- 44net - mailman.ardc.net

Amprnet vpn
by lleachii＠aol.com 17 Feb '17

17 Feb '17

Shawn, I'm lost; but I guess my inquires sum up to: - Are you running a stock installation of Ubuntu, or is it a version offered by the Virtual Machine Provider? - How are you "receiving the route information" and what do you mean by "but that would be it"? Did you receive route information via rip44d and confirm it by typing: ip route show table 44 ? Have you been successful at getting rip44d to run as a service? If the routes are there, this indicates you may have already made great progress. Did you attempt to ping or traceroute any IPs from an interface assigned an AMPR IP? If so, did you receive a reply? In any case, this means you are receiving the packets at the VM. We need to determine if the tunnel interface Up. Please verify by typing: ifconfig If you used startampr, you should see an interface listed as tunl0, it MIGHT say IPIP or UNSPEC, but you will recall you configured it for IPENCAP (this is because the Linux Kernel module for both are the same). Also note the names of your other interfaces, as the names used in the script must also be correct. Since Ubuntu 16.04, the Ethernet interfaces were no longer named: eth0, eth1, etc. Since I used eth0 and eth1 in documentation, you must account for variations in your system configuration. The ifconfig command will be most helpful to that end. You can also assign an IP to tunl0 (a commented-out line in the script allows for that). Lastly, have you ever received a copy of startampr from me? If you're using a script from Internet, that might be your problem (earlier versions contained less documentation). The current copy is only available on AMPR at: http://kb3vwg-010.ampr.org/amprnet_docs/start_ampr_version2/startampr Since that presents a chicken-and-the-egg problem for you at this time, contact me off-forum and we can arranging for you to get a copy. - KB3VWG

1 0

Amprnet vpn
by Shawn Bush 17 Feb '17

17 Feb '17

Thanks for the detailed reasponce. I have work with the 44ripd daemon and I was recieveing the route information but that would be it. In thr startampr script that is show, it tries to setup mode ipip and that is just something that I couldn't figure out how to get a ubuntu vm to run with. In the ubuntu host, the ipip works just fine and there is a module for it. But the module isn't in the VM and I dont see why. But I was told ipensec is what I'm supposed to be using? I have no idea how to route diffrent protocols....

2 1

Re: [44net] AMPR VPN
by lleachii＠aol.com 16 Feb '17

16 Feb '17

Sean, If you are using the AMPR VPN listed on the services wiki site, it uses the allocation given to its operator. You MUST setup an IPENCAP tunnel, or have your subnet routed over the global Internet via BGP. You might be able to have your allocation directed to the VPN operator (callsign - OH7LZB) and then arrange for him to route your IPs to the tunnel connection you have established between him. Please be advised, out of all the options, this one is not regularly supported. In addition, your latency would be extremely poor, since you appear to be in the United States and the VPN endpoint is in Finland. Lastly, from what I observed, the AMPR VPN appears to be a Layer 3 VPN (not Layer 2). This means that more detailed configuration (on part of the operator) may be required to route multiple IPs to your VPN instance - my understanding is that the VPN is maintained on a volunteer basis. What issue(s) are you having getting "[IPENCAP] over to the VM"? I ran my AMPR router as an Ubuntu VM for many years before migrating it to an actual hardware border router running OpenWRT; perhaps I can assist. 73, Lynwood KB3VWG

1 0

AMPR VPN
by Shawn Bush 15 Feb '17

15 Feb '17

I recently setup a AMPR NET VPN with openvpn in a OpenVZ container due to the fact I couldn't figure out how to get IPIP over to the VM. My question is this, I have a weird ip a 44.x.x.x number and I want to be able to use my given IP of 44.102.204.32, can I route my IP over the given one from the VPN? I'm using Ubuntu in the container and the routing for the VPN is working just fine. I want to setup linBPQ32 with this IP and start routing this way if I can. I'm pretty good with Linux, but not so much with routing. I setup a ampr interface and gave it my 44.102.204.32 IP, but from their I am stuck. 73's KD8NCV Shawn Bush

1 0

What ports needed to open for IPIP ?
by R P 15 Feb '17

15 Feb '17

Hi there We got permission to use our local university network for ham radio We plan to connect our DMR repeater to this network (some ports needed to be opened to allow the repeater to connect to the server) In adddiotion i want to place a AmprNET IPIP gateway there The University protected by firewall no outgoing and no incomming packets free flow.. What should I tell the IT person to open in order to allow gateway to run ? Does Firewall have IPIP protocole definition ? if not ... what should they open ? Outbond and inbond and from /to UCSD 44 Net Router ? Please Advice Thanks Forward Regards Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

3 3

Re: [44net] 192.168.0.2 gateway
by Rob Janssen 06 Feb '17

06 Feb '17

> Subject: > Re: [44net] 192.168.0.2 gateway > From: > Mark Phillips <g7ltt(a)g7ltt.com> > Date: > 02/06/2017 02:34 PM > > To: > AMPRNet working group <44net(a)hamradio.ucsd.edu> > > > I would say "no". > > Y'see, we don't know what kind of network things are riding over. the > network in question could be (for example) a mesh install configured > similar to that of the local cable company. The users get real addresses > but the infrastructure does not. I think precisely this is the reason why such addresses should be rejected: The user may have the wrong assumption that the address to be entered here is the address of the system terminating the tunnel, while in reality it has to be the internet-visible address that supposedly is NATted to the tunnel gateway. So, what happens in the local infrastructure does not matter. Rob

2 1

192.168.0.2 gateway
by Brian Kantor 06 Feb '17

06 Feb '17

I just spotted this entry in the latest encap file: route addprivate 44.74.0.128/28 encap 192.168.0.2 Unless you're doing something highly unusual, setting your gateway address in the portal to 192.168.0.2 probably is a mistake since it's not reachable from the Internet. - Brian

6 6

Re: [44net] was Verifying the identities of IP coordinators
by Steve L 02 Feb '17

02 Feb '17

First I wanted to mention I am glad to read Bjorn's message about adding some content to the network. Keeping in contact is key. Be that a coordinator or any host on the amprnet. Seems every few months on here we are discussing how someone is sending out random packets, and a straight forward way to get a hold of people would be helpful. Some time back it was brought up to have a whois server or something like that. I bet I can guess the status of that. As for everyone having an ampr.org email address, perhaps a forwarding service like the arrl.net addresses? Then there is the possible spam problem, and the fact that someone would need to set up such a service. Overall a lot of good ideas are brought up on this list, so few ever happen. The only solution I am offering is everyone should help spread the word and try and get more people involved with moving this network forward. I wish I had better coding skills. One of the core problems at least in my country where the ampr/44net space is not well utilized is the lack of higher speed equipment to build a network. You really have to be part of a well organized club with site connections to do anything microwave on any big scale from what I have seen.

7 7

PACCOMM TNC-320 Smoke
by vk1kw 31 Jan '17

31 Jan '17

Hello All, I recently had a power supply problem and it has let the smoke out of my PacComm TNC-320 packet modem. While I have the manual, I do not have a circuit diagram and only have a partial id on one of the cooked ICs U17. The partial number is MC xxxxx06P (I think) and is on the main board across the RS-232 D9 connector circuit. Could you check your circuit diagram, parts list or slide off the cover and have a look and let me know what the U17 IC is please? Many Thanks Rob VK1KW

4 5

BGP announced gateways and Mikrotik RIPv2 AMPR Gateway Setup Script 3.0
by Marius Petrescu 24 Jan '17

24 Jan '17

Hello all, If you may have noticed, there is a recent IPIP tunnel with a 44net gateway (which you may have seen flapping on your Mikrotik routers - 44.130.120.0/24 via 44.130.120.65). This is a experimental setup to allow tunneling via BGP announced 44net gateways, with no real hosts there yet. Ampr-ripd newer than 1.13 will ignore this RIP broadcast (an update will be available soon). Our first step to make it run on Mikrotik routers (this will stop the route flapping): Announcing the Mikrotik RIPv2 AMPR Gateway Setup Script 3.0 (21.Jan.2017) - Added support for tunnels with BGP announced 44net endpoints If you already use v.2.x, only update ampr_gw and from the archive file and add manually the new parameter "AmprDefaultGw" to your config file (see the example file in the archive). "AmprDefaultGw" can be set to your gateway WAN interface name or the correct gateway IP for your router. Download as usual: RSC file: http://www.yo2loj.ro/hamprojects/ampr-gw-3.0.rsc ZIP archive: http://www.yo2loj.ro/hamprojects/ampr-gw-3.0.zip Greetings, Marius, YO2LOJ

4 8

Re: [44net] Forum for Packet, AX.25
by Steve L 24 Jan '17

24 Jan '17

In addition to what has already been posted: the TAPR nos-bbs list http://www.tapr.org/mailman/listinfo/nos-bbs

1 0

Forum for Packet, AX.25
by Adi Linden 23 Jan '17

23 Jan '17

Is there a good forum to discuss packet, AX.25 and such things? After some 20 years of abstinence from packet I am really interested in getting something going. In my area APRS is alive and well, but packet on VHF or UHF is dead and has been dead for a long time. Lots of equipment is still out there, such as KPC-3 and the like, just not being used. Although I am very interested in getting packet going again, I have no idea where to start. Got hardware to spare, but where to start? What’s out there for software (OpenBCM, JNOS, BPQ32, what else?)… I realize that this is probably not the avenue to discuss, but perhaps someone can point me in the right direction of where to start looking, where to ask. Thanks, Adi

3 2

44net IP Block for D-STAR Hosting Use
by Storer, Darren 22 Jan '17

22 Jan '17

Hi Chris, Life at Ofcom has overtaken amateur radio activity almost totally for the last 3 1/2 years but I'm starting to "emerge" again, I'm sure that you understand life's nasty way of getting in the way of hobby time. A number of D-STAR services are still hosted on my servers, including the central dsync reporting tool ( http://dsync.dstar.info/ is the public reporting page but there is an extensive admin portal too) and also some reflectors including REF006 ( http://ref006.dstargateway.org/ ). The servers are due to be re-homed to an A&A data centre, where a few of the staff are amateurs. Some of the D-STAR gateway admins have previously asked about accessing services via ampr.org IP addresses; do you think that this would be an appropriate use of the resource? Tentatively I asked A&A if they could BGP advertise a subnet of ampr.org and they'd be happy to do that, so it's more of a question of whether D-STAR services for hams would be okay to provide via AMPRNet? Are there any rules that would prevent the dsync pages being dual homed via public IP space and ampr.org IP space? Has anyone managed to regularly route digital voice (UDP) over AMPRNet? Sorry for all the questions but I know that you will know the answers... 73 de Darren G7LWT

