- 44net - mailman.ardc.net

ideas to uutomatic updates of gateway file to Cisco Routers ?
by R P 12 Mar '16

12 Mar '16

Hi there My CS8251 works very well I need a idea how to make it get the Updated encap file automatically I do it now by Cut and paste but know that TFTP can do the job as well I need a solution that this can be done automatic (by batch or script) Any ideas , Solutions welcome Regards Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

5 12

Re: [44net] ideas to uutomatic updates of gateway file to Cisco Routers ?
by Assi Friedman 11 Mar '16

11 Mar '16

Ronen: Keep in mind that TFTP is horribly insecure and not very robust. It should only be used on local area networks. Assi -----Original Message----- From: 44Net [mailto:44net-bounces+assi=kiloxray.com@hamradio.ucsd.edu] On Behalf Of R P Sent: Friday, March 11, 2016 12:33 PM To: AMPRNet working group <44net(a)hamradio.ucsd.edu> Subject: Re: [44net] ideas to uutomatic updates of gateway file to Cisco Routers ? (Please trim inclusions from previous messages) _______________________________________________ I have made some tests with uploading config file to cisco in few ways The Telnet way is very slow it take to upload the whole gateways command about 5 minutes Today i have done config network (it is doing TFTP for the config file ) the whole procedure took 3 seconds The disadvantage that this way require TFTP server ... but i know it can be done with web also i will check tat too ... The script is also very simple all it have to do is to connect ... to wait for # prompt then to give the command conf network and to give some parameters such as the TFTP server address and file name and in the end to wait for OK When i will have fully automatic and running script (i will have to ask some of the local Script gurus to make it for me ) i will post it here and update the WIKI page Regards Ronen - 4Z4ZQ http://www.ronen.org

2 1

Re: [44net] need someone that use Cisco with Policy routing
by Jesse Hindmarsh 11 Mar '16

11 Mar '16

Ronen, Below is a code snippet I use on my AmprNet router to direct any traffic with a 44/8 source or destination address to use Tunnel1 as my default interface. This allows any non-44 sourced traffic to route back to UCSD. The “ip local policy” command tells the router to apply the route-map to any locally generated traffic. ip local policy route-map NET44-ROUTE-MAP interface Loopback0 ip address 44.56.193.1 255.255.255.0 interface Tunnel1 description Default AMPRNet tunnel ip unnumbered Loopback0 ip tcp adjust-mss 1360 tunnel source 24.229.88.253 tunnel destination 169.228.66.251 tunnel mode ipip interface FastEthernet0/1 ip address 44.56.192.254 255.255.255.240 ip policy route-map NET44-ROUTE-MAP duplex auto speed auto ip access-list extended NET44-PBR permit ip any 44.0.0.0 0.255.255.255 permit ip 44.0.0.0 0.255.255.255 any route-map NET44-ROUTE-MAP permit 10 match ip address NET44-PBR set default interface Tunnel1 Thanks Jesse - WC3XS On 3/11/16, 1:57 PM, "44Net on behalf of R P" <44net-bounces+jesse=hindmarsh.cc(a)hamradio.ucsd.edu on behalf of ronenp(a)hotmail.com> wrote: >(Please trim inclusions from previous messages) >_______________________________________________ >Hi there > >Is there any one that use Cisco as Gateway and use Policy routing for redirecting the 44 Net Traffic ? > >I would like to get the Policy routing lines and the access list that belong to it > >and also the static route command specially the one that refer to the default route and to the route to AMPR Gateway (the main 44 net router) > >I am writing in the ampr wiki page how to set up a gateway with Cisco Router and i cant succeed to make my policy route work correct and dont want to publish example that doesn't work > >Thanks in advance > >Ronen - 4Z4ZQ > >http://www.ronen.org > >Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> >www.ronen.org >ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com > > >

1 0

need someone that use Cisco with Policy routing
by R P 11 Mar '16

11 Mar '16

Hi there Is there any one that use Cisco as Gateway and use Policy routing for redirecting the 44 Net Traffic ? I would like to get the Policy routing lines and the access list that belong to it and also the static route command specially the one that refer to the default route and to the route to AMPR Gateway (the main 44 net router) I am writing in the ampr wiki page how to set up a gateway with Cisco Router and i cant succeed to make my policy route work correct and dont want to publish example that doesn't work Thanks in advance Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

1 0

Re: [44net] Is there raceroutre machine on 44 net available forpublic ?
by Rob Janssen 10 Mar '16

10 Mar '16

> We are not in a real mesh. We are in a star topology from each node. > A real mesh would mean that each node knows its neighbourgs (of course ) AND > is also > Able to handle traffic for its neighbourgs. That not the case if I'm right. This is not right, the IPIP network (at least when properly implemented) is a full mesh. All nodes can send traffic to all other nodes without having to rely on a central node or a neighbor other than the destination. Technically one can even send traffic to "the wrong node" and it might forward it to the correct endpoint, but that is not guaranteed to work because not all nodes allow that in their firewall rules. The only thing that operates in a star fashion is the distribution of routing information using RIP. It would be perfectly possible to setup a second node that sends this same information, to cover the case where that central node goes down and the other nodes gradually lose their routing info. Rob

6 7

Re: [44net] Is there raceroutre machine on 44 net available forpublic ?
by Rob Janssen 10 Mar '16

10 Mar '16

> And there comes nice feature > of ampr-ripd program by Marius YO2LOJ: > in case of missing or not broadcasted > RIPv4 transmission, it keeps LASTLY > received data, thus preserving routing table. But of course only for completely lost transmissions. Some time ago I was hunting a problem where I apparently had packet loss in RIP transmissions, likely because they are sent in a big burst and may overflow buffers or exceed rate limits somewhere. In that case I was randomly losing routes. I kind of fixed that by increasing the timeout on routes to two hours (default was much lower, 15 minutes I think). Also when something would break down that resulted in e.g. the RIP server sending only info about 44.0.0.0/8 in a single packet and not all the other gateways (e.g. due to an empty result from a database query due to some outside issue), the routes would still be lost. It is always difficult to prevent all possible mishaps. Sending updates from different sources will also not prevent all problems (after all there must be a single source of all the info that is being distributed, or we would be faced with two portal systems and the obligation to always register and update both). Rob

