Ubuntu Linux Gateway Example

The following are the steps necessary to create a general purpose gateway to AMPRNet using an Ubuntu Linux Server.

Cautions

 * Some of these changes may disrupt your Internet Connection! Make sure you have a backup way to reach the Internet to look up information and ask for help!
 * Be sure to read through all the directions and make sure you understand what you are doing before proceeding.
 * It may be helpful to print out these directions (and related material) for reference.
 * Be sure to be aware of the security implications of performing these steps. While the steps here try to maximize security for your "non-ham" devices, be aware that these steps may expose those devices to hackers, criminals, and script-kiddies.

Finally, to paraphrase from the Broadband-Hamnet(tm) folks:

As with ANY piece of Ham radio gear, AMPRNet COULD be used illegally, and it is the control operator's duty to make sure it is being used in accordance with your local Amateur Radio rules.

'''This website is not in a position to offer any definitive legal advice. Only a duly appointed person, empowered to interpret the rules and regulations, can do that. That means that for most of us, our opinion has no legal standing – no more than any personal opinion on tax law.'''

You only need to setup a gateway if:
 * You want to access AMPRNet resources that are not accessible from the global Internet.
 * You want to provide access to AMPRNet over RF (via packet or using WiFi) and there doesn't exist such a service in your area.

Design
The basic design consists of a standard PC running Ubuntu 12.04 (LTS) and three network connections:
 * 1) The first connection (eth0) is to your ISP so you can reach the Internet.
 * 2) The second connection (eth1) is used to connect your normal "non-ham" devices to the Internet.
 * 3) The third connection (eth2) is used to connect your "ham" devices so they can see and be seen by other devices on AMPRNet.

The following diagram illustrates the gateway design. (Click on the image to enlarge).



Hardware you will need
I'm running my gateway on an old Dell Optiplex GX260 (a Pentium 4 with 512 MB of RAM and a 20 GB Hard drive). You don't need much of a system if your Internet Service Provider's (ISP) bandwidth is 100Mb/s or less.

Along with the built in Ethernet network interface, I've installed two additional 10/100 Ethernet network cards I purchased from Amazon.

Software you will need
On the Dell I've installed Ubuntu 12.04 LTS (the 32-bit server version). With one exception all of the software you will need for the gateway you can get with the server.

Installing Required Linux Software
Install the Ubuntu Linux Distribution on your gateway hardware following the instructions on Ubuntu's web site.

After you have installed Ubuntu, you will need to upgrade it with the latest fixes and patches. To do this, you will need to login with the username and password you setup when installing Ubuntu and type the following commands:

You will be prompted for your password and then your gateway will update its database of software to the latest version.

To actually update the sotfware, type the following command:

Enter yes when prompted to install the updates.

You will probably need to restart your gateway after installing your updates. To do this type:

Your gateway should shutdown and restart. Log back in.

After you have completed upgrading your operating system, you will need to install the following software packages:


 * isc-dhcp-server : This software will be used to assign IP addresses dynamically to your "non-ham" and "ham" devices.
 * iptables : This software will help protect your gateway, "non-ham" devices, and AMPRNet devices from hackers.
 * iptables-persistent : You will need this make sure your iptables settings are remembered when you restart your gateway

To install the software packages type the following at the command line on your gateway hardware:

What is an IPv4 Address ?
An IPv4 address is a unique 32-bit binary number that is assigned to every publicly connected Internet device.

To make the address easy for humans to read, it is usually represented as a four decimal numbers separated by periods (example - 192.0.0.2).

More information on IPv4 addresses can be found in this Wikipedia article. Take some time to read it over, it will help make it easier to understand the following steps.

What is a "Static" IP ?
Normally your ISP assigns your router a public IPv4 address dynamically from a pool of IPv4 addresses shared by many customers. This means that your Public IPv4 address can change periodically and without notice. Usually this isn't a big issue for most normal users, however it can cause problems when trying implement an AMPRNet gateway. While it is possible to make AMPRNet gateways work with a dynamically assigned address, there could be a significant time lag between the time your Public IPv4 address changes and when others on AMPRNet learn about the new gateway address. During this time your AMPRNet subnet may be unreachable.

Therefore, I recommend asking your ISP for a "static" IPv4 address. A "static" IPv4 address is one that doesn't change. Usually your ISP will set you up with one for a small setup fee and small monthly recurring fee. It is well worth the extra cost to insure a stable gateway.

