https://wiki.ampr.org/w/api.php?action=feedcontributions&user=M0mux&feedformat=atom44Net Wiki - User contributions [en]2024-03-28T10:27:58ZUser contributionsMediaWiki 1.41.0https://wiki.ampr.org/w/index.php?title=Routing_your_allocation_via_BGP&diff=992Routing your allocation via BGP2022-12-26T00:27:03Z<p>M0mux: </p>
<hr />
<div>To announce your allocation directly via your Internet Service Provider (ISP) you will need to:<br />
<br />
# Contact your ISP and ask them if they are willing to agree to announce your AMPRNet allocation in accordance with the terms of the [https://www.ampr.org/terms-of-service/ AMPRNet Terms of Service and Acceptable Use Agreement] (specifically section 7b).<br />
# Provide a WRITTEN copy of your agreement with your ISP to the AMPRNet administrator.<br />
# Upon verification of the agreement, the AMPRNet administrator will provide WRITTEN authorization to your ISP allowing them to announce your allocation.<br />
<br />
<br />
== Providers Supporting Customers Bringing IPv4 Blocks ==<br />
<br />
{| class="wikitable"<br />
! Provider Name || URL || Region(s) || IPv6 Block Add-Ons || Info<br />
|-<br />
| Free Range Cloud || https://freerangecloud.com/ || Fremont/CA/US, Ashburn/VA/US || Yes ||<br />
|- <br />
| Vultr || https://www.vultr.com/ || 16 Worldwide Locations || ? ||<br />
|- <br />
| Spartan Host || https://spartanhost.net/ || Seattle/WA/US, Dallas, TX/US || ? ||<br />
|- <br />
| Virtua Cloud || https://virtua.cloud/ || Paris/Lille FR, Fremont US || ? || Requires Net-Block in ARIN IRR (AltDB/RadDB not accepted)<br />
|}</div>M0muxhttps://wiki.ampr.org/w/index.php?title=Routing_your_allocation_via_BGP&diff=991Routing your allocation via BGP2022-12-26T00:25:32Z<p>M0mux: </p>
<hr />
<div>To announce your allocation directly via your Internet Service Provider (ISP) you will need to:<br />
<br />
# Contact your ISP and ask them if they are willing to agree to announce your AMPRNet allocation in accordance with the terms of the [https://www.ampr.org/terms-of-service/ AMPRNet Terms of Service and Acceptable Use Agreement] (specifically section 7b).<br />
# Provide a WRITTEN copy of your agreement with your ISP to the AMPRNet administrator.<br />
# Upon verification of the agreement, the AMPRNet administrator will provide WRITTEN authorization to your ISP allowing them to announce your allocation.<br />
<br />
<br />
== Providers Supporting Customers Bringing IPv4 Blocks ==<br />
<br />
{| class="wikitable"<br />
! Provider Name || URL || Region(s) || IPv6 Block Add-Ons<br />
|-<br />
| Free Range Cloud || https://freerangecloud.com/ || Fremont/CA/US, Ashburn/VA/US || Yes<br />
|- <br />
| Vultr || https://www.vultr.com/ || 16 Worldwide Locations || ?<br />
|- <br />
| Spartan Host || https://spartanhost.net/ || Seattle/WA/US, Dallas, TX/US || ?<br />
|- <br />
| Virtua Cloud || https://virtua.cloud/ || Paris/Lille FR, Fremont US || ? || Requires Net-Block in IRR (AltDB/RadDB not accepted)<br />
|}</div>M0muxhttps://wiki.ampr.org/w/index.php?title=Setting_up_a_gateway_on_Ubiquiti_EdgeRouter&diff=889Setting up a gateway on Ubiquiti EdgeRouter2020-06-06T21:06:31Z<p>M0mux: /* Smoke test */</p>
<hr />
<div><br />
'''== Updated 16/05/2020 - M0MUX =='''<br />
<br />
<br />
== Setting up a gateway on Ubiquiti EdgeRouter ==<br />
<br />
EdgeRouter is a low cost professional grade router made by Ubiquiti.<br />
All routers in the product family such as EdgeRouter X, EdgeRouter Lite and EdgeRouter PoE run the EdgeOS router operating system.<br />
EdgeOS seems to be an OEM version of Vyatta (now Brocade) and Vyos (an open source version).<br />
The commands are almost identical so with little adjustments this guide could serve the different variant.<br />
<br />
EdgeRouter is appealing to anyone interested in setting up a gateway to AMPRNet due to the built in support for the IPIP tunneling protocol.<br />
This guide was created based on my experience with setting up a gateway to AMPRNet using the EdgeRouter PoE model.<br />
I haven't tested it on other models, but since they all use the same OS, it should work with minimal adjustment if any.<br />
<br />
This guide covers only one tunnel to the master AMPRnet gateway at UCSD. This guide doesn't cover the automatic setup of tunnels to other gateways.<br />
<br />
== Assumptions / Prereqs ==<br />
<br />
• You have already registered with AMPRNet and got your 44.x.x.x/y allocation and it is showing in the encap.txt file<br />
