Skip to content

Network Architecture & Infrastructure

📡 Network Overview

WithinEarth infrastructure operates on a flat network architecture with a single internal subnet, hosted at LeaseWeb data center across 3 physical racks with dual 10Gbps switching infrastructure.

Network Summary

Aspect Details
Network Type Flat Network (No VLANs)
Internal Subnet 10.32.8.0/24
WAN Bandwidth 1 Gbps (standard), 10 Gbps (XCP-ng hypervisors)
LAN Switching Dual 10 Gbps managed switches (WAN + LAN)
Hosting Provider LeaseWeb Data Center
Physical Layout 3 racks with redundant switching
Firewall Solution pfSense (Multiple instances)
VPN Solution WireGuard (2 servers)
Security pfSense IDS/IPS, HAProxy rate limiting & DDoS protection

🌐 Complete Network Topology

graph TB
    INTERNET["🌍 Internet"]

    subgraph LEASEWEB["🏢 LeaseWeb Data Center - 3 Racks"]
        subgraph SWITCHES["⚡ Network Switching Infrastructure"]
            WAN_SW["WAN Switch<br/>10 Gbps Managed"]
            LAN_SW["LAN Switch<br/>10 Gbps Managed<br/>10.32.8.0/24"]
        end

        subgraph PUBLIC_FACING["🌐 Public-Facing Services"]
            HAPROXY_PUB["HAProxy Aloha HA<br/>Floating IP: 89.149.192.33<br/>Master: 10.32.8.36<br/>Standby: 10.32.8.38"]

            subgraph VPN_SERVERS["🔐 VPN Servers (WireGuard)"]
                VPN1["VPN-Employee<br/>10.32.8.XX<br/>Public: 95.211.19.203"]
                VPN2["VPN-2<br/>10.32.8.XX"]
            end

            MEET["Jitsi Meet Server<br/>meet.withinearth.com<br/>95.211.19.213"]
        end

        subgraph FIREWALLS["🛡️ Firewall Layer (pfSense)"]
            PFS1["pfSense-1 (Main Gateway)<br/>10.32.8.XX<br/>Public: 95.211.19.202<br/>IDS/IPS Enabled"]
            PFS2["pfSense-2<br/>10.32.8.XX<br/>Public: 95.211.19.205<br/>VM on XCP-2"]
        end

        subgraph SUPPLIER_GATEWAYS["🚪 Supplier Gateway Layer (NAT)"]
            GW1["Gateway-1<br/>10.32.8.3<br/>Public: 95.211.19.201<br/>Serves: Proxy 1,2,3"]
            GW2["Gateway-2<br/>10.32.8.4<br/>Public: 95.211.19.207<br/>Serves: Proxy 4,5"]
            GW3["Gateway-3<br/>10.32.8.10<br/>Public: 95.211.19.211<br/>Serves: Proxy 6,7"]
            SP1["Supplier Proxy-1<br/>10.32.8.41<br/>Public: 178.162.128.4"]
        end

        subgraph INTERNAL["🖥️ Internal Network (10.32.8.0/24)"]
            direction LR
            API_SERVERS["7 API Servers<br/>134, 135, 139, 137<br/>35, 166, 167<br/><b>WAN Disabled</b><br/><b>LAN Only</b>"]

            DB_SERVERS["SQL & MongoDB<br/>16+ SQL Databases<br/>8 MongoDB Servers<br/>All on LAN"]

            PROXY_SERVERS["7 Supplier Proxies<br/>41, 42, 43, 48<br/>45, 46, 47<br/>LAN Only"]

            OTHER_SERVICES["Supporting Services<br/>RabbitMQ, OTH, CM<br/>Monitoring, etc."]
        end
    end

    EMPLOYEES["👥 Remote Employees"]
    CLIENTS["👥 End Users<br/>(Agents, B2B)"]
    SUPPLIERS["🏨 External Suppliers<br/>Expedia, Booking.com<br/>Agoda, HotelBeds, etc."]

