azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wiki: goldstein - full network + remote-access topology (UniFi gateways, Site Magic, OpenVPN, roaming playbook) (#32384)

Browse Source
This commit is contained in:
Howard Enos
2026-07-10 15:03:13 -07:00
parent a0690793bc
commit 830a86ea95
1 changed files with 122 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

169
wiki/clients/goldstein.md
View File

@@ -2,79 +2,154 @@
type: client type: client
name: goldstein name: goldstein
display_name: Goldstein (Sheldon Goldstein) display_name: Goldstein (Sheldon Goldstein)
last_compiled: 2026-07-07 last_compiled: 2026-07-10
compiled_by: HOWARD-HOME/claude-main compiled_by: HOWARD/claude-main (live UniFi + RMM investigation)
sources: sources:
- clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md - clients/goldstein/session-logs/2026-07/2026-07-06-howard-dallas-rmm-onboard.md
- clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md - clients/goldstein/session-logs/2026-07/2026-07-07-howard-dallas-rdp-pro-upgrade.md
- clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md - clients/goldstein/onboarding-baselines/DALLAS-20260706T233936.md
- Live UniFi Site Manager + GuruRMM investigation 2026-07-10 (tickets #32490, #32384)
backlinks: [] backlinks: []
--- ---
# Goldstein (Sheldon Goldstein) # Goldstein (Sheldon Goldstein)
Law firm (lawyersdallas.com) with **two physical locations** — Dallas, TX (Michelle) and
Tucson, AZ / "Armory Park" (Sheldon) — joined by a UniFi Site Magic site-to-site VPN.
## Profile ## Profile
- **Contract type:** Break-fix / T&M (Syncro `prepay_hours` = 0). History shows a small monthly - **Contract type:** Break-fix / T&M (Syncro `prepay_hours` = 0). Small monthly recurring
recurring invoice (~$59.30) alongside occasional labor at $150/hr remote. invoice (~$59.30) plus occasional labor at $150/hr remote.
- **Key contacts:** Michelle Goldstein — 972-814-5677 (Dallas location); Sheldon Goldstein — - **Key contacts:** Michelle Goldstein — 972-814-5677 (Dallas); Sheldon Goldstein —
sheldon@lawyersdallas.com; "Armory Park Location" (Tucson). sheldon@lawyersdallas.com (Tucson / Armory Park).
- **Billing rate:** $150/hr remote (verify onsite/emergency against Syncro). - **Billing:** $150/hr remote (verify onsite/emergency in Syncro). No prepaid block.
- **Hours remaining (if prepaid):** none (break-fix).
- **Syncro customer ID:** 25307933 - **Syncro customer ID:** 25307933
- **Managed devices (Syncro assets):** 1
- **Two physical locations:** Dallas, TX (Michelle) and Tucson, AZ / Armory Park (Sheldon). ## Network & Remote Access ← READ THIS FIRST for any remote/VPN work
Law firm (lawyersdallas.com).
### UniFi gateways (both in OUR ui.com account — "owner" consoles)
Both sites run a **UCG-Ultra** (model `UDRULT`, UniFi Network `10.4.57`). Reachable remotely
with **no LAN/VPN** via the UniFi Site Manager cloud API + connector proxy.
| Console (ui.com) | WAN IP | ISP | LAN | Gateway | Console ID |
|---|---|---|---|---|---|
| **CGU-Goldstein Tucson** | 98.225.73.165 | Comcast (Pima/Tucson) | **10.1.10.0/24** | 10.1.10.1 | `0CEA146890BF000000000885E5160000000008FA3AD6000000006741FA51:285001334` |
| **CGU-Goldstein Dallas** | 99.127.21.4 | AT&T | **192.168.1.0/24** | 192.168.1.1 | `0CEA1456463900000000087729C50000000008EAA14D0000000067282B45:989250246` |
- Both have **dual-WAN** hardware but **Internet 2 is disabled** on each.
- **API access:** key in vault `services/unifi-site-manager` (`credentials.api_key`).
Reads via `unifi-wifi` skill `gw-sitemanager.sh` (`fleet|sites|find|net <console> raw <path>`).
**Gotcha:** the skill's `net … raw` truncates output at 5 KB, so full `networkconf` (has the
OpenVPN cert) must be read directly through the connector:
`curl -H "X-API-KEY: $KEY" https://api.ui.com/v1/connector/consoles/<ID>/proxy/network/api/s/default/rest/<path>`
(e.g. `rest/networkconf`, `rest/setting/<key>`, `rest/routing`, `rest/account`). **Writes**
through the connector DO work (verified) but do gateway config in the UI, not raw API.