4 3

Re: [44net] OpenVPN
by Steve L 10 Mar '16

10 Mar '16

I haven't heard back from Tal. Is there anyone else who share the details on how to build the server keys so that they work with lotw client based certificates? Steve, KB9MWR >Hello, >The time here is 23:53 and i'm not next to my computer. >Tomorrow I'll send configuration file for the openvpn server and one to the >client, also i have script that generate key files & config files for >clients. > >Sorry that i can't send them now. > >Regards, >Tal. > >>Brian, thanks for the update. >> >>I know I asked before on how to build openvpn server keys and other >>configuration details that will let a openvpn server I build work with >>any hams lotw key clients that has previously documented: >> >>http://wiki.ampr.org/wiki/AMPRNet_VPN >> >>This is what I have built my own generated certificate authority, >>server keys, with before using the >> >>./clean-all >>./build-ca >>./build-key-server server >>./build-key client1 >>./build-dh >> >>I could really use something detailed on the values for the keys and >>certificates parameters to make a server work with the lotw based keys >> >>Its not clear to me where one gets the the LoTW root CA certificate(s) >>that need to be installed on the server. And I assume these are >>Diffie hellman parameters? >> >>Steve

1 0

Re: [44net] Documentation on the AMPRNet network
by Brian Kantor 10 Mar '16

10 Mar '16

I wish there were. There was an explanation in the NOSIntro book by Ian Wade which is out of print (but PDFs of it have shown up on line - for example, there is something at QSL.net, and it's available used from Amazon). There really should be an article in the wiki but no one has written it yet. - Brian On Wed, Mar 09, 2016 at 07:08:52PM -0500, Jerry Kutche (N9LYA) wrote: > Is there any reading material online for NET44 and how it works.. > Documentation, maybe also for the Ip Coordinator to gain a grip.. Thanks...

1 1

Re: [44net] FW: Making Packet Node with Pi ?
by Leon Zetekoff 10 Mar '16

10 Mar '16

I apologize to everyone been extremely busy and other things have cropped up taking my time away from pulling the tnc out. I'll definitely try to get it out this weekend and report back thanks 73 leon On 3/9/2016 7:10 PM, Assi Friedman wrote: > Hi Leon: > How much are you asking for the TNC? I assume this is the model consisting > of the TNC + the 9600 G6RUH card? > Thanks, > Assi kk7kx > > -----Original Message----- > From: 44Net [mailto:44net-bounces+assi=kiloxray.com@hamradio.ucsd.edu] On > Behalf Of Leon Zetekoff > Sent: Wednesday, March 02, 2016 4:23 PM > To: 44net(a)hamradio.ucsd.edu > Subject: Re: [44net] Making Packet Node with Pi ? > > (Please trim inclusions from previous messages) > _______________________________________________ > I have a paccomm 9600 which i really never used much way back when. I'd > unload it if anyone wants it. please contact me off list. > > Leon WA4ZLW > > On 3/2/2016 6:43 PM, Jerry Kutche (N9LYA) wrote: >> (Please trim inclusions from previous messages) >> _______________________________________________ >> Yes I have an SCS Tracker and yes it too can do 9600 baud.. >> >> A lot of miss information going on here... >> >> That's two TNCs... Still in production.... Any more probably... >> >> 73 jerry n9lya >> >> -----Original Message----- >> From: 44Net >> [mailto:44net-bounces+n9lya=uronode.n9lya.ampr.org@hamradio.ucsd.edu] >> On Behalf Of Bill Vodall >> Sent: Wednesday, March 2, 2016 6:18 PM >> To: AMPRNet working group <44net(a)hamradio.ucsd.edu> >> Subject: Re: [44net] Making Packet Node with Pi ? >> >> (Please trim inclusions from previous messages) >> _______________________________________________ >>> I'd LOVE a 9K6+++ modem but they just don;t seem to be available. >> SCS TNC tracker (http://www.p4dragon.com/en/Modems.html#widget4) and >> the sound card modes such as DireWolf and UZ7HO now claim to support >> 19,200 so 9600 should be doable. >> >> Bill, WA7NWP >> _________________________________________ >> 44Net mailing list >> 44Net(a)hamradio.ucsd.edu >> http://hamradio.ucsd.edu/mailman/listinfo/44net >> >> _________________________________________ >> 44Net mailing list >> 44Net(a)hamradio.ucsd.edu >> http://hamradio.ucsd.edu/mailman/listinfo/44net > _________________________________________ > 44Net mailing list > 44Net(a)hamradio.ucsd.edu > http://hamradio.ucsd.edu/mailman/listinfo/44net >

1 0

Re: [44net] Is there raceroutre machine on 44 net available for public ?
by Rob Janssen 10 Mar '16

10 Mar '16

> Even APRS would be useful for folks that have 44net services to share. > (Re-inventing bonjour/ZeroConf....) Perhaps this is a good reason to > revive the HTPP convsers server (IRC clone) and use it for > announcements like the DStar folks do with IRC technology. I think there would be some slightly different approaches: 1. a written announcement like writing "I have this nice webserver" on convers and requiring people to read the discussion there. of course this information will get lost over time as other services are announced there. 2. a more static approach like putting all available services on a WiKi page that can be edited by everyone. (possibly in a hierarchic way with a page linking to other regional pages) 3. an automatic system like bonjour where every active service is regularly announcing itself on the network and some page is dynamically updated when services appear and disappear. It certainly is something that is worthwhile to take up because it is a frequent question when having new users. "what can I find on the net and where" Rob

11 15

Re: [44net] RIP packet loss
by Rob Janssen 09 Mar '16

09 Mar '16

> Subject: > Re: [44net] Is there raceroutre machine on 44 net available forpublic ? > From: > Brian Kantor <Brian(a)UCSD.Edu> > Date: > 03/09/2016 02:37 PM > > To: > AMPRNet working group <44net(a)hamradio.ucsd.edu> > > > I've never found the cause of this; the rip sender would report protocol > buffer overflows and never has. The UCSD network can easily take the > amount of traffic that the rip transmissions constitute, and is not rate > limited, so I am led to the conclusion that the loss must be along the > transit path somewhere. Of course, being UDP inside IP, we don't get > notified of in-transit packet drops so it remains a mystery why this > is/was happening. Well, when you send a few thousand UDP packets from a fast system on a gigabit ethernet it does not really surprise me that there can be drops somewhere. Probably not within the fast infrastructure of a university network, but maybe further along the path. There could be queues on interfaces that are slower or loaded with other traffic and that drop some of the packets. At that time there was an obscure second transmission of the same RIP data and when that was dropped, the situation appeared to improve. The gateway where I was observing the problem is on a 100 Mbit line shared with several other systems, maybe the drops were occurring locally due to some rate limiting in place to achieve fair sharing of the bandwidth. I don't think I observed it on our gigabit connected gateway, that was installed later. You could put a small delay between sending the packets or after each small group of packets. Also when you are sending the series of packets to all the gateways, consider to make the inner loop by gateway and the outer loop by packet of the series, not sending all packets for 1 gateway first and then the series to the next gateway. The small delay could then be in the outer loop, and each gateway receives its packets somewhat spaced. Rob

