IBR Netzwerk

The following tables show the VLANs and subnets that are currently used in the IBR network.

IP address spaces

• IPv4 host configuration MUST be done via DHCP. Never use static address configuration!
• IPv6 host configuration MUST be done via autoconf (preferably) or DHCP (alternatively). Never use static address configuration!

If you consider to use a new IPv4 private subnet for your own work, please talk to Frank to get a unique and documented address prefix (e.g., 10.x.0.0/16).

VLANs

To be prepared for cases in which VLANs may span multiple floors of our building or even a wider range, VLAN-IDs have to be unique. Therefore, the VLAN ID namespace is managed by the GITZ. The following table lists the VLAN which are currently assigned to IBR:

IPv6 Routing

Don't worry, if you see multiple IPv6 default routes. As of 2017-02 we really have two routers: The Linux firewall and gateway router advertises itself with "low" priority, while the Mellanox switch/router advertises itself with "high" priority, because it is able to route much faster between the IBR subnets. Just in case, the Mellanox router fails, well behaved IPv6 clients should use the Linux router.

Using Switches

If you have to use multiple devices in a single room, you will most probably consider using a switch with an uplink to a room port. In this case you should keep these things in mind:

• Generally, a "flat" topology should be preferred by us and is preferred by the GITZ staff. It allows for a higher summarized throughput and a more detailed monitoring and management, e.g. when malicious clients shall be disabled by the GITZ.
• As of end of 2019 there seems to be a default limit of no more than 10 clients attached to a single GITZ switch port with respect to "IP device tracking". When the GITZ switch detects more MAC addresses we should expect some of them getting wiped from an internal table of switched target addresses leading to annoying connection problems. Upon request via the IBR DV Koordinator (Frank) the GITZ networking group may increase this limit for some ports.
• The GITZ switches do not like switches with active spanning tree protocol connected to their ports, since many such devices showed annoying misbehiour in the past. Therefore, most GITZ switch ports get automatically deactivated completely(!) for some time, if you connect a spanning tree capable switch! As a compromise, in most IBR rooms each port labeled "1.1" should be configured to represent an exception to this rule. But don't rely on this in each and every case. It would be better to carefully avoid spanning tree.
• Of course, you should avoid loops.

DNS-based Ad-Blocking (Pi-Hole)

You may wish to make your device use an (experimental) Pi-Hole DNS resolver by forcing your DHCP client to send a user-class option containing the string pihole. If you are using ISC dhclient, add this to your dhclient.conf (probably /etc/dhcp/dhclient.conf):

send user-class = "pihole";