Home or Small business Firewall appliance

Fibre is everywhere, its reshaping our daily lives, I recall a few years ago when we were all stuck having to use ADSL, oversubscribed and erratic at the best of times. Nowdays we can stream TV in full HD while someone has a skype video call and someone else downloads emails. Its great…..I think… but is it really? 

Children nowdays all have tablets and one annoyance I find is that all the games have adverts and links, before long they have clicked or touched, and the Tablet is full of junk. In some instances, they have clicked and ended up in places where one would prefer they did not. 

Well, I found a great solution....

It’s a small Firewall Appliance, ordered off the shelf installed with the latest version of PFSense. This is a full firewall product that will give any commercial competitor a good run for its money, except that PFSense is open source. (Free)

These boxes are perfect for the job, they all can run the WAN DHCP configuration that most ISP's use and by default they allow nothing in but the LAN is allowed out. So a basic setup will get your home connected in no time.

The appliance I bought has 4 Ethernet ports for use, this is fantastic if you have a more than basic setup like I have. One port is LAN, one port is Fibre WAN, one port is LTE WAN and the other port is DMZ for guest Wifi.

You can run some pretty nice services that will for example strip those banner ads in YouTube and many websites. You can block sites based on DNS Blacklisting or category. (malware, Advertising, social media, Adult…)

If you really want to get fancy you can give priority to the Video calling but limit/block your teenagers ability to download torrents with the Traffic Shaper.

Of course, there is a web proxy you can use with its own antivirus engine and then you can use the DHCP function to control all your local addressing too.

I bought these boxes for 126 USD each, they ship with 2 Gigs or RAM and a 16 Gig SSD. They are low power devices and run super quiet as they are fan-less. You can specify more RAM and SSD if you wanted to.

My boxes arrived with PFSense installed but you could always install your own PFSense build directly off Netgate’s website.

The software is very capable, you can run two of these in a HA Cluster if you want and failover is within seconds, for any small to medium business that does not have the budget for Checkpoint this is a really great second choice. Sadly, it does not do any SD WAN although if you created multiple link and tuned the Traffic Shaper you would get pretty close.

A super little box for a bargain price...

Here are some pictures:

New in the box..

Smart ET Remotes

Smart is for everyone:

Smart home is more and more becoming a phrase heard almost everywhere. It is sure to convenience us in some respects and if you are wary of letting it get too smart then just hold the reigns tight.

There are varying degrees of smart, best thing is to stick at the level that you are comfortable.

I will make some posts about smartening up your home, all are more or less DIY-able, you don't need to be a genius, just some tech savvy and common sense will do.

The devices I have used are:

4 Channel relay switch, this is a smart switch that can be used to switch or connect anything be it a 12v light, a 220v light, motor or a dry contact like a door buzzer. Its a bank of 1, 2, 4 relays that can be pulsed (latched) or switched on/off. This is what I am using to remote switch my modified ET Remote. I have also used this to wire up a watering system, the relays simply connect to the valves for each watering zone. (not that we can use it now)

Smart switch, this is a single 220v switch that you put in line with a light or appliance. The switch can be accessed via the smart phone app but you can also setup a scheduled timer on the app that will e.g turn on a light at 8 pm and off again at 8 am or switch on a pool pump for 2 hours every day or other day.

4 Channel Smart switch, this is the exact same thing as the above switch, just a bank of 4, this comes with DIN rail clips so it can be mounted din the DB. This only switches 220 volts.

30 Amp Smart Switch, once again this is the same as the single smart switch, just 30 Amps load capable, so you can stick it in line with you geyser. Useful for a timer function.

Smart light switch, these are glass panel light switches that work on touch. Its the exact same functions as the smart switches in that you can add a timer or schedule, the glass face is very nice looking. They come in a standard 2x4 size and a irritating 3x3 size. If you have a 4x4 light switch then you need to do a modification to a blanking plate to make it work.

There are a host of other units that will allow you to interface almost anything with a smart switch, all the units will allow you to turn devices on/off with Amazon Alexa or Goggle Home. The above few are the ones that I have personally installed, as I add more smart devices I will put them into the blog.