2 2

Re: [44net] BGPed Gateway
by Rob Janssen 22 Jan '17

22 Jan '17

> With the BGP advertisement my subnet is reachable via internet and can reach anywhere via internet. Other 44 networks can reach my subnet as long as they are also advertised via BGP or have appropriate NAT rules to allow internet access. I can reach any BGP advertised 44 net addresses. However, I should not be able to reach any non-BGP advertised 44 net addresses unless there is a gateway (at USCD?) that allows for access to IPIP only 44 networks from 44 networks. > I guess I don’t know the network topology of the 44 net or the functions that are provided at the UCSD gateway. > I assumed that in order to reach IPIP only networks I would have to also establish IPIP tunnelling from each 44 host or gateway using subnets of my BGP advertised subnet. When the system that handles the traffic that comes in on your BGP advertised route also has a public IP address and is made member of the IPIP mesh for the same subnet it advertises on BGP, you can talk to everyone that is on the IPIP mesh. They will send traffic for you via the IPIP tunnel that they establish because you are in the list maintained via portal.ampr.org and transmitted using RIP from the gateway at UCSD. You then only use IPIP for traffic between hosts on the IPIP mesh, not for the remainder of traffic to and from internet. Rob

1 0

BGPed Gateway
by Adi Linden 22 Jan '17

22 Jan '17

Hi, I received a 44 net allocation and am successfully advertising it to the internet via my ISP. I have been reading on the AMPRNet Wiki about IPIP tunnelling and Startampr. Are there best practices or anything else I need to be aware of before venturing into building the gateway? On a related note, I have been using OpenVPN to provide publicly routable /32 IP addresses to individual Windows PC. I don’t see support for IPIP on Windows, are there any other tunnelling methods worth looking at, for Windows7 specifically, or is OpenVPN my best bet? Thanks, Adi VA3ADI

4 7

Coordinator response?
by M6XCV (Mike) 20 Jan '17

20 Jan '17

Hi, I wouldn't normally post here about this, but I see a couple of others seem to have gotten a response from doing so. I am new to amatuer radio and while I was getting my license someone told me about APRMnet, so I decided to join. I put in a network request back in november and got a response from the coordinator G1FEF asking for clarification on my request. I responded via the portal, however that has been the last I have heard. I sent a follow-up email directly at the beginning of January, however I haven't had any further response. What should I do next? Thanks, - Mike, M6XCV

3 3

Tunnel on Cisco Router
by Bill Atkinson 18 Jan '17

18 Jan '17

Greetings! I have a /22 block of AMPRNet space. I've configured it for tunnel access, and defined the gateway in my portal. Following the instructions on the wiki, here is my router config: interface GigabitEthernet0/0 ip address 44.48.8.1 255.255.252.0 secondary ip address 96.82.54.108 255.255.255.240 duplex auto speed auto media-type rj45 end interface Tunnel0 no ip address tunnel source 96.82.54.108 tunnel mode ipip tunnel destination 169.228.66.251 end results of 'sh int tunnel0' amprnet-router#sh int tunnel0 Tunnel0 is up, line protocol is up Hardware is Tunnel MTU 17920 bytes, BW 100 Kbit/sec, DLY 50000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel source 96.82.54.108, destination 169.228.66.251 Tunnel protocol/transport IP/IP Tunnel TTL 255, Fast tunneling enabled Tunnel transport MTU 1480 bytes Tunnel transmit bandwidth 8000 (kbps) Tunnel receive bandwidth 8000 (kbps) Last input 00:02:16, output never, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 7024 packets input, 3500920 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out At this point, I believe I need to get RIP running with the right options. However, this is where the wiki falls short. The only rip configs examples are for the linux daemons. Here is the output of 'sh ip prot' amprnet-router#sh ip protocols *** IP Routing is NSF aware *** Routing Protocol is "rip" Outgoing update filter list for all interfaces is not set Incoming update filter list for all interfaces is not set Sending updates every 30 seconds, next due in 13 seconds Invalid after 180 seconds, hold down 180, flushed after 240 Redistributing: rip Neighbor(s): 169.228.66.251 Default version control: send version 2, receive version 2 Automatic network summarization is in effect Maximum path: 4 Routing for Networks: 44.0.0.0 Passive Interface(s): GigabitEthernet0/0 GigabitEthernet0/1 VoIP-Null0 Routing Information Sources: Gateway Distance Last Update Distance: (default is 120) As is standard practice, I've put all interfaces in passive-default, and then explicitly defined tunnel0 as non-passive. I have not been able to establish any sort of RIP adjacency: amprnet-router#sh ip route rip Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP + - replicated route, % - next hop override Gateway of last resort is not set amprnet-router#sh ip rip database 44.0.0.0/8 auto-summary 44.48.8.0/22 directly connected, GigabitEthernet0/0 Thanks in advance to anyone who can offer any guidance. --- 73, Bill Atkinson, NF9K ARRL Technical Specialist ARRL VE/OO Laurel VE PODXS 070 Club #1595 30MDG #6014 www.nf9k.net www.crossroadsdmr.org

2 1

Re: [44net] BGPed Gateway
by Rob Janssen 18 Jan '17

18 Jan '17

> I received a 44 net allocation and am successfully advertising it to the internet via my ISP. > I have been reading on the AMPRNet Wiki about IPIP tunnelling and Startampr. Are there best practices or anything else I need to be aware of before venturing into building the gateway? It is advisable to make your system an IPIP tunnel gateway for the same subnet as you advertise via BGP. Make sure you use a non-44 public IP for the tunnel. > On a related note, I have been using OpenVPN to provide publicly routable /32 IP addresses to individual Windows PC. I don’t see support for IPIP on Windows, are there any other tunnelling methods worth looking at, for Windows7 specifically, or is OpenVPN my best bet? We offer OpenVPN but beware: it allows an easy entry into the AMPRnet that has nothing to do with amateur radio anymore. You just become a VPN provider like there already are so many on internet. To do something amateur-radio related with AMPRnet you really should offer radio access and encourage the users to use it, and OpenVPN works counter-productive in that regard. Rob

2 1

44net Direct Allocation
by Adi Linden 15 Jan '17

15 Jan '17

Hi, I am interested in accessing 44 Net number via BGP. What would be the best avenue to discuss this? I already sent a message using the “Contact Us” link on the portal. How would I go about it? Thanks, Adi VA3ADI

2 1

Re: [44net] 44Net Digest, Vol 6, Issue 8
by kd6oat 12 Jan '17

12 Jan '17

On 1/12/17 1:19 PM, Jonathan Smith wrote: > Anyone have the UT coordinator email, or know where I can find it? I am the Utah coordinator. Based on the inquiry I checked my spam mail and found what I believe is the subject request. This will be processed shortly. Sorry for any inconvenience. Ken - KD6OAT On Thu, Jan 12, 2017 at 1:00 PM, <44net-request(a)hamradio.ucsd.edu> wrote: > Send 44Net mailing list submissions to > 44net(a)hamradio.ucsd.edu > > To subscribe or unsubscribe via the World Wide Web, visit > http://hamradio.ucsd.edu/mailman/listinfo/44net > or, via email, send a message with subject or body 'help' to > 44net-request(a)hamradio.ucsd.edu > > You can reach the person managing the list at > 44net-owner(a)hamradio.ucsd.edu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of 44Net digest..." > > > Today's Topics: > > 1. TrivnetDB (Brian) > 2. Re: Allocation time (Jonathan Smith) > 3. Re: Allocation time (Bryan Fields) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 12 Jan 2017 12:15:22 -0500 > From: Brian <n1uro(a)n1uro.ampr.org> > To: 44net(a)hamradio.ucsd.edu > Subject: [44net] TrivnetDB > Message-ID: <1484241322.23614.13.camel@n1uro> > Content-Type: text/plain; charset="utf-8" > > Is there someone from there on this list? If so please contact me > offlist. Thanks. > -- > I don't have to worry about body fitness in 2017. All I do is > show my body to itself in the mirror and it throws plenty of > fits. > -------- > 73 de Brian - N1URO > email: (see above) > Web: http://www.n1uro.net/ > Ampr1: http://n1uro.ampr.org/ > Ampr2: http://nos.n1uro.ampr.org > Linux Amateur Radio Services > axMail-Fax & URONode > http://uronode.sourceforge.net > http://axmail.sourceforge.net > AmprNet coordinator for: > Connecticut, Delaware, Maine, > Maryland, Massachusetts, > New Hampshire, New Jersey, Pennsylvania, > Rhode Island, and Vermont. > > >

1 0

Allocation time
by Jonathan Smith 12 Jan '17

12 Jan '17

How long does it usually take for the coordinator to approve requests? I know the holidays will get in the way. I'm just wondering. I'm looking for some space in Utah. Thanks.

5 6

TrivnetDB
by Brian 12 Jan '17

12 Jan '17

Is there someone from there on this list? If so please contact me offlist. Thanks. -- I don't have to worry about body fitness in 2017. All I do is show my body to itself in the mirror and it throws plenty of fits. -------- 73 de Brian - N1URO email: (see above) Web: http://www.n1uro.net/ Ampr1: http://n1uro.ampr.org/ Ampr2: http://nos.n1uro.ampr.org Linux Amateur Radio Services axMail-Fax & URONode http://uronode.sourceforge.net http://axmail.sourceforge.net AmprNet coordinator for: Connecticut, Delaware, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, Pennsylvania, Rhode Island, and Vermont.

1 0

IPv6 talk from the DCC
by Steve L 11 Jan '17

11 Jan '17

I found the talk that was just released, by Brian, W9CR very informative. Very good historical overview of IPv4 as well, highly recommend watching it. https://www.youtube.com/watch?v=mkKOX5q1XJ4#t=04m20s Steve, KB9MWR

1 0

Contact...
by SP2L Tom 11 Jan '17

11 Jan '17

Hello Paul G4APL. Could you please contact me off the list as I lost your e-mail address. Weird... Thank you very much in advance. Best regards. --- Tom - SP2L Sent from Xperia Z1 with AquaMail http://www.aqua-mail.com

1 0

Re: [44net] Coordinator bug?
by Rob Janssen 09 Jan '17

09 Jan '17

> If I don't hear from them in a week or two, I put a comment "awaiting > response to email" in their coordination request and return it to them. > Returned requests will expire in 3 months if no further action is taken > and do not generate coordinator reminders. In that case it is not so bad. However, my experience is that most users who do not understand the portal (and of course there are more of those in my country, because they have the language barrier in addition to the already complicated matter) and get a request returned to them (previously this was called rejected, now it is called returned) will always manage to click on the re-submit link. So the ball is again in my park, and when I don't play it back to them, I get the reminders. I have once got it returned 3 times this way. Normally it is not a real problem when a requester does not come back after requesting additional information, because (here) the original request usually wasn't what they wanted anyway (we use the portal only for IPIP gateways). Rob

1 0

Re: [44net] Coordinator bug?
by Rob Janssen 09 Jan '17

09 Jan '17

> You're welcome. Yes, I don't get many requests during a year and I go > through a learning curve every time I use the portal site. I still have the problem that users (who have to use a non-native language) do not understand the portal, make a request for something they do not want, and when I reject it with an explanation what the need to do next (read our website, mail me) they just click on all links in that reply mail causing the request to be re-submitted with the comments that I have put in there myself. We really need some button to just delete a request without notification to the submitter, so that I can contact them out-of-band. When I just leave the bad requests there will be "reminder" mails from the portal later. Rob

3 2

Coordinator bug?
by Pedja YT9TP 09 Jan '17

09 Jan '17

I am country coordinator. I have administrative options meant for coordinator, but I lost options ordinary user has: for example I cannot apply for an IP allocation. Is this a bug, or I am missing to find this option in portal menu? 73 Pedja YT9TP --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

3 4

System patch to pass 44net protocols through pfSense
by Luzemário Dantas 07 Jan '17

