Skip to content

Spiral One: Network isolation

The goal of this first spiral was simply to establish a reliable management path to two Raspberry Pis. Pi 1 acts as the management node with Wi-Fi, VNC, SSH, while Pi 2 remains isolated from Wi-Fi and is only reachable through the Ethernet connection.

Check list:

  • set up two raspberry PI's,
  • first one - Pi OS full GUI
    • flash with Wi-Fi and ssh config
    • Enable VNC
    • generate ssh key
  • second one - Pi OS lite no GUI
    • flash with no wifi and public key from the first one
  • Connect the first one with Ethernet cable

I'm using two PI 4 model B. I only had my laptop so everything was done with a headless setup.

Flash PI 1

To flash I used Pi Imager I ran into issues with the custom configuration. I figured I was using a old version of Pi Imager (1.8.5) after changing to version 2.0.10. It worked it also asked to get elevated privileges and it was solved. Using nmap was very useful to debugg.

To flash I used Pi Imager, these are the steps I took:

  • Raspberry Pi OS full
  • Set hostname: pi
  • Create user: pi
  • Enable SSH
  • Use password
  • Fill out Wi-Fi info

Check the ssh conection

I booted the pi and then I ran a ssh comand to connect.

ssh pi@pi.local

It made the conection and asked for a password

pi1 ssh

Check and connect VNC

Port scan on local laptop:

nmap -Pn -p 5900,5901 <ip address>

Result:

5900/tcp closed
5901/tcp closed

I could see the firewall is not blocking VNC but the no VNC server is currently listening.

Next step was to conect the pi again and open the TUI config.

sudo raspi-config

To Enable VNC:

- Interface Options
     => VNC

Then I rebooted the pi and connected with Tiger VNC. This confirmed that the graphical desktop could be accessed remotely without attaching a monitor.

Flash PI 2

To flash I used Pi Imager, these are the steps I took:

  • Raspberry Pi OS Lite
  • Set hostname: piception
  • Create user: piception
  • Enable SSH
  • Use public key authentication
  • Paste Pi 1's public key (id_ed25519.pub)
  • Leave WiFi blank
  • Leaving Wi-Fi disabled on Pi 2 creates a physically isolated device that can only be reached through Pi 1.

Configure Pi 1 Ethernet

To make the Pi's talk I had three option I could grab a keyboard and display and set a static address on PI2. Setup a DHCP and caching DNS server or take the SD card and manualy add a static IP. I chose the DHCP because it scales better than manually configuring the Pi 2 and keeps the processes headless.

First I had to find the Ethernet connection:

nmcli connection show

Then assign it with a static IP:

sudo nmcli connection modify netplan-eth0 \
    ipv4.method manual \
    ipv4.addresses 10.10.10.1/24 \
    ipv6.method ignore \
    connection.autoconnect yes

sudo nmcli connection up netplan-eth0

Then I verified that it had worked:

ip addr show eth0

It showed:

10.10.10.1/24

Install dnsmasq

I instaled dnsmasq that is a network tool for small networks.

sudo apt update && sudo apt install dnsmasq

Just in case I made a backup for the config: 

sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig

I then opened the config and editied it:

sudo vi /etc/dnsmasq.conf

Contents:

interface=eth0
bind-interfaces
dhcp-range=10.10.10.100,10.10.10.150,255.255.255.0,12h
dhcp-host=dc:a6:32:76:6d:0e,10.10.10.2

Then I did a system restart:

sudo systemctl restart dnsmasq

Cheked the status:

sudo systemctl status dnsmasq

Now it was time to connect Pi 2 directly to Pi 1 using a standard Ethernet cable. Modern Raspberry Pi Ethernet interfaces support auto MDI-X, so a crossover cable is not required.

Then I started up the DHCP and watched the messages:

sudo journalctl -u dnsmasq -f

Expected:

DHCPDISCOVER
DHCPOFFER
DHCPREQUEST
DHCPACK

It looked all good and after restarting the pi2 I could see it connected.

Connect to the PIception

I had named the second pi PIcetion at this point and it was time to try the ssh connection.

first I pinged it to verify the connection:

ping 10.10.10.2

it responded so everything looked good now only thing left was to try the ssh.

ssh piception@10.10.10.2

And I was in the PIcetion this confirmed that key-based SSH authentication worked across the isolated Ethernet network.

picetion

I now had a architecture looking like this:

 Internet
    │
  Router
    │
  WiFi
    │
+----------------+
|     Pi 1       |
|----------------|
| VNC            |
| SSH            |
| DHCP Server    |
| 10.10.10.1     |
+----------------+
        │
   Ethernet
        │
+----------------+
|   PIception    |
|----------------|
| SSH            |
| 10.10.10.2     |
+----------------+

ssh ssh

Troubleshooting

I did need to do some troubleshooting to get this to work and here are some useful commands for debugging.

Physical link:

ip link show eth0

Check IP:

ip addr show eth0

DHCP traffic:

sudo tcpdump -i eth0 -n port 67 or port 68

Follow dnsmasq logs:

sudo journalctl -u dnsmasq -f