1 0

amprnet routing
by Rob Janssen 09 Mar '16

09 Mar '16

> For a mesh this information gathering step can not be circumvented. Even if > we change routing protocols, you still need to know your peers BEFORE being > able to set up BGP or OSPF. > And if you know your peers, you can know their subnets, too. So there is > actually no need for a routing protocol running on a limited bandwidth > network, because the information is already there, in your peering data. Way back in the days of the previous packet radio network and NETCHL I started to code a solution for this. I implemented multicast in NETCHL and created a simple info protocol that multicasted information about the local system to address 224.0.1.31 port 1535 (look them up in DNS and /etc/services!) These announcements were sent with a TTL of 5 or so, so the neighborhood in the then existing IP/AX.25/NETROM network learned some details about the nodes, like the sysop call, the frequencies it was operating on, and the subnets it was serving. The info could be displayed when connected to the NETROM. The intention was to create an automatic IP routing protocol from there, and then replace IP-over-NETROM and plain connects over NETROM by an automatically routed IP network and a service to encapsulate plain user AX.25 connects (user1-node1-node2-user2) in TCP/IP connects between the nodes. (replacing NETROM) This never materialized, and in neighboring Germany a network was deployed (Flexnet) that stuck to the AX.25 routing, and it became quite popular. The author was not interested in IP at all. More and more operators wanted to switch to that network so further development on NETCHL was mostly halted. Of course, now this change has been made anyway (the network is IP with AX.25 running on top of it instead of under it), but quite some time has passed... Of course we could again embark on such a project, but there is always the issue of migration to a new method without breaking the whole network in the transition phase. Rob

1 0

Re: [44net] Is there raceroutre machine on 44 net available for public ?
by Rob Janssen 08 Mar '16

08 Mar '16

> 3-rd option is interesting. Just that there will be alot of opposition > from people worrying about 1 ping an hour should some multicast group > announcement and subscription messages appear on the network... No, it would work the other way around! Someone sets up a service on amprnet where services can announce themselves to be in the global directory of services. Anyone running a service who would want to be in that directory sends regular announcements to the central server, and those who do not want traffic simply don't annouce themselves and won't have any unwanted traffic. It can be really simple, any capable PHP or ASP programmer can write this in "one rainy sunday afternoon" as the saying is here. Of course to get it universally accepted is another matter. Design would be like this: Anyone who wants to announce their service makes a cron job that once per day posts a file to the central server (XML, JSON, whatever) using a simple call to wget or curl. The file contains the specification of the local services. It can be called manually whenever the file has been edited for quick update. The central server receives the posts (simple HTTP POST) and parses the data, if valid it creates one or more database records with services and sets the time it (last) received this announcement. The same central server provides an overview page (with search and/or selection options) that just dumps the contents of the database as a table. There is some expiration interval (a small multiple of the post interval, e.g. 3 days) after which records are deleted or no longer shown. This can also be a parameter in the selection. Bottleneck: convince everyone who provides some service on amprnet to write the corresponding XML/JSON file and setting up the cron job. Providing a working script callable by cron (i.e. the wget call with the proper parameters) will help. An indication how to write a properly formatted file and/or a tool to do this will also help. It can be made a part of www.ampr.org, for example. Then we can direct anyone there to lookup the service directory. Rob

2 1

Re: [44net] Is there raceroutre machine on 44 net available for public ?
by Rob Janssen 08 Mar '16

08 Mar '16

> Do you have any way to check connectivity and routing problem without doing at least ping and trace route ? > I dont know ... > Whats the point to put the encap file if you cant use it ? What you have just found out is that a network by itself may be fun to construct but is not very useful on its own. That has always been a weak spot of tunneling amprnet over internet: why would you want to do that, when you can just use internet. When you want to actually use amprnet you need some way to find public services that are of interest. Then you can try to connect those, and assume that the operators have no problem with visitors. That is something different than pinging or tracerouting everything in sight. For example, enter in Google: site:ampr.org hamradio Or some other keywords after that text "site:ampr.org" (without the quotes) That way you will find websites on ampr.org (as far as they are connected to real internet), and you may find interesting pages that tell you about other things available on amprnet. Rob

5 4

Re: [44net] Is there raceroutre machine on 44 net available for public ?
by marius 08 Mar '16

08 Mar '16

WW Converse is actually live and wll. Just more servers than users. Maybe it could be made more useful by association with some other populas service. Marius, YO2LOJ Sent from Samsung tablet. -------- Original message -------- From: Bill Vodall <wa7nwp(a)gmail.com> Date:08/03/2016 01:34 (GMT+02:00) To: AMPRNet working group <44net(a)hamradio.ucsd.edu> Subject: Re: [44net] Is there raceroutre machine on 44 net available for public ? ... Perhaps this is a good reason to revive the HTPP convsers server (IRC clone) and use it for announcements like the DStar folks do with IRC technology.