Firstly let me do the 4 Channel Relay with the ET Remote:

Now there are probably many ways to do this and I am sure there will be a stack of people with other advice, that's great. Below is what works for me..

I needed to be able to (1) open my gate from anywhere, (2) open the garage door from anywhere and (3) arm my remote from anywhere.
The alarm was easy since mine is already connected via a phone app but having a second option is always a good idea.
The Garage and gate are a small challenge since they don't have communication modules. Yes, I could run a wire to my alarm and create a zone that can be triggered by a code on the keypad, but that's too much trouble.

There is a simpler way, since the Gate, Garage and Alarm all work off the same 4 button ET remote so I am halfway there.

I bought a "smart relay switch" and added it to my home wifi, it comes with a phone app (eWeLink) that allows me to trigger each relay independently. I can configure the module for a "latching" mode, this means its not just on / off but rather like a quick pulse.

Here is a screen shot of the eWeLink application




I then took a ET Remote and opened it up, using some tech skills I cut off the 4 switches that make the buttons and replaced them with 2 wires to each switch, I soldered the wires to the connecting pads on the PC Board. These wires I then took into the smart relay. The relay then will act as the switch and "latch" the two wires together when I press the switch on the application.

End result is that from the Phone App I can then press whatever button I assigned to the ET remote button to perform that function. As long as my phone is connected a network be it 3G or WiFi the functions will work.

I put the remote in a central place in the house so any interference from outside is negated by the walls and roof.

Costs:
I already had an ET remote so I did not need that, all I needed was a smart switch. Best place to get the is China but since it takes too long we need to pay the local premium.

Communica is a good option, Netram is also an option but its about R 100.00 more.
Just for interest sake, you can pick these up for about 20 USD in China. Below is a one button option,  so if you wanted to wire up a single button remote then the is your device.

 

Here is a photo from the user manual..






















Here is the complete unit without the covers on.
















Here is a pic from the "hacked" remote.

If your soldering sucks... I could be persuaded to do it for a bottle of red wine... if you need the whole solution it may take a case, if the case is given first, it may take a while to complete...

IT Infrastructure --- “least cost spending”

I have over the years found ways of doing things that cost very little or in some cases nothing. Yes there are downsides to “free” but its not always bad news.
Here is a list of things that can be done for a small company that will give you the feeling of a big solution.

Connectivity, we all need it and with the advent of fibre everywhere it’s a must have. How do you terminate your fibre to the home/business? The option of the cheap and nasty router is there but in the end its still just cheap and nasty.
I have found PFSense to be a fantastic solution, it’s a state-full firewall and can handle as much as you can throw at it. All you need is an old-ish PC with two network cards and you are good to go. It can do all the functions you would expect from an enterprise class firewall for the cost of ZERO.
If you wanted alternative hardware, you can buy one of those fan-less PC’s from China, they will cost you about 100 USD, comes with 2 LAN ports, a few USB and HDMI, it runs off onboard flash and runs PFSense perfectly.

If that is still not what you want then scrounge around few an old Riverbed appliance, re-flash it with PFSense, sadly it will only run the 32 bit version but it will run it very well.
PFSense can run in a HA configuration, so get two Riverbed Appliances and suddenly you have some redundancy, add a second link and you have an enterprise solution.
The firewall can do anything that an enterprise solution will do; site to site VPN, PPTP VPN, routing, policy routing, NAT, GEO IP blocking, proxy….. and more..
Yes, there are more free version around, I think they spilt off PFSense and created OpenSense at some point but since I was around from the initial stages of PFSense I have always just stuck with it. After all, if it works, why change it…

Monitoring, this is another essential requirement no matter how big or small your organization. A good monitoring system will be able to alert you of things as soon as they happen or in some cases before they happen. I use PRTG for all my monitoring requirements; the really great thing is that for a small organization you can get away with the “free” version. This is a full running version that is limited to 100 sensors. In a small business that is enough to monitor quite a lot of things.
You can monitor via SNMP and/or WMI which gives you insight into your connectivity devices and Windows servers. You can track things like disk space use get alerts generated long before the disk runs full.

Historical graphs can be viewed and netflows can be checked all giving you enough information to know what is happening on your servers, hosts and network.