### Site Magic (auto site-to-site VPN) — LAN-to-LAN ONLY, and it's LOCKED
- WireGuard-based **auto-mesh** between the two consoles (`magic_site_to_site_vpn`, iface
`wgsts1000`). **Enabled, healthy, verified BOTH directions** (Tucson↔Dallas).
- Advertises **only the two corporate LANs**: Tucson shares `10.1.10.0/24`, Dallas shares
`192.168.1.0/24`. It is **`attr_no_edit` / `attr_no_delete` (auto-managed)** — you **cannot
add networks to it** (e.g. an OpenVPN client pool) and there are **no static routes**.
- **CONSEQUENCE (important):** a device only reaches the *other* site via Site Magic when it is
**on one of those two LAN subnets**. Traffic sourced from any other subnet (like the OpenVPN
pool `192.168.2.0/24`) is **not** carried across the mesh. This is why a single offsite VPN
connection cannot reach both sites — see the playbook below.
### OpenVPN remote-user servers (one per gateway)
- **Both gateways** run a native UniFi **OpenVPN remote-user server**: `proto tcp`, port **1194**,
on the WAN. Client pool `192.168.2.0/24` on **BOTH** (identical — fine because a client only
connects to one at a time).
- **Auth = RADIUS** (each gateway's built-in RADIUS server; shared secret). RADIUS **users
`Michelle` and `Sheldon` exist on BOTH gateways** (each UCG has its own RADIUS server, so users
must be created on both). Username is `Michelle` (not "michell").
- **All secrets + both client `.ovpn` profiles → vault
`clients/goldstein/openvpn-remote-access.sops.yaml`** (radius_secret, tucson/dallas endpoints,
`*_ovpn_b64`, `michelle_/sheldon_vpn_username/password`).
- The UniFi-exported `.ovpn` ships **full-tunnel** (`redirect-gateway def1`) + `comp-lzo`. For a
clean **split-tunnel** client on OpenVPN 2.6: drop `redirect-gateway`, change `comp-lzo` →
`compress lzo` + `allow-compression yes`, add `route-nopull` + explicit `route` lines, and point
`auth-user-pass` at a creds file. (Defender flags the `.ovpn` — its embedded key — so add a
Defender exclusion for the OpenVPN config folder before re-enabling Defender.)
### Remote-access playbook (how ASUS-2024 reaches DALLAS + DalRes10)
**ASUS-2024 is a roaming laptop (Michelle, user `miche`)** that moves between the Tucson office
and offsite. It needs to RDP into **DALLAS** (`192.168.1.226`) and **DalRes10** (`10.1.10.170`).
- **At the Tucson office → OpenVPN OFF.** Put the laptop on the **UniFi "Goldstein" WiFi
(10.1.10.x)** and Site Magic gives it both machines: DalRes10 local, DALLAS over the mesh.
**GOTCHA:** the office also has a **separate Cox network broadcast as SSID `Gold-Scop`
(192.168.0.0/24, gw 192.168.0.1)** — that is NOT the UniFi LAN and NOT on Site Magic. A laptop
on `Gold-Scop` can reach *neither* site's internal machines. Must be on the UniFi WiFi.
- **Offsite → OpenVPN ON, TWO profiles** (one connection can't reach both — Site Magic won't
carry the VPN pool): connect the **Dallas** profile to RDP **DALLAS**; connect the **Tucson**
profile to RDP **DalRes10**. Pick the profile for the machine you want.
- RDP shortcuts already on ASUS: `Tucson Computer.rdp` → `10.1.10.170` (DalRes10),
`Dallas Computer.rdp` → `192.168.1.226` (DALLAS).
### DO NOT: machine-level WireGuard tunnels
Leftover machine-level WireGuard configs exist (`WireGuardServer1-Client1` on ASUS-2024; a tunnel
on DalRes10) from a prior June attempt. **They are full-tunnel and dangerous** — activating the
one on DalRes10 (2026-07-10) captured its own routing and took it **completely offline** (no
remote path; requires deactivating WireGuard **at the console**). Do NOT activate these; they're
being removed in favour of OpenVPN. **Teleport was disabled on the Tucson UCG** (2026-07-10) as
part of the move to OpenVPN.