1 0

Re: [44net] Is there raceroutre machine on 44 net available for public ?
by Rob Janssen 07 Mar '16

07 Mar '16

> Subject: > Re: [44net] Is there raceroutre machine on 44 net available for public ? > From: > Antonio Querubin <tony(a)lavanauts.org> > Date: > 03/07/2016 08:52 PM > > To: > AMPRNet working group <44net(a)hamradio.ucsd.edu> > > > > You should NOT assume that all gateways actually have the entire mesh encap table loaded. Some only load a partial table to those networks they want to reach. You'd have to check with each gateway operator to verify which encap routes are > actually loaded if you can't reach any of the net-44 nodes behind their gateway. And of course the encap table does not tell you anything about which 44-net address is used by the gateway itself. So there is no way you can check if you can reach the gateway. (even if you would know the address of the gateway there is no guarantee that it will reply to detection attempts) It has already been made clear to mr "Please Advice" that lots of operators do not appreciate what he is doing. Unfortunately, he rarely listens to the advice he is constantly asking for.... Rob

2 1

Misconfiguration of gateway tunnel interfaces
by Rob Janssen 07 Mar '16

07 Mar '16

> Is there a amprnet wiki page with recommendations and notes on just > how to do this? It depends too much on the layout of your network and the equipment and software you are using how to do this. I normally use tshark (terminal version), unfortunately it can only display a condensed version of each packet that does not show how it is tunneled, or a way-to-verbose version where one packet takes up multiple screens full of data. The GUI version 'wireshark' can nicely fold and unfold all levels of detail but of course it is more difficult to run it inside a router or small Linux system used as a router. Rob

2 1

Re: [44net] Misconfiguration of gateway tunnel interfaces
by Steve L 07 Mar '16

07 Mar '16

I just use tcpdump: tcpdump -i eth0 -vvv host amprgw.sysnet.ucsd.edu or ip proto \\icmp tcpdump -vvv -s0 -n proto ipencap > I would recommend amprnet operators starting a network analyzer on your > network > (like wireshark) every time you have made a configuration change, added some > equipment, > or just have a few minutes of time to spend.

1 0

Re: [44net] Is there raceroutre machine on 44 net available for public ?
by Steve L 07 Mar '16

07 Mar '16

Ronen, Feel free to use mine: http://44.92.21.1/tools/ These tools reside on my gateway (IPIP not BGP) and it does have a DNS entry so it should be accessible from the world wide internet as well as 44net. I have a ip route lookup tool, so you can see what my local routing table has for a return route. 73 Steve KB9MWR >Hi there > >I have unexplained 44 net routing problem > >There are some gateways i can reach from my 44 net address and others not ... > >I can access any of my 44 net equipment from any non 44 net IP with no problem > >the Encap text is most updated.... > >The gateways i cant reach are accessible from their non AMPRNET side > >I need a tool (beside this one http://44.60.44.10 ) to be able to do traceroute and ping to me and > to other 44 net > >Is there anyone that have such a thing open for the public (or willing to give me access ) on his >machine (that sit on 44 net IP via tunnel (not via BGP) ? > >Please Advice > >Thanks Forward > >Ronen - 4Z4ZQ > >http://www.ronen.org

1 0

Re: [44net] OpenVPN
by Steve L 07 Mar '16

07 Mar '16

Thanks Tal.. I'll be looking forward to the email. It should help. >Hello, >The time here is 23:53 and i'm not next to my computer. >Tomorrow I'll send configuration file for the openvpn server and one to the >client, also i have script that generate key files & config files for >clients. > >Sorry that i can't send them now. > >Regards, >Tal. > >> Brian, thanks for the update. >> >> I know I asked before on how to build openvpn server keys and other >> configuration details that will let a openvpn server I build work with >> any hams lotw key clients that has previously documented: >> >> http://wiki.ampr.org/wiki/AMPRNet_VPN >> >> This is what I have built my own generated certificate authority, >> server keys, with before using the >> >> ./clean-all >> ./build-ca >> ./build-key-server server >> ./build-key client1 >> ./build-dh >> >> I could really use something detailed on the values for the keys and >> certificates parameters to make a server work with the lotw based keys >> >> Its not clear to me where one gets the the LoTW root CA certificate(s) >> that need to be installed on the server. And I assume these are >> Diffie hellman parameters? >> >> Steve

1 0

Is there raceroutre machine on 44 net available for public ?
by R P 07 Mar '16

07 Mar '16

Hi there I have unexplained 44 net routing problem There are some gateways i can reach from my 44 net address and others not ... I can access any of my 44 net equipment from any non 44 net IP with no problem the Encap text is most updated.... The gateways i cant reach are accessible from their non AMPRNET side I need a tool (beside this one http://44.60.44.10 ) to be able to do traceroute and ping to me and to other 44 net Is there anyone that have such a thing open for the public (or willing to give me access ) on his machine (that sit on 44 net IP via tunnel (not via BGP) ? Please Advice Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org

2 1

Misconfiguration of gateway tunnel interfaces
by Rob Janssen 07 Mar '16

07 Mar '16

> I've been observing the following: > a. - gateways sending RFC1918 addresses in the inside header (e.g. > 192.168.11.0/24) Unfortunately it is very common. Not only on IPIP tunnels but also on other connections we have (OpenVPN, IPsec tunnels, radio access points). Some weeks ago I mentioned it on the list, the sender claimed he would act on it, but it just continues. Unfortunately not many users understand iptables well enough to just block invalid traffic on their own gatewat and even fewer are actively monitoring their equipment so they would notice they are sending stuff like this and receiving "prohibited" replies all the time :-( I would recommend amprnet operators starting a network analyzer on your network (like wireshark) every time you have made a configuration change, added some equipment, or just have a few minutes of time to spend. It will teach you a lot and make the other operators happy. Rob

3 2

OpenVPN
by Rob Janssen 07 Mar '16

07 Mar '16

> Phil has dropped the project. I doubt he'll take it up again. > - Brian Why? It was quite easy to implement on our gateway. And I did some extra work to make it easier for me to maintain, else it would have been even simpler. Maybe there were other reasons? Rob

4 4

OpenVPN
by Rob Janssen 06 Mar '16

06 Mar '16

> I suspect they were personal reasons; Phil has retired from networking > entirely and between battling cancer and turning his remaining time to > teaching high-school students about science and engineering, I know he's > not interested in AMPRNet anymore. He said so when we had dinner a few > weeks ago. > - Brian I'm sorry to hear that... please send him my best wishes when you have contact with him. It is his work that made the AMPRNet possible in the early days... Rob

1 0

Re: [44net] OpenVPN?
by Steve L 06 Mar '16

06 Mar '16

About 5 years ago I thought I read that Phil Karn was working on getting OpenVPN implemented on the AMPRGW. Is there a status update on that? The reason I ask is once again, I have a situation where we could really use some sort of statefull way to connect some HSMM links. There is always a lot of arm twisting needed to convince folks who are donating us an internet connection that we need access to the firewall to forward ports for IRLP and the like. Steve