Server Platform, in the past it was standard practice for a small company to have a glorified PC running the local copy of Pastel accounting or payroll, then someone had a PC that doubled up as a “ Data server”. Backups were problematic and in the end you had multiple copies of data all over the place. With the advent of VMware most corporates have moved off and gone the VMWare route leaving the smaller companies wondering what now?

Well, thankfully this has changed too, VMWare is available to the small business in the form of a “free” version.  (has actually been for a while already) It’s a working version of the platform with some limitations, but the limitations are all the things that a corporate would require.
For a small company the free version is a perfect platform to host the accounting or payroll system and any company data. The limitations are along the lines of clustering and HA.
…. Then there is the question of backups…. This is one of the limitations of the free version, if you wanted to use something like Backup Exec or Veeam you will be stopped short because the free version will not support it.
Having said that, there is a free version of Veeam but it will not run on the free VMWare, so you either need a licensed VMWare platform or a different product.

Backup software, and there just had to be one, there is a product called Unitrends that has an appliance that worked perfectly with the Free VMWare.
Of course it’s a “free” version of Unitrends too and the limitation is 2 TB of backup data. Most small companies do not backup more than a few hundred megabytes per night. The software runs as a VM on your VMWare platform, it will send you reports based on your settings, restores are quick and painless, it support files based restores or bare metal restores. You can do a backup to NAS or local disk or you can backup to local disk and do a replicate to NAS.

Wifi, we all need managed wifi connectivity and there is no other option for corporate or small business as far as I can see. Ubiquity have a fantastic selection of products, their Unify solution is great. The Access points come in 2.4 / 5 GHz models but the best thing is, free from their website is the Unify controller that will tie all the access points together. You can create a closed network and a guest network, limit use and access and have full visibility of it, all for the cost of the Access points. The controller can run as a small VMWare appliance as a linux machine meaning you don't need a Windows licence for the host.

There are a host of IT things that you can get for free, having a VMWare platform means its even easier to spin up a Linux appliance to run something, the possibilities are endless, you just need some inspiration....

3KVA Solar hybrid Installation

I have decided to do another solar installation, this time its going to be 2 installations of a 3KVA Hybrid system.

Hybrid just means its going to be a combination of Solar/Battery and Grid (Eskom), there is not really must else to do, a "Grid Tie" solution is just not feasible, you need to buy such expensive inverters in the end you pay Eskom to give them power.

The end result is going to be 3KVA system that will run some appliances off solar by day and switch to Eskom by night, if there is a power outage at night we will be able to run some things for some of the time. The "Some" of the time is battery dependant so the more you buy the more the "some" can be.

Here is my basic equipment list:

Solar Inverter
Solar Panels
Solar DB Board
DC Trip switches
Batteries
DC Cables
Inverter DB board
AC Trip switches
AC wiring

Some of the pricing I can already put here long with the suppliers:

Inverter R 2999.00 bought from SetSolar in Epping
300 Watt solar panels R 1735.00 also SetSolar Epping
DC Trip switches I ordered from Feoo in China as before, the costs including shipping are less than 15% of the local price.

Alarm Systems and a word on CCTV

An overview of Alarm Systems from my perspective

There are many security specialists around, you don’t have to look hard or far, the problem is many of them don’t really have a clue what they are doing.

I was presented with this issue when I asked about the features and tweaks for an alarm system that would make my life a little easier. Being in IT I am always of the opinion that everything can be “connected”. My alarm system is no different. Its most frustrating to get that call just as you sit down to a meal in a restaurant, “Hi, you alarm has gone off, we are sending the armed response out”.

While that in itself is a form of reassurance I would in addition want to be able to see what zone caused the alarm and then reset the system remotely. In addition having online CCTV would be great, then you can see exactly what is happening.

When I asked these questions from the installer over 8 years ago I was looked at as if I was asking the impossible.

That is when my quest began and I looked up the alarm suppliers details and registered to become an installer. Since I have an electronics background all I needed was a course from the alarm supplier and coupled with my IT knowledge I was armed with all I needed.

The concept of an alarm system is not that complex, there are a few components that make up the system, in brief:

• Alarm panel – This is the system board, its the main box usually located somewhere secure and all “zones” or sensors connect to it.

