Startampr - Revision history

KI5QKX: mw push

2026-04-30T18:52:40Z

mw push

← Older revision		Revision as of 18:52, 30 April 2026
Line 1:		Line 1:
	'''startampr''' is a custom suite of [https://en.wikipedia.org/wiki/Bash_%28Unix_shell%29 Bourne Again Shell] scripts developed by KB3VWG and others in the [[44Net mailing list]] Community, that turns a Debian/Ubuntu-based Linux machine into an AMPR [[Gateway]] on boot; and starts an [https://en.wikipedia.org/wiki/IP_in_IP IPENCAP] (or [https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers IP Protocol] number four) tunnel. The primary advantage to using this suite is that it executes and enables AMPR RIP44 daemons, munge scripts, interfaces and routing commands in proper boot order; and references them using the command syntax, default command arguments and practices that have become the de facto standard on [[AMPRNet]]. It is also minimally invasive, in that the machine otherwise remains an "untouched" default installation; and can be returned to an OEM Ubuntu installation by simply removing all associated files and uninstalling all packages added when configuring the machine to run '''startampr''' (please assist me in developing an uninstall script, if interested). Also, if you install a server GUI (e.g. [http://www.webmin.com Webmin]), you can disable the routing features of the machine simply by checking a box, and hitting APPLY (on next reboot, it is disabled). '''The current versions are 1.0 (no longer developed), and 2.0, released to the [[44Net mailing list]] Community on May 26, 2017 at 14:14 UTC.		'''startampr''' is a custom suite of [https://en.wikipedia.org/wiki/Bash_%28Unix_shell%29 Bourne Again Shell] scripts developed by KB3VWG and others in the [[44Net mailing list]] Community, that turns a Debian/Ubuntu-based Linux machine into an AMPR [[Gateway]] on boot; and starts an [https://en.wikipedia.org/wiki/IP_in_IP IPENCAP] (or [https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers IP Protocol] number four) tunnel. The primary advantage to using this suite is that it executes and enables AMPR RIP44 daemons, munge scripts, interfaces and routing commands in proper boot order; and references them using the command syntax, default command arguments and practices that have become the de facto standard on [[AMPRNet]]. It is also minimally invasive, in that the machine otherwise remains an "untouched" default installation; and can be returned to an OEM Ubuntu installation by simply removing all associated files and uninstalling all packages added when configuring the machine to run '''startampr''' (please assist me in developing an uninstall script, if interested). Also, if you install a server GUI (e.g. [http://www.webmin.com Webmin]), you can disable the routing features of the machine simply by checking a box, and hitting APPLY (on next reboot, it is disabled). '''The current versions are 1.0 (no longer developed), and 2.0, released to the [[44Net mailing list]] Community on May 26, 2017 at 14:14 UTC.


	== Detailed summary ==		== Detailed summary ==
Line 186:		Line 185:
	* [(link to KB3VWG's site here) Detailed Readme and Installation instructions by KB3VWG]		* [(link to KB3VWG's site here) Detailed Readme and Installation instructions by KB3VWG]

			[[Category:How-To]]
	[[Category:Reference]]		[[Category:Reference]]

	[[Category:How-To Guides]]		[[Category:How-To Guides]]
	[[Category:Getting Started]]		[[Category:Getting Started]]

KI5QKX: mw push

2026-03-01T00:14:37Z

mw push

← Older revision		Revision as of 00:14, 1 March 2026
Line 190:		Line 190:

	[[Category:How-To Guides]]		[[Category:How-To Guides]]
			[[Category:Getting Started]]

KI5QKX: mw push

2026-02-28T23:20:23Z

mw push

← Older revision		Revision as of 23:20, 28 February 2026
Line 2:		Line 2:


