IPIP Mesh/Firewalls - Revision history

KI5QKX: Organize IPIP Mesh documentation and navigation

2026-09-29T19:09:04Z

Organize IPIP Mesh documentation and navigation

← Older revision		Revision as of 19:09, 29 September 2026
Line 1:		Line 1:
			{{Section nav\|hub=IPIP Mesh\|title=IPIP Mesh\|category=IPIP Mesh}}

	Welcome to the Firewall Wiki.		Welcome to the Firewall Wiki.

Line 34:		Line 36:
	* Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.'''		* Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.'''
	* ''If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.''		* ''If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.''
	* '''For most embedded devices, it is suggested to use [[Firewalls#ipset\|ipset]] rules instead'''		* '''For most embedded devices, it is suggested to use [[IPIP Mesh/Firewalls#ipset\|ipset]] rules instead'''

	'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering		'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering
Line 83:		Line 85:

	''REQUIRED:''		''REQUIRED:''
	[[ampr-ripd]] (using the -x and -d arguments), the diff command from the [http://www.gnu.org/software/diffutils/manual/diffutils.html diffutils package] and the [https://www.gnu.org/software/sed/manual/sed.html sed command].		[[IPIP Mesh/Ampr-ripd\|ampr-ripd]] (using the -x and -d arguments), the diff command from the [http://www.gnu.org/software/diffutils/manual/diffutils.html diffutils package] and the [https://www.gnu.org/software/sed/manual/sed.html sed command].

	# Place this rule a the last firewall command		# Place this rule a the last firewall command
Line 169:		Line 171:
	If your AMPR node is downstream, you will create an INPUT '''and''' DNAT forward rule to the destination LAN IP of your AMPR node.		If your AMPR node is downstream, you will create an INPUT '''and''' DNAT forward rule to the destination LAN IP of your AMPR node.

	''To enable receipt of [[RIP]]44''		''To enable receipt of [[IPIP Mesh/RIP\|RIP]]44''

	iptables -t filter -I INPUT -p udp -s 44.0.0.1 --sport 520 -d 224.0.0.9 --dport 520 -i tunl0 -j ACCEPT		iptables -t filter -I INPUT -p udp -s 44.0.0.1 --sport 520 -d 224.0.0.9 --dport 520 -i tunl0 -j ACCEPT
Line 216:		Line 218:
	To enable dynamic filtering of IPENCAP (IP Protocol Number 4)		To enable dynamic filtering of IPENCAP (IP Protocol Number 4)

	''REQUIRED:'' [[ampr-ripd]] (using the -x and -d arguments) and the ipset package.'''		''REQUIRED:'' [[IPIP Mesh/Ampr-ripd\|ampr-ripd]] (using the -x and -d arguments) and the ipset package.'''

	#!/bin/sh		#!/bin/sh
Line 238:		Line 240:
	== OpenBSD ==		== OpenBSD ==

	''See the Instructions for [[Setting up a gateway on OpenBSD]].''		''See the Instructions for [[IPIP Mesh/OpenBSD\|Setting up a gateway on OpenBSD]].''

	OpenBSD comes with a robust, flexible and highly performant firewall called "PF" that works well on AMPRNet. See https://www.openbsd.org/faq/pf/ for more information.		OpenBSD comes with a robust, flexible and highly performant firewall called "PF" that works well on AMPRNet. See https://www.openbsd.org/faq/pf/ for more information.
Line 244:		Line 246:
	== OpenWrt ==		== OpenWrt ==

	''See: [[Firewalls#iptables\|iptables]] and [[Firewalls#ipset\|ipset]] (above), and the Instructions for [[~~setting up a gateway on OpenWRT~~\|setting up a gateway on OpenWRT]].''		''See: [[IPIP Mesh/Firewalls#iptables\|iptables]] and [[IPIP Mesh/Firewalls#ipset\|ipset]] (above), and the Instructions for [[IPIP Mesh/OpenWrt\|setting up a gateway on OpenWRT]].''