When you ask for a "static" IPv4 address, your ISP will provide you with the following information that you will need to configure your server.

Caution!!!: Once you request a "static" IPv4 address from your ISP, you will need to complete the rest of this setup before you will be able to re-connect your "non-ham" devices to the Internet!!!


 * IP Address (example - 192.0.2.2) : The "static" IP Address itself.
 * Netmask (example - 255.255.255.0) : The netmask is used to determine what part of the IPv4 address is the "network" portion and what portion is the "host" (a good analogy is a Postal Code (network) vs. a House Number (host)).
 * Default Gateway (example - 192.0.2.1) : The default gateway is an IP address that you send traffic to to reach the rest of the Internet.
 * DNS Server Addresses (example - 192.0.2.23,192.0.2.24</tt>: DNS server addresses are the IP addresses of systems that look up the IP address of a device you specify by name. (When you type "google.com" into your browser, the DNS Servers look up the IP address for "google.com" to know where to send your search request.

Please make sure you copy this information down carefully and verify it with your ISP. Your gateway will not work correctly without it!

Decide on Private IPv4 Addresses for "Non-Ham" Devices
Your "non-ham" devices will need their own IP Addresses, separate from AMPRNet. Normally these addresses are assigned from what is known as private address space. Your gateway will take care of routing traffic to and from this private address space to the public Internet.

For this example, let's use the private network 192.168.11.0</tt>. The relevant information would be:
 * IP Address for our gateway: 192.168.11.1</tt>
 * Netmask 255.255.255.0</tt>
 * Default Gateway: 192.168.11.1</tt> (Our gateway will be the default gateway for devices on the "non-ham" network).
 * DNS Name Servers: Use the same DNS Name server IP Addresses given to you by your ISP.

Obtain an AMPRNet IPv4 Address Allocation and Register Your Gateway
Once you have your "static" IPv4 address from your ISP; you will need to go the AMPRNet Portal, request an AMPRNet subnet from a regional coordinator, and register your gateway.

For this example we will use a range of AMPRNet addresses that is reserved for testing and documentation.

Caution!!!: In order to make sure your AMPRNet gateway and subnet is reachable by others, you MUST obtain and use a production AMPRNet subnet!!!


 * IP Address : 44.128.10.1</tt>
 * Netmask : 255.255.255.0</tt>
 * Default Gateway : 44.128.10.1</tt>
 * DNS Name Servers : 8.8.8.8, 8.8.4.4 (I use Google's DNS Servers because my ISP doesn't allow queries from subnets other than their own)

Configuring the interface
To configure the ISP Interface, type the following command to edit the file /etc/networking/interfaces</tt>:

Find the section that looks like this:

Change it to look like the following (Remember to substitute the information you received from your ISP!!!):

Double check that the information is correct then save the file by pressing CTRL-X</tt> and then Y</tt> to save the file.

To make the changes take effect, type the following commands:

Testing
At this point you should be able to reach the Internet from the gateway (but not from "non-ham" or "ham" devices yet). To test, type the following command: You should see something like:

Press CTRL-C</tt> to stop the program.

If you see something different, please check the following: Don't continue to the next steps until you are successfully able to get the gateway connected to the Internet.
 * 1) That the correct network interface on the gateway system is connected to your ISP (cable or DSL modem).
 * 2) Double check the settings in the /etc/network/interfaces</tt> file.

Setting up the "Non-Ham" Network Interface
Now we need to configure things so that you can connect your "non-ham" devices to the Internet.

Configuring the Interface
Once again you will need to edit the file /etc/network/interfaces</tt> by type the following: Find and edit or add the following section:

and execute the following commands:

Setting up DHCP
DHCP stands for Dynamic Host Configuration Protocol and is used to assign IP addresses to hosts dynamically. To configure DHCP for our "non-ham" devices you will need to edit the file /etc/dhcp/dhcpd.conf</tt>.

Uncomment (remove the #</tt> from the start of the line) the following line:

Add the following lines to the end of the file (Remember to substitute the address for your DNS Servers)

and save the file.

Next we will need to restart the DHCP server software by typing the following:

Enabling forwarding
Now, we will need to enable "forwarding" of traffic through the gateway. To do this we will need to edit the file <tt>/etc/sysctl.conf</tt>.

Find the following section and do what it recommends. It should end up looking like this:

Save the file and restart your gateway with <tt>sudo shutdown -r now</tt>.

