PES Guide

Deploy your backend on virtech in ten minutes

Type the machine's IP and the kind of server: you get every command with the ports already worked out, a service that survives reboots and a setup.sh to download. It all happens in your browser and nothing is sent.

virtech, the FIB private cloud

A self-service virtual machine service for the courses that request it, at virtech.fib.upc.edu. Your teachers give you the accounts.

  • Ubuntu machines with the alumne user, who can use sudo. You are responsible for everything that happens on them.
  • The course quota sets how many machines you get and how big they are. There is no firewall.
  • There are no backups and machines are deleted at the end of the term. Code on GitHub; configuration documented.
  • If you lose access to a machine, it cannot be recovered: delete it and create another. One more reason to script the installation.
Template with VPN

FIB network only

Reachable from campus, or from home with the UPC VPN (UPClink). But the VPN is personal and allows a single connection: you cannot have your laptop and phone on it at once, nor give the app to anyone outside.

Recommended for apps

Template without VPN

It has 10 ports open to the Internet through nattech.fib.upc.edu, and SSH from UPC or over VPN. Any phone can reach it, stakeholders' phones included.

Create the machine and run your service

  1. VMs → +, pick the template, give it a name and the user password, then Create. Wait until it goes from DEPLOYING to RUNNING.
  2. Open the Console (VNC) and log in. The welcome message shows the IP and the ports. You can show it again with /etc/update-motd.d/99-info-nat.
  3. From then on, use SSH (from UPC or over VPN): the commands are below.
  4. Start the service listening on 0.0.0.0 and on a port from 8080 to 8089. If it listens on localhost, it cannot be reached from outside.
  5. Test it from outside with the public port: http://nattech.fib.upc.edu:40330.

Your commands, worked out

What you type stays in this browser. Change any field and the commands update.

The one shown on virtech or in the welcome message.

setup.sh does the install, the service and the start. Copy it to the machine with scp and run bash setup.sh.

How the ports are worked out

Every machine reaches the Internet through the same address, nattech.fib.upc.edu, and each one gets its own port range from the last number of its IP (172.16.4.XXX):

  • SSH: port 22000 + XXX.
  • Services: from port 40000 + XXX·10 onwards, ten consecutive ports mapped to 8080-8089 on the machine.
How do I check the connection works before I have any service?

On the machine, nc -l -p 8080. On your computer, nc nattech.fib.upc.edu 40330 (with your port) and type anything: it should appear on the machine.

Why does ping not answer?

Because of how the NAT is set up, ping does not work from outside the machines' network, not even over VPN. Use curl or nc.

Can I SSH in from home without the VPN?

No. For security, SSH from outside UPC only works over the VPN. The 10 service ports are open to everyone.

I forgot the machine's password.

It cannot be recovered: delete the machine and create a new one. The virtech password (not the machine's) is changed in the user menu → Settings → Change password.

Mobile apps and unencrypted HTTP

nattech serves HTTP, not HTTPS. Android (since version 9) and iOS block that traffic by default, and the call fails with few clues. Allow it for this domain only.

<!-- res/xml/network_security_config.xml (in Flutter: android/app/src/main/res/xml/) -->
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="false">nattech.fib.upc.edu</domain>
        <domain includeSubdomains="false">10.0.2.2</domain>
    </domain-config>
</network-security-config>

<!-- AndroidManifest.xml -->
<application
    android:networkSecurityConfig="@xml/network_security_config"
    ... >

Passwords travel in clear text over HTTP. For PES the per-domain exception is enough, but do not use real passwords and list it as a known limitation in the documentation.