• Keypad – This is the keypad and display for arming/disarming, many times confused with the “panel”

• Zones – This is each individual sensor, be it a door magnetic contact or a passive detector, many times confused with areas.

• Partitions or Areas – This is made up of a collection of “zones” or sensors, they can be grouped to function independently of each other.

• Magnetic Contacts – This is the small square block on a window or door that senses if it is open or closed.

• Indoor Passives – This is the white box installed at ceiling height in a room, it usually has a red glow when you walk past it.

• Outdoor Passives – These are bigger than the indoor passives, they function much in the same way but are weather proof.

• Outdoor beams – These are usually black and usually have two single beams that run between two units. They work much like the ding-dong things they had in shops many years ago.

• Expanders – A system board will only have 8 built in zones, thereafter you can add another 8 zones directly onto the system, adding more requires a network expander or two.

Alarm systems have become quite technical in the last while, you can configure the systems to auto arm at a certain time, allow access to certain people only on certain days, limit access to certain areas only, turn appliances on and off by timer and you can have access to the entire system on a phone app or via your PC.

In terms of cost, the two main players are pretty much the same, yes there are cheap kits from China that will work, they usually don’t come with any support or warranty. Most systems are very scale-able, you can add zones depending on the main boards ability.

I have decided to stick to the Texecom brand, British design and manufacture and backed by local support it can do pretty much all you need it to.

As a standard I always suggest the 32 zone main board, you can start with the on board 8 zones and add expanders to accommodate more as you need. By default when you go with anything over 16 zones you need to go with a LCD keypad, this is preferable anyhow, it just makes it much easier.

As a necessity add on to the system you must get a network module, this will connect the system to your local network and with some configuration allow you to access the system via an app or your PC from anywhere. (provided you have ADSL or fibre)

I usually mix the zones on the system board, if you have door contacts and passives its a good idea to spread it over a few expanders, this way if one expander fails you don’t compromise an entire area.
Along with this configuration I create partitions or areas for convenience. If for example you have a perimeter of outdoor beams its a good idea to put these into a partition, you can then do things like create a bypass group or part arm the system to only arm the beams when you are at home.

Indoor passives come in two main types, normal infrared and then the anti-cloaking devices. Infrared detects heat differences in the air but criminals are wrapping themselves in bubble wrap, this fools the normal PIR detectors since they then cannot distinguish heat differences. The circumvent this we install anti-cloaking passives, these have microwave detectors that sense movement no matter what. Its good practice to put one or two of these in main areas.

Outdoor passives, I believe in only one make Takex, they are dual beam weatherproof passives that can cover 180 degrees and are very adjustable. Detection range is 12 meters either way so you can put them on a wall and it will cover a 24 meter area. Outdoor beams are useless, most criminals know to crawl under them.

The Texecom system has an app for iPhone and Android that will send you alerts on any alarm activation, from the app you can disarm, arm, bypass or even view CCTV cameras. The app will cater for 4 IP CCTV cameras, if this is all you need then its a very easy system to configure.

A word on CCTV, there are myriads of cheap system from China, they are not prefect but they work well enough, for residential requirements I would not buy any expensive systems.

I prefer using a system called Blue Iris, its the management system that and CCTV system would use. Many cheap systems you only make use of the console screen attached to the CCTV box. If it all you need to see then thats about where you stop.

If however you want to be able to remote view or receive alerts then Blue Iris is a million time a better than the embedded console or the supplied CMS software.

I recently discovered that Blue Iris works very well with the TVT CCTV systems, you literally can wire up the camera to the TVT box and then manage it all via a PC running Blue Iris. I run a Windows 7 mini PC with Blue Iris on it, the TVT DVR streams the video from the Cameras to the PC via the DVR. All control email alerts etc is done on the PC, the DVR is literally just a way to convert the analogue camera to IP.

Solar Power, One Year Later

Solar Power, One year later

Since the 15th August in 2015 we have been running on a Hybrid solar system, solar by day and Grid by night.

Oddly enough since the day we switched the solar on we have not had a single day's load shedding.