    INTERNET --> WAN_SW
    WAN_SW --> HAPROXY_PUB
    WAN_SW --> VPN1 & VPN2
    WAN_SW --> MEET
    WAN_SW --> PFS1 & PFS2
    WAN_SW --> GW1 & GW2 & GW3 & SP1

    EMPLOYEES -.WireGuard VPN.-> VPN1 & VPN2
    VPN1 & VPN2 --> LAN_SW

    CLIENTS --> HAPROXY_PUB
    HAPROXY_PUB --> LAN_SW

    LAN_SW --> API_SERVERS
    LAN_SW --> DB_SERVERS
    LAN_SW --> PROXY_SERVERS
    LAN_SW --> OTHER_SERVICES

    API_SERVERS --> PROXY_SERVERS
    PROXY_SERVERS --> GW1 & GW2 & GW3
    GW1 & GW2 & GW3 --> INTERNET
    SP1 --> INTERNET
    INTERNET --> SUPPLIERS

    style HAPROXY_PUB fill:#90EE90
    style PFS1 fill:#FFB6C1
    style PFS2 fill:#FFB6C1
    style API_SERVERS fill:#87CEEB
    style LEASEWEB fill:#F0F0F0

🔄 Complete Traffic Flow Diagram

graph LR
    subgraph EXTERNAL["🌍 External Traffic"]
        USERS["End Users"]
        SUPPLIERS["Supplier APIs<br/>Expedia, Agoda<br/>Booking.com"]
        EMPLOYEES["Remote Team"]
    end

    subgraph PUBLIC_IPS["📡 Public IP Layer"]
        HAPROXY_IP["HAProxy Public<br/>89.149.192.33"]
        VPN_IP["VPN Public<br/>95.211.19.203"]
        GW1_IP["Gateway-1<br/>95.211.19.201"]
        GW2_IP["Gateway-2<br/>95.211.19.207"]
        GW3_IP["Gateway-3<br/>95.211.19.211"]
    end

    subgraph INTERNAL_LAN["🏢 Internal LAN (10.32.8.0/24)"]
        direction TB
        HAPROXY["HAProxy HA<br/>36, 38"]
        VPN["VPN Servers<br/>WireGuard"]

        API["7 API Servers<br/>WAN: Disabled<br/>LAN: Active"]

        PROXY["7 Supplier Proxies<br/>41-48"]

        GW_INT["3 NAT Gateways<br/>3, 4, 10"]

        DB["Databases<br/>SQL + MongoDB"]
    end

    USERS -->|"HTTPS"| HAPROXY_IP
    HAPROXY_IP -->|"NAT"| HAPROXY

    EMPLOYEES -->|"WireGuard"| VPN_IP
    VPN_IP --> VPN

    HAPROXY -->|"HTTP/HTTPS"| API
    VPN -->|"SSH/RDP/HTTPS"| API

    API -->|"Search Request"| PROXY
    API <-->|"DB Queries"| DB

    PROXY --> GW_INT
    GW_INT -->|"NAT"| GW1_IP & GW2_IP & GW3_IP

    GW1_IP & GW2_IP & GW3_IP -->|"HTTPS API Calls"| SUPPLIERS

    style HAPROXY_IP fill:#90EE90
    style API fill:#87CEEB
    style SUPPLIERS fill:#FFA500

🗺️ Public IP Address Allocation

XCP-ng Hypervisor 1 (10.32.8.22)

Public IP Internal IP Service Purpose
95.211.19.201 10.32.8.3 Supplier Gateway-1 NAT for Proxies 1, 2, 3
95.211.19.202 10.32.8.XX pfSense-1 Main Gateway & Firewall
95.211.19.203 10.32.8.XX VPN-Employee WireGuard VPN for team
178.162.128.4 10.32.8.41 Supplier Proxy-1 Direct supplier connection

XCP-ng Hypervisor 2 (10.32.8.23)

Public IP Internal IP Service Purpose
95.211.19.205 10.32.8.XX pfSense-2 Secondary Firewall
95.211.19.207 10.32.8.4 Supplier Gateway-2 NAT for Proxies 4, 5
95.211.19.208 - Reserved -
95.211.19.209 - Reserved -

XCP-ng Hypervisor 3 (10.32.8.24)