07 Jan '17

Hi guys, Anyone of you do use pfSense? I want a clue about forwarding 44net protocols on it without manual editing. It is FreeBSD based, but I want to get the webConfigurator way to get 44net trafic forwarded to my Linux Debian box. PfSense allows NATting 44net protocols to a Linux box. But it's webConfigurator does not show all protocols to be listed in the NAT configuration page. Despite all IP protocols being supported in "/etc/protocols", only the most common protocols are listed in the protocols drop-down of NAT configuration page (it is a webConfigurator limitation). There is a workaround by editing system files, but I am wondering if someone already have a system patch handy to add the needed protocols without manual editing, by using only the "System Patches" package. I don't like the idea of myself editing system files, since I don't know too much PHP programming. PfSense has a System Patches package wich makes easy to change system components (easy for the ones that understand it). Can someone help me to build a system patch to show 44net protocols in the NAT protocol drop-down menu? There are some comments on the link below, but I could not figure out how to do so by making a system patch, so anyone could apply the patch without manual editing. Thanks for your comments. https://forum.pfsense.org/index.php?topic=64060.msg346690#msg346690 73 de PT2LDR Luzemario

3 2

Re: [44net] mikrotik
by Rob Janssen 06 Jan '17

06 Jan '17

Chris, Did you go to the http://www.yo2loj.ro/ site and go to the Ham projects subpage? It has a newer version of the script than what is mentioned on the Wiki (Wiki has to be updated) Rob

1 0

mikrotik
by Chris McCune 06 Jan '17

06 Jan '17

Hi, I followed the wiki on using a Mikrotik as a gateway to the 44 net but I seem to be stuck. I watch the tunnel go up and down but I never get any farther. Does anyone have a little more complete setup procedure? Thanks, Chris --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

1 0

Re: [44net] direction request
by Alessandro Spinella 04 Jan '17

04 Jan '17

hello everybody, i greet you all (Ronen included) for your kind answers; Brian : <<...have to get your connectivity via one of the commercial or government satellite services...>> Feel it the more suitable solution. <<....you can find a charity that will fund or donate the necessary equipment or service....>> just 2 words about: have distance-adopted a daughter, if I need charity the whole question become a nonsense.... it is my duty and pleasure to get rid of matter. Michael : <<...it would not be a legal solution.>> hahaha! thank you for the adivce, but will not encrypt anything and care not so much about what U.S.A. laws states; just like to reach a daughter and feel nobody can dislike it. <<...amateur radio is probably not a viable solution for your application...>> I agree, will move to satellite equipment & services Bill : <<...this is a fit for Outernet...>> maybe, but file transfer lead to a "misuse" of resources even if will be able to fool the content constraints (no personal messages are allowed); feel it can't fit requirements. anyway: thank you very much for your time and suggestions, my research is now better directed. wish you all great day. Alessandro

2 1

Re: [44net] direction request
by Bill Vodall 03 Jan '17

03 Jan '17

Perhaps this is a fit for Outernet ? On Jan 3, 2017 8:48 AM, "Brian Kantor" <Brian(a)ucsd.edu> wrote: (Please trim inclusions from previous messages) _______________________________________________ Hello Alessandro, To the best of my knowledge, there is no AMPRNet infrastructure in Bangladesh, so there is nothing for you to connect to using network 44. While it is true that amateur radio can communicate over long distances, it can only do so at extremely slow data rates, far too slow for internet use. The only way I can think of for you to accomplish the connection you seek is to use satellite communications. There are indeed amateur radio satellites, but none of them handle the kind of data that would be needed for internet use. I believe you will have to get your connectivity via one of the commercial or government satellite services. In the USA, this is not expensive, but I have no idea how much it would cost for Bangladesh. Perhaps you can find a charity that will fund or donate the necessary equipment or service. I wish you the best of luck. - Brian On Tue, Jan 03, 2017 at 12:39:28PM +0100, Alessandro Spinella wrote: > (Please trim inclusions from previous messages) > _______________________________________________ > hello everybody, > > let me shortly present myself and the matter: working in IT for more than 30 years, experienced with network devices (switch, routers, firewalls, IDS/IPS), programming (C and some others), good knowledge on protocols and RFCs; hosts under my control are not allowed to run anything else than FreeBSD. > > but absolutely not experienced about radio transmission/devices/requirements so had carefully read http://wiki.ampr.org/wiki/Quickstart and feel it is not suitable for my problem: I am looking how to arrange for an internet-connected PC located somewhere in a remote village of Bangladesh with no local power source. > > while it seem almost easy to power the PC with solar-cells battery is it not clear for me: > > - if and how is possible to use 44net to internet-connect the remote site via RF, feel it just a matter to have sufficient "radio power" to reach a 44net bridge, a PC/router and some radio devices but unsure. > - what kind of radio devices are suitable for that use (or: how far can radio waves go with a "poor" power source?) > - locations (if any) of local-radio-amateur joined in 44net that can bridge some internet traffic from/to such a "leaf-site" > > moreover my limit are: > > - money: while it's a personal initiative have no founding except my incoming and thus cheap is a must > - reliability: can't be on site to fix any possible problem as them arise, so "good" devices are required > > as stated in RFC1925 : <<good, fast, cheap: choose two, you can't have all three>> implies that am aware that "fast" can't be get; just need directions and some "good" reference for the HW where I can learn details as power requirements and for the SW (but I guess 44net is the right place). > > wish you nice day > > > $witch > _________________________________________ > 44Net mailing list > 44Net(a)hamradio.ucsd.edu > http://hamradio.ucsd.edu/mailman/listinfo/44net _________________________________________ 44Net mailing list 44Net(a)hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net

1 0

direction request
by Alessandro Spinella 03 Jan '17

03 Jan '17

hello everybody, let me shortly present myself and the matter: working in IT for more than 30 years, experienced with network devices (switch, routers, firewalls, IDS/IPS), programming (C and some others), good knowledge on protocols and RFCs; hosts under my control are not allowed to run anything else than FreeBSD. but absolutely not experienced about radio transmission/devices/requirements so had carefully read http://wiki.ampr.org/wiki/Quickstart and feel it is not suitable for my problem: I am looking how to arrange for an internet-connected PC located somewhere in a remote village of Bangladesh with no local power source. while it seem almost easy to power the PC with solar-cells battery is it not clear for me: - if and how is possible to use 44net to internet-connect the remote site via RF, feel it just a matter to have sufficient "radio power" to reach a 44net bridge, a PC/router and some radio devices but unsure. - what kind of radio devices are suitable for that use (or: how far can radio waves go with a "poor" power source?) - locations (if any) of local-radio-amateur joined in 44net that can bridge some internet traffic from/to such a "leaf-site" moreover my limit are: - money: while it's a personal initiative have no founding except my incoming and thus cheap is a must - reliability: can't be on site to fix any possible problem as them arise, so "good" devices are required as stated in RFC1925 : <<good, fast, cheap: choose two, you can't have all three>> implies that am aware that "fast" can't be get; just need directions and some "good" reference for the HW where I can learn details as power requirements and for the SW (but I guess 44net is the right place). wish you nice day $witch

4 4

AXIP/UDP links in Australia request
by vk1kw 28 Dec '16

28 Dec '16

Hello All, Looks like I have lost all of my AXIP/UDP links in Australia over the years and would like to try and configure a couple again within Australia and New Zealand please? I am Rob VK1KW 44.136.3.92 Canberra A.C.T. local area 44.136.0.0/21 Vk1kw.dyndns.org EMAIL Vk1kw(a)netspace.net.au BBS Vk1kw(a)vk1kw.act.aus.oc JNOS APRS BPQ & FBB Best wishes for the New Year Rob

1 0

Re: [44net] 44Net Digest, Vol 5, Issue 193
by lleachii＠aol.com 28 Dec '16

28 Dec '16

Miguel, - The remote IP should be blank, you have to use the tunl0 to connect to all endpoints - You must be able to access the underlying Debian system in order to install ampr-ripd (I haven't seen instructions on how to do this since it was called Vyatta) - You cannot use RIPv2, you must use a RIP44 daemon (e.g. ampr-ripd) 73, Lynwood KB3VWG On 12/27/2016 03:00 PM, 44net-request(a)hamradio.ucsd.edu wrote: > Send 44Net mailing list submissions to > 44net(a)hamradio.ucsd.edu > > To subscribe or unsubscribe via the World Wide Web, visit > http://hamradio.ucsd.edu/mailman/listinfo/44net > or, via email, send a message with subject or body 'help' to > 44net-request(a)hamradio.ucsd.edu > > You can reach the person managing the list at > 44net-owner(a)hamradio.ucsd.edu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of 44Net digest..." > > > Today's Topics: > > 1. AMPR + VyOS (Miguel Rodriguez) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 27 Dec 2016 13:40:14 -0500 > From: Miguel Rodriguez <miguemely101(a)gmail.com> > To: AMPRNet working group <44net(a)hamradio.ucsd.edu> > Subject: [44net] AMPR + VyOS > Message-ID: > <CANvo9Dh7iDAS5JTnTrohNtnSbJuzJjPX5-aFFTgZ8E5pHtUrjQ(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hello everyone! > > Does anyone have any experience setting up VyOS for use on the AMPR > network? I have the IPIP tunnel to UCSD set up, however, I don't know how > to proceed from there in terms of RIP. > > This is what I did so far: > set interfaces tunnel tun0 > set interfaces tunnel tun0 local-ip 'wanip' > set interfaces tunnel tun0 remote-ip 169.228.66.251 > set interfaces tunnel tun0 encap ipip > set interfaces tunnel tun0 descr "Tunnel to AMPR Gateway" > set interfaces tunnel tun0 multicast enable > set protocols static table 1 interface-route 0.0.0.0/0 next-hop-interface > tun0 > set policy route SOURCE_ROUTE rule 10 set table 1 > set policy route SOURCE_ROUTE rule 10 source address 44.0.0.0/16 > set interfaces ethernet eth1 vif 44 policy route SOURCE_ROUTE > set protocols rip interface eth1.44 > set interfaces ethernet eth1 vif 44 ip rip authentication > plaintext-password [therippass] > > >

2 3

Re: [44net] AMPR + VyOS
by Rob Janssen 27 Dec '16

27 Dec '16

44net-request(a)hamradio.ucsd.edu wrote: > Subject: > [44net] AMPR + VyOS > From: > Miguel Rodriguez <miguemely101(a)gmail.com> > Date: > 12/27/2016 07:40 PM > > To: > AMPRNet working group <44net(a)hamradio.ucsd.edu> > > > Hello everyone! > > Does anyone have any experience setting up VyOS for use on the AMPR > network? I have the IPIP tunnel to UCSD set up, however, I don't know how > to proceed from there in terms of RIP. I have no experience with that, but I would guess that the easiest way is to use ampr-ripd for that. Is is possible to compile and install it on your system? Check the generic installation instructions on the WiKi. Rob