Setting up the Firewall (Part 1)
Now will we need to setup the Firewall using <tt>iptables</tt>. The following articlegives a good overview of <tt>iptables</tt>. The firewall will serve two purposes:
 * 1) Allow your "non-ham' devices on private address space to access the Internet buy using NAT.
 * 2) Help protect your gateway and "non-ham" devices.

What is NAT?
NAT stands for Network Address Translation.

NAT is what is used in your typical home router or wireless Access Point (AP) to allow you to connect multiple devices to one Internet Service Provider (ISP) connection.

Basically NAT makes all your devices on your home network appear as one device to the ISP. It does this by keeping track of the data coming from each of your devices and makes sure that the return data from the Internet gets back to the right device.

Setting up NAT
Setting up NAT for our "non-ham" devices requires the following command: (Be sure to substitute your "static" IP address in the <tt>--to-source</tt> option)

Protecting the Gateway
First, we need to define our default Firewall Policies:
 * DROP all traffic headed for our gateway
 * ACCEPT all traffic headed out from our gateway
 * DROP all traffic to be forwarded between interfaces

To do this type the following commands:

Next we need to allow access to the "loopback" interface (The loopback interface is used internally by Linux on the gateway).

Next, we need to allow traffic back into the gateway from connections that were made by the gateway.

Protecting the "Non-Ham" Network
Now we need to allow connections from the "non-ham" network to the Internet and allow the returning traffic from the Internet back to the "non-ham" network.

Saving the firewall rules
To save our firewall rules so far, type the following commands.

Testing
At this point you should be able to connect a "non-ham" device to the "non-ham" interface of your gateway, and be able to access the Internet.

Note: If you are using a home router or wireless access point, you will need to configure it for "bridging mode" in order to use it with  your gateway. Check the documentation for your device to see how to do this.

Configuring the Interface
Once again you will need to edit the file <tt>/etc/network/interfaces</tt> by typing the following: Find and edit or add the following section: NOTE: (Be sure to substitute your production AMPRNet subnet you obtained from your regional coordinator)

and execute the following commands:

More DHCP
To configure DHCP for our "ham" devices you will need to edit the file <tt>/etc/dhcp/dhcpd.conf</tt> again.

Add the following lines to the end of the file. NOTE: (Remember to substitute your production AMPRNet addresses for the ones in the example)

Next we will need to restart the DHCP server software by typing the following:

Automating Gateway Updates with ampr-ripd
The easiest way to receive updates is by running <tt>ampr-ripd</tt> <tt>ampr-ripd</tt> is a C program that listens for updates from the AMPRNet gateway at UCSD and populates a routing table with the routes to all other gateways.

Getting, compiling, and installing ampr-ripd
To get ampr-ripd and install it, type the following

Finding the password for ampr-ripd
By default the gateway updates are projected by a password. To find the password execute the following command after you have installed ampr-ripd After a short while you should see: Write down the <SecretPassword> and press <tt>CTRL-C</tt> to stop the program.

Creating a startup script to connect to AMPRNet
The following text can be appended to the end of the <tt>/etc/rc.local</tt> file on your gateway to do the following:
 * 1) Configure the AMPRNet IPIP Tunnel
 * 2) Configure local routing
 * 3) Start ampr-ripd

First a note about netmask notation in the file
In the file below your "netmask" is represented differently than you may receive from your ISP.

In this case we are using CIDR notaton.

For example the netmask <tt>255.255.255.0</tt> is represented by the CIDR notation <tt>/24</tt>.

A good table of netmask to CIDR notation can be found here. (Courtesy of packetlife.net ).

To add the text edit the <tt>/etc/rc.local</tt> file by:

Here is the text to append to the file NOTE: Don't forget to substitute your IP addresses for for the ones in the file.

Forwarding Traffic to "Ham" Devices
You will need to add the following <tt>iptables</tt> rules to allow traffic to and from your local AMPRNet subnet and the global AMPRNet and allow your "ham" devices to obtain IP addresses via DHCP.

If you want to only allow AMPRNet traffic to and from your local AMPRNet net add the following rules:

Or you can let everything through by adding these rules instead:

'''Caution: This rule allows all traffic between the Global AMPRNet and your local AMPRNet subnet. Be sure you understand the security and legal implications of allowing this traffic, especially when sending traffic over RF!!'''

For ease of troubleshooting it's a good idea to log rejected packets with the following commands:

Finally to save our firewall rules, type the following commands.

Testing
At this point you should be able to connect "ham" devices to the "ham" network interface <tt>eth2</tt> and be able to reach the internet.