by uwave » Fri Apr 27, 2012 11:22 pm
Uwave swapped out our power hungry server for distributed pcs tied together with a gig-e network on a transcend managed gig-e switch. We have 4 buildings tied w/ microwave links runnig 10gbps on the microwave channel, but just 1gpbs cat5e cables inside to maintain compatibility with the pcs, net printers, designjet plotters, etc.
Pretty much at the heart of this is - yea you guessed it - our synology server. It watches our cameras and logs traffic. It moves data to/from remote pcs, runs our vpn when we are offsite, has 15 T1 lines attached and inverse muxed into a single 100 mbps link. We use android phones and their lapdock solutionon 4g (31mbps down / 20 mbps up) to link home - the lapdock lets us drop any cellphone into it and have a 1080x1920 display w/ stereo speakers (amped) and touchpad and keyboard. We prefer to use wireless keyboards, so there is a usb dongle on our lapdock with a remote mouse/keyboard made by Microsoft of all companies - works well on the droid bionic / droid 4 phones on the road. Speaking of apps, we found a new app that crosses the android/iphone boarder and gives you your own free, private nextel/iden network - zello walkie talkie (think jello with a z) - they are tied to a voip pc app (no mac support yet) called loudtalks.com - it ties your pc to your handheld talk groups using the f7 key. This allows a pc to be a dispatch system - you talk into it signed into a talkgroup that has all pcs enrolled into it (each pc must subscribe to prevent spam) . Press f7 and hold it down and talk - all pcs in your talkgroup hear your speach. Over 5 users and you pay a trivial monthly fee - best news is their audio codec is better than cellular and the carriers 4g data signal reaches into places where 3g does not reach, so its possible to send walkie talkie signals into remote corners of the service area.
Now the bad part.
We've got 2 volumes defined with all our contracts, blueprints, data, etc on a raid 5 system - one is on the initial 5x2tb or 10tb disk on the 1010+ - the second volume is kept on the sidecar. Both arrays have their power cords duct-taped into their sources, and are run to an APC ups with 48VDC x 100AH power batteries which will run the microwave tranceivers and associated network hardware - it runs for up to a few hours to start our genset that backs it up. I do not recommend putting laser printers on the backups - ours is a 3KW backup and the fuser heater in the laserjet can seem like a power glitch on the UPS.
We are interested in migrating to DSM4.0 - however we do not have confidence that we may loose data in the transfer. This is an issue. I'm looking for people with simple DS1010+ servers that got migrated from DSM3.2 to dsm 4.0 with a sidecar for 10 drives (we are using 2TB drives) - the risks - the pitfalls - the downtime - and the features you gain moving to dsm40 - does it work with all the dsfile apps on handhelds which we get ALOT of use out of for both iphone and android handhelds. None of our volumes are over 50% full of data, but some are getting close at 47% so I figure the time is right to migrate.
Finally we want to install BIND and a proxy cache server on the web like SQUID on our DSM4.0 based 1010+. The reason is alot of viruses are comming in on advertising with buffer overflow attacks. Norton catches them on the pc, but they fly right through all the firwalls. There is a neat trick that speeds up page loads. Most internet pages have 4 ads - 2 on top 2 on the side. They come from servers like www4.3rdpartyadsgalore.com (which got hacked into by a script kiddie age 17 and face full of acne to send out ads w/ buffer overflow.)
What you do in phase one of operation "ADSTOP" is load your caching name server /etc/hosts file with a list of all ad servers (google maintains this list) and instead of returning their actual IP address you return 128.0.0.1 from /etc/hosts. Because you don't have a page on your localhost (128.0.0.1 is YOUR pc's loopback address) the 404 not found or error no server here loads in 1-2 miliseconds instead of the 3-4 seconds the overtaxed ad servers take to respond with their virus or non-virus ad.
The second half of operation "ADSTOP" is running a private squid proxy server on the dsm box with a gigabyte network cache flushed every 24 hours and told not to cache frequently changing sites like quote.com, schwab.com, ameritrade.com - all those are passed on direct, and https rides on port 443 separate so it never sees squid - EVER. Squid keeps things like the google logo for the day for 24 hours and sends it to the pc at 2 gbps (dual links to the 10gbps microwave channel).
BIND kills the adserver from ever sending ads to pcs using dsm's bind dns resolver. squid speeds up page loads to the double link (2 each 1gpbs ties bonded to the transcend gigabit managed switch). Provided /etc/hosts is kept up to date with all adservers it prevents any request going through the dsm system running bind from ever getting a real IP address for an adserver.
This may sound like alot of work but our dsm3.2 system is on the public net (passwords are over 19 characters in length and admin/administrator are locked out so we have hidden accounts for admin - part of our security and the reason the system log shows so many hack attacks every day)
If anyone else has moved their ds1010 plus to dsm 4.0 without loosing data in raid5 x 2 volumes (sidecar + main disk array) please help. I can be reached after 2pm at area code four zero eight two siz one four thousand - wait for answer - then enter extension four thousand nine 4 - 0 - 0 - 9 on your keypad. it will transfer you to my desk phone and we can discuss options.
The dsm1010+ has been running for a couple years now and has serviced us reliably the entire time. I'm actively searching other 1010+ / dsm3.2 -> 4.0 migrators and to hear their experience - also people who run bind and / or squid on their NAS so I can learn from experiences of other people. Name is Everett as in the city in washington, Basham as in w. Ralph Basham former director of the secret service. website is www dot uwave dot com and is our remote entry point for employees at home.
Thanks for your time and collaberation. Much appreciated and may we all come out ahead.
EFB