2 1

Mikrotik firewall rules for 44net?
by Nick G4IRX 10 Dec '16

10 Dec '16

I've recently installed Marius YO2LOJ's RIPv2 AMPR Gateway Setup Script 2.2 on a Mikrotik RB450G. RouterOS is version 6.37.3, I have 44.131.56.241 configured on the ucsd-gw interface and 44.131.56.9/29 on ether5 for my LAN. It seems to work well and I can access 44net hosts from a 44net machine on the LAN. I'm filtering traffic on the WAN interface of the router to only permit ipip traffic, however I still see traffic from outside 44/8 - mainly tcp syn packets to port 23 appearing on the LAN. These must be coming down via a tunnel and I'd like to filter them out. I've implemented an output rule to permit traffic from 44/8 to 44/8 and drop everything else, applied this to ether5. Is there a better way to implement this? I would like to filter on the WAN side but that would mean a firewall input rule on every tunnel. Thanks, -- Nick G4IRX

2 2

Re: [44net] Telnet To JNOS From Public IP Users Not Working
by Rob Janssen 10 Dec '16

10 Dec '16

> i was able to telnet in from here and got a login prompt from > wa4zlw.ampr.org Yes, from .ampr.org hosts it works OK. But the question was about "Public IP" users (he means users on the normal internet). That does not work, at least not here. When JNOS is running on Linux it is best to do the tunneling in Linux and have JNOS on a local subnet behind that. When running on another OS, it will be required to put a decent router inbetween. Rob

1 0

Re: [44net] Telnet To JNOS From Public IP Users Not Working
by Rob Janssen 10 Dec '16

10 Dec '16

> Your JNOS is trying to respond directly to the incoming connections rather > than traversing an encap tunnel. This will not work as the upstream > hardware does not know about you and your 44net allocation. You receive > packets over the encap bridge but you respond back directly. > As for how to fix it? Dunno. We need to somehow encap your outgoing default > route for your 44 IP address so that packet response is along the same path > that it came in. Is that the issue? When I telnet to him from internet I do get "established" suggesting that something gets back... But when it is as you write, what you need is "policy routing". that means, the capability to select a (default) route based on criteria like the source address (your 44-net address or your public IP address). The first has to go to amprgw, the second has to go to your ISP. Does JNOS even offer that? It can be solved with Linux or a sophisticated router like MikroTik or OpenWRT, but I am not sure a bare JNOS system can do this. Rob

2 1

Re: [44net] Telnet To JNOS From Public IP Users Not Working
by Rob Janssen 09 Dec '16

09 Dec '16

> Subject: > [44net] Telnet To JNOS From Public IP Users Not Working > From: > "Charles Hargrove" <n2nov(a)n2nov.net> > Date: > 12/09/2016 07:13 PM > > To: > 44net(a)hamradio.ucsd.edu > > > I am having trouble getting users to telnet from their homes to my JNOS box > located at 44.68.41.1 on port 2300. Their seems to be an asynchronous > connections as they try to transverse the UCSD portal. I see my responses > going back to them, but they are just hanging on their side. I have in my > autoexec.nos file "route add default tun1 44.0.0.1" as their is a tunnel > interface between the JNOS and the linux box that it is running on. Does > anyone have any ideas? Thanks. I get a connect but no text. Normally this means there is an MTU issue somewhere, but in this case (trying from net-44) the welcome text appears to be too smal for that kind of problem. it could be a firewall issue as well. Why do you set the default route to 44.0.0.1 instead of 169.228.66.251 ? Is that normal for JNOS? Rob

4 3

Telnet To JNOS From Public IP Users Not Working
by Charles Hargrove 09 Dec '16

09 Dec '16

I am having trouble getting users to telnet from their homes to my JNOS box located at 44.68.41.1 on port 2300. Their seems to be an asynchronous connections as they try to transverse the UCSD portal. I see my responses going back to them, but they are just hanging on their side. I have in my autoexec.nos file "route add default tun1 44.0.0.1" as their is a tunnel interface between the JNOS and the linux box that it is running on. Does anyone have any ideas? Thanks. -- Charles J. Hargrove - N2NOV NYC ARECS/RACES Citywide Radio Officer/Skywarn Coord. NYC-ARECS/RACES Net Mon. @ 8:30PM 449.025/123.0 PL http://www.nyc-arecs.org and http://www.nyc-skywarn.org NY-NBEMS Net Saturdays @ 10AM & USeast-NBEMS Net Wednesdays @ 7PM on 7.036 Mhz USB/1500 hz waterfall spot; Olivia 8/500 check-ins "Information is the oxygen of the modern age. It seeps through the walls topped by barbed wire, it wafts across the electrified borders." - Ronald Reagan "The more corrupt the state, the more it legislates." - Tacitus "Molann an obair an fear" - Irish Saying (The work praises the man.) "No matter how big and powerful government gets, and the many services it provides, it can never take the place of volunteers." - Ronald Reagan "We are fast approaching the stage of ultimate inversion: the stage where the government is free to do anything it pleases, while the citizens may act only by permission." - Ayn Rand

1 0

Re: [44net] LoRa
by Steve L 27 Nov '16

27 Nov '16

>Are hams allowed to use spread spectrum modes in USA? Yes. Speaking of rules... I once asked about data data rates and bandwidth rules for ham radio in other countries. I am interested in learning about spread spectrum rules, and encryption rules for the hobby in other areas for anyone who cares to share. Steve KB9MWR

2 1

Re: [44net] LoRa
by Steve L 27 Nov '16

27 Nov '16

Dean, Thanks for sharing. Range will be the big thing at least for me, so if you get around to testing that, I hope you'll share your results. Though I am really leaning toward the 400 MHz modules. If there continues to be hold up on the MMDVM boards, then I'll likely order some LoRa modules for my winter project instead.

1 0

LoRa
by Steve L 27 Nov '16

27 Nov '16

Since we really need some other data radio options in the hobby, I wanted to mention LoRa. It's a chirped spread spectrum technology used for low power WAN applications, with air transfer rates: 300bps-31.2Kbps. There are 433 MHz modules, as well as 900 MHz and 2.4 GHz. As a staring place, WA2KWR has some code here: https://github.com/fcolumbu/LoRa_Projects/wiki Steve, KB9MWR

2 1

Re: [44net] LoRa
by Rob Janssen 27 Nov '16

27 Nov '16

> Since we really need some other data radio options in the hobby, I > wanted to mention LoRa. > It's a chirped spread spectrum technology used for low power WAN > applications, with air transfer rates: 300bps-31.2Kbps. There are 433 > MHz modules, as well as 900 MHz and 2.4 GHz. Indeed it is interesting, I have looked at it as well when a local telecom company recently announced it has deployed a country-covering network. (by mounting LoRa equipment at all cell towers and locations) They use 900 MHz, which is not a ham band here. But 433 could be useful. It is unfortunate that the datarate is too low for many applications. It could be interesting for APRS-like mobile datacomm or other telemetry, which is also what the commercial network is for. Rob

2 1

postfix/smtp/smtpd flood...
by SP2L 23 Nov '16

23 Nov '16

Greetings. Lately my small amateur server been severely flooded with similar activities: Nov 21 22:54:01 linux postfix/smtp/smtpd[26048]: connect from unknown[200.7.249.218] Nov 21 22:54:02 linux postfix/smtp/smtpd[26048]: disconnect from unknown[200.7.249.218] Nov 21 22:55:01 linux postfix/smtp/smtpd[26048]: connect from unknown[83.70.149.33] Nov 21 22:55:04 linux postfix/smtp/smtpd[26048]: disconnect from unknown[83.70.149.33] Nov 21 22:56:59 linux postfix/smtp/smtpd[26066]: connect from mail.devaney.net[96.91.214.49] Nov 21 22:57:00 linux postfix/smtp/smtpd[26066]: disconnect from mail.devaney.net[96.91.214.49] Nov 21 23:00:11 linux postfix/smtp/smtpd[26161]: connect from unknown[83.70.149.33] Nov 21 23:00:11 linux postfix/smtp/smtpd[26161]: disconnect from unknown[83.70.149.33] Nov 21 23:02:27 linux postfix/smtp/smtpd[26203]: connect from unknown[186.33.182.12] Nov 21 23:02:28 linux postfix/smtp/smtpd[26203]: disconnect from unknown[186.33.182.12] Nov 21 23:02:31 linux postfix/smtp/smtpd[26203]: connect from unknown[unknown] Nov 21 23:02:31 linux postfix/smtp/smtpd[26203]: disconnect from unknown[unknown] Nov 21 23:04:32 linux postfix/smtp/smtpd[26205]: connect from unknown[50.126.82.18] Nov 21 23:04:32 linux postfix/smtp/smtpd[26205]: lost connection after HELO from unknown[50.126.82.18] Nov 21 23:04:32 linux postfix/smtp/smtpd[26205]: disconnect from unknown[50.126.82.18] System logs were building up very fast! Created new entries for fail2ban porogram and got rid of this in a few minutes time! In jail.local file added: [postfix-auth] enabled = true filter = postfix.auth action = iptables-multiport[name=postfix, port="http,https,smtp,submission,pop3,pop3s,imap,imaps,sieve", protocol=tcp] logpath = /var/log/mail.log In filter.d folder added new filter postfix.auth.conf with regex: # failregex = ^%(__prefix_line)slost connection after (AUTH|UNKNOWN|EHLO) from (.*)\[<HOST>\].* ^%(__prefix_line)sconnect from unknown\[<HOST>\].* ^%(__prefix_line)swarning: hostname.* ignoreregex = # >From now on NO MORE such crap!!! Best regards. Tom - SP2L

1 0

Re: [44net] Wikipedia article on AMPRNet
by Steve L 06 Nov '16

06 Nov '16

Speaking of documentation... Every once and a while I get an email from someone, and it's not clear to them how the IP space is useful, "since everyone on the internet already has a publicly routeable address." Maybe that can be made clearer some where? Just a suggestion.