• You have registered some hosts in the AMPRNet DNS like <your call sign>.ampr.org<br />
• Your EdgeRouter is upgraded to the latest EdgeOS (currently version v2.0.6)<br />
• You have a standard working NAT setup<br />
• Interface eth0 is your connection to your ISP<br />
• Interface eth1 is your home LAN where your computers are connected<br />
<br />
You have successfully setup the EdgeRouter and it is connected to the internet and providing service to your home computers<br />
<br />
== The plan ==<br />
<br />
We will use eth2 as our AMPRNet LAN where computers and other devices with assigned AMPRNet address will connect via an IPIP tunnel to the UCSD AMPRNet gateway and the internet.<br />
<br />
== Warning!! ==<br />
<br />
The author does not assume responsibility if you mess up/brick your router. Please make sure to back up your EdgeRouter configuration prior to any change.<br />
Also make sure you know how to restore your configuration and you know how to restore your router to factory defaults if everything else fails.<br />
<br />
== Initial setup ==<br />
<br />
Open the CLI using the GUI button or connect using an ssh client such as PuTTY to 192.196.2.1.<br />
<br />
The default username/password is ubnt/ubnt unless you have already changed it.<br />
<br />
'''You need to establish a Gateway for your 44 network, that the clients will route through.'''<br />
<br />
As I write this, my 44net allocation is 44.131.252.64/28<br />
<br />
My Gateway will be the next IP in the block. 44.131.252.65<br />
<br />
Enter configuration mode<br />
• ubnt@ubnt:~$ configuration<br />
Set the AMPRNet network assignment you have received to eth2 (Gateway we just decided on)<br />
• ubnt@ubnt:~$ set interfaces ethernet eth2 address 44.131.252.65/28<br />
Now commit the changes<br />
• ubnt@ubnt:~$ commit<br />
<br />
== Setting up the tunnel ==<br />
<br />
In configuration mode enter the following commands<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 local-ip <put the external ip assigned to you by your ISP><br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 remote-ip 169.228.34.84<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 encapsulation ipip<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 description "Tunnel to AMPRNet gateway"<br />
Now commit the changes<br />
• ubnt@ubnt:~$ commit<br />
To verify your input so far, enter the following command<br />
• ubnt@ubnt:~$ show interfaces tunnel tun0<br />
The output should look like this<br />
• description "Tunnel to AMPRNet gateway"<br />
• encapsulation ipip<br />
• local-ip <your assigned ISP address><br />
• remote-ip 169.228.34.84<br />
<br />
== Setting up source address routing policy ==<br />
<br />
Most likely your home computers LAN is setup to route to any internet destination via the interface connected to the ISP.<br />
In addition, all your private ip addresses are being masqueraded before getting to the outside world.<br />
Entering the following command (in operational mode) will print the routing table<br />
• ubnt@ubnt:~$ show ip route<br />
<br />
You should get something similar to this routing table<br />
<br />
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP<br />
O - OSPF, IA - OSPF inter area<br />
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2<br />
E1 - OSPF external type 1, E2 - OSPF external type 2<br />
> - selected route, * - FIB route, p - stale info<br />
IP Route Table for VRF "default"<br />
S *> 0.0.0.0/0 [210/0] via <your ISP default gateway>, eth0<br />
C *> <your ISP network> is directly connected, eth0<br />
C *> 127.0.0.0/8 is directly connected, lo<br />
<br />
0.0.0.0/0 basically means "every ip address"<br />
<br />
We want to make sure the following happen:<br />
<br />
• Normal routing for your home computers LAN is maintained.<br />
<br />
• Your AMPRNet hosts are being routed to the tunnel to connect to the internet. No masquerading is needed.<br />
<br />
Let's define source address routing policy that will make sure only AMPRNet hosts are routed to the tunnel<br />
• ubnt@ubnt:~$ set protocols static table 1 interface-route 0.0.0.0/0 next-hop-interface tun0<br />
• ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 description 'traffic to AMPRNet'<br />
• ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 source address <put your AMPRNet assigned network - in my case 44.252.131.64/28><br />
• ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 modify table 1<br />
• ubnt@ubnt:~$ set interfaces ethernet eth2 firewall in modify SOURCE_ROUTE<br />
<br />
Now commit the changes<br />
• ubnt@ubnt:~$ commit<br />
<br />
== Smoke test ==<br />
<br />
To test our configuration, we first need to connect a computer to the EdgeRouter interface eth2 and manually assign an ip address from our assigned AMPRNet network range that has already been registered with the DNS.<br />
<br />
To test that we are accessible from the outside world, use a "ping service" such as ping.eu to ping the above mentioned host. If you see response, this basically means that the tunnel is working! (At least from the outside in)<br />
<br />
To see that our source routing policy works, ping an external host such as google DNS server @ 8.8.8.8. If you see a response, you at least know that your above mentioned host is reaching the internet.<br />
<br />
To verify that we are exiting the router via the tunnel, do a traceroute command to 8.8.8.8. If in the trace you see some ucsd.edu host, you know that you are using the tunnel.<br />
<br />
The last test we can do is to use a site like whatismyip.com to see the address which we are coming from. If it is the address is the above mentioned host, then we have successfully setup the AMPRNet gateway.<br />
<br />
== Finishing touches ==<br />
<br />
If you have reached so far and everything is working correctly, it is time to save our configuration.<br />
In configuration mode enter the following<br />
• ubnt@ubnt:~$ save<br />
<br />
Since we have now an open tunnel to the world ending in our EdgeRouter, we need to extend our firewall protection to interface tun0. This can easily be done in the EdgeRouter GUI.<br />
• Select the Firewall/NAT tab<br />
• Select firewall policies tab<br />
There should be two rulesets<br />
o WAN_IN<br />
o WAN_LOCAL<br />
<br />
For each rule, press the actions button on the right and select the interfaces option.<br />
<br />
• Press the + Add Interface button.<br />
• Select tun0 as the interface and select in as the direction.<br />
• Finish by pressing the Save Ruleset button.<br />
<br />
<br />
== Example Config ==<br />
<br />
This is from my working ER4.<br />
<br />
firewall modify SOURCE_ROUTE {<br />
rule 10 {<br />
action modify<br />
description "traffic to ampr"<br />
modify {<br />
table 5<br />
}<br />
source {<br />
address 44.131.252.64/28<br />
}<br />
}<br />
}<br />
<br />
firewall name 44Net_IN {<br />
default-action drop<br />
description "44Net in"<br />
rule 10 {<br />
action accept<br />
description "Allow established/related"<br />
log disable<br />
state {<br />
established enable<br />
related enable<br />
}<br />
}<br />
rule 20 {<br />
action accept<br />
description ICMP<br />
log disable<br />
protocol icmp<br />
}<br />
rule 30 {<br />
action drop<br />
description "Drop invalid state"<br />
state {<br />
invalid enable<br />
}<br />
}<br />
}<br />
<br />
interfaces ethernet eth3 {<br />
address 44.131.252.65/28<br />
description 44.131.252.65/28<br />
duplex auto<br />
firewall {<br />
in {<br />
modify SOURCE_ROUTE<br />
}<br />
local {<br />
}<br />
out {<br />
}<br />
}<br />
ip {<br />
}<br />
speed auto<br />
}<br />
<br />
interfaces tunnel tun0 {<br />
description "Tunnel to AMPRNet"<br />
encapsulation ipip<br />
firewall {<br />
in {<br />
name 44Net_IN<br />
}<br />
}<br />
ip {<br />
}<br />
local-ip 80.235.222.210<br />
multicast disable<br />
remote-ip 169.228.34.84<br />
ttl 255<br />
}<br />
<br />
protocols static {<br />
table 5 {<br />
interface-route 0.0.0.0/0 {<br />
next-hop-interface tun0 {<br />
}<br />
}<br />
}<br />
}</div>M0muxhttps://wiki.ampr.org/w/index.php?title=Setting_up_a_gateway_on_Ubiquiti_EdgeRouter&diff=888Setting up a gateway on Ubiquiti EdgeRouter2020-05-16T19:42:02Z<p>M0mux: </p>
<hr />
<div><br />
'''== Updated 16/05/2020 - M0MUX =='''<br />
<br />
<br />
== Setting up a gateway on Ubiquiti EdgeRouter ==<br />
<br />
EdgeRouter is a low cost professional grade router made by Ubiquiti.<br />
All routers in the product family such as EdgeRouter X, EdgeRouter Lite and EdgeRouter PoE run the EdgeOS router operating system.<br />
EdgeOS seems to be an OEM version of Vyatta (now Brocade) and Vyos (an open source version).<br />
The commands are almost identical so with little adjustments this guide could serve the different variant.<br />