	* the Bogon ipset script is added to '''System > Startup''' on the web GUI - or into the Unified Configuration Interface (UCI) file ''/etc/rc.local''		* the Bogon ipset script is added to '''System > Startup''' on the web GUI - or into the Unified Configuration Interface (UCI) file ''/etc/rc.local''
	* [[Firewalls#iptables\|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''		* [[IPIP Mesh/Firewalls#iptables\|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''
	* [[Firewalls#ipset\|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall'' ''(OpenWrt syntax must be used in this file!)''		* [[IPIP Mesh/Firewalls#ipset\|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall'' ''(OpenWrt syntax must be used in this file!)''
	* '''MSS Clamping is enabled in the Firewall Section, you should enable this on both the AMPRLAN and AMPRWAN interfaces'''		* '''MSS Clamping is enabled in the Firewall Section, you should enable this on both the AMPRLAN and AMPRWAN interfaces'''

	''Adding Bogon drop rule to OpenWrt (using [[Firewalls#ipset\|ipset]])''		''Adding Bogon drop rule to OpenWrt (using [[IPIP Mesh/Firewalls#ipset\|ipset]])''

	# in /etc/config/firewall		# in /etc/config/firewall
Line 262:		Line 264:
	option extra '-m set --match-set bogons src'		option extra '-m set --match-set bogons src'

	''Adding IPENCAP Filtering of AMPR Nodes to OpenWrt (using [[Firewalls#ipset\|ipset]])''		''Adding IPENCAP Filtering of AMPR Nodes to OpenWrt (using [[IPIP Mesh/Firewalls#ipset\|ipset]])''

	# in /etc/config/firewall		# in /etc/config/firewall
Line 273:		Line 275:
	option extra '-m set --match-set ipipfilter src'		option extra '-m set --match-set ipipfilter src'

	''Adding ICMP Filtering of AMPR Nodes to OpenWrt (using [[Firewalls#ipset\|ipset]])''		''Adding ICMP Filtering of AMPR Nodes to OpenWrt (using [[IPIP Mesh/Firewalls#ipset\|ipset]])''

	# in /etc/config/firewall		# in /etc/config/firewall

KI5QKX: KI5QKX moved page Firewalls to IPIP Mesh/Firewalls: Group IPIP Mesh firewall documentation under IPIP Mesh

2026-09-29T19:09:03Z

KI5QKX moved page Firewalls to IPIP Mesh/Firewalls: Group IPIP Mesh firewall documentation under IPIP Mesh

← Older revision	Revision as of 19:09, 29 September 2026
(No difference)

KI5QKX: mw push

2026-04-30T18:52:54Z

mw push

← Older revision		Revision as of 18:52, 30 April 2026
Line 2:		Line 2:

	This page is intended to be edited by the community to add use practices, command syntax, etc. regarding firewalling and security on AMPRNet nodes. While each operator is ultimately responsible for the administration of their node, it is highly suggested amongst the [[44Net mailing list]] Community that nodes be firewalled.		This page is intended to be edited by the community to add use practices, command syntax, etc. regarding firewalling and security on AMPRNet nodes. While each operator is ultimately responsible for the administration of their node, it is highly suggested amongst the [[44Net mailing list]] Community that nodes be firewalled.


	== Cisco ==		== Cisco ==


	== DD-WRT ==		== DD-WRT ==
Line 286:		Line 284:
	option extra '-m set --match-set ipipfilter src'		option extra '-m set --match-set ipipfilter src'
	option name 'Ping_fromIPENCAPS'		option name 'Ping_fromIPENCAPS'



	[[Category:Reference]]		[[Category:Reference]]
	[[Category:Infrastructure]]		[[Category:Infrastructure]]

KI5QKX: mw push

2026-03-01T00:14:54Z

mw push

← Older revision		Revision as of 00:14, 1 March 2026
Line 290:		Line 290:

	[[Category:Reference]]		[[Category:Reference]]
			[[Category:Infrastructure]]

KI5QKX at 20:28, 12 December 2024

2024-12-12T20:28:03Z

← Older revision		Revision as of 20:28, 12 December 2024
Line 286:		Line 286:
	option extra '-m set --match-set ipipfilter src'		option extra '-m set --match-set ipipfilter src'
	option name 'Ping_fromIPENCAPS'		option name 'Ping_fromIPENCAPS'



			[[Category:Reference]]

Cross: Mention OpenBSD and PF

2024-05-04T12:12:02Z

Mention OpenBSD and PF

← Older revision		Revision as of 12:12, 4 May 2024
Line 237:		Line 237:

	== Microtik ==		== Microtik ==

			== OpenBSD ==

			''See the Instructions for [[Setting up a gateway on OpenBSD]].''

			OpenBSD comes with a robust, flexible and highly performant firewall called "PF" that works well on AMPRNet. See https://www.openbsd.org/faq/pf/ for more information.