	== Detailed ~~Summary~~ ==		== Detailed summary ==

	In addition to the first and main script, '''startampr''', other tools included with the official release are: init scripts to execute the file, save the routing table (if using a method that does not automatically save it); and an executable script generator (made using [http://linux.die.net/man/1/sed the sed command]) that can restore the AMPR routing table (i.e. in the case the administrator flushes the table). The script uses the [http://www.linuxfoundation.org/collaborate/workgroups/networking/tunneling ipip Linux Kernel module] and implements [http://linux.die.net/man/8/ip Linux ip] routing table's [https://en.wikipedia.org/wiki/Policy-based_routing policy-based routing] to properly move traffic across the routing plane. It is suggested that [https://en.wikipedia.org/wiki/Iptables iptables] be used to firewall traffic after verification of a proper installation.		In addition to the first and main script, '''startampr''', other tools included with the official release are: init scripts to execute the file, save the routing table (if using a method that does not automatically save it); and an executable script generator (made using [http://linux.die.net/man/1/sed the sed command]) that can restore the AMPR routing table (i.e. in the case the administrator flushes the table). The script uses the [http://www.linuxfoundation.org/collaborate/workgroups/networking/tunneling ipip Linux Kernel module] and implements [http://linux.die.net/man/8/ip Linux ip] routing table's [https://en.wikipedia.org/wiki/Policy-based_routing policy-based routing] to properly move traffic across the routing plane. It is suggested that [https://en.wikipedia.org/wiki/Iptables iptables] be used to firewall traffic after verification of a proper installation.
Line 10:		Line 10:
	'''NOTE: if you do not wish to compile software, you must use [[rip44d]] or [[Encap.txt]] with a [[munge script]].'''		'''NOTE: if you do not wish to compile software, you must use [[rip44d]] or [[Encap.txt]] with a [[munge script]].'''

	== 2.0 Security ~~Update~~ ==		== 2.0 Security update ==

	'''startampr 2.0's code includes a security fix that corrects a routing issue that allows unencapsulated traffic from the tunnel to leak onto the LAN or Public Internet interface in version 1.0 - this only occurs when a AMPRNnet-facing user attempts to connect using invalid source IPs or invalid AMPRNet IP address'''. In original development of version 1.0, it was considered that this behavior could be valid to reach subnets ran by operators using the option at: [[Announcing your allocation directly]]; '''but do not make their tunnel available on a non-44.0.0.0/8 address''' (it was announced on the [[44Net mailing list]] on 04AUG2015, that AMPRGW now routes traffic to/from BGPed and IPENCAPed AMPR subnets, making this programmatic workaround unnecessary).		'''startampr 2.0's code includes a security fix that corrects a routing issue that allows unencapsulated traffic from the tunnel to leak onto the LAN or Public Internet interface in version 1.0 - this only occurs when a AMPRNnet-facing user attempts to connect using invalid source IPs or invalid AMPRNet IP address'''. In original development of version 1.0, it was considered that this behavior could be valid to reach subnets ran by operators using the option at: [[Announcing your allocation directly]]; '''but do not make their tunnel available on a non-44.0.0.0/8 address''' (it was announced on the [[44Net mailing list]] on 04AUG2015, that AMPRGW now routes traffic to/from BGPed and IPENCAPed AMPR subnets, making this programmatic workaround unnecessary).
Line 106:		Line 106:
	### ENABLE IP FORWARDING ###		### ENABLE IP FORWARDING ###
	sysctl -w net.ipv4.ip_forward=1		sysctl -w net.ipv4.ip_forward=1
	## Allows traceroute to respond using ~~44net~~ IP of tunl0 or br-amprlan ##		## Allows traceroute to respond using 44Net IP of tunl0 or br-amprlan ##
	echo 1 > /proc/sys/net/ipv4/icmp_errors_use_inbound_ifaddr		echo 1 > /proc/sys/net/ipv4/icmp_errors_use_inbound_ifaddr