<br />
EdgeRouter is appealing to anyone interested in setting up a gateway to AMPRNet due to the built in support for the IPIP tunneling protocol.<br />
This guide was created based on my experience with setting up a gateway to AMPRNet using the EdgeRouter PoE model.<br />
I haven't tested it on other models, but since they all use the same OS, it should work with minimal adjustment if any.<br />
<br />
This guide covers only one tunnel to the master AMPRnet gateway at UCSD. This guide doesn't cover the automatic setup of tunnels to other gateways.<br />
<br />
== Assumptions / Prereqs ==<br />
<br />
• You have already registered with AMPRNet and got your 44.x.x.x/y allocation and it is showing in the encap.txt file<br />
• You have registered some hosts in the AMPRNet DNS like <your call sign>.ampr.org<br />
• Your EdgeRouter is upgraded to the latest EdgeOS (currently version v2.0.6)<br />
• You have a standard working NAT setup<br />
• Interface eth0 is your connection to your ISP<br />
• Interface eth1 is your home LAN where your computers are connected<br />
<br />
You have successfully setup the EdgeRouter and it is connected to the internet and providing service to your home computers<br />
<br />
== The plan ==<br />
<br />
We will use eth2 as our AMPRNet LAN where computers and other devices with assigned AMPRNet address will connect via an IPIP tunnel to the UCSD AMPRNet gateway and the internet.<br />
<br />
== Warning!! ==<br />
<br />
The author does not assume responsibility if you mess up/brick your router. Please make sure to back up your EdgeRouter configuration prior to any change.<br />
Also make sure you know how to restore your configuration and you know how to restore your router to factory defaults if everything else fails.<br />
<br />
== Initial setup ==<br />
<br />
Open the CLI using the GUI button or connect using an ssh client such as PuTTY to 192.196.2.1.<br />
<br />
The default username/password is ubnt/ubnt unless you have already changed it.<br />
<br />
'''You need to establish a Gateway for your 44 network, that the clients will route through.'''<br />
<br />
As I write this, my 44net allocation is 44.131.252.64/28<br />
<br />
My Gateway will be the next IP in the block. 44.131.252.65<br />
<br />
Enter configuration mode<br />
• ubnt@ubnt:~$ configuration<br />
Set the AMPRNet network assignment you have received to eth2 (Gateway we just decided on)<br />
• ubnt@ubnt:~$ set interfaces ethernet eth2 address 44.131.252.65/28<br />
Now commit the changes<br />
• ubnt@ubnt:~$ commit<br />
<br />
== Setting up the tunnel ==<br />
<br />
In configuration mode enter the following commands<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 local-ip <put the external ip assigned to you by your ISP><br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 remote-ip 169.228.34.84<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 encapsulation ipip<br />
• ubnt@ubnt:~$ set interfaces tunnel tun0 description "Tunnel to AMPRNet gateway"<br />
Now commit the changes<br />
• ubnt@ubnt:~$ commit<br />
To verify your input so far, enter the following command<br />
• ubnt@ubnt:~$ show interfaces tunnel tun0<br />
The output should look like this<br />
• description "Tunnel to AMPRNet gateway"<br />
• encapsulation ipip<br />
• local-ip <your assigned ISP address><br />
• remote-ip 169.228.34.84<br />
<br />
== Setting up source address routing policy ==<br />
<br />
Most likely your home computers LAN is setup to route to any internet destination via the interface connected to the ISP.<br />
In addition, all your private ip addresses are being masqueraded before getting to the outside world.<br />
Entering the following command (in operational mode) will print the routing table<br />
• ubnt@ubnt:~$ show ip route<br />
<br />
You should get something similar to this routing table<br />
<br />
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP<br />
O - OSPF, IA - OSPF inter area<br />
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2<br />
E1 - OSPF external type 1, E2 - OSPF external type 2<br />
> - selected route, * - FIB route, p - stale info<br />
IP Route Table for VRF "default"<br />
S *> 0.0.0.0/0 [210/0] via <your ISP default gateway>, eth0<br />
C *> <your ISP network> is directly connected, eth0<br />
C *> 127.0.0.0/8 is directly connected, lo<br />
<br />
0.0.0.0/0 basically means "every ip address"<br />
