Setting up a gateway on Ubiquiti EdgeRouter

== Updated 16/05/2020 - M0MUX ==

Setting up a gateway on Ubiquiti EdgeRouter

EdgeRouter is a low cost professional grade router made by Ubiquiti. All routers in the product family such as EdgeRouter X, EdgeRouter Lite and EdgeRouter PoE run the EdgeOS router operating system. EdgeOS seems to be an OEM version of Vyatta (now Brocade) and Vyos (an open source version). The commands are almost identical so with little adjustments this guide could serve the different variant.

EdgeRouter is appealing to anyone interested in setting up a gateway to AMPRNet due to the built in support for the IPIP tunneling protocol. This guide was created based on my experience with setting up a gateway to AMPRNet using the EdgeRouter PoE model. I haven't tested it on other models, but since they all use the same OS, it should work with minimal adjustment if any.

This guide covers only one tunnel to the master AMPRnet gateway at UCSD. This guide doesn't cover the automatic setup of tunnels to other gateways.

Assumptions / Prereqs

• You have already registered with AMPRNet and got your 44.x.x.x/y allocation and it is showing in the encap.txt file • You have registered some hosts in the AMPRNet DNS like <your call sign>.ampr.org • Your EdgeRouter is upgraded to the latest EdgeOS (currently version v2.0.6) • You have a standard working NAT setup

       •    Interface eth0 is your connection to your ISP
       •    Interface eth1 is your home LAN where your computers are connected

You have successfully setup the EdgeRouter and it is connected to the internet and providing service to your home computers

The plan

We will use eth2 as our AMPRNet LAN where computers and other devices with assigned AMPRNet address will connect via an IPIP tunnel to the UCSD AMPRNet gateway and the internet.

Warning!!

The author does not assume responsibility if you mess up/brick your router. Please make sure to back up your EdgeRouter configuration prior to any change. Also make sure you know how to restore your configuration and you know how to restore your router to factory defaults if everything else fails.

Initial setup

Open the CLI using the GUI button or connect using an ssh client such as PuTTY to 192.196.2.1.

The default username/password is ubnt/ubnt unless you have already changed it.

You need to establish a Gateway for your 44 network, that the clients will route through.

As I write this, my 44net allocation is 44.131.252.64/28

My Gateway will be the next IP in the block. 44.131.252.65

Enter configuration mode

       • ubnt@ubnt:~$ configuration

Set the AMPRNet network assignment you have received to eth2 (Gateway we just decided on)

       • ubnt@ubnt:~$  set interfaces ethernet eth2 address 44.131.252.65/28

Now commit the changes

       • ubnt@ubnt:~$  commit

Setting up the tunnel

In configuration mode enter the following commands

       • ubnt@ubnt:~$  set interfaces tunnel tun0
       • ubnt@ubnt:~$  set interfaces tunnel tun0 local-ip <put the external ip assigned to you by your ISP>
       • ubnt@ubnt:~$  set interfaces tunnel tun0 remote-ip 169.228.34.84
       • ubnt@ubnt:~$  set interfaces tunnel tun0 encapsulation ipip
       • ubnt@ubnt:~$  set interfaces tunnel tun0 description "Tunnel to AMPRNet gateway"

Now commit the changes

       • ubnt@ubnt:~$  commit

To verify your input so far, enter the following command

       • ubnt@ubnt:~$  show interfaces tunnel tun0

The output should look like this

       • description "Tunnel to AMPRNet gateway"
       • encapsulation ipip
       • local-ip <your assigned ISP address>
       • remote-ip 169.228.34.84

Setting up source address routing policy

Most likely your home computers LAN is setup to route to any internet destination via the interface connected to the ISP. In addition, all your private ip addresses are being masqueraded before getting to the outside world. Entering the following command (in operational mode) will print the routing table

       • ubnt@ubnt:~$  show ip route

You should get something similar to this routing table

      Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
      O - OSPF, IA - OSPF inter area
      N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
      E1 - OSPF external type 1, E2 - OSPF external type 2
      > - selected route, * - FIB route, p - stale info
      IP Route Table for VRF "default"
      S    *> 0.0.0.0/0 [210/0] via <your ISP default gateway>, eth0
      C    *> <your ISP network> is directly connected, eth0
      C    *> 127.0.0.0/8 is directly connected, lo

0.0.0.0/0 basically means "every ip address"

We want to make sure the following happen:

• Normal routing for your home computers LAN is maintained.