2 1

Cisco config questions
by Martin A Flynn 06 Mar '16

06 Mar '16

We are finally setting up the gateway at N2MO - the plan is to use an existing Cisco 2811 Integrated Services Router for AMPRnet. After reading the config notes at: http://wiki.ampr.org/wiki/Setting_up_a_gateway_on_Cisco_Routers , I had several questions 1) For the FQDN of the commercial internet connection, is there an accepted naming convention ? 2) Our 2811 ISR has both serial and Ethernet WIC (WIC-2T and HWIC-2FE). Is there any benefit to using the serial connection? 73 Martin A Flynn / W2RWJ Ocean-Monmouth Amateur Radio Club, Inc 2300 Marconi Road Wall Township, NJ 07719 Tel: +01 732-428-7373 Email: mflynn(a)n2mo.org Visit us online at: www.n2mo.org

2 1

Doing IPIP with Ubiquiti ?
by R P 06 Mar '16

06 Mar '16

Hi there I started to config my Bullet2 to be access point for delivering the AMPRNET to the HAMS and saw that there is tunnel and ipip in the commands Does it mean it support by default IPIP tunneling and can serve as Gateway ? I couldn't succeeded to find the correct syntax of the command whatever i have done it gave me error that something is "garbage" Please Advice Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

2 6

GRE over IPsec tunnel in Linux
by Rob Janssen 05 Mar '16

05 Mar '16

On our gateway system we try to offer tunneling technologies that are easily usable on the equipment the users have available. For example, we deployed OpenVPN because it is so easy for the users to install and use. For use on routers like MikroTik, IPsec is more convenient. We offer IPsec tunnels for subnets and individual addresses, in AH and ESP mode, and the latter also over NAT-T. A number of users have such a tunnel working over NAT-T without problem. We use setkey/racoon. To connect a radio network router that uses BGP to provide it with a fallback in case the radio network is down or when it has not yet been deployed, it is more convenient to use a GRE tunnel over IPsec transport. BGP can then consider the GRE tunnel as an alternative path. This is easily configurable on a MikroTik in ESP mode, but AH is also possible. (AH mode uses less CPU because there is no encryption, only authentication) After deploying some GRE over IPsec transport connections, of course the first site appeared who has the MikroTik router behind a NAT router which cannot be removed. GRE over IPsec transport does not work over NAT. So, I researched the matter and found that there are examples of the use of GRE over IPsec tunnel mode, which in turn can operate over NAT-T (when ESP is used). Of course terribly inefficient in terms of header size, but it should work. Ok, back to the configuration drawing board and implement this on the Linux gateway. I cannot get it to work. The whole IPsec tunnel is established correctly (of course, this already worked), I can add the GRE interface and make it use the tunnel, but when GRE traffic comes in on the IPsec tunnel it does not appear on the GRE interface. Which worked fine when using IPsec transport instead of tunnel. When I ping from the gateway to a connected test router (MikroTik), I can see the pings arrive on the GRE interface there, being returned to the gateway, arrive as ESP-over-UDP, matched in the firewall, sent to an iptables entry that matches on protocol 47, I can even dump them to the log with -j LOG where they appear: Mar 5 18:23:43 gw-44-137 kernel: [17858.781986] IN=eth0 OUT= MAC=00:0c:29:cc:5a:2a:dc:38:e1:f6:2f:f0:08:00 SRC=10.0.1.43 DST=10.11.12.13 LEN=148 TOS=0x00 PREC=0x00 TTL=255 ID=81 DF PROTO=47 The corresponding GRE tunnel with these addresses is present, it works in the outgoing direction, but not incoming. My guess is that it is a problem to match the SRC and DST addresses in an IPsec tunnel packet to the remote and local addresses of a GRE interface, and it never finds its way. Probably the wrong addresses are matched, the outside rather than the inside addresses of the IPsec tunnel. Does anyone have experience with this and know what might be the problem and how it can be fixed? The Linux kernel is version 3.2.0 (Debian Wheezy) in case that matters. Rob

1 0

Making Gateway with OpenWRT with home routers ?
by R P 05 Mar '16

05 Mar '16

Hi there Has anyone try or doing a Gateway with home router (like TP-LINK) that he has Flashed it to work With OpenWRT ? If yes how is are results ?can it hold the 520 Gateways routes on its memory and still function ? Please Advice Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

1 0

rip daemon update
by Marc, LX1DUC 05 Mar '16

05 Mar '16

Hello, I added 2 new gateways yesterday afternoon (static public commercial IP addresses, no firewall) but I'm still waiting to receive RIP broadcasts on those IP addresses. I think to remember that new gateway IP addresses are only added to the broadcast list every few hours. How can I verify that my gateways actually did make it into the list? 73 de Marc, LX1DUC

3 5

Making Packet Node with Pi ?
by R P 05 Mar '16

05 Mar '16

Hi there Is there a way to have a Packet Node with Pi (or any other small size solution that will not require a PC) ? If yes How do I connect TNC (serial port) to PI is the Pi support USB to serial external interface (like the profilic ones) ? Or (preferred) something can be done to do the TNC on Sound card (can be an External sound card that connect to the USB of the PI) Please Advice Thanks Forward Ronen - 4Z4ZQ jttp://www.ronen.org