## Infrastructure ## Infrastructure
### GuruRMM ### GuruRMM
- **Client:** Goldstein — `7eed26be-4126-40a5-8414-3c0c28b9d182` - **Client:** Goldstein — `7eed26be-4126-40a5-8414-3c0c28b9d182`
- **Sites:** - **Sites:** Dallas — code `SILVER-PEAK-3739`, id `653b7e39-5e5e-4b93-b135-c70fc12ececa` ·
- **Dallas** (TX) — site code `SILVER-PEAK-3739`, id `653b7e39-5e5e-4b93-b135-c70fc12ececa` Tucson — code `RED-LION-9255`, id `4526ef0e-31d6-48f1-8df4-40d3a16519c1`
- **Tucson** (AZ) — site code `RED-LION-9255`, id `4526ef0e-31d6-48f1-8df4-40d3a16519c1` - **Note:** RMM "site" tags don't always match physical location — ASUS-2024 is tagged Dallas but
physically roams (often on Cox in AZ).
### Endpoints (GuruRMM agents) ### Endpoints
| Host | Site | OS | Notes | | Host | Site | IP (RDP target) | Role / Notes |
|---|---|---|---| |---|---|---|---|
| DALLAS | Dallas | Windows 11 **Pro for Workstations** (26200; upgraded from Home 2026-07-07, MAK activated) | Lenovo Yoga Slim 7 15ILL9, serial PF570RZ0; Michelle's laptop (`Dallas\miche`); workgroup; 192.168.1.226; **RDP host enabled** (3389, NLA); enrolled 2026-07-06; agent id `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02` | | **DALLAS** | Dallas | **192.168.1.226** (Wi-Fi) | Michelle's Lenovo Yoga Slim 7 (`Dallas\miche`), Win 11 **Pro for Workstations** (upgraded from Home 2026-07-07, MAK). **RDP host** (fDenyTS=0, NLA, TermService Auto). Public 99.127.21.4. Modern-Standby — kept AC-no-sleep. The machine staff RDP **into**. Agent `36c7bbc8-504f-4b4a-8995-3b3e5cdc0f02`; SC `29c62473-a5cb-4e94-a190-c91f05031809`. |
| ASUS-2024 | Dallas | Windows | Pre-existing Dallas-site agent | | **DalRes10** | Tucson | **10.1.10.170** (Wi-Fi) | Sheldon's desktop. **RDP host** (fDenyTS=0, NLA) — but **TermService StartType = Manual** (won't auto-start RDP after reboot). Target IP is on **Wi-Fi** (also Ethernet 10.10.1.149 on a *different* segment) so RDP reachability tracks Wi-Fi. Agent `81cde315-013b-4acd-80d7-5ec2b9b5f084`. |
| DalRes10 | Tucson | Windows | (verify role) | | **ASUS-2024** | Dallas (tag) | roams — Cox `192.168.0.200` when on `Gold-Scop` | **Roaming laptop (Michelle, user `miche`).** Has the OpenVPN client + RDP shortcuts to both targets. Agent `f50b17c1-a711-4e80-89c2-03cb630f5622`; SC `cfddaed7-b6b9-463c-b210-384dec88e0f8`. |
| GS-Backup | Tucson | Windows | Name implies backup box (verify) | | **GS-Backup** | Tucson | — | Tucson box (name implies backup). Agent `4f52ef22-89ae-4124-a2b4-d339aaf42f53`. |
### DALLAS endpoint detail (onboarding baseline 2026-07-06, grade AMBER)
- Intel Core Ultra 7 256V, 15.6 GB RAM; TPM + Secure Boot; BitLocker on C: 100% (RecoveryPassword + TPM).
- Public IP 99.127.21.4; private 192.168.1.226 (Intel Wi-Fi 7 BE201); DNS/gateway 192.168.1.1.
- Defender active + tamper-protected (only registered AV); all firewall profiles on; SMBv1 off; LAPS present.
- Local admins: `Dallas\Administrator`, `Dallas\miche`.
## Access ## Access
- **Remote access:** ScreenConnect (ConnectWise Control) — DALLAS session - **UniFi:** ui.com Site Manager (both Goldstein consoles are "owner") — see Network section.
`29c62473-a5cb-4e94-a190-c91f05031809`, tagged Company=Goldstein / Site=Dallas. GuruRMM agent also present. - **ScreenConnect:** DALLAS `29c62473-…`, DalRes10 `a8b53a73-ff0e-42c9-b51f-4ff71aff45f7`,
ASUS-2024 `cfddaed7-…`, GS-Backup `75f4ee70-…` (all Company=Goldstein).
- **GuruRMM install (Dallas site):** https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739 - **GuruRMM install (Dallas site):** https://rmm.azcomputerguru.com/install/SILVER-PEAK-3739
- **Vault:** (verify — no client secrets vaulted yet) - **Vault:** `clients/goldstein/openvpn-remote-access.sops.yaml` (OpenVPN/RADIUS).