<br />
We want to make sure the following happen:<br />
<br />
• Normal routing for your home computers LAN is maintained.<br />
<br />
• Your AMPRNet hosts are being routed to the tunnel to connect to the internet. No masquerading is needed.<br />
<br />
Let's define source address routing policy that will make sure only AMPRNet hosts are routed to the tunnel<br />
• ubnt@ubnt:~$ set protocols static table 1 interface-route 0.0.0.0/0 next-hop-interface tun0<br />
• ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 description 'traffic to AMPRNet'<br />
• ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 source address <put your AMPRNet assigned network - in my case 44.252.131.64/28><br />
• ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 modify table 1<br />
• ubnt@ubnt:~$ set interfaces ethernet eth2 firewall in modify SOURCE_ROUTE<br />
<br />
Now commit the changes<br />
• ubnt@ubnt:~$ commit<br />
<br />
== Smoke test ==<br />
<br />
To test our configuration, we first need to connect a computer to the EdgeRouter interface eth0 and manually assign an ip address from our assigned AMPRNet network range that has already been registered with the DNS.<br />
<br />
To test that we are accessible from the outside world, use a "ping service" such as ping.eu to ping the above mentioned host. If you see response, this basically means that the tunnel is working! (At least from the outside in)<br />
<br />
To see that our source routing policy works, ping an external host such as google DNS server @ 8.8.8.8. If you see a response, you at least know that your above mentioned host is reaching the internet.<br />
<br />
To verify that we are exiting the router via the tunnel, do a traceroute command to 8.8.8.8. If in the trace you see some ucsd.edu host, you know that you are using the tunnel.<br />
<br />
The last test we can do is to use a site like whatismyip.com to see the address which we are coming from. If it is the address is the above mentioned host, then we have successfully setup the AMPRNet gateway.<br />
<br />
== Finishing touches ==<br />
<br />
If you have reached so far and everything is working correctly, it is time to save our configuration.<br />
In configuration mode enter the following<br />
• ubnt@ubnt:~$ save<br />
<br />
Since we have now an open tunnel to the world ending in our EdgeRouter, we need to extend our firewall protection to interface tun0. This can easily be done in the EdgeRouter GUI.<br />
• Select the Firewall/NAT tab<br />
• Select firewall policies tab<br />
There should be two rulesets<br />
o WAN_IN<br />
o WAN_LOCAL<br />
<br />
For each rule, press the actions button on the right and select the interfaces option.<br />
<br />
• Press the + Add Interface button.<br />
• Select tun0 as the interface and select in as the direction.<br />
• Finish by pressing the Save Ruleset button.<br />
<br />
<br />
== Example Config ==<br />
<br />
This is from my working ER4.<br />
<br />
firewall modify SOURCE_ROUTE {<br />
rule 10 {<br />
action modify<br />
description "traffic to ampr"<br />
modify {<br />
table 5<br />
}<br />
source {<br />
address 44.131.252.64/28<br />
}<br />
}<br />
}<br />
<br />
firewall name 44Net_IN {<br />
default-action drop<br />
description "44Net in"<br />
rule 10 {<br />
action accept<br />
description "Allow established/related"<br />
log disable<br />
state {<br />
established enable<br />
related enable<br />
}<br />
}<br />
rule 20 {<br />
action accept<br />
description ICMP<br />
log disable<br />
protocol icmp<br />
}<br />
rule 30 {<br />
action drop<br />
description "Drop invalid state"<br />
state {<br />
invalid enable<br />
}<br />
}<br />
}<br />
<br />
interfaces ethernet eth3 {<br />
address 44.131.252.65/28<br />
description 44.131.252.65/28<br />
duplex auto<br />
firewall {<br />
in {<br />
modify SOURCE_ROUTE<br />
}<br />
local {<br />
}<br />
out {<br />
}<br />
}<br />
ip {<br />
}<br />
speed auto<br />
}<br />
<br />
interfaces tunnel tun0 {<br />
description "Tunnel to AMPRNet"<br />
encapsulation ipip<br />
firewall {<br />
in {<br />
name 44Net_IN<br />
}<br />
}<br />
ip {<br />
}<br />
local-ip 80.235.222.210<br />
multicast disable<br />
remote-ip 169.228.34.84<br />
ttl 255<br />
}<br />
<br />
protocols static {<br />
table 5 {<br />
interface-route 0.0.0.0/0 {<br />
next-hop-interface tun0 {<br />
}<br />
}<br />
}<br />
}</div>M0mux