KI5QKX at 20:38, 12 December 2024

2024-12-12T20:38:16Z

← Older revision		Revision as of 20:38, 12 December 2024
Line 185:		Line 185:
	* [http://marc.storck.lu/blog/2013/08/howto-setup-an-amprnet-gateway-on-linux/ Alternative installation instructions by Marc, LX1DUC]		* [http://marc.storck.lu/blog/2013/08/howto-setup-an-amprnet-gateway-on-linux/ Alternative installation instructions by Marc, LX1DUC]
	* [(link to KB3VWG's site here) Detailed Readme and Installation instructions by KB3VWG]		* [(link to KB3VWG's site here) Detailed Readme and Installation instructions by KB3VWG]


			[[Category:Reference]]

			[[Category:How-To Guides]]

WB6CYT at 11:46, 25 July 2019

2019-07-25T11:46:19Z

← Older revision		Revision as of 11:46, 25 July 2019
Line 161:		Line 161:
	* The '''startampr''' backup script '''/etc/cron.hourly/backup_ampr''' is added to a folder that is configured in Ubuntu, by default, to run scripts at :17 after the hour. The Main AMPR Gateway sends an update every five minutes. For advanced instructions on changing this time interval, see [https://help.ubuntu.com/community/CronHowto the Ubuntu Community cron HowTo].		* The '''startampr''' backup script '''/etc/cron.hourly/backup_ampr''' is added to a folder that is configured in Ubuntu, by default, to run scripts at :17 after the hour. The Main AMPR Gateway sends an update every five minutes. For advanced instructions on changing this time interval, see [https://help.ubuntu.com/community/CronHowto the Ubuntu Community cron HowTo].
	* A strict assortment of: file permissions, naming conventions and leading characters (e.g. '''"#!/bin/bash"''') are required in '''/etc/init/''', '''/etc/if-up.d/''' (used in a script to reload table 44 on boot) and '''/etc/cron.hourly/'''. Note that: '''startampr''' has properly named those files. If you wish to edit them, please follow the documentation and README for more details.		* A strict assortment of: file permissions, naming conventions and leading characters (e.g. '''"#!/bin/bash"''') are required in '''/etc/init/''', '''/etc/if-up.d/''' (used in a script to reload table 44 on boot) and '''/etc/cron.hourly/'''. Note that: '''startampr''' has properly named those files. If you wish to edit them, please follow the documentation and README for more details.
	* '''Please note that: any machine acting as an AMPRNet Gateway must explicitly create high-priority routing rules for all traffic addressed to or from eth0. The network assigned to eth0 must be configured to ONLY use table main.''' No other valid configuration has been found to properly work (discovered by PE1CHL and tested by KB3VWG and others in the [[44Net mailing list]] Community). '''This is due to the unique fact that, on AMPRNet routers, 44.0.0.0/8 exists on both the Public (eth0) and AMPRNet-facing (tunl0) sides of the device. There is no way to properly differentiate the route or destination interface of the traffic received from 44.0.0.0/8 over tunl0 (with your 44Router's 44 IP address), versus that from eth0 (on the Gateway's Public-facing IP). Meaning, there is no way to route traffic for all cases, except by SOURCE OR DESTINATION IP ADDRESS. Therefore, ALL traffic to and from the network facing eth0, must use eth0.''' In order to access your AMPRNet from a local network, you must create another routable LAN (and add TO rules, e.g. ip route add to 172.55.0.0/24 table main priority - and masquerade accordingly if configured to reach all of ~~44.0.0.0/8~~), or simply connect directly to an AMPR-facing interface. The rule to only use the main table for the eth0 network allows the AMPRNet Gateway to reach 44 hosts on the Public Internet, leaving the operator to provide all routing rules for AMPR-facing interfaces, which is the intent of '''startampr'''.		* '''Please note that: any machine acting as an AMPRNet Gateway must explicitly create high-priority routing rules for all traffic addressed to or from eth0. The network assigned to eth0 must be configured to ONLY use table main.''' No other valid configuration has been found to properly work (discovered by PE1CHL and tested by KB3VWG and others in the [[44Net mailing list]] Community). '''This is due to the unique fact that, on AMPRNet routers, 44.0.0.0/8 exists on both the Public (eth0) and AMPRNet-facing (tunl0) sides of the device. There is no way to properly differentiate the route or destination interface of the traffic received from 44.0.0.0/8 over tunl0 (with your 44Router's 44 IP address), versus that from eth0 (on the Gateway's Public-facing IP). Meaning, there is no way to route traffic for all cases, except by SOURCE OR DESTINATION IP ADDRESS. Therefore, ALL traffic to and from the network facing eth0, must use eth0.''' In order to access your AMPRNet from a local network, you must create another routable LAN (and add TO rules, e.g. ip route add to 172.55.0.0/24 table main priority - and masquerade accordingly if configured to reach all of AMPRNet), or simply connect directly to an AMPR-facing interface. The rule to only use the main table for the eth0 network allows the AMPRNet Gateway to reach 44 hosts on the Public Internet, leaving the operator to provide all routing rules for AMPR-facing interfaces, which is the intent of '''startampr'''.