1 0

Re: [44net] Wikipedia article on AMPRNet
by Rob Janssen 06 Nov '16

06 Nov '16

> Ah, I stand corrected; I've updated the entry. The section on 44.128/16 was > pointing to an obsolete article that incorrectly gave the impression that > that subnet was unroutable like an RFC1918 network, whereas it's really just > reserved for testing. > Unfortunately, there's an article on www.eastnetpacket.net that incorrectly > states that it *IS* an RFC1918-style network and people outside the AMPRNet > are quoting it as justification for using the network AS an unrouted network. Well, that amprnets.txt file of course has existed and has been maintained on hamradio.ucsd.edu for many many years. I have 3 old copies and all of them mention that it may be assumed that any packets with 44.128 addresses are bogons, so this text has probably been there for at least a decade if not much more. Currently this file does not exist anymore at hamradio.ucsd.edu, I presume its function has been taken over by the "networks" menu item at portal.ampr.org. However, that listing does not mention 44.128.0.0/16 at all. When it is desired to change the definition of this subnet, it may be better to provide an explicit new definition, instead of trying to remove the old definition from internet without providing a new one. I think that is not going to work well, given the way information is stored, copied and archived on the web. Also note that this information on portal.ampr.org is only available to registered users, so it would be wise to put some information on a publicly available site as well (maybe a description of the subnetting of net 44 at the top level without all that country-specific info). That could be on the www.ampr.org site. Rob

2 1

Wikipedia article on AMPRNet
by Brian Kantor 06 Nov '16

06 Nov '16

There are some rather troublesome inaccuracies in the Wikipedia article on the AMPRNet. Does anyone on this list have edit privileges on this page so those could be corrected? - Brian

3 5

44.127/16
by Assi Friedman 01 Nov '16

01 Nov '16

Quick question: why is 44.127/16 listed as "No Country" on the portal? How are the subnet allocations different from allocations that belong under a specific country? Thanks, Assi

2 1

Missing RIP broadcasts
by Boudewijn (Bob) Tenty 28 Oct '16

28 Oct '16

Hi Brian, I don't see the rip broadcasts from ucsd to my gateway at 69.165.175.62 since a couple days. I'm still in the encap.txt and I still see the regular packets routed by ucsd.edu addressed to my subnets coming in. Something wrong at that end? Bob (Boudewijn) VE3TOK -- There is nothing permanent except change Heraclitus

6 7

Re: [44net] EdgeRouter/EdgeOS Wiki
by Rob Janssen 27 Oct '16

27 Oct '16

> I've tried a few other things with no avail at this point. Put a monitoring device at the outside port, or start a data capture in the router itself when EdgeOS can do that, and then check what is arriving when you do the outside ping. When you see packets coming from 169.228.66.251 addressed to your external IP with protocol field 4 you at least know the external causes are covered. You can then concentrate on the setup of your router. When no such packets appear, the problem is in your gateway setup at portal.ampr.org or your DNS entry. As I don't see your callsign or AMPRnet IP anywhere in your message I can't do much research... Rob

5 10

tunl0 and ax0
by Eduardo Castillo 27 Oct '16

27 Oct '16

Hi a question tunl0 tunnel is my ip 44.153.32.97 and my radio ax0 44.153.35.100 as I can do to make 44.153.35.0/24 out by ax0 and not tunl0 my local colleagues via radio frequency use 44.153.35 0/24 regards -- __ __ __ __ | / \(__\| \/ |_ BBS GF05OM TORTUGUITAS 145010Mhz |__\__/ __/|__/\__|__ TELNET LU9DCE.DYNU.COM PORT 6300 == power by linux === NODO LU9DCE.DYNU.COM PORT 3694 ## AMPR NET 44 // LU9DCE.AMPR.ORG // 44.153.32.97 ## *** https://www.facebook.com/groups/newpacketradio/ GRUPO DE PACKET WHATSAPP https://chat.whatsapp.com/Id3cEQjDdXl8BL0Sik4lGQ

2 1

system 'hamradio' offline Monday
by brian 24 Oct '16

24 Oct '16

The host 'hamradio.ucsd.edu' will be offline some of Monday to upgrade its operating system. Services such as this mailing list and the DNS robot will be unavailable during that time. - Brian

2 3

Re: [44net] EdgeRouter/EdgeOS Wiki
by Rob Janssen 24 Oct '16

24 Oct '16

> Any ideas? I feel like I did configure the tunnel correctly, but I don't > see anything on the LAN. Will post config if needed. Your gateway config looks OK to me. Your route entry appears in our gateway: 44.98.17.32/27 via 73.1.142.180 dev tunl0 proto ampr-ripd metric 4 onlink (of course useless for us, because the method described on the WiKi does not provide connectivity for gateway stations other than amprgw) I can ping your external address. Maybe Comcast or the modem is filtering IPIP? Rob

2 2

Re: [44net] Stats
by Steve L 23 Oct '16

23 Oct '16

Its not perfect. I was just curious as to the shift now being done direct with BGP. Probably the most useful information for many would be to correlate gateways or network space with a rough location. One might like to coordinate some coordinate some tunneled activities/traffic with someone in a geographic area for instance. I for one, would like to know who else in my state is reachable over 44net. But I don't see an easy way to do that.

1 0

Re: [44net] Stats
by Rob Janssen 23 Oct '16

23 Oct '16

> Actually, Steve, because of the host-level filtering at amprgw, > only 17652 hosts addresses implied in the encap file go anywhere. > - Brian That is what I wanted to suggest as well. You cannot calculate the number of reachable hosts from the subnet sizes alone. Not even when you subtract two (network- and broadcast address) for every subnet you know about. And please do not try to resolve this puzzle by trying to ping every host... Rob

1 0

Re: [44net] Stats
by Steve L 23 Oct '16

23 Oct '16

Rob, Its a count of the number of routed hosts, taken from the encap file and the BGP announce list. Small math bug, but the number of hosts was right. So about 10% of the 44/8 allocation actually goes somewhere. 10/22/16 Routeable Ampr.org 44/8 Net Stats: ENCAP Total Hosts: 1224922 ENCAP Percent: 7 BGP Total Hosts: 581204 BGP Percent: 3

2 1

Re: [44net] Stats
by Rob Janssen 23 Oct '16

23 Oct '16

What do these numbers mean? Rob

1 0

Stats
by Steve L 22 Oct '16

22 Oct '16

I created a little script because I was curious, so I figured I'd share what it told me: 10/22/16 Routeable Ampr.org 44/8 Net Stats: ENCAP Total Hosts: 1224922 ENCAP Percent: 13 BGP Total Hosts: 581204 BGP Percent: 28

1 0

EdgeRouter/EdgeOS Wiki
by Rob Janssen 22 Oct '16

22 Oct '16

> Quick question, is the EdgeRouter wiki page outdated? Just did it by the > letter, but I got no outside ping to my router's IP. Well, what is described there does not constitute a proper AMPRnet gateway, i.e. with such a setup you can only communicate between your own subnet and internet via the amprgw at UCSD, *not* with other users of the AMPRnet network! When you cannot ping from addresses outside 44.0.0.0/8, check: - is your router IP (and other IPs you want to use) registered in DNS for .ampr.org? - is protocol-4 traffic being passed to your EdgeRouter? (not filtered by some other modem/router you may have in front of it) Rob

2 2

EdgeRouter/EdgeOS Wiki
by Miguel Rodriguez 21 Oct '16

21 Oct '16

Hey folks! Quick question, is the EdgeRouter wiki page outdated? Just did it by the letter, but I got no outside ping to my router's IP. -- Miguel Rodriguez 12th Grade Student miguemely101(a)gmail.com Tel: *561-758-0631* *Accredited District Since 2008; Re-certification - January 2013* Home of Florida's first LEED Gold Certified School *Disclaimer*: Under Florida law, e-mail addresses are *public records*. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.

1 0

Re: [44net] Dynamic IPENCAP Filtering on OpenWRT/iptables-based devices
by Rob Janssen 21 Oct '16

21 Oct '16

> I have implemented the dynamic IPENCAP firewall script in OpenWRT; and > it works! I did not mention in the mail that I had to resolve those catch-22 effects as well... In my system, I initialize the firewall using a shell script that has a long list of iptables commands in it. I prefer that over manipulating it ad-hoc and then saving it using iptables-save, because I can put comments in the script, use variables to hold values like the external and internal IP addresses, etc. Inside this script, after the commands to erase any existing rules, I first call the update script I posted that populates the ipipfilter so I can add that in the rule for incoming -p 4 traffic without getting a nonexisting chain error. (it is not possible to forward-reference chains in iptables) For other purposes I now use "ipset" to hold such lists of addresses instead of a long list of rules that matches them one by one. Is more efficient as well, but in my Linux version it is not possible to keep hit counters for ipset members, which I would like to do (to occasionally check which gateways actually send traffic to us). Using an ipset could resolve the issues that you have been facing, as one can create the empty ipset before setting up the iptables, put the public address of amprgw in it (hardwired), then start ampr-ripd and let it receive the tunnel information and put it in the ipset. You never have unresolved values while doing that. You can use ipset like this: ipset create gateways hash:ip ipset add gateways 169.228.66.251 and then in the firewall: iptables -A INPUT -p 4 -m set --match-set gateways src -j ACCEPT The script called from ampr-ripd would then use "ipset add", "ipset del" and "ipset list" commands to manipulate the set similar to what I did with iptables. Rob

1 0

Re: [44net] Information - Traffic Attempt to Route Through my Node
by Rob Janssen 21 Oct '16

21 Oct '16

> Rob, > You stated: > "When you are worried about intrusions it is probably more effective to > block IPIP packets from sources that are not in the gateway list. I do > that as well (via ampr-ripd)." > What command/script do you use to add the endpoints to iptables? I have posted it before on this mailinglist: http://hamradio.ucsd.edu/mailman/private/44net/2014-November/003577.html This script manipulates an iptables chain. It would be possible to do a similar thing with the "ipset" command to manipulate an address list when you are familiar with that (I wasn't when I wrote this script). Advantage of using iptables is you have statistics per rule in the table so you can see which IPIP peers are sending traffic to you. New versions of ipset support counters but the one I am running doesn't. With a command like this you get a quick overview of your active IPIP peers: iptables -L ipipfilter -vn | grep -v ' 0 ACCE' Rob

2 1

Re: [44net] test ping
by Rob Janssen 18 Oct '16

18 Oct '16

> For years, my node had similar behavior, causing various kinds of > intermittent issues. The problem was solved when I added an iptables > rule permitting inbound IPENCAP: Ok in your case it was a configuration error? Of course we should make sure that there is no error outside the router, e.g. by using wireshark to confirm that IPIP packets are not arriving when the source is new. Well, it will be a tricky investigation especially when we have to instruct those that are not so proficient in networking to determine the cause of the problem. (gateway system, internet router, maybe ISP filters or cgNAT) Rob

1 0

Re: [44net] test ping
by Rob Janssen 18 Oct '16

18 Oct '16

> No, it is not ok. > It is working because of connection tracking if YOU access the page. > Here the output ofhttp://yo2tm.ampr.org/nettools.php ping: > Ping Output: > PING 44.153.32.97 (44.153.32.97) 56(84) bytes of data. > --- 44.153.32.97 ping statistics --- > 4 packets transmitted, 0 received, 100% packet loss, time 2999ms Indeed, it is not working correctly. He sent me a mail telling me that he could ping me at 44.137.41.97 and I happened to be at the computer when it came in, I immediatelu tried to ping back and it worked. Then I waited an hour, tried again, and again it did not work. So all symptoms point to a stateful firewall of IPIP traffic, probably in his ISP router. I suspect that some NAT routers do a connection tracking firewall even when the DMZ HOST is set in the config. The DMZ HOST only receives all TCP and UDP traffic, but not protocol-4. However, just like all other hosts on the LAN, it can send out protocol-4 traffic and receive the "reply" traffic. So doing outbound connections works, but inbound on an idle tunnel is not working. It would be interesting to investigate which routers suffer from this bug, so a list can be made on the WiKi page. I think quite some gateway stations have this fault. The operator believes he has a working gateway because he can connect whatever other gateway station he tries, but incoming connects do not work when there has been no prior traffic. (of course the same thing happens when DMZ HOST is not set at all, so this has to be properly investigated) Rob