## Patterns & Known Issues ## Patterns & Known Issues
- **Multi-site under one Syncro customer** — Dallas (TX) and Tucson (Armory Park) locations map to - **Multi-site, one Syncro customer** — Dallas (TX) + Tucson (Armory Park). New endpoints must
two GuruRMM sites; make sure new endpoints land in the correct site (Dallas machines → `SILVER-PEAK-3739`). land in the correct GuruRMM site (Dallas → `SILVER-PEAK-3739`).
- **Tucson→Dallas RDP** works over the UniFi site-to-site VPN (verified DalRes10 → 192.168.1.226:3389). - **Site Magic bridges only the two LANs and is locked** — cross-site works for LAN devices, NOT
Connect via the `RDP DALLAS` desktop shortcut on the Tucson PCs. RDP into DALLAS is single-session — for VPN-pool clients. Offsite remote access = two OpenVPN profiles (Dallas + Tucson).
it signs Michelle out locally. - **`Gold-Scop` WiFi ≠ UniFi LAN** — it's a separate Cox line (192.168.0.x); a device on it can't
- **DALLAS is a Modern Standby laptop and MUST stay awake to be RDP-reachable.** AC no-sleep + lid-does- reach either site's internal machines. Use the UniFi "Goldstein" WiFi (10.1.10.x) at the office.
nothing is set deliberately; if it sleeps, Tucson can't reach it. (On battery it still sleeps normally.) - **DALLAS is Modern-Standby** — kept AC-no-sleep + lid-does-nothing so it stays RDP-reachable.
- **DALLAS laptop hygiene (2026-07-06):** pending Windows updates + pending reboot; time source on RDP into DALLAS is single-session (signs Michelle out locally).
local CMOS (not NTP); **no backup agent detected** — confirm whether this laptop needs cloud/local backup. - **DalRes10 target IP is on Wi-Fi** and **TermService is Manual** — RDP can vanish if Wi-Fi drops
or after a reboot until the service is started.
- **No backup agent** detected on DALLAS (2026-07-06) — confirm cloud/local backup need.
## Active Work ## Active Work (2026-07-10, ticket #32384 "Remote - Issues with remote access")
- *No open tickets.* #32490 (Dallas RDP access) **Invoiced 2026-07-07** — invoice 1650967814 ($150.00). - **DALLAS offsite RDP via OpenVPN: DONE** — ASUS-2024 → Dallas profile → RDP DALLAS works.
- **DalRes10:** knocked **offline** by its machine-level WireGuard tunnel; recovery needs someone
to **Deactivate WireGuard at its console** (onsite ~4pm 2026-07-10). Then: disable that tunnel
service, import the **Tucson** OpenVPN profile on ASUS, test RDP.
- OpenVPN 2.6.14 installed on ASUS-2024; Teleport disabled on Tucson UCG.
## History Highlights ## History Highlights
- **2026-07-07** — Enabled Tucson→Dallas RDP: upgraded DALLAS Windows Home → Pro → **Pro for Workstations** - **2026-07-10** — Stood up OpenVPN remote access (both UCGs, RADIUS, users Michelle/Sheldon);
(MAK activated), enabled RDP, verified 3389 from DalRes10 over the VPN, pushed `RDP DALLAS` icons to the mapped the full UniFi/Site-Magic topology; confirmed Site Magic is LAN-only + locked; DALLAS
Tucson desktops (DalRes10, GS-Backup). Billed 1.0h remote ($150), #32490 Invoiced. (Spanned two days — offsite RDP working; DalRes10 taken offline by a stray WireGuard tunnel (pending console fix).
the Modern-Standby laptop slept before the first attempt could finish.) Ticket #32384.
- **2026-07-06** — Onboarded DALLAS (Michelle's Lenovo) to remote management: ScreenConnect installed, - **2026-07-07** — Enabled Tucson→Dallas RDP: DALLAS Home → Pro → Pro-for-Workstations (MAK),
GuruRMM agent deployed into the existing Goldstein/Dallas site, onboarding diagnostic run (AMBER, RDP enabled, verified from DalRes10 over the VPN, `RDP DALLAS` icons on Tucson PCs. #32490
0 critical). Ticket #32490. Invoiced (1.0h, $150, invoice 1650967814).
- **2026-07-06** — Onboarded DALLAS to remote management (ScreenConnect + GuruRMM, AMBER diag). #32490.
- **2026-06** — Prior remote-access attempt (#32384): Teleport/WireGuard tried, hit route + login
issues; Mike reset the Site Magic VPN to restore access at the time.
## Backlinks ## Backlinks