	= Support, bug reports and improvements =		= Support, bug reports and improvements =

Kb9mwr: /* Links */

2017-09-21T18:00:51Z

Links

← Older revision		Revision as of 18:00, 21 September 2017
Line 182:		Line 182:
	= Links =		= Links =

	* [http://www.qsl.net/kb9mwr/wapr/tcpip/~~rip44d~~.html Alternative installation instructions by KB9MWR]		* [http://www.qsl.net/kb9mwr/wapr/tcpip/ampr-ripd.html Alternative installation instructions by KB9MWR]
	* [http://marc.storck.lu/blog/2013/08/howto-setup-an-amprnet-gateway-on-linux/ Alternative installation instructions by Marc, LX1DUC]		* [http://marc.storck.lu/blog/2013/08/howto-setup-an-amprnet-gateway-on-linux/ Alternative installation instructions by Marc, LX1DUC]
	* [(link to KB3VWG's site here) Detailed Readme and Installation instructions by KB3VWG]		* [(link to KB3VWG's site here) Detailed Readme and Installation instructions by KB3VWG]

Kb3vwg: /* Script */ added ToS inherit, this gives outer header same ToS header as inner header

2017-06-05T17:13:15Z

Script: added ToS inherit, this gives outer header same ToS header as inner header

← Older revision		Revision as of 17:13, 5 June 2017
Line 116:		Line 116:
	# ip addr add <IP from your 44>/32 dev tunl0		# ip addr add <IP from your 44>/32 dev tunl0
	# ip link set tunl0 mtu 1480 up		# ip link set tunl0 mtu 1480 up
	# ip tunnel change tunl0 ttl 64 pmtudisc		# ip tunnel change tunl0 ttl 64 tos inherit pmtudisc

	################### AMPRNet IPENCAP OpenWRT/LEDE SYNTAX #######################		################### AMPRNet IPENCAP OpenWRT/LEDE SYNTAX #######################
	# ip tunnel add tunl0		# ip tunnel add tunl0
	# ip tunnel change tunl0 mode ipip ttl 64 pmtudisc		# ip tunnel change tunl0 mode ipip ttl 64 tos inherit pmtudisc
	###(you may reuse this IP on an Ethernet interface		###(you may reuse this IP on an Ethernet interface
	# ip addr add <IP from your 44>/32 dev tunl0		# ip addr add <IP from your 44>/32 dev tunl0