Public IP Internal IP Service Purpose
95.211.19.210 - Reserved -
95.211.19.211 10.32.8.10 Supplier Gateway-3 NAT for Proxies 6, 7
95.211.19.212 - Reserved -
95.211.19.213 10.32.8.XX meet.withinearth.com Jitsi Meet Server

HAProxy Aloha (on Proxmox)

Public IP Internal IP Service Purpose
89.149.192.33 10.32.8.36/38 HAProxy Floating IP Main application load balancer
212.7.202.151 - Reserved/Secondary -
212.7.202.152 - Reserved/Secondary -

🔐 VPN Infrastructure (WireGuard)

VPN Architecture

graph LR
    subgraph REMOTE["🏠 Remote Locations"]
        DEV1["Developer 1"]
        DEV2["Developer 2"]
        ADMIN1["System Admin"]
        SUPPORT["Support Team"]
    end

    subgraph VPN_LAYER["🔐 WireGuard VPN Layer"]
        VPN_PRIMARY["VPN-Employee<br/>10.32.8.XX<br/>Public: 95.211.19.203<br/>WireGuard"]
        VPN_BACKUP["VPN-2<br/>10.32.8.XX<br/>WireGuard Backup"]
    end

    subgraph ACCESS["🎯 Accessible Resources"]
        ALL_SERVERS["All Internal Servers<br/>10.32.8.0/24<br/>- API Servers<br/>- Databases<br/>- Monitoring<br/>- Management"]
    end

    DEV1 & DEV2 & ADMIN1 & SUPPORT -->|"WireGuard Tunnel"| VPN_PRIMARY
    DEV1 & DEV2 & ADMIN1 & SUPPORT -.Failover.-> VPN_BACKUP

    VPN_PRIMARY --> ALL_SERVERS
    VPN_BACKUP --> ALL_SERVERS

    style VPN_PRIMARY fill:#90EE90
    style VPN_BACKUP fill:#FFE4B5

VPN Configuration

Parameter Value
Protocol WireGuard
Primary Server VPN-Employee (95.211.19.203)
Backup Server VPN-2
Access Network 10.32.8.0/24 (Full internal network)
Use Case Internal team access only
Allowed Access SSH, RDP, HTTPS, Database ports
Users Developers, System Admins, Support

🚪 Supplier Gateway Routing

Gateway Distribution & NAT Configuration

graph LR
    subgraph APIs["🖥️ API Servers (LAN Only)"]
        API1["API-1<br/>10.32.8.134"]
        API2["API-2<br/>10.32.8.135"]
        API3["API-3<br/>10.32.8.139"]
        API4["API-4<br/>10.32.8.137"]
        API5["API-5<br/>10.32.8.35"]
        API6["API-6<br/>10.32.8.166"]
        API7["API-7<br/>10.32.8.167"]
    end

    subgraph PROXIES["🔌 Supplier Proxies (LAN)"]
        P1["Proxy-1<br/>10.32.8.41"]
        P2["Proxy-2<br/>10.32.8.42"]
        P3["Proxy-3<br/>10.32.8.43"]
        P4["Proxy-4<br/>10.32.8.48"]
        P5["Proxy-5<br/>10.32.8.45"]
        P6["Proxy-6<br/>10.32.8.46"]
        P7["Proxy-7<br/>10.32.8.47"]
    end

    subgraph GATEWAYS["🚪 NAT Gateways"]
        GW1["Gateway-1<br/>LAN: 10.32.8.3<br/>WAN: 95.211.19.201"]
        GW2["Gateway-2<br/>LAN: 10.32.8.4<br/>WAN: 95.211.19.207"]
        GW3["Gateway-3<br/>LAN: 10.32.8.10<br/>WAN: 95.211.19.211"]
    end

    INTERNET["🌍 Internet<br/>Supplier APIs"]

    API1 --> P1 --> GW1
    API2 --> P2 --> GW1
    API3 --> P3 --> GW1
    API4 --> P4 --> GW2
    API5 --> P5 --> GW2
    API6 --> P6 --> GW3
    API7 --> P7 --> GW3

