Setting up a gateway on Ubiquiti EdgeRouter

Setting up a gateway on Ubiquiti EdgeRouter

EdgeRouter is a low cost professional grade router made by Ubiquiti. All routers in the product family such as EdgeRouter X, EdgeRouter Lite and EdgeRouter PoE run the EdgeOS router operating system. EdgeOS seems to be an OEM version of Vyatta (now Brocade) and Vyos (an open source version). The commands are almost identical so with little adjustments this guide could serve the different variant.

EdgeRouter is appealing to anyone interested in setting up a gateway to AMPRNet due to the built in support for the IPIP tunneling protocol. This guide was created based on my experience with setting up a gateway to AMPRNet using the EdgeRouter PoE model. I haven't tested it on other models, but since they all use the same OS, it should work with minimal adjustment if any.

Assumptions / Pre requisites

• You have already registered with AMPRNet and got your 44.x.x.x/y allocation and it is showing in the encap.txt file

• You have registered some hosts in the AMPRNet DNS like <your call sign>.ampr.org

• Your EdgeRouter is upgraded to the latest EdgeOS (currently version 1.8)

• You have used the wizard to set your router as WAN+2LAN, where:

       •    Interface eth1 is your connection to your ISP
       •    Interface eth2 is your home LAN where your computers are connected
       •    Interface eth0 is a second LAN, unused mapped to 192.168.1.1/24

• You have successfully setup the EdgeRouter and it is connected to the internet and providing service to your home computers

The plan

As shown in figure 1.1, we will use eth0 as our AMPRNet LAN where computers and other devices with assigned AMPRNet address will connect via an IPIP tunnel to the UCSD AMPRNet gateway and the internet.

Figure 1.1 the network plan

Warning!!

The author does not assume responsibility for you messing up/bricking your router. Please make sure to back up your EdgeRouter configuration prior to any change. Also make sure you know how to restore your configuration and you know how to restore your router to factory defaults if everything else fails.

Initial setup

• Open the CLI using the GUI button or connect using an ssh client such as PuTTY to 192.196.2.1.

       The default username/password is ubnt/ubnt unless you have already changed it.

• Enter configuration mode

       • ubnt@ubnt:~$ configuration

• Limit access to GUI only from home LAN

       • ubnt@ubnt:~$  set service gui listen-address 192.168.2.1

• Limit access to ssh console only from home LAN

       • ubnt@ubnt:~$  set service ssh listen-address 192.168.2.1

• Now commit the changes

       • ubnt@ubnt:~$  commit

• Delete the network assignment of eth0

       • ubnt@ubnt:~$  delete interfaces ethernet eth0 address 192.168.1.1/24

• Set the AMPRNet network assignment you have received to eth0

       • ubnt@ubnt:~$  set interfaces ethernet eth0 address <put your AMPRNet network assignment>

• Now commit the changes

       • ubnt@ubnt:~$  commit

Setting up the tunnel

In configuration mode enter the following commands

       • ubnt@ubnt:~$  set interfaces tunnel tun0
       • ubnt@ubnt:~$  set interfaces tunnel tun0 local-ip <put the external ip assigned to you by your ISP>
       • ubnt@ubnt:~$  set interfaces tunnel tun0 remote-ip 169.228.66.251
       • ubnt@ubnt:~$  set interfaces tunnel tun0 encapsulation ipip
       • ubnt@ubnt:~$  set interfaces tunnel tun0 description "Tunnel to AMPRNet gateway"

• Now commit the changes

       • ubnt@ubnt:~$  commit

• To verify your input so far, enter the following command

       • ubnt@ubnt:~$  show interfaces tunnel tun0

• The output should look like this

       • description "Tunnel to AMPRNet"
       • encapsulation ipip
       • local-ip <your assigned ISP address>
       • remote-ip 169.228.66.251

Setting up source address routing policy

Most likely your home computers LAN is setup to route to any internet destination via the interface connected to the ISP. In addition, all your private ip addresses are being masqueraded before getting to the outside world. Entering the following command (in operational mode) will print the routing table

       • ubnt@ubnt:~$  show ip route

You should get something similar to this routing table Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP

      O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2
      > - selected route, * - FIB route, p - stale info
      IP Route Table for VRF "default"
      S    *> 0.0.0.0/0 [210/0] via <your ISP default gateway>, eth1
      C    *> <your ISP network> is directly connected, eth1
      C    *> 127.0.0.0/8 is directly connected, lo
      C    *> 192.168.2.0/24 is directly connected, switch0

0.0.0.0/0 basically means "every ip address"

We want to make sure of the following:

• Normal routing for your home computers LAN is maintained

• Your AMPRNet hosts are being routed to the tunnel to connect to the internet. No masquerading is needed.

Let's define source address routing policy that will make sure only AMPRNet hosts are routed to the tunnel

       • ubnt@ubnt:~$ set protocols static table 1 interface-route 0.0.0.0/0 next-hop-interface tun0
       • ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 description 'traffic to AMPRNet'
       • ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 source address <put your AMPRNet assigned network>
       • ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 modify table 1
       • ubnt@ubnt:~$ set interfaces ethernet eth0 firewall in modify SOURCE_ROUTE

• Now commit the changes

       • ubnt@ubnt:~$  commit

Smoke test

To test our configuration, we first need to connect a computer to the EdgeRouter interface eth0 and manually assign an ip address from our assigned AMPRNet network range that has already been registered with the DNS. To test that we are accessible from the outside world, use a "ping service" such as ping.eu to ping the above mentioned host. If you see response, this basically means that the tunnel is working! (At least from the outside in) To see that our source routing policy works, ping an external host such as google DNS server @ 8.8.8.8. If you see a response you at least know that your above mentioned host is reaching the internet. To verify that we are exiting the router via the tunnel, do a traceroute command to 8.8.8.8. If in the trace you see some ucsd.edu host, you know that you are using the tunnel The last test we can do is to use a site like whatismyip.com to see the address which we are coming from. If it is the address is the above mentioned host, then we have successfully setup the AMPRNet gateway. Finishing touches If you have reached so far and everything is working correctly, it is time to save our configuration. • In configuration mode enter the following • Save

Since we have now an open tunnel to the world ending in our EdgeRouter, we need to extend our firewall protection to interface tun0. This can easily be done in the EdgeRouter GUI. • Select the Firewall/NAT tab • Select firewall policies tab • There should be two rulesets o WAN_IN o WAN_LOCAL • For each rule, press the actions button on the right and select the interfaces option • Press the + Add Interface button • Select tun0 as the interface and select in as the direction • Finish by pressing the Save Ruleset button