Kb3vwg: /* Script */ added discovery packet -L argument information

2017-06-05T14:03:13Z

Script: added discovery packet -L argument information

← Older revision		Revision as of 14:03, 5 June 2017
Line 149:		Line 149:
	################### WITH DYNAMIC FIREWALL SCRIPT USING -x		################### WITH DYNAMIC FIREWALL SCRIPT USING -x
	################### see http://wiki.ampr.org/wiki/Firewalls for dynamic script		################### see http://wiki.ampr.org/wiki/Firewalls for dynamic script
	./ampr-ripd-2.0.x64_Ubuntu16 -i <tunl_interface> -t 44 -a <CIDR_44_allocation> -s -x '/etc/config/load_ipipfilter.sh' &		./ampr-ripd-2.0.x64_Ubuntu16 -i <tunl_interface> -t 44 -a <CIDR_44_allocation> -s -x '/etc/config/load_ipipfilter.sh' -L <CALLSIGN>@<GRID_SQUARE> &

	= Notes =		= Notes =

Kb3vwg: /* Script */ change optional IP numbering of tunl0 to required

2017-06-05T14:01:43Z

Script: change optional IP numbering of tunl0 to required

← Older revision		Revision as of 14:01, 5 June 2017
Line 112:		Line 112:
	# modprobe ipip		# modprobe ipip
	# ip tunnel add tunl0 mode ipip		# ip tunnel add tunl0 mode ipip
	###~~OPTIONAL TO~~ NUMBER tunl0		###NUMBER tunl0 with a /32 from your allocation
	# ip addr add <IP from your 44> dev tunl0		###(you may reuse this IP on an Ethernet interface
			# ip addr add <IP from your 44>/32 dev tunl0
	# ip link set tunl0 mtu 1480 up		# ip link set tunl0 mtu 1480 up
	# ip tunnel change tunl0 ttl 64 pmtudisc		# ip tunnel change tunl0 ttl 64 pmtudisc
Line 120:		Line 121:
	# ip tunnel add tunl0		# ip tunnel add tunl0
	# ip tunnel change tunl0 mode ipip ttl 64 pmtudisc		# ip tunnel change tunl0 mode ipip ttl 64 pmtudisc
	###~~OPTIONAL TO NUMBER tunl0~~		###(you may reuse this IP on an Ethernet interface
	# ip addr add <IP from your 44> dev tunl0		# ip addr add <IP from your 44>/32 dev tunl0
	# ip link set tunl0 mtu 1480 up		# ip link set tunl0 mtu 1480 up

Kb3vwg: /* Script */ change another reference to rip44d and spelling edit

2017-05-26T23:07:21Z

Script: change another reference to rip44d and spelling edit

← Older revision		Revision as of 23:07, 26 May 2017
Line 76:		Line 76:
	### v2.0 RC3		### v2.0 RC3
	### - Exclusively seperates route and tables, as well as priotities by: class and type		### - Exclusively seperates route and tables, as well as priotities by: class and type
	### - This makes unnecessary the exclusion of local subnets in ~~rip44d~~ using the '-a' switch,		### - This makes unnecessary the exclusion of local subnets in ampr-ripd using the '-a' switch,
	### by adding local 44 network(s) to a higher priority routing table		### by adding local 44 network(s) to a higher priority routing table
	### - This should enable you can to become a tunnel GW for BGPed 44/8 subnets		### - This should enable you can to become a tunnel GW for BGPed 44/8 subnets
Line 92:		Line 92:
	## Ubuntu 16.04.2 LTS PC eth0 configured to the Public facing		## Ubuntu 16.04.2 LTS PC eth0 configured to the Public facing
	## LAN and eth1 to the 44LAN. It is designed to enable an		## LAN and eth1 to the 44LAN. It is designed to enable an
	## AMPR Router using the ampr-ripd v2.0, the standard ampr-~~ripdd~~,		## AMPR Router using the ampr-ripd v2.0, the standard ampr-ripd,
	## using the -t switch to add routes to routing table '44'		## using the -t switch to add routes to routing table '44'
	## with no further configuration needed (firewall optional)		## with no further configuration needed (firewall optional)