    GW1 & GW2 & GW3 -->|"NAT to Public IP"| INTERNET

    style API1 fill:#87CEEB
    style API2 fill:#87CEEB
    style API3 fill:#87CEEB
    style API4 fill:#87CEEB
    style API5 fill:#87CEEB
    style API6 fill:#87CEEB
    style API7 fill:#87CEEB
    style INTERNET fill:#FFA500

Gateway Routing Table

API Server Supplier Proxy NAT Gateway Public IP Suppliers Served
API-1 (134) Proxy-1 (41) Gateway-1 (3) 95.211.19.201 Expedia, Agoda, etc.
API-2 (135) Proxy-2 (42) Gateway-1 (3) 95.211.19.201 Booking.com, etc.
API-3 (139) Proxy-3 (43) Gateway-1 (3) 95.211.19.201 HotelBeds, etc.
API-4 (137) Proxy-4 (48) Gateway-2 (4) 95.211.19.207 Various suppliers
API-5 (35) Proxy-5 (45) Gateway-2 (4) 95.211.19.207 Various suppliers
API-6 (166) Proxy-6 (46) Gateway-3 (10) 95.211.19.211 Various suppliers
API-7 (167) Proxy-7 (47) Gateway-3 (10) 95.211.19.211 Various suppliers

Traffic Flow: 1. API Server generates search request 2. Request sent to assigned Supplier Proxy 3. Proxy forwards to NAT Gateway 4. Gateway performs NAT and routes via public IP 5. Traffic reaches external supplier APIs (Expedia, Agoda, Booking.com, etc.) 6. Response follows reverse path

🏢 Physical Network Infrastructure

Data Center Layout

graph TB
    subgraph DATACENTER["🏢 LeaseWeb Data Center"]
        subgraph RACK1["Rack 1"]
            XCP1["XCP-ng Hypervisor 1<br/>10.32.8.22<br/>11 VMs"]
            PHYSICAL1["Physical Servers<br/>API-1, API-2<br/>SQL Replicas"]
        end

        subgraph RACK2["Rack 2"]
            XCP2["XCP-ng Hypervisor 2<br/>10.32.8.23<br/>17 VMs"]
            PHYSICAL2["Physical Servers<br/>API-3, API-4<br/>MongoDB 51-53"]
        end

        subgraph RACK3["Rack 3"]
            XCP3["XCP-ng Hypervisor 3<br/>10.32.8.24<br/>14 VMs<br/><b>10 Gbps WAN</b>"]
            PHYSICAL3["Physical Servers<br/>API-5, API-6, API-7<br/>SQL Primary"]
            PROX["Proxmox Cluster<br/>13, 14<br/>HAProxy Aloha VMs"]
        end

        subgraph NETWORK["⚡ Network Infrastructure"]
            WAN_SWITCH["WAN Switch<br/>10 Gbps Managed<br/>Single Switch"]
            LAN_SWITCH["LAN Switch<br/>10 Gbps Managed<br/>Single Switch<br/>10.32.8.0/24"]
        end
    end

    ISP["🌐 LeaseWeb ISP<br/>1 Gbps (Standard)<br/>10 Gbps (XCP-ng)"]

    ISP --> WAN_SWITCH
    WAN_SWITCH --> XCP1 & XCP2 & XCP3 & PROX
    WAN_SWITCH --> LAN_SWITCH

    LAN_SWITCH --> XCP1 & XCP2 & XCP3
    LAN_SWITCH --> PHYSICAL1 & PHYSICAL2 & PHYSICAL3
    LAN_SWITCH --> PROX

    style DATACENTER fill:#F5F5F5
    style NETWORK fill:#E0E0E0
    style WAN_SWITCH fill:#90EE90
    style LAN_SWITCH fill:#87CEEB

Physical Network Specifications

Component Specification Details
Location LeaseWeb Data Center 3 Physical Racks
WAN Switch 10 Gbps Managed Single switch, all uplinks
LAN Switch 10 Gbps Managed Single switch, internal network
Network Cabling 10 Gbps All servers connected at 10 Gbps
Internet Bandwidth 1 Gbps / 10 Gbps Standard: 1 Gbps, XCP-ng: 10 Gbps
Redundancy Dual NICs All servers have 2 NICs (WAN + LAN)
API Server NICs LAN Only WAN interface disabled for security

