From 830a86ea95fbeca5c853aefe69f1bb379b3835e7 Mon Sep 17 00:00:00 2001 From: Howard Enos Date: Fri, 10 Jul 2026 15:03:13 -0700 Subject: [PATCH] wiki: goldstein - full network + remote-access topology (UniFi gateways, Site Magic, OpenVPN, roaming playbook) (#32384) --- wiki/clients/goldstein.md | 169 +++++++++++++++++++++++++++----------- 1 file changed, 122 insertions(+), 47 deletions(-) diff --git a/wiki/clients/goldstein.md b/wiki/clients/goldstein.md index 3391f6cf..a2c1072f 100644 --- a/wiki/clients/goldstein.md +++ b/wiki/clients/goldstein.md @@ -2,79 +2,154 @@ type: client name: goldstein display_name: Goldstein (Sheldon Goldstein) -last_compiled: 2026-07-07 -compiled_by: HOWARD-HOME/claude-main +last_compiled: 2026-07-10 +compiled_by: HOWARD/claude-main (live UniFi + RMM investigation) sources: - clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md - clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md + - Live UniFi Site Manager + GuruRMM investigation 2026-07-10 (tickets #32490, #32384) backlinks: [] --- # Goldstein (Sheldon Goldstein) +Law firm (lawyersdallas.com) with **two physical locations** — Dallas, TX (Michelle) and +Tucson, AZ / "Armory Park" (Sheldon) — joined by a UniFi Site Magic site-to-site VPN. + ## Profile -- **Contract type:** Break-fix / T&M (Syncro `prepay_hours` = 0). History shows a small monthly - recurring invoice (~$59.30) alongside occasional labor at $150/hr remote. -- **Key contacts:** Michelle Goldstein — 972-814-5677 (Dallas location); Sheldon Goldstein — - sheldon@lawyersdallas.com; "Armory Park Location" (Tucson). -- **Billing rate:** $150/hr remote (verify onsite/emergency against Syncro). -- **Hours remaining (if prepaid):** none (break-fix). +- **Contract type:** Break-fix / T&M (Syncro `prepay_hours` = 0). Small monthly recurring + invoice (~$59.30) plus occasional labor at $150/hr remote. +- **Key contacts:** Michelle Goldstein — 972-814-5677 (Dallas); Sheldon Goldstein — + sheldon@lawyersdallas.com (Tucson / Armory Park). +- **Billing:** $150/hr remote (verify onsite/emergency in Syncro). No prepaid block. - **Syncro customer ID:** 25307933 -- **Managed devices (Syncro assets):** 1 -- **Two physical locations:** Dallas, TX (Michelle) and Tucson, AZ / Armory Park (Sheldon). - Law firm (lawyersdallas.com). + +## Network & Remote Access ← READ THIS FIRST for any remote/VPN work + +### UniFi gateways (both in OUR ui.com account — "owner" consoles) +Both sites run a **UCG-Ultra** (model `UDRULT`, UniFi Network `10.4.57`). Reachable remotely +with **no LAN/VPN** via the UniFi Site Manager cloud API + connector proxy. + +| Console (ui.com) | WAN IP | ISP | LAN | Gateway | Console ID | +|---|---|---|---|---|---| +| **CGU-Goldstein Tucson** | 98.225.73.165 | Comcast (Pima/Tucson) | **10.1.10.0/24** | 10.1.10.1 | `0CEA146890BF000000000885E5160000000008FA3AD6000000006741FA51:285001334` | +| **CGU-Goldstein Dallas** | 99.127.21.4 | AT&T | **192.168.1.0/24** | 192.168.1.1 | `0CEA1456463900000000087729C50000000008EAA14D0000000067282B45:989250246` | + +- Both have **dual-WAN** hardware but **Internet 2 is disabled** on each. +- **API access:** key in vault `services/unifi-site-manager` (`credentials.api_key`). + Reads via `unifi-wifi` skill `gw-sitemanager.sh` (`fleet|sites|find|net raw `). + **Gotcha:** the skill's `net … raw` truncates output at 5 KB, so full `networkconf` (has the + OpenVPN cert) must be read directly through the connector: + `curl -H "X-API-KEY: $KEY" https://api.ui.com/v1/connector/consoles//proxy/network/api/s/default/rest/` + (e.g. `rest/networkconf`, `rest/setting/`, `rest/routing`, `rest/account`). **Writes** + through the connector