17 30

Re: [44net] STAs
by Steve L 05 Mar '16

05 Mar '16

For anyone interested in considering a STA you should go to this site: https://apps.fcc.gov/oetcf/els/forms/STANotificationPage.cfm STAs are only good for six months, but they can be extended by filing another application. The filing fee is $60, and you will need your FRN and password to file it. It is not a simple process, but it is doable. You should have a narrative explanation of what you propose to do in PDF format to upload as an attachment as well as filling out the form completely. ________________________________ >Is this how STAs now work? > >When we were implementing packet radio in Canada in the late seventies, >American hams claimed that the STA process was slow and difficult, the >equivalent to getting an act through Congress that was difficult and slow > >Was this real at the time? Is it better now? > >I may have to go through this to push a new mesh protocol through as STA >(yah, gotta do my local exams first!) and what to know what I'll be up >against. > >- Richard > > >On 3/4/16 10:30 PM, ve1jot wrote: >> (Please trim inclusions from previous messages) >> _______________________________________________ >> +1 >> >> On 16-03-04 08:16 PM, kd6oat wrote: >>> (Please trim inclusions from previous messages) >>> _______________________________________________ >>> Regarding an STA for higher data rates experimentation: I would think a >>> well written proposal accompanied by the signature of a number of >>> licensed >>> operators willing to participate in experiments would go a long way. >>> Count >>> me in as one who would be willing to sign on. >>> Ken - KD6OAT >>> >>> On Thu, Mar 3, 2016 at 11:22 AM, Brian Kantor <Brian at ucsd.edu> wrote: >>> >>>> (Please trim inclusions from previous messages) >>>> _______________________________________________ >>>> In the FCC arena, one of the better ways to get technical restrictions >>>> removed is to apply for and operate under an STA - Special Temporary >>>> Authority, a document from the FCC that basically allows you to operate >>>> an exception to the normal rules. Typically the only requirement is >>>> that you make a good case for it technically and that you write up a >>>> report afterwards. In the past, STAs have been the basis for >>>> changes to >>>> the rules. Someone who writes well may want to consider submitting >>>> one to >>>> allow higher data rates based solely on bandwidth and then >>>> experimenting >>>> with it. >>>> >>>> Another possibility is to apply for a Experimental Radio Service >>>> license >>>> which basically allows you to do just about anything if you can make a >>>> good case for it. They used to be a little expensive and they require >>>> a written report on what you found out with your experiments but it >>>> does >>>> allow nearly anything you can think of. >>>> - Brian

2 1

TNC-Pi
by Rob Janssen 04 Mar '16

04 Mar '16

> Beyond what others have mentioned like the TNC-Pi (nice kit), using a $7 > USB soundcard and Direwolf will provide superior decodes. Yes, I wonder why on earth they use a hardware AFSK modem chip in that design... I can see a place for an adapter board that provides PTT keying, possibly isolated audio interface, etc for the Pi, but it should always just do A/D and D/A conversion of the audio and leave the processing to software. That works so much better, and it enables the development of alternative modem designs without having to change the hardware every time. Rob

2 1

Symbol rate
by Steve L 03 Mar '16

03 Mar '16

There were some attempts/news a couple years ago to modernize this: http://www.arrl.org/news/arrl-files-symbol-rate-petition-with-fcc http://www.arrl.org/news/arrl-s-symbol-rate-petition-nears-top-of-fcc-s-mos… The problem is it takes a very long time for the FCC to act on pretty much anything ham radio related. It took 3 years for the Mototrbo/TDMA rule change. Prior to that I recall the spread spectrum automatic power control rule change took about half that. I agree though, a STA is a good idea to make a case and bring the issue to the forefront. >In the FCC arena, one of the better ways to get technical restrictions >removed is to apply for and operate under an STA - Special Temporary >Authority, a document from the FCC that basically allows you to operate >an exception to the normal rules. Typically the only requirement is >that you make a good case for it technically and that you write up a >report afterwards. In the past, STAs have been the basis for changes to >the rules. Someone who writes well may want to consider submitting one to >allow higher data rates based solely on bandwidth and then experimenting >with it. > >Another possibility is to apply for a Experimental Radio Service license >which basically allows you to do just about anything if you can make a >good case for it. They used to be a little expensive and they require >a written report on what you found out with your experiments but it does >allow nearly anything you can think of. >- Brian > > >On Thu, Mar 03, 2016 at 07:42:09PM +0200, Demetre - SV1UY wrote: >> Not good for US though, "thanks" to FCC's 300baud symbol rate restrictions of HF.

2 1

DROWN attack
by Rob Janssen 03 Mar '16

03 Mar '16

portal.ampr.org and www.portal.ampr.org are listed (as the only hosts in ampr.org) as vulnerable to the DROWN attack published today. it is not a high-priority issue but it is a good idea to have a look and fix the software and/or settings. Rob* *

8 10

Re: [44net] Making Packet Node with Pi ?
by Assi Friedman 02 Mar '16

02 Mar '16

High speed packet radio collapsed at 9.6 kbps because hams were no longer able to hack modems into surplus land mobile radios. For the first time, one needed full channel equalization and plug and pray no longer worked. That was pretty much the end of packet radio circa mid 1990's. The only thing that survived was APRS which is based on cheap land mobile radios, PIC microcontrollers, and AX25/UI. Assi kk7kx -----Original Message----- From: 44Net [mailto:44net-bounces+assi=kiloxray.com@hamradio.ucsd.edu] On Behalf Of Mark Phillips Sent: Wednesday, March 02, 2016 2:19 PM To: AMPRNet working group <44net(a)hamradio.ucsd.edu> Subject: Re: [44net] Making Packet Node with Pi ? (Please trim inclusions from previous messages) _______________________________________________ According to the TNC-X website, John Hansen claims to be working on a 9K6 modem but that was quite a few years back and nothing has been heard since. I'd LOVE a 9K6+++ modem but they just don;t seem to be available. I've looked at quite a few of the old designs that came out of German and Slovenia back in the late 90's and early 2K's. They are either no longer available, require an SCC card to provide clocks etc, have no driver support any more or require firmware which is unavailable. Whilst the soundcard road is somewhat acceptable, a hardware modem can't be beat.. Mark NI2O/G7LTT

2 1

Re: [44net] Making Packet Node with Pi ?
by Assi Friedman 02 Mar '16

02 Mar '16

A few notes: 1) There is a TNC board for the RPi: http://tnc-x.com/TNCPi.htm and it supports stacking multiple TNCs on a single RPi. It's a pretty elegant solution. 2) The RPi has UART pins on the I/O connector. All you need is a RS232 to LVCMOS level converter. The only disadvantage to that is that you can only connect a single TNC unless you go to NETROM firmware on the TNCs. 3) Using USB<->RS232 converters should work but do yourself a favor and avoid any adapter that is based on the Prolific chipset. The number of fake Prolific devices on the market is unreal and their drivers are very suspect. Use FTDI based devices as they have done a good job of protecting their IP and maintaining a stable driver set for Windows and Linux. Assi kk7kx -----Original Message----- From: 44Net [mailto:44net-bounces+assi=kiloxray.com@hamradio.ucsd.edu] On Behalf Of R P Sent: Tuesday, March 01, 2016 10:25 PM To: AMPRNet working group <44net(a)hamradio.ucsd.edu> Subject: [44net] Making Packet Node with Pi ? (Please trim inclusions from previous messages) _______________________________________________ Hi there Is there a way to have a Packet Node with Pi (or any other small size solution that will not require a PC) ? If yes How do I connect TNC (serial port) to PI is the Pi support USB to serial external interface (like the profilic ones) ? Or (preferred) something can be done to do the TNC on Sound card (can be an External sound card that connect to the USB of the PI) Please Advice Thanks Forward Ronen - 4Z4ZQ jttp://www.ronen.org