4 3

test ping
by Eduardo Castillo 18 Oct '16

18 Oct '16

Hello !! as I can test the ping to my ip .. my route in dmz activated addressed to my pc I tried the page http://yo2tm.ampr.org/nettools.php and it's OK ! my ip is 44.153.32.97 --------- Hola !! como puedo testear el ping hacia mi ip .. mi route en dmz activado dirigido a mi pc yo probe la pagina http://yo2tm.ampr.org/nettools.php y esta bien ! mi ip es 44.153.32.97 -- ====================================================================== La vida nunca nos depara lo que queremos en el momento apropiado. Las aventuras ocurren, pero no puntualmente. -- Edward Morgan Foster. ====================================================================== __ __ __ __ | / \(__\| \/ |_ BBS GF05OM TORTUGUITAS 145010Mhz |__\__/ __/|__/\__|__ TELNET LU9DCE.DYNU.COM PORT 6300 == power by linux === NODO LU9DCE.DYNU.COM PORT 3694 ## AMPR NET 44 // LU9DCE.AMPR.ORG // 44.153.32.97 ## *** https://www.facebook.com/groups/newpacketradio/

5 4

fwd linfbb
by Eduardo Castillo 15 Oct '16

15 Oct '16

Hello everyone I have a running FBB baires I would like to have a fwd with a colleague europe or usa network by 44 if there is any colleague who could - I would appreciate I leave my email lu9dce(a)gmail.com regards 73 -- ====================================================================== El joven conoce las reglas, el viejo las excepciones. ====================================================================== __ __ __ __ | / \(__\| \/ |_ BBS GF05OM TORTUGUITAS 145010Mhz |__\__/ __/|__/\__|__ TELNET LU9DCE.DYNU.COM PORT 6300 == power by linux === NODO LU9DCE.DYNU.COM PORT 3694 ## AMPR NET 44 // LU9DCE.AMPR.ORG // 44.153.32.97 ## *** https://www.facebook.com/groups/newpacketradio/

1 0

Re: [44net] test ampr bbs
by Rob Janssen 13 Oct '16

13 Oct '16

> Subject: > [44net] test ampr bbs > From: > Eduardo Castillo <lu9dce(a)gmail.com> > Date: > 10/12/2016 06:46 PM > > To: > 44net(a)hamradio.ucsd.edu > > > pls test bbs 44.153.32.97 port 6300 !! > > send report !! my mail lu9dce(a)gmail.com !! tks !! I can't connect it. There appears to be a tunnel route to 44.153.32.97 via 181.192.58.28 but I can't even ping 44.153.32.97 so probably there is some issue, maybe the wellknown NAT DMZ issue? Rob

5 4

Re: [44net] test ampr bbs
by Rob Janssen 12 Oct '16

12 Oct '16

> I can ping 44.153.32.97 from here and connect to his port 6300. > - Brian When I ping from a public IP it works, the traffic will then be routed over internet to amprgw and then tunneled to him. He probably has reverse traffic via amprgw so there is an open "session" in his router. When he pings me, he gets replies. But when I later (or before) ping him, I only see the traffic departing at our GW (properly encapsulated and sent to 181.192.58.28) but nothing is returned. I suspect it is the problem of being behind a stateful firewall in a NAT router. This sometimes cannot be disabled for other protocols than TCP/UDP even when defining the host as "DMZ Host". But I don't know if he has already tried that. Rob

1 0

test ampr bbs
by Eduardo Castillo 12 Oct '16

12 Oct '16

pls test bbs 44.153.32.97 port 6300 !! send report !! my mail lu9dce(a)gmail.com !! tks !! -- ====================================================================== Hombre invisible busca mujer transparente para hacer lo nunca visto. -- Stepi taglines. ====================================================================== __ __ __ __ | / \(__\| \/ |_ BBS GF05OM TORTUGUITAS 145010Mhz |__\__/ __/|__/\__|__ TELNET LU9DCE.DYNU.COM PORT 6300 == power by linux === NODO LU9DCE.DYNU.COM PORT 3694 ## AMPR NET 44 // LU9DCE.AMPR.ORG // 44.153.32.97 ## *** https://www.facebook.com/groups/newpacketradio/

1 0

Information - Traffic Attempt to Route Through my Node
by lleachii＠aol.com 12 Oct '16

12 Oct '16

All, FYI, I have recorded NetFlow on my tunl0 interface that appears to be NESTED IPENENCAP packets. I have also seen these previously. This is similar to a vector I described in my 20AUG remarks in "Security/Wiki Question - Requesting a Block." Because the source and destination IP addresses recorded could be spoofed (or the result of a misconfigured AMPR router), I do not want to alarm anyone by giving the specific address. I will note the packets contained the source address of an AMPR node and the destination of AMPRGW (i.e. another nested packet or a packet that would be de-encapsulated by AMPRGW); and were recorded over 60 seconds in a window of 24 hours. I have added the following rule to my firewall, to appear in iptables before my bogons: # THIS PREVENTS NESTED IPENCAP iptables -t raw -I PREROUTING -p 4 -i tunl0 -j DROP To add: a source IP iptables rule (based on BCP 38) had prevented these packets from forwarding. 73, - Lynwood KB3VWG /"//Archives of security comments in this forum from others suggest proper firewalling is necessary in environments running IPENCAP-enabled routers, ESPECIALLY BECAUSE of the presence of NAT/masquerade co-existing in some AMPRNet nodes..."/

2 3

Re: [44net] Information - Traffic Attempt to Route Through my Node
by Rob Janssen 12 Oct '16

12 Oct '16

> FYI, I have recorded NetFlow on my tunl0 interface that appears to be > NESTED IPENENCAP packets. I have also seen these previously. I have had a rule in place to log and drop these for ages, and I have not seen them recently at our gateway. As pointed out, they are configuration errors, e.g. because people put 44net addresses as tunnel endpoint address and policy routing is sending the traffic into a tunnel instead of direct on the interface. Other misconfigurations can result in recursive encapsulation. I believe I added the rule when there was an incident resulting in many-level encapsulated IPIP packets that only were limited by the MTU. When you are worried about intrusions it is probably more effective to block IPIP packets from sources that are not in the gateway list. I do that as well (via ampr-ripd). Rob

1 0

Re: [44net] Issue routing multiple IPs to Mikrotik
by Rob Janssen 05 Oct '16

05 Oct '16

> So in my opinion the best approach would be to send only traffic with 44 > origin and 44 destination not in other routes via ampr-gw, to preserve > your original 44 IP. > All the rest should be NAT-ed to your public gateway IP, not your > gateway's 44 net, in order to circumvent the whole 44net completely. > This will give you better speed, better response times and will ease the > work of the ampr gateway. I agree that there are situations where you better NAT the traffic than send it via amprgw. E.g. you are running Windows or Linux systems on 44-net addresses and you want to fetch operating system- or virus signature updates from an internet source, and you do not want to needlessly load amprgw with that traffic. (over here that does not really matter, we have our own gw and it can easily handle that load for the subnet of users that are in 44.137.0.0/16) Unfortunately, there are also situations where that NAT is really undesirable. The best example is Echolink. It simply will not work correctly when your system partly communicates directly (to other 44net systems) and partly uses NAT to communicate to internet systems. Of course it is also possible to use advanced techniques like the packet- and connection marking that you already mentioned to run a mix between direct and NAT. For a while I had a connection mark in the gateway that was set for certain host/port combinations and forced the use of srcnat in the POSTROUTING table. This was an attempt to work around issues like Echolink and also reachability of a system that is also running partly with NAT. I have dropped it some time ago as it was not easy to maintain it. Rob

1 0

Issue routing multiple IPs to Mikrotik
by Christopher S. Munz-Michielin 05 Oct '16

05 Oct '16

Hey all, I've been trying to configure a Mikrotik router to allow devices connectivity to the Amprnet and have been running into a bit of a snag. First off here's what my architecture looks like: Internet------------->Edge Router------------>AMPR Mikrotik------------->Devices I have a public IP on the edge router and a static /29 of public IPs between the Edge router and the AMPRNet router. I have confirmed I have external access to the AMPRNet router's public IP. I followed the guide outlined by Marius here: http://www.yo2loj.ro/hamprojects/ampr-gw-README.txt and have the following WORKING as expected: 1) connectivity from the Internet to my router's 44 IP (44.135.193.129) 2) connectivity to/from the AMPRNet to my router's 44 IP 3) connectivity to/from the AMPRNet to devices behind my router (44.135.193.18) What is not working is connectivity from the Internet to devices behind the router; i.e. I am unable to PING these devices from the Internet and am unable to access any Internet resources from these devices. If I add a layer of NAT at the AMPR router, the end devices CAN access the Internet, as the source IP is concealed and appears to UCSD to be that of the 44 IP of my router (44.135.193.129). I have also tried to add an additional 44 IP to my ampr-gw IPIP interface (44.135.219.130/8) but am also unable to PING that IP from the Internet. When I look at a packet capture on the router I do not see any packets destined for this second IP making it to the router at all. Is there something special that needs to be done in order to facilitate routing to more then one 44 IP via the UCSD tunnel? Cheers, Chris

4 7

Re: [44net] Issue routing multiple IPs to Mikrotik
by Rob Janssen 05 Oct '16

05 Oct '16

> if you want to go to the internet from 44net you need to NAT. you should > also have a firewall to deal with those issues as well > also you want to NAT if you go from a non-routable to 44net This is of course incorrect. The whole point of having amprgw is to be able to communicate between 44net and internet without having to use NAT. But indeed it is true that for amprgw and some other gateways to transport your traffic between internet and 44net you need to have a DNS entry for each of your addresses. And it is also true that you should have a careful look at your firewall when you are not used to having systems "directly on the internet" without the implicit firewalling provided by a NAT router. Rob

1 0

Re: [44net] IPv6
by Rob Janssen 03 Oct '16

03 Oct '16

> Perhaps someone would like to know not only what are the callsigns under > which both endpoints of the RF are operating, but also who is the > Amateur that originated the message and which Amateur is the final > recipient. I can imagine several reasons to want to know these. In the packet radio days, our license conditions explicitly included this requirement. It was fulfilled by ordinary digipeating, but not by NET/ROM. I added support to my version of NET to make NET/ROM nodes operate as a virtual digipeater, so the outgoing connect of a NET/ROM on behalf of a user was not made under the USERCALL-(15-SSID) call, but as "user via node". (a packet that was transmitted by the node as if it had been digipeated by the node) IP was a problem under those regulations, however an arrangement was made with the authorities that source and destination of the traffic were sufficiently identified when there was an accessible list of IP addresses and corresponding callsigns. The hosts files provided that information. (I doubt that the authorities ever listened in on amateur IP over AX.25 traffic and tried to identify the endpoints, I heard that the only AX.25 equipment available at the monitoring station was a PK-232) However, since then we have lost our "license" and now operate under a "unlicensed station with mandatory registration" regime here, with usage conditions that are far less detailed. Operating modes are no longer specified, only identification modes. As long as you ID your station in one of a specified set of modes, they no longer care what you transmit and what its source is. This also makes it legal to forward internet content, something that was not allowed under our old license conditions (that explicitly prohibited 3rd party content and connections with external networks). But of course it can still be useful to have identification information in IPv6 addresses, if only because of the general lack of reverse-DNS information in the IPv6 network. Rob