DO work (verified) but do gateway config in the UI, not raw API. + +### Site Magic (auto site-to-site VPN) — LAN-to-LAN ONLY, and it's LOCKED +- WireGuard-based **auto-mesh** between the two consoles (`magic_site_to_site_vpn`, iface + `wgsts1000`). **Enabled, healthy, verified BOTH directions** (Tucson↔Dallas). +- Advertises **only the two corporate LANs**: Tucson shares `10.1.10.0/24`, Dallas shares + `192.168.1.0/24`. It is **`attr_no_edit` / `attr_no_delete` (auto-managed)** — you **cannot + add networks to it** (e.g. an OpenVPN client pool) and there are **no static routes**. +- **CONSEQUENCE (important):** a device only reaches the *other* site via Site Magic when it is + **on one of those two LAN subnets**. Traffic sourced from any other subnet (like the OpenVPN + pool `192.168.2.0/24`) is **not** carried across the mesh. This is why a single offsite VPN + connection cannot reach both sites — see the playbook below. + +### OpenVPN remote-user servers (one per gateway) +- **Both gateways** run a native UniFi **OpenVPN remote-user server**: `proto tcp`, port **1194**, + on the WAN. Client pool `192.168.2.0/24` on **BOTH** (identical — fine because a client only + connects to one at a time). +- **Auth = RADIUS** (each gateway's built-in RADIUS server; shared secret). RADIUS **users + `Michelle` and `Sheldon` exist on BOTH gateways** (each UCG has its own RADIUS server, so users + must be created on both). Username is `Michelle` (not "michell"). +- **All secrets + both client `.ovpn` profiles → vault + `clients/goldstein/openvpn-remote-access.sops.yaml`** (radius_secret, tucson/dallas endpoints, + `*_ovpn_b64`, `michelle_/sheldon_vpn_username/password`). +- The UniFi-exported `.ovpn` ships **full-tunnel** (`redirect-gateway def1`) + `comp-lzo`. For a + clean **split-tunnel** client on OpenVPN 2.6: drop `redirect-gateway`, change `comp-lzo` → + `compress lzo` + `allow-compression yes`, add `route-nopull` + explicit `route` lines, and point + `auth-user-pass` at a creds file. (Defender flags the `.ovpn` — its embedded key — so add a + Defender exclusion for the OpenVPN config folder before re-enabling Defender.) + +### Remote-access playbook (how ASUS-2024 reaches DALLAS + DalRes10) +**ASUS-2024 is a roaming laptop (Michelle, user `miche`)** that moves between the Tucson office +and offsite. It needs to RDP into **DALLAS** (`192.168.1.226`) and **DalRes10** (`10.1.10.170`). + +- **At the Tucson office → OpenVPN OFF.** Put the laptop on the **UniFi "Goldstein" WiFi + (10.1.10.x)** and Site Magic gives it both machines: DalRes10 local, DALLAS over the mesh. + **GOTCHA:** the office also has a **separate Cox network broadcast as SSID `Gold-Scop` + (192.168.0.0/24, gw 192.168.0.1)** — that is NOT the UniFi LAN and NOT on Site Magic. A laptop + on `Gold-Scop` can reach *neither* site's internal machines. Must be on the UniFi WiFi. +- **Offsite → OpenVPN ON, TWO profiles** (one connection can't reach both — Site Magic won't + carry the VPN pool): connect the **Dallas** profile to RDP **DALLAS**; connect the **Tucson** + profile to RDP **DalRes10**. Pick the profile for the machine you want. +- RDP shortcuts already on ASUS: `Tucson Computer.rdp` → `10.1.10.170` (DalRes10), + `Dallas Computer.rdp` → `192.168.1.226` (DALLAS). + +### DO NOT: machine-level WireGuard tunnels +Leftover machine-level WireGuard configs exist (`WireGuardServer1-Client1` on ASUS-2024; a tunnel +on DalRes10) from a prior June attempt. **They are full-tunnel and dangerous** — activating the +one on DalRes10 (2026-07-10) captured its own routing and took it **completely offline** (no +remote path; requires deactivating WireGuard **at the console**). Do NOT activate these; they're +being removed in favour of OpenVPN. **Teleport was disabled on the Tucson UCG** (2026-07-10) as +part of the move to OpenVPN. ## Infrastructure ### GuruRMM - **Client:** Goldstein — `7eed26be-4126-40a5-8414-3c0c28b9d182` -- **Sites:** - - **Dallas** (TX) — site code `SILVER-PEAK-3739`, id `653b7e39-5e5e-4b93-b135-c70fc12ececa` - - **Tucson** (AZ) — site code `RED-LION-9255`, id `4526ef0e-31d6-48f1-8df4-40d3a16519c1` +- **Sites:** Dallas — code `SILVER-PEAK-3739`, id `653b7e39-5e5e-4b93-b135-c70fc12ececa` · + Tucson — code `RED-LION-9255`, id `4526ef0e-31d6-48f1-8df4-40d3a16519c1` +- **Note:** RMM "site" tags don't always match physical location — ASUS-2024 is tagged Dallas but + physically roams (often on Cox in AZ). -### Endpoints (GuruRMM agents) -| Host | Site | OS | Notes | +### Endpoints +| Host | Site | IP (RDP target) | Role / Notes | |---|---|---|---| -| DALLAS | Dallas | Windows 11 **Pro for Workstations** (26200; upgraded from Home 2026-07-07, MAK activated) | Lenovo Yoga Slim 7 15ILL9, serial PF570RZ0; Michelle's laptop (`Dallas\miche`); workgroup; 192.168.1.226; **RDP host enabled** (3389, NLA); enrolled 2026-07-06; agent id `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` | -| ASUS-2024 | Dallas | Windows | Pre-existing Dallas-site agent | -| DalRes10 | Tucson | Windows | (verify role) | -| GS-Backup | Tucson | Windows | Name implies backup box (verify) | - -### DALLAS endpoint detail (onboarding baseline 2026-07-06, grade AMBER) -- Intel Core Ultra 7 256V, 15.6 GB RAM; TPM + Secure Boot; BitLocker on C: 100% (RecoveryPassword + TPM). -- Public IP 99.127.21.4; private 192.168.1.226 (Intel Wi-Fi 7 BE201); DNS/gateway 192.168.1.1. -- Defender active + tamper-protected (only registered AV); all firewall profiles on; SMBv1 off; LAPS present. -- Local admins: `Dallas\Administrator`, `Dallas\miche`. +| **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7 (`Dallas\miche`), Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. | +| **DalRes10** | Tucson | **10.1.10.170** (Wi-Fi) | Sheldon's desktop. **RDP host** (fDenyTS=0, NLA) — but **TermService StartType = Manual** (won't auto-start RDP after reboot). Target IP is on **Wi-Fi** (also Ethernet 10.10.1.149 on a *different* segment) so RDP reachability tracks Wi-Fi. Agent `81cde315-013b-4acd-80d7-5ec2b9b5f084`. | +| **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop` | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets. Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. | +| **GS-Backup** | Tucson | — | Tucson box (name implies backup). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. | ## Access -- **Remote access:** ScreenConnect (ConnectWise Control) — DALLAS session - `29c62473-a5cb-4e94-a190-c91f05031809`, tagged Company=Goldstein / Site=Dallas. GuruRMM agent also present. +- **UniFi:** ui.com Site Manager (both Goldstein consoles are "owner") — see Network section. +- **ScreenConnect:** DALLAS `29c62473-…`, DalRes10 `a8b53a73-ff0e-42c9-b51f-4ff71aff45f7`, + ASUS-2024 `cfddaed7-…`, GS-Backup `75f4ee70-…` (all Company=Goldstein). - **GuruRMM install (Dallas site):** https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739 -- **Vault:** (verify — no client secrets vaulted yet) +- **Vault:** `clients/goldstein/openvpn-remote-access.sops.yaml` (OpenVPN/RADIUS). ## Patterns & Known Issues -- **Multi-site under one Syncro customer** — Dallas (TX) and Tucson (Armory Park) locations map to - two GuruRMM sites; make sure new endpoints land in the correct site (Dallas machines → `SILVER-PEAK-3739`). -- **Tucson→Dallas RDP** works over the UniFi site-to-site VPN (verified DalRes10 → 192.168.1.226:3389). - Connect via the `RDP DALLAS` desktop shortcut on the Tucson PCs. RDP into DALLAS is single-session — - it signs Michelle out locally. -- **DALLAS is a Modern Standby laptop and MUST stay awake to be RDP-reachable.