NIC Configuration

Server Type NIC 1 (WAN) NIC 2 (LAN) Purpose
API Servers Disabled Active (10.32.8.0/24) Security - No direct internet access
Gateway Servers Active (Public IP) Active (10.32.8.0/24) NAT and routing
Database Servers Disabled Active (10.32.8.0/24) Internal only
Hypervisors Active Active Management and VM traffic
HAProxy Aloha Active (89.149.192.33) Active (10.32.8.0/24) Load balancing

🛡️ Security Architecture

Firewall Configuration (pfSense)

graph TB
    INTERNET["🌍 Internet"]

    subgraph FIREWALL_LAYER["🛡️ pfSense Firewall Layer"]
        PFS1["pfSense-1 (Main)<br/>10.32.8.XX<br/>Public: 95.211.19.202<br/><b>IDS/IPS Enabled</b>"]
        PFS2["pfSense-2 (Secondary)<br/>10.32.8.XX<br/>Public: 95.211.19.205<br/><b>IDS/IPS Enabled</b>"]
    end

    subgraph PROTECTED["🔒 Protected Internal Network"]
        INTERNAL["10.32.8.0/24<br/><b>No Internal Firewalls</b><br/>Flat Network<br/>Full Trust"]
    end

    subgraph PROTECTION["🛡️ Security Measures"]
        HAPROXY_SEC["HAProxy Aloha<br/><b>Rate Limiting</b><br/><b>DDoS Protection</b><br/><b>IP Whitelisting</b>"]
        PFSENSE_SEC["pfSense IDS/IPS<br/><b>Snort/Suricata</b><br/><b>Firewall Rules</b>"]
    end

    INTERNET --> PFS1 & PFS2
    PFS1 & PFS2 --> INTERNAL
    INTERNET --> HAPROXY_SEC
    HAPROXY_SEC --> INTERNAL

    style PFS1 fill:#FFB6C1
    style PFS2 fill:#FFB6C1
    style HAPROXY_SEC fill:#90EE90
    style INTERNAL fill:#87CEEB

Security Layers

Layer Technology Protection Details
Perimeter pfSense Firewall IDS/IPS, NAT, Filtering Main gateway with Snort/Suricata
Application HAProxy Aloha Rate Limiting, DDoS Protection IP whitelisting enabled
Internal Flat Network No internal firewalls Full trust within 10.32.8.0/24
Access WireGuard VPN Encrypted tunnel Team access only
Updates Manual Patching Security updates Applied manually as needed

Security Zones

Zone Servers Access Level Protection
Public-Facing HAProxy (89.149.192.33) Internet accessible Rate limiting, DDoS, IP whitelist
VPN Access VPN servers (95.211.19.203) WireGuard only Encrypted tunnel
NAT Gateways 3 Supplier Gateways Outbound only pfSense firewall rules
Internal LAN All other servers (10.32.8.0/24) VPN or internal only No direct internet access
API Servers 7 API servers LAN only (WAN disabled) Maximum security - no WAN NIC

Critical Security Measures

API Server Isolation

All 7 API servers have WAN interfaces DISABLED - Only LAN connectivity (10.32.8.0/24) - No direct internet access - All outbound traffic via Supplier Proxies → NAT Gateways - Accessible only via HAProxy or VPN

HAProxy Aloha Protection

  • Rate Limiting: Prevents API abuse
  • DDoS Protection: Automated mitigation
  • IP Whitelisting: Only approved IPs can access
  • Public IP: 89.149.192.33 (only public entry point)

No Internal Firewall

  • Flat network architecture
  • No VLANs or segmentation
  • Full trust model within 10.32.8.0/24
  • Security relies on perimeter defense