The system has worked fairly well, as soon as the sunlight comes in over the mountains the system kicks over to solar, some days it runs for an hour or so and then cuts back to grid because the light is just too low. In general the winter days it ends up being a cut over to solar at between 8 and 9 am, then it stays on solar until about 5 or 6 pm.

Below is typically what I see on the daily graphs. The very flat line at 230 volts is the inverter output, the horrible unstable line is the grid power. Below you can see that we ran on Solar from 8am to about 18h00

I made a mathematical calculation for projected savings, it seems I was not far off..

If I look at the year period from September 2015 to August 2016 and compare that with the year period September 2014 to August 2015, we made a 20% saving on power consumption. At the current power cost that equates to R 3140.00.

If I look at the year period from September 2013 to August 2016 and compare that with the year September 2015 to August 2016, we made a 25% saving on power consumption. At the current power cost that equates to R 4 146.00.

The reason I compare the previous year is that I started fiddling with the solar system from January 2015 already, so part of 2015 was already seeing the power savings.

From my previous blog you can see I predicted a R 3 900.00 rand saving, if I take the two above numbers and average them I am at R 3 600.00 odd rand. Pretty darn close I think.

What is not factored in to the "savings" is the additional power we have used, simply because it was available. For instance in Summer we ran the air conditioner on some of the hot days, this was never done in the past. Also my cost predictions were done on the current power cost at the time, come next year this time we will have a better ROI simply because the cost of power has gone up.

The initial investment value has gone up since the initial installation, I added a few extra WATTS of Panel.

The complete cost of the system was R 31 074.00 At the rate of R 3 600.00 its going to take 6 odd years to pay itself off, that being on an assumption that power increases by cost at 10% per year.

I predict that my Batteries my well be in need of replacement in 6 years so that would start the repayment cost again, this time the ROI value will be a fraction of the initial investment cost.

Part 4 Finally working

The physical installation

I decided to choose a blank spot on the wall next to the existing Distribution board for my Inverter, it made sense to keep all the power stuff together in one place.
I bought a wooden workbench (those flat pack DIY ones) and used the lower shelf for my batteries, keeps them off the ground and out of the way. I used nice big welding cables to run from the batteries up to a 100 amp DC trip switch, from there it runs to the Inverter battery input.

New Inverter as it arrived

100 AMP DC Trip switch

Mounting the inverter was pretty easy, it "hangs" on 3 screws much like a painting does, you need to mount it eye height so reading the display is easy.

Installed Inverter

I ordered a solar panel switch box that terminates all the solar panels into "fuses", these feed into a DC trip switch that is the equivalent of the maximum current my inverter can handle.
This I mounted slightly above the inverter, so the cables from the panels drop into the switch box and from there drop to the Inverter solar input.

PV Panel Isolator Box

I needed to get an electrician out to make some changes, the existing DB was too small and messy, I wanted a split DB so that one half would feed all lights/appliances on solar and the other half would feed all lights/appliances on the grid.

A NOTE on this, I have not gone the whole hog and just put everything onto solar, I calculated what my average daily requirements are and then scaled the system according to that. To me it makes no sense designing a system that has an unreal ROI.
For instance to cater for an average house running everything you must be able to draw a peak load of about 9000 watts, this would be say a geyser, microwave, kettle and general appliances. This is in my design a triple system, each inverter can do 4000 watts so you need to have 3 in parallel do get enough and have spare to avoid tripping everything.

I decided that I am not catering for no sun periods, at night I revert to the grid. Since we are at work most days to me it then made sense to leave the kitchen appliances on the grid, so the oven, microwave, kettle and geyser stay on the grid DB. In most cases the kettle and microwave are used at night anyhow when there is no solar, no point in scaling they system to include them if its never going to pay itself back. The only draw back here is that if we have load shedding and I need to run any of these I will have to plug them over to an inverter fed plug.

The rest of the house I moved over to the DB being fed from the inverter. The exception to the pay back theory are the lights, I know lights are used at night when there is no solar but I put them on the inverter so that in the event of load shedding we still have lights.

Once all the connections were made the last thing to do was the solar panels. An array mounting kit could cost you upwards of R 20 000.00, I was not going to pay that. There are a few options depending on the roof type. If you have a corrugated roof its dead easy, you simply buy a length of aluminium angle and pop rivet one side to the panel sides, then use those roof screws to go straight into the trusses.