• Your AMPRNet hosts are being routed to the tunnel to connect to the internet. No masquerading is needed.

Let's define source address routing policy that will make sure only AMPRNet hosts are routed to the tunnel

       • ubnt@ubnt:~$ set protocols static table 1 interface-route 0.0.0.0/0 next-hop-interface tun0
       • ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 description 'traffic to AMPRNet'
       • ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 source address <put your AMPRNet assigned network - in my case 44.252.131.64/28>
       • ubnt@ubnt:~$ set firewall modify SOURCE_ROUTE rule 10 modify table 1
       • ubnt@ubnt:~$ set interfaces ethernet eth2 firewall in modify SOURCE_ROUTE

Now commit the changes

       • ubnt@ubnt:~$  commit

Smoke test

To test our configuration, we first need to connect a computer to the EdgeRouter interface eth0 and manually assign an ip address from our assigned AMPRNet network range that has already been registered with the DNS.

To test that we are accessible from the outside world, use a "ping service" such as ping.eu to ping the above mentioned host. If you see response, this basically means that the tunnel is working! (At least from the outside in)

To see that our source routing policy works, ping an external host such as google DNS server @ 8.8.8.8. If you see a response, you at least know that your above mentioned host is reaching the internet.

To verify that we are exiting the router via the tunnel, do a traceroute command to 8.8.8.8. If in the trace you see some ucsd.edu host, you know that you are using the tunnel.

The last test we can do is to use a site like whatismyip.com to see the address which we are coming from. If it is the address is the above mentioned host, then we have successfully setup the AMPRNet gateway.

Finishing touches

If you have reached so far and everything is working correctly, it is time to save our configuration. In configuration mode enter the following

       • ubnt@ubnt:~$ save

Since we have now an open tunnel to the world ending in our EdgeRouter, we need to extend our firewall protection to interface tun0. This can easily be done in the EdgeRouter GUI.

      • Select the Firewall/NAT tab
      • Select firewall policies tab

There should be two rulesets

      o WAN_IN
      o WAN_LOCAL

For each rule, press the actions button on the right and select the interfaces option.

      • Press the + Add Interface button.
      • Select tun0 as the interface and select in as the direction.
      • Finish by pressing the Save Ruleset button.

Example Config

This is from my working ER4.

 firewall modify SOURCE_ROUTE {
        rule 10 {
            action modify
            description "traffic to ampr"
            modify {
                table 5
            }
            source {
                address 44.131.252.64/28
            }
        }
    }

 firewall name 44Net_IN {
        default-action drop
        description "44Net in"
        rule 10 {
            action accept
            description "Allow established/related"
            log disable
            state {
                established enable
                related enable
            }
        }
        rule 20 {
            action accept
            description ICMP
            log disable
            protocol icmp
        }
        rule 30 {
            action drop
            description "Drop invalid state"
            state {
                invalid enable
            }
        }
    }

  interfaces ethernet eth3 {
        address 44.131.252.65/28
        description 44.131.252.65/28
        duplex auto
        firewall {
            in {
                modify SOURCE_ROUTE
            }
            local {
            }
            out {
            }
        }
        ip {
        }
        speed auto
    }

  interfaces tunnel tun0 {
        description "Tunnel to AMPRNet"
        encapsulation ipip
        firewall {
            in {
                name 44Net_IN
            }
        }
        ip {
        }
        local-ip 80.235.222.210
        multicast disable
        remote-ip 169.228.34.84
        ttl 255
    }

  protocols static {
        table 5 {
            interface-route 0.0.0.0/0 {
                next-hop-interface tun0 {
                }
            }
        }
       }