wireguard VPN

You can connect to the local network from outside via Wireguard VPN. To use the VPN, you have many options. Two most common are:

Configuring the VPN in Network Manager. This is useful for Linux workstations.
Configuring it via configuration files and starting it at boot. This is useful for embedded devices connecting, for example, via Wi-Fi.

For the latter option, create /etc/wireguard/wg0.conf similar to the one below. You can ask Michal Sojka to automatically generate one for you. If that's not possible, prepare the file yourself including the key pair.

[Interface]
Address = 192.168.95.XXX/24
ListenPort = 51820
PrivateKey = ...

[Peer]
PublicKey = T6/nLgiNeavqRbnbX3bzEGEfwkN2H+HMkyj9yARsIU8=
AllowedIPs = 192.168.95.0/24
Endpoint = 147.32.71.16:55820
PersistentKeepalive = 60

PrivateKey can be generated by running:

wg genkey

Corresponding public key can be obtained by:

echo <PRIVKEY> | wg pubkey

Send the public key to Michal Sojka and he will tell you the last byte of the address (XXXX), which you should use in the wg0.conf file.

To start the VPN, run:

wg-quick up wg0

To do this automatically at boot, ensure that the above command is executed. On systems with systemd, run:

systemctl edit --full --force wireguard-wg0

Then put the following to the opened editor:

[Unit]
After=network.target network-online.target
Description=WireGuard Tunnel - wg0
Requires=network-online.target

[Service]
ExecStart=wg-quick up wg0
ExecStop=wg-quick down wg0
RemainAfterExit=true
Type=oneshot

[Install]
WantedBy=multi-user.target

Then enable the just created unit by:

systemctl enable wireguard-wg0