2 1

Re: [44net] IPv6
by Rob Janssen 03 Oct '16

03 Oct '16

> I don't see why anyone would want to encode information about the > country in the first 64 bits, especially since you can use compound > callsigns such as PA/EA4GPZ if you're operating abroad. > Perhaps it would be interesting to have the information about the > Maidenhead locator or GPS coordinates of a subnet (where this makes > sense). Someone could use this info to make a geographical map of the > network. However, I think that this info should belong to an external > database (whois maybe) and not be encoded in the IPv6's. I also don't think it should be done that way, especially because we seem to agree on the idea that we do not want to have a large IPv6 network for amprnet (which we could subnet in creative ways), but rather use the IPv6 addresses provided by a local ISP. We don't have control over the numbering and network size of those addresses, and especially during the initial phase of the rollout there will always be ISPs that do not understand IPv6 and give a customer only a single /64 or even less. Hopefully that will change later, but we cannot wait for that forever. So, keep all special handling in the last 64 bits and treat the first 64 as random. I think a special handling of the address should not even be mandatory, only a good suggestion that may help others to determine the source of traffic easily. It should still be possible to send traffic from addresses not conforming to this methid, at most risking that it will be dropped at an internet-radio gateway when prior arrangements have not been made. Probably a next step would be to standardize a method to distribute information about valid IPv6 AMPRnet networks (that can be somewhat trusted in access lists). E.g. use BGP, downloadable textfiles, (ampr-)RIPv6, etc. It may not be possible to standardize a single method due to limitations of used software and hardware, although this probably is less important than with the current gateway list. (where we need to remain compatible with very old software that cannot do IPv6 anyway) Rob

4 3

Re: [44net] IPv6
by Rob Janssen 02 Oct '16

02 Oct '16

> Hmm.. Do you have any examples of such ISPs? I’ve only seen them give out a /64 to the PPPoE / WAN interface and then also have a routable /56 or /48 which is almost always available using DHCPv6-PD. The /64 is only used for communication with the ISP (can also be a /126) while everything else if up to the router to manage. Although I do get a /48 from my ISP there is nothing I can manage about the subnetting. The 16 bits between my prefix and my networks are assigned by my router using DHCPv6-PD and there is nothing I can do to set these bits. They are assigned to my networks sequentially. I don't think it is feasible to use those bits with a special meaning. Rob

3 2

Re: [44net] IPv6
by Rob Janssen 02 Oct '16

02 Oct '16

> I'm using this proposal in my systems: >https://github.com/darconeous/ham-addr/blob/master/ham-addr.txt.md Maybe it is useful to develop a simple tool, e.g. a webpage with some javascript, that allows input of a callsign in a field and converts the input to the HAM-64, EUI-48 and EUI-64 forms as far as possible. A similar tool could work the other way around. This allows some experimentation. Rob

2 1

Re: [44net] IPv6
by Rob Janssen 01 Oct '16

01 Oct '16

> Currently many routers (I’ve tested and written a tutorial on Ubiquiti, and OpenWRT) allow you to set the subnet you want. In addition to that, some ISPs have pages that have details on how to do this in FreeBSD, OpenBSD, Gentoo, Windows, Cisco, etc. Of course, the modem / router / switch / access point provided by the ISPs may not allow you this, but it’s certainly possible. In the MikroTik routers quite popular in amateur networking, and also in the AVM Fritz!box routers that my ISP provides, it is not possible to do this when DHCPv6-PD is used. (it is possible when static IPv6 addresses are used as is done by some ISPs) There is an open feature request at MikroTik to implement something like you depict in your tutorial, but currently it is not there. Rob

2 1

Re: [44net] IPv6
by Rob Janssen 01 Oct '16

01 Oct '16

> The good thing about IPv6 is that due to the large address space it's > possible to make it mandatory to encode the callsign in the last 64 bits > of the address. This eliminates the problem that we have in IPv4 of > trying to trace back which callsign is behind an IP. I think it basically is a good idea, but it needs to be more flexible. We would like to be able to derive the callsign from the IP, but there should be no 1:1 mapping between callsign and IP, because that would mean only a single system can be online for each callsign. The standard should leave some bits (at least 8) available for use as "SSID" as we had in the packet days (callsign-1 callsign-2 etc), maybe also with some encoding of alphanumeric values. Rob

4 5

IPv6
by Dani EA4GPZ 01 Oct '16

01 Oct '16

Hi all, Sorry for the slight off-topic. I'm testing in my systems the idea of using IPv6 for Amateur Radio. My idea is to use some way of encoding the callsign in the IPv6 address. I'm using this proposal in my systems: https://github.com/darconeous/ham-addr/blob/master/ham-addr.txt.md Certainly, there are several other proposals that could be used. The good thing about IPv6 is that due to the large address space it's possible to make it mandatory to encode the callsign in the last 64 bits of the address. This eliminates the problem that we have in IPv4 of trying to trace back which callsign is behind an IP. The idea is to make some sort of whitelist of globally routable subnets that are using some way of encoding the callsign into the IPv6 (I would like to allow for the admin of a net to choose the encoding he wants to use). This whitelist can then be used in a firewall for several things: allowing access to some services to Amateurs only or deciding if a packet is fit to be routed by an RF link (for instance, one could require that the source and destination have both their callsigns encoded in their IPv6's). I'm using the subnet 2001:470:6915:8000::/49 for these tests. If someone has IPv6 connectivity and wants to try, there's a mumble server and a DX cluster (telnet port 7300) at ea4gpz.destevez.net (its IPv6 has the callsign EA4GPZ-Z encoded). The long term goal would be to have something similar to the 44net but where each user is using subnets allocated directly from their ISP instead of having a large block for amateurs (like the 44.0.0.0/8). Connectivity between different amateur subnets would run over the IPv6 internet instead of using a mesh VPN (as the IPIP mesh of 44net). The whitelist could be used to decide which IPv6's are amateur and get "special treatment". I have a longer text describing these ideas, but it's in Spanish. I'll translate it and put it somewhere, but I want to keep this email short enough. So, is anyone doing something similar already? I would like to get some subnets into the whitelist, so I can test how well this works. Questions, suggestions, comments? Anyone interested in joining these tests? 73, Dani EA4GPZ.

1 0

Re: [44net] Security - Telnet (port tcp/23)
by Rob Janssen 01 Oct '16

01 Oct '16

> the "Iot" is quite a culprit..I am constantly probed and attacked by > routers, refrigerators, and many, many so-called "smart > TV's"...sometimes, when I'm bored, I shut them off...it gives me a > tickle to think of someone botting away and abruptly being shut > down...but the poor, unknowing customer is the one who suffers...I've > got to wonder if they even notice their appliance is acting strangely, > or laggy, and why... > this would best be fixed at the manufacturers end.. At least half of the problem is the refusal of ISPs in general to implement BCP38. When there would be source address filtering, we would not see all the backscatter (DNS replies mainly). Then there are shodan.io and a lot of other "research" systems. I keep a blacklist to drop all their traffic, but of course it still arrives at the router. They usually offer unlisting the network, but at least in the case of shodan.io this is completely fake. A day or a week later they just resume. Finally we all know about the cheap virtual Linux cloudhosting companies like AWS, Linode, etc. Probably half blackhats, half sincere users don't even know that they got hacked. After all, Linux is secure so you don't have to think about that. Rob

1 0

Re: [44net] Security - Telnet (port tcp/23)
by Rob Janssen 30 Sep '16

30 Sep '16

> The unanswered SYN traffic to port 23 is much, much more. Especially before the "allow only > registered hosts" filter. We are dropping around 80 Mbyte/day of traffic for our /16 subnet due > to the address not being registered, so that would be about 20 GByte/day for amprgw.... Of course it is way more than that. I forgot that the about count is only for the subnets within our /16 that are actually routed. That is about 1/5 of our space. So the total "noise" traffic is more like 400 MB/day and would be like 100 GB/day for the entire AMPRnet. Rob

4 4

Re: [44net] Security - Telnet (port tcp/23)
by Rob Janssen 30 Sep '16

30 Sep '16

> I usually allow remote access (SSH, RDP, etc...) through VPN only. > When access from Internet is absolutely required (because it's not > possible to have a VPN), then I usually add a firewall rule to allow > access only from a list of known WAN IP addresses. That is certainly the best approach! Also, whenever possible, I run those protocols on IPv6 only, preferably on an address that is not as well in DNS for other services on the host. They cannot viably scan the IPv6 range so this obscurity hides the remote access quite well. Rob

2 1

Re: [44net] Security - Telnet (port tcp/23)
by Rob Janssen 30 Sep '16

30 Sep '16

> >/When I had SSH open to the world, I saw similar usernames in the failure log as I now /> >/see on this telnet honeypot. / > If your connectivity to the world is via a tunnel from amprgw, please > resist the temptation to run a honeypot - we're trying to reduce the > amount of bandwidth, not increase it. Although a honeypot isn't > necessarily a big bandwidth consumer, every bit helps. > - Brian It is on our BGP-routed subnet so the traffic is via our own gateway through a direct IPIP tunnel to that system. However, it is not really something to worry about. It attracts about 10-20 kbytes of internet->host traffic per day (the usernames and passwords that I log). Those attackers are trying maybe 10-15 different logons then move on. It is not like they try a list of 100,000 most often use passwords, they probably have the default passwords for some commonly used routers and other IoT devices, in some cases probably only a single one. (the worms that infect one particular device) The unanswered SYN traffic to port 23 is much, much more. Especially before the "allow only registered hosts" filter. We are dropping around 80 Mbyte/day of traffic for our /16 subnet due to the address not being registered, so that would be about 20 GByte/day for amprgw.... Rob

1 0

Re: [44net] Security - Telnet (port tcp/23)
by Rob Janssen 30 Sep '16

30 Sep '16

> As always, the best practice recommendation is to disable telnet logins > entirely as it represents a security issue because passwords pass over > the connection in clear plaintext. > - Brian Well, the issue is not really the passwords being in plaintext. The issue is the availability of a remote login feature with possibly weak passwords. It affects SSH just as much as it affects telnet. The malvolents are scanning the IPv4 space and when they can connect to a remote logon service (telnet, SSH, RDP, VNC) they try a number of common usernames and passwords. They are not listening in on your traffic. While it is clear that telnet is not the most secure login service, it really doesn't make a difference. I have a fake telnetd running on one of my systems that simply presents the user with a login prompt and logs what is being typed, and it shows endless connections trying things like root/12345 root/password admin/admin etc. They probably get into certain routers or other systems like that, then install some trojan that does further scanning. This is also indicated by certain loggings where they apparently believe they got logged in and then send a long string like "wget something; chmod a+x something; ./something" or similar. Rob

5 4

Re: [44net] Security - Telnet (port tcp/23)
by Rob Janssen 29 Sep '16

29 Sep '16

> The term to search for is 'honeypot'. There are many such scripts out there > on github and on the web in general. That is correct. In my case I quickly hacked something together but there are lots of examples to be found that are probably much more advanced. When I had SSH open to the world, I saw similar usernames in the failure log as I now see on this telnet honeypot. Rob