1 0

Wiki page text format problem
by R P 02 Mar '16

02 Mar '16

Hi there Is anyone know why the Wiki Page behave different then a regular notepad or Wordpad ? The problem is mainly when i publish scripts it look different then it look if i see it in a notepad Please Advice Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

2 1

Network Monitor Of Gateways ?
by R P 01 Mar '16

01 Mar '16

Hi There Is there any Network monitor tool (like WhatsUp Gold) or HP Openview ) that someone run and monitor all the Gateways ? and available for the public to see the network status ? Long ago telneting to UCSD router to some port return status of ping to all the Gateway Any Way Im running WhatsUpGold for my purposes and u can add (if needed ) Gateways to monitor It can Even send Email of events like Down Up and much more it can be seen here http://4z4zq.no-ip.org:81/whatsup1.wup.cgi It require login name and password Just leave them blank This is what left from our Network that was working long ago hope soon it will return to operation About the Project Can be read here http://www.qsl.net/4z4zq/wlan.html 73;s<http://www.qsl.net/4z4zq/wlan.html> Ronen - 4Z4ZQ<http://www.qsl.net/4z4zq/wlan.html> <http://www.qsl.net/4z4zq/wlan.html>http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com <http://www.qsl.net/4z4zq/wlan.html> The Wireless Lan Project page - QSL.net<http://www.qsl.net/4z4zq/wlan.html> www.qsl.net For the Commercial companies. You have a wireless lan cards/equipment that you want to test ? we are ready to make cooperation on a NON PROFIT base

6 17

Re: [44net] Network Monitor Of Gateways ?
by Rob Janssen 01 Mar '16

01 Mar '16

> Is making 3Pings to about 400 Gateways worldwide from non AMPR IP to their AMPR ip every 5 minutes consider acceptable thing to do ? Please do not perform any coninuous monitoring or other probing of any other networks than your own without the explicit desire and consent of the operators of the other network. We are blacklisting all sources of unwanted monitoring and probing traffic like research scanners, shodan.io etc etc and I regularly send opt-out messages to those. Still we get over 1 megabit/s of such crap all day. Rob

2 1

Getting the encap file by FTP (or any other autometed way) ?
by R P 29 Feb '16

29 Feb '16

Hi there Is there any way to get the encap file with FTP or any automated way that a machine do it automaticly ? I want to upload my Cisco with updated encap file without doing it manually ? Please Advice Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org Ronen Pinchooks (4Z4ZQ) WebSite<http://www.ronen.org/> www.ronen.org ronen.org (Ronen Pinchooks (4Z4ZQ) WebSite) is hosted by domainavenue.com

2 1

Re: [44net] BGP stats for AMPRNet
by Rob Janssen 27 Feb '16

27 Feb '16

> No one has permission to announce that subnet. It is apparently > being announced by TINET in Italy. I shall have to write to them > to find out what's going on. It may be a mistake or it may be a > prefix hijack; it wouldn't be the first. > Thank you for calling it to my attention. Somehow our BGP monitoring > missed it. I have 4 snapshots of the BGP routed subnet situation here, and this entry is present in all of them. It apparently is not a recent change. ampr/bgpnets-201406:44.68.52.0/24 ampr/bgpnets-201406:44.68.52.0, 44.68.52.255, "AS12637 Seeweb s.r.l." ampr/data-add-ARIN-201508: 12637 44.68.52.0/24 ampr/data-add-ARIN-201512: 12637 44.68.52.0/24 ampr/data-add-ARIN-201601: 12637 44.68.52.0/24 Rob

6 15

Re: [44net] BGP stats for AMPRNet
by Charles Hargrove 26 Feb '16

26 Feb '16

Tom, Could you tell me who has the 44.68.52/24 subnet? I am the coordinator for 44.68/16 (NY State) and I have not issued anything in that range. On Wed, February 17, 2016 6:50 pm, Tom Hayward wrote: > route-views>show ip route 44.0.0.0 Routing entry for 44.0.0.0/8, 74 known > subnets Variably subnetted with 8 masks ... > B 44.68.52.0/24 [20/10] via 89.149.178.10, 3w5d -- Charles J. Hargrove - N2NOV NYC ARECS/RACES Citywide Radio Officer/Skywarn Coord. NYC-ARECS/RACES Net Mon. @ 8:30PM 147.360/107.2 PL http://www.nyc-arecs.org and http://www.nyc-skywarn.org NY-NBEMS Net Saturdays @ 10AM & USeast-NBEMS Net Wednesdays @ 7PM on 7.036 Mhz USB/1500 hz waterfall spot; Olivia 8/500 check-ins "Information is the oxygen of the modern age. It seeps through the walls topped by barbed wire, it wafts across the electrified borders." - Ronald Reagan "The more corrupt the state, the more it legislates." - Tacitus "Molann an obair an fear" - Irish Saying (The work praises the man.) "No matter how big and powerful government gets, and the many services it provides, it can never take the place of volunteers." - Ronald Reagan "We are fast approaching the stage of ultimate inversion: the stage where the government is free to do anything it pleases, while the citizens may act only by permission." - Ayn Rand

3 2

Re: [44net] Looking for Net/Rom Node
by William Lewis 26 Feb '16

26 Feb '16

Yes, I run a gateway and also 2 RF NetRom RF Radio ports. Bill / KG6BAJ At 01:33 PM 2/26/2016, you wrote: >(Please trim inclusions from previous messages) >_______________________________________________ >Is there anyone who operate on his gateway NEt/Rom Node that connected >also to Radio Port ? >Or those days of the Packet has gone and replaced with high speed >WIFI links only ? > >If there is still someone with Net/Rom I would like to try and connect >to him >Thanks Forward >Ronen- 4Z4ZQ >jttp://www.ronen.org > > > >_________________________________________ >44Net mailing list >44Net(a)hamradio.ucsd.edu >http://hamradio.ucsd.edu/mailman/listinfo/44net

1 0

Re: [44net] NTP server for 44 Net ?
by Brian Kantor 26 Feb '16

26 Feb '16

> >Is there any NTP in the 44 net ? It occurs to me that you'd get better results using a non-44 NTP service such as pool.ntp.org, as the traffic wouldn't have to travel over your tunnel with its variable delays and congestion. Likely it's a better stratum as well. - Brian

2 2

Re: [44net] NTP server for 44 Net ?
by Rob Janssen 26 Feb '16

26 Feb '16

> I've heard about some other NTP server on AMPRNet but I don't remember > their IP. We are running NTP on 44.137.0.1 Stratum 2, offset well within 1ms. Rob

1 0

Re: [44net] Example of nodes monitoring
by Rob Janssen 26 Feb '16

26 Feb '16

> Subject: > Re: [44net] Example of nodes monitoring > From: > lleachii(a)aol.com > Date: > 02/26/2016 04:02 PM > > To: > 44net(a)hamradio.ucsd.edu > > > I'm not sure if your solution if free; I use Cacti on Ubuntu: We use Nagios+Nagiosgrapher for monitoring and graphing, and also Cacti for switchport traffic graphing. At the moment someone is experimenting with Zabbix as an alternative solution. For monitoring the routers I am also looking at MikroTik's "the Dude", but I am not yet sure if it is useful. In Nagios we have 114 hosts and 297 services being monitored. Rob

1 0

Re: [44net] Example of nodes monitoring
by Steve L 26 Feb '16

26 Feb '16

Thanks for the info. I had not heard of mutiny before. I have played with Cacti though. A couple years back I tried to nmap all the connected address space to get an idea of what is out there: http://www.qsl.net/kb9mwr/wapr/tcpip/amrprnet-nmap-2014.txt Looking back I feel a bit guilty about doing this as some of the radio links are slower ones. I wish under the gateways tab of the portal there was a check box to signify 1200 baud or hsmm. Of course I wish a lot of things. I had a script grab an encap file and merged that with the 44 BGP list and had a script incrementally nmap each connected subnet.

2 1

Example of nodes monitoring
by Jean-Marc Magnier 26 Feb '16

26 Feb '16

Hi, For those interested, the following link shows how can be monitored nodes/gateways. http://44.151.178.254/views/index.do?view=cvwg Only hardware is monitored. 73 de F1SCA

3 4

split subnet
by Tal Raveh 25 Feb '16

25 Feb '16

Hello, I got subnet 44.138.2.0/24 Can I split it to few defrent subnet ( i have few locations) ?ind it in my portal something like: 44.138.2.0/29 (which give me 0-7 ) 44.138.2.8/29 (which give me 8-15) in the portal I can take my full segment. another question, where can I enter dns record ? ( I can't see it in my portal). Best Regards, Tal Raveh 4z7tal

2 3

Making Gateways With Home Routers ?
by Rob Janssen 25 Feb '16

25 Feb '16

> I'm testing this with Marius...the script is cpu intensive and most > likely not a candidate for a MIPS type processor. I'm testing with a > 1200mhz celeron (old watchguard hardware since cpu) and it goes 100% Ok... is there any obvious reason why this would happen? It did not appear to be all that complicated, and it is scheduled as a repeating job so even when it uses some resources for some time it should be idle most of the time. I have no immediate intention to use it. Marius also suggested the use of metarouter, but of course this does not make things easier for those users who want a simple system. (with 2 different environments to configure and the need to have either binary compiled ampr-ripd or a cross-compilation environment on a PC or similar) After all, the Raspberry Pi may be the simpeler solution :-) Rob

1 0

where can i find Startampr ?
by Tal Raveh 25 Feb '16

25 Feb '16

Hello, From where can i download Startampr? regards, Tal 4z7tal

1 0

Re: [44net] Making Gateways With Home Routers ?
by Rob Janssen 25 Feb '16

25 Feb '16

Sorry for the layout mess in the previous post!! > I saw that Microtik Routers support IPIP by default > Is it possible to make a gateway with home routers ? > If yes how to deal with 300 tunnels lines to the rest of the gateways on the net ? will a home router have enough memory for that ? Look what Marius posted yesterday. He has made a script for MikroTik routers that updates the configuration using the AMPR RIP transmissions! This is a very nice solution because it will receive all current routes automatically without requiring an external computer. MikroTik routers are very versatile. They can run user-written programs (scripts) to do things like this. I have a MikroTik RB2011UiAS-2HnD here, which would classify as a home router. It has 128MB RAM and 128MB flash which is more than enough for this purpose. I paid 125 euro for this nice box. They also exist in rackmount version, and we use these in our digital network. And they have a nice web interface that actually is usable also for advanced things. (contrary to some other manufacturers products where the web interface is only for rudimentary tasks and advanced things are only possible via the command line) I have no experience with the script that Marius posted yet, as I do not run IPIP here at home, I use IPsec VPN from the MikroTik to my Raspberry Pi in a datacenter which does IPIP. Notice that for best results (and less headaches) you need to put this router directly on a public IP, not behind a provider-supplied router that does NAT. Either put the provider router in transparent (bridge) mode or omit it completely. (depending on what connection you have) Rob

4 4

Re: [44net] Making Gateways With Home Routers ?
by Rob Janssen 25 Feb '16

25 Feb '16

> I saw that Microtik Routers support IPIP by default > Is it possible to make a gateway with home routers ? > If yes how to deal with 300 tunnels lines to the rest of the gateways on the net ? will a home router have enough memory for that ? Look what Marius posted yesterday. He has made a script for MikroTik routers that updates the configuration using the AMPR RIP transmissions! This is a very nice solution because it will receive all current routes automatically without requiring an external computer. MikroTik routers are very versatile. They can run user-written programs (scripts) to do things like this. I have a MikroTik RB2011UiAS-2HnD here, which would classify as a home router. It has 128MB RAM and 128MB flash which is more than enough for this purpose. I paid 125 euro for this nice box. They also exist in rackmount version, and we use these in our digital network. And they have a nice web interface that actually is usable also for advanced things. (contrary to some other manufacturers products where the web interface is only for rudimentary tasks and advanced things are only possible via the command line) I have no experience with the script that Marius posted yet, as I do not run IPIP here at home, I use IPsec VPN from the MikroTik to my Raspberry Pi in