📊 Network Monitoring

Monitoring Infrastructure

Tool Server IP Purpose Protocol
Zabbix Physical Server 10.32.8.148 Infrastructure monitoring SNMP, ICMP, Agents
UptimeKuma VM on XCP-3 10.32.8.102 Uptime monitoring HTTP/HTTPS checks
Netdata Multiple servers Various Bandwidth monitoring Real-time metrics
HAProxy Stats HAProxy Aloha 10.32.8.36 Load balancer stats Built-in dashboard

Monitored Metrics

  • Network Traffic: Bandwidth utilization on all servers
  • Connection Status: All public IPs and services
  • VPN Connections: Active WireGuard tunnels
  • Gateway Health: NAT gateway availability
  • API Response Times: End-to-end latency monitoring
  • Firewall Logs: pfSense IDS/IPS alerts

🔧 Network Configuration Reference

Internal Network (10.32.8.0/24)

Range Purpose Details
10.32.8.1 Gateway Default gateway
10.32.8.3-10 Gateways & Infrastructure NAT gateways, core services
10.32.8.11-50 Databases SQL, MongoDB, OTH, etc.
10.32.8.51-100 MongoDB & NoSQL MongoDB cluster and instances
10.32.8.101-150 Monitoring & Management Zabbix, UptimeKuma, etc.
10.32.8.134-167 API Servers 7 API servers (physical)
10.32.8.41-48 Supplier Proxies 7 Supplier Proxy servers (VMs)

DNS Configuration

Type Servers Usage
External DNS Google (8.8.8.8), Cloudflare (1.1.1.1) All servers use public DNS
Internal DNS None No internal DNS server
Resolution IP-based Direct IP addressing for internal services

Routing Configuration

Type Configuration Details
Static Routes None Flat network, no static routes
Default Gateway 10.32.8.1 All servers point to this gateway
NAT 3 Gateway servers Supplier traffic NAT to public IPs
Internal Routing Layer 2 switching All traffic on same subnet

📋 Quick Reference

Critical IP Addresses

Service Internal IP Public IP Purpose
HAProxy Master 10.32.8.36 89.149.192.33 Main load balancer
HAProxy Standby 10.32.8.38 89.149.192.33 Failover load balancer
VPN Primary 10.32.8.XX 95.211.19.203 WireGuard VPN
pfSense Main 10.32.8.XX 95.211.19.202 Main firewall & gateway
Gateway-1 10.32.8.3 95.211.19.201 NAT for Proxies 1,2,3
Gateway-2 10.32.8.4 95.211.19.207 NAT for Proxies 4,5
Gateway-3 10.32.8.10 95.211.19.211 NAT for Proxies 6,7
SQL Primary 10.32.8.130 - Primary database (LAN only)
Zabbix 10.32.8.148 - Monitoring server (LAN only)

Network Access Methods

Access Type Method Endpoint Users
Public API HTTPS 89.149.192.33 End users, agents, B2B
Team VPN WireGuard 95.211.19.203 Internal team members
Supplier APIs HTTPS Via 3 NAT gateways API servers only
Management SSH/RDP Via VPN System administrators

🚨 Network Troubleshooting

Common Issues & Solutions

Issue Symptom Solution
Cannot reach API External users unable to connect Check HAProxy (10.32.8.36), verify 89.149.192.33
VPN not connecting WireGuard tunnel fails Check VPN server (95.211.19.203), verify firewall
Supplier timeout API cannot reach suppliers Check NAT gateways (3, 4, 10), verify public IPs
Internal connectivity Servers cannot reach each other Check LAN switch, verify 10.32.8.0/24 network
Slow performance High latency Check Netdata bandwidth monitoring, verify 10 Gbps links

Health Check Commands

# Check HAProxy status
curl -I http://10.32.8.36:8080/stats

# Verify VPN connectivity
ping 10.32.8.102 (from VPN client)

# Check NAT gateway routing
traceroute -I 95.211.19.201 (from supplier proxy)

# Test database connectivity
telnet 10.32.8.130 1988 (SQL Primary)

# Verify MongoDB
telnet 10.32.8.51 27017 (MongoDB-1)

Last Updated: 2025-11-16 Network Infrastructure: LeaseWeb Data Center - 10 Gbps Dual Switching