2 1

Re: [44net] Security - Telnet (port tcp/23)
by Gabriel Medinas 29 Sep '16

29 Sep '16

Hello Lynwood, I had in my JNOS virtually a lot of attempts connections to port 23 from all part of the world, to achieve forwarding to other BBS had change the telnet port to 2323 and substantially lower these attempts. When I speak attempts to port 23 are evidence of brute force, it is almost impossible to have open this port, also same the 20, 21, 443, etc. 73 Gabriel YV5KXE. Venezuela AmprNet Coordinator yv5kxe.ampr.org Date: Thu, 29 Sep 2016 12:15:57 -0400 From: lleachii(a)aol.com To: 44net(a)hamradio.ucsd.edu Subject:Date: Thu, 29 Sep 2016 12:15:57 -0400 From: lleachii(a)aol.com To: 44net(a)hamradio.ucsd.edu Subject: [44net] Security - Telnet (port tcp/23) Message-ID: <8c28faa2-76ff-45a9-06c6-1705433cf307(a)aol.com> Content-Type: text/plain; charset=windows-1252; format=flowed All, In June, we discussed a topic entitled: "Odd Username attempts at login" where Bill, KG6BAJ noticed odd connection attempts to his JNOS system via Telnet. I have recently been working on my SNMP and NetFlow servers, and noticed quite a bit of Telnet connection attempts from Asia, Europe and South America. While I have also seen SSH, RDP, NTP, ICMP and VNC, by far the largest amount of traffic reaching my border interface is Telnet. Doing some research, I discovered that NIC.CZ <http://nic.cz/> has been operating the Turris Project. They have determined that these attempts are coming from a botnet of embedded devices that have Telnet vulnerabilities. I have provided a link to those findings here: https://en.blog.nic.cz/2016/09/01/telnet-is-not-dead-at- least-not-on-smart-devices/ 09-28 19:57:36 0.000 TCP 60.189.137.98:28940 -> 44.60.44.128:2323 09-28 19:57:55 0.000 TCP 115.219.124.37:49067 -> 44.60.44.133:23 09-28 19:57:55 0.000 TCP 222.124.85.17:34905 -> 44.60.44.133:23 09-28 19:57:52 5.552 TCP 190.67.215.114:29593 -> 44.60.44.6:23 09-28 19:58:03 0.123 TCP 115.219.124.37:21070 -> 44.60.44.133:23 09-28 19:58:54 0.000 TCP 116.102.62.182:37311 -> 44.60.44.135:23 Please be mindful. 73, - Lynwood KB3VWG

1 0

Security - Telnet (port tcp/23)
by lleachii＠aol.com 29 Sep '16

29 Sep '16

All, In June, we discussed a topic entitled: "Odd Username attempts at login" where Bill, KG6BAJ noticed odd connection attempts to his JNOS system via Telnet. I have recently been working on my SNMP and NetFlow servers, and noticed quite a bit of Telnet connection attempts from Asia, Europe and South America. While I have also seen SSH, RDP, NTP, ICMP and VNC, by far the largest amount of traffic reaching my border interface is Telnet. Doing some research, I discovered that NIC.CZ has been operating the Turris Project. They have determined that these attempts are coming from a botnet of embedded devices that have Telnet vulnerabilities. I have provided a link to those findings here: https://en.blog.nic.cz/2016/09/01/telnet-is-not-dead-at-least-not-on-smart-… 09-28 19:57:36 0.000 TCP 60.189.137.98:28940 -> 44.60.44.128:2323 09-28 19:57:55 0.000 TCP 115.219.124.37:49067 -> 44.60.44.133:23 09-28 19:57:55 0.000 TCP 222.124.85.17:34905 -> 44.60.44.133:23 09-28 19:57:52 5.552 TCP 190.67.215.114:29593 -> 44.60.44.6:23 09-28 19:58:03 0.123 TCP 115.219.124.37:21070 -> 44.60.44.133:23 09-28 19:58:54 0.000 TCP 116.102.62.182:37311 -> 44.60.44.135:23 Please be mindful. 73, - Lynwood KB3VWG

2 1

Re: [44net] Fwd: MicroTik and Dumb Questions
by Rob Janssen 29 Sep '16

29 Sep '16

> You need to use mangle rules in firewall to mark the incoming packets from the gateway interface and then using route marking route them back out the way they came. That is another approach, but you will have to handle outgoing connections as well. Rob

3 4

Fwd: MicroTik and Dumb Questions
by Miguel Rodriguez 26 Sep '16

26 Sep '16

Good evening/morning folks! I have some dumb questions about setting up the MicroTik. I currently have everything set(I got all the RIP records and routes created), however, it can't talk to the internet. I'm trying to figure out, would this be a firewall issue? Do I need to create a whole new NIC just for the 44net? Basically, where should I go from here? Thanks, Miguel Rodriguez 12th Grade Student miguemely101(a)gmail.com <javascript:_e(%7B%7D,'cvml','miguemely101(a)gmail.com');> Tel: *561-758-0631* *Accredited District Since 2008; Re-certification - January 2013* Home of Florida's first LEED Gold Certified School *Disclaimer*: Under Florida law, e-mail addresses are *public records*. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing. -- Miguel Rodriguez 12th Grade Student miguemely101(a)gmail.com Tel: *561-758-0631* *Accredited District Since 2008; Re-certification - January 2013* Home of Florida's first LEED Gold Certified School *Disclaimer*: Under Florida law, e-mail addresses are *public records*. If you do not want your e-mail address released in response to a public records request, do not send electronic mail to this entity. Instead, contact this office by phone or in writing.

4 4

Re: [44net] Fwd: MicroTik and Dumb Questions
by Rob Janssen 26 Sep '16

26 Sep '16

> Rob, > I thought the script took care of routing. So I would have to create new routes for 44net to go to the IPIP tunnel? It should not be required for 44net, but only for internet. I.e. for communication between your 44net hosts and systems on internet outside 44net. That traffic has to be forced through the IPIP tunnel to UCSD (169.228.66.251) instead of directly to your ISP, which will drop it. This can be achieved by creating the 44net routes in a different routing table, I'll wait to see if Marius joins the discussion to find how this is best achieved when using his script. I am not using IPIP myself on my MikroTik, I have a VPN to another system and use BGP. There I have configured the BGP to put the routes in a separate routing table named amprnet and configured some IP Route Rules so that this table is used for amprnet traffic only. Rob

2 2

Re: [44net] Fwd: MicroTik and Dumb Questions
by Rob Janssen 26 Sep '16

26 Sep '16

> I have some dumb questions about setting up the MicroTik. I currently have > everything set(I got all the RIP records and routes created), however, it > can't talk to the internet. I'm trying to figure out, would this be a > firewall issue? Do I need to create a whole new NIC just for the 44net? When you want to route from net-44 addresses to internet (non-net-44), and your ISP implements source address filtering (BCP38) you need to setup policy routing, because you need a separate default route for traffic from your public internet address (pointing to your ISP) and for traffic from your net-44 systems (pointing to the IPIP tunnel to UCSD). Rob

2 1

Allocation of addresses
by John Ricketts 25 Sep '16

25 Sep '16

Thank you to all that responded to my email, I made my request through the portal. I would like to provide free tunnel services to any amateur that applies and issue 44net addresses to those who qualify. I also will be experimenting locally with RF. I am currently connected to AT&T at 10gbits/sec, should be snappy. Thanks! John KD5ZZH

1 0

Re: [44net] Co-located point of presence for 44net
by Rob Janssen 25 Sep '16

25 Sep '16

> So my question is this: Is what I want to do feasable as a way to get a > static address and act as an AMPR gateway? Yes, this works quite well. I have the same setup here. I have a colocated Raspberry Pi that is on the IPIP mesh using ampr-ripd in the standard setup that is described on the WiKi, and it serves my subnet and a couple of /32 addresses. My subnet is tunneled to my home using IPsec in AH/Tunnel mode. Using AH instead of ESP (as is usually used) reduces CPU usage, and encryption is not required for this purpose anyway. At home I have a MikroTik router. I do have a fixed IP at home so IPsec is easy, when you don't have that it may be easier to use a VPN that does not care about addresses, e.g. OpenVPN. I also run a couple of applications locally on the Pi, hence the /32 addresses. Today, thanks to Marius' work, it is also possible to use a MikroTik router instead of the Raspberry Pi. It may be easier to configure and is available in rackmount formfactor. Rob

1 0

Co-located point of presence for 44net
by Tom C 25 Sep '16

25 Sep '16

Greetings. I'm somewhat new to the list and would like to join the network. I am not able to get a static address from my ISP, well I could, but I'd have to get a business account and my speeds would be a lot slower than they are now. I'm considering getting a VPS or a colocated raspberry pi to act as a vpn server and my point of presence to connect to my network via a tunnel. A rough ASCII diagram follows: (^^^^^^^^^^^^^^^^^^^^^^^^^^^^) ( IPIP/Tun0/VPN Svr <<--- ) ( Ieth0 RasPi in DATA CENTER) (vvIvvvvvvvvvvvvvvvvvvvvvvvvv) I (^^I^^^^^^^^^^) (^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^) ( Internet )====(>LinuxRouter/VPN/Tun0/eth2-->>44.98.63.0/29) (vvIvvvvvvvvvv) (vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv) I (^^I^^^^^^^^) (IPIP @ SDSU) ( 44/8 ) (vvvvvvvvvvv) My intent is to initilly have connectivity for a small LAN and then build it out over AX25 for my local area. I've run linux as my router/firewall (iptables and ipset) since 2012, but have not done much with "ip route" or "route", tunneling or anything with bridging but I did play a little with GRE and OpenSwan a couple of years ago. My thinking is building tun0/eth0 bridge and feeding that through the VPN to the distant RasPi which would vbidge the other end of the connection to the IPIP tunnel. So my question is this: Is what I want to do feasable as a way to get a static address and act as an AMPR gateway? Any suggestions, hints or approaches to prod me in the right direction to get me going would be appreciated. -- tom 73 de N2XU/Tom Cardinal/MSgt USAF (Ret)/BSCS/Security+/IPv6 Certified

1 0

New 44.0.0.0 /24 request
by John Ricketts 24 Sep '16

24 Sep '16

All, KD5ZZH here. I currently run an ISP (AS 62744) and I would like to provide an exit bridge to the public internet and link the Tom Green<x-apple-data-detectors://0> County, TX area as well. How does one go about getting a /24 out of the block? John Ricketts, PhD Quintex Alliance Consulting (325) 263-3488<tel:(325)%20263-3488>

3 3

ampr-ripd update 1.14
by Marius Petrescu 23 Sep '16

23 Sep '16

Hello all, It seems that the ampr-ripd daemon will be included into Debian by the DebianHams group. To be able to fit into an easy setup for all fellow hams, after discussions with Brian Kantor and Ana C. Custura taking care of packackaging it, we reached the following conclusions: - The RIP password was never actually meant as a security feature, more a validation mechanism - Everyone having access to the RIP data can actually extract the password by sniffing the stream - Since access to the network implies a gateway registration, and the RIP sources are well defined and restricted, the password could be ignored. Now, as a result of these discussions, I made some changes to the ampr-ripd daemon: - the RIP password is now included into the source file. The RIP data will continue to be validated against this password. - the password option can be omitted, but is still there for compatibility reasons and if it would be necessary to change the password at a later time - password discovery via debug mode still works - a man page for ampr-ripd was added (Tnx. Ana) You can get the updated ampr-ripd from: Internet: http://www.yo2loj.ro/hamprojects/ampr-ripd-1.14.tgz 44Net: http://yo2tm.ampr.org/hamprojects/ampr-ripd-1.14.tgz or from GitHub: git clone https://github.com/yo2loj/ampr-ripd.git Have fun, Marius, YO2LOJ

5 5

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net