	== OpenWrt ==		== OpenWrt ==

Kb3vwg: /* OpenWrt */ added information about MSS Clamping

2019-04-25T16:17:08Z

OpenWrt: added information about MSS Clamping

← Older revision		Revision as of 16:17, 25 April 2019
Line 245:		Line 245:
	* [[Firewalls#iptables\|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''		* [[Firewalls#iptables\|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''
	* [[Firewalls#ipset\|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall'' ''(OpenWrt syntax must be used in this file!)''		* [[Firewalls#ipset\|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall'' ''(OpenWrt syntax must be used in this file!)''
			* '''MSS Clamping is enabled in the Firewall Section, you should enable this on both the AMPRLAN and AMPRWAN interfaces'''

	''Adding Bogon drop rule to OpenWrt (using [[Firewalls#ipset\|ipset]])''		''Adding Bogon drop rule to OpenWrt (using [[Firewalls#ipset\|ipset]])''

Kb3vwg: accidentally added my own subnet to ipset bogons, edited ipset to properly reflect

2019-01-21T20:54:24Z

accidentally added my own subnet to ipset bogons, edited ipset to properly reflect

← Older revision		Revision as of 20:54, 21 January 2019
Line 206:		Line 206:
	ipset -A bogons 203.0.113.0/24		ipset -A bogons 203.0.113.0/24
	ipset -A bogons 224.0.0.0/4		ipset -A bogons 224.0.0.0/4
	ipset -A bogons 240.0.0.0/4		ipset -A bogons 240.0.0.0/4
	ipset -A bogons 44.60.44.0/24		# Block of your own AMPRNet Subnet
			# ipset -A bogons 44.xxx.xxx.xxx/xx
	# Block of Test AMPRNet Subnet		# Block of Test AMPRNet Subnet
	# ipset -A bogons 44.128.0.0/16		# ipset -A bogons 44.128.0.0/16

Kb3vwg: added warning about using iptables on embeded devices - ipset prefered

2019-01-12T16:09:19Z

added warning about using iptables on embeded devices - ipset prefered

← Older revision		Revision as of 16:09, 12 January 2019
Line 36:		Line 36:
	* Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.'''		* Since the IPENCAP Linux Kernel Module IPIP is in the kernel, '''you must set the default forwarding policy to DROP or REJECT.'''
	* ''If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.''		* ''If you set your default routing policy to ACCEPT, all packets that have not been explicitly DROPped or REJECTed elsewhere, will route, regardless of firewall policies.''
			* '''For most embedded devices, it is suggested to use [[Firewalls#ipset\|ipset]] rules instead'''

	'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering		'''General Bogon rules''' - see: https://en.wikipedia.org/wiki/Bogon_filtering
Line 80:		Line 81:
	''NOTE:''		''NOTE:''

	* ''This script needs work, see Thu Jan 10 11:09:27 PST 2019 message in the [[44Net mailing list]] archive. Due to overheard running on many devices, the ipset script is suggested instead.''		* ''This script needs work, see Thu Jan 10 11:09:27 PST 2019 message in the [[44Net mailing list]] archive. Due to extreme overheard running on many devices, the ipset script is suggested instead.''
	* This rule (or one of the ipset or static rules below) is required for other AMPR nodes to initiate inbound traffic to your node.		* This rule (or one of the ipset or static rules below) is required for other AMPR nodes to initiate inbound traffic to your node.

Kb3vwg: add ipset bogon config

2019-01-12T16:05:24Z

add ipset bogon config

@@ Line 69: / Line 69: @@
   # Block of Test AMPRNet Subnet
   # iptables -t raw -I PREROUTING -s 44.128.0.0/16 -i tunl0 -j DROP
   ############################################################
   # THIS PREVENTS NESTED IPENCAP (BCP 38)
@@ Line 184: / Line 185: @@
 == ipset ==
 '''Dynamic IPENCAP Filtering of AMPR Nodes (using ipset)'''
@@ Line 213: / Line 240: @@
 ''See: [[Firewalls#iptables|iptables]] and [[Firewalls#ipset|ipset]] (above), and the Instructions for [[setting up a gateway on OpenWRT|setting up a gateway on OpenWRT]].''
-* [[Firewalls#iptables|iptables]]-based rules are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface
+* the Bogon ipset script is added to '''System > Startup''' on the web GUI - or into the Unified Configuration Interface (UCI) file ''/etc/rc.local''
-* [[Firewalls#ipset|ipset]]-based rules are entered on the command line - into the Unified Configuration Interface (UCI) file ''/etc/config/firewall''
+* [[Firewalls#iptables|iptables]]-based scripts are entered at '''Network > Firewall > Custom Firewall''' on the LuCI web GUI interface - or into the Unified Configuration Interface (UCI) file ''/etc/firewall.user''
 ''Adding IPENCAP Filtering of AMPR Nodes to OpenWrt (using [[Firewalls#ipset|ipset]])''