In my case its cement tiles, I made some brackets from hoop iron, pop riveted one end to the panel and screwed the other into the trusses or batten (whichever was easier)
I used an aluminium channel to hold the two Solar panels together, then riveted that to the hoop iron that was fixed to the trusses.

Below is the Aluminium channel used


Here are the two panels side by side being riveted to the aluminium channel.


I used nice big rivets so there was no chance they would pull through.


Here is one set of panels, these make up one array of 48 volts, they are 2 x 380 watt 24 volt panels.


Here is the one hoop iron bracket screwed into the batten and curved around the tile


Once curved over the tile it runs under the panel, bends up by 90 degrees and is riveted to the side of the panel.


This is the top side, towards the apex of the roof


A second on showing the top side of the panel towards the apex of the roof


Here is the mounted panel showing the bottom side of the panel. You will notice I do the 90 degree bend at the edge of the tile. This is done first to position the panel, the top "fixer" is then done to fit the panel length on the tiles.



I ran the wires under a tile into the roof and made my series connections in the roof and then ran from there down to my solar switch box using 4mm wire.

Once the wiring was complete I double checked the voltages before the trip switches in each case, 48 volts DC from the batteries, about 76 volts DC from the panels, 230 volts AC from the grid input.

Switch on

Power on was first the 100 Amp trip switch from the batteries, once that was on I started up the inverter, after that I switched on the solar array and finally I added the grid input power.

System powered on and running from Grid

Then I needed to configure the system, I loaded the software supplied and connected to the inverter unit via the supplied cable. The software makes it easy to set priorities, cut back voltages, overrides etc.

System disconnected from Grid but powered on Panels

Then it was/is a case of sit back and watch how it all works, Its been almost a month and there have been some very good days and some not so good days. Seeing that its solar...on a rainy day you can kiss any savings goodbye, but that is to be expected.

My average saving thus far has been 22%, the best day was 43% and the worst was 1%. The saving over last month thus far was 27.02%.

As the sum moves around the day are getting better and better, my solar geyser is also starting to work better and I think by October my power usage will have dropped by 50% of what it is in Winter.
I think by November when we usually switch off the solar geyser element we should be using about 90% less electricity than we do in winter.

I keep referring to winter because I used it as a peg in the ground, power use is very dynamic and there is no way to get 100% accurate usage figures, each day is different. I took the average winter units per day and made that my yardstick. My feeling is whatever I can save off that figure is good for now.

I have some stats from the past few years, I managed to put them into a graph format that shows how our power use increased year on year.

Power use for 2013 (No Solar Inverter)

The first part of the year we ran under 15 units a day average, from May it went above 15 and stayed well above that for the entire year.


Power use for 2014 (No Solar inverter but a some solar powered LED Lights)

Usage wach much more evenly spread but never dropped below the 15 units a day mark.



Power use for 2015 ( Solar inverter installed 15 August)

Usage started above 15 units a day and wet up again to the 25 units a day mark until mid October when the Inverter was installed, thereafter it dropped below 15 units a day.


Power use for 2016 (Running on Solar Inverter)

Usage has stayed below 15 units a day, this despite additional load being run on the hot days in the form of an air conditioner. I did add another 500 watts of solar panels for the air conditioner though.

If I assume constant use (just for the sake of argument) and say that summer months before the system was installed I was using 17 units a day in summer months and in winter months 24 units a day then rough calculations for average power use is as follows:




If I assume constant use (again for argument sake) of 11 units a day post system installation for the summer months and using the same jump of 7 units between summer and winter so assume this winter will be an average of 18 units a day, then the post install average power use is as follows:



This shows a 30% saving on power


I calculate it as follows, at a cost of  R 1.79 per unit its an annual (estimated) saving of about
R 4000.00



This puts it very much in perspective that the ROI is just a little over 7 years.

Whether that is worth it or not I cannot say, we will have to see how much added value comes from the threat of load shedding in the next few years to see if the convenience factor plays any role is making the ROI seem better or not.

:-)

In the end it was a fantastic experience and I learnt a great deal in the process.