** AC no-sleep + lid-does- - nothing is set deliberately; if it sleeps, Tucson can't reach it. (On battery it still sleeps normally.) -- **DALLAS laptop hygiene (2026-07-06):** pending Windows updates + pending reboot; time source on - local CMOS (not NTP); **no backup agent detected** — confirm whether this laptop needs cloud/local backup. +- **Multi-site, one Syncro customer** — Dallas (TX) + Tucson (Armory Park). New endpoints must + land in the correct GuruRMM site (Dallas → `SILVER-PEAK-3739`). +- **Site Magic bridges only the two LANs and is locked** — cross-site works for LAN devices, NOT + for VPN-pool clients. Offsite remote access = two OpenVPN profiles (Dallas + Tucson). +- **`Gold-Scop` WiFi ≠ UniFi LAN** — it's a separate Cox line (192.168.0.x); a device on it can't + reach either site's internal machines. Use the UniFi "Goldstein" WiFi (10.1.10.x) at the office. +- **DALLAS is Modern-Standby** — kept AC-no-sleep + lid-does-nothing so it stays RDP-reachable. + RDP into DALLAS is single-session (signs Michelle out locally). +- **DalRes10 target IP is on Wi-Fi** and **TermService is Manual** — RDP can vanish if Wi-Fi drops + or after a reboot until the service is started. +- **No backup agent** detected on DALLAS (2026-07-06) — confirm cloud/local backup need. -## Active Work -- *No open tickets.* #32490 (Dallas RDP access) **Invoiced 2026-07-07** — invoice 1650967814 ($150.00). +## Active Work (2026-07-10, ticket #32384 "Remote - Issues with remote access") +- **DALLAS offsite RDP via OpenVPN: DONE** — ASUS-2024 → Dallas profile → RDP DALLAS works. +- **DalRes10:** knocked **offline** by its machine-level WireGuard tunnel; recovery needs someone + to **Deactivate WireGuard at its console** (onsite ~4pm 2026-07-10). Then: disable that tunnel + service, import the **Tucson** OpenVPN profile on ASUS, test RDP. +- OpenVPN 2.6.14 installed on ASUS-2024; Teleport disabled on Tucson UCG. ## History Highlights -- **2026-07-07** — Enabled Tucson→Dallas RDP: upgraded DALLAS Windows Home → Pro → **Pro for Workstations** - (MAK activated), enabled RDP, verified 3389 from DalRes10 over the VPN, pushed `RDP DALLAS` icons to the - Tucson desktops (DalRes10, GS-Backup). Billed 1.0h remote ($150), #32490 Invoiced. (Spanned two days — - the Modern-Standby laptop slept before the first attempt could finish.) -- **2026-07-06** — Onboarded DALLAS (Michelle's Lenovo) to remote management: ScreenConnect installed, - GuruRMM agent deployed into the existing Goldstein/Dallas site, onboarding diagnostic run (AMBER, - 0 critical). Ticket #32490. +- **2026-07-10** — Stood up OpenVPN remote access (both UCGs, RADIUS, users Michelle/Sheldon); + mapped the full UniFi/Site-Magic topology; confirmed Site Magic is LAN-only + locked; DALLAS + offsite RDP working; DalRes10 taken offline by a stray WireGuard tunnel (pending console fix). + Ticket #32384. +- **2026-07-07** — Enabled Tucson→Dallas RDP: DALLAS Home → Pro → Pro-for-Workstations (MAK), + RDP enabled, verified from DalRes10 over the VPN, `RDP DALLAS` icons on Tucson PCs. #32490 + Invoiced (1.0h, $150, invoice 1650967814). +- **2026-07-06** — Onboarded DALLAS to remote management (ScreenConnect + GuruRMM, AMBER diag). #32490. +- **2026-06** — Prior remote-access attempt (#32384): Teleport/WireGuard tried, hit route + login + issues; Mike reset the Site Magic VPN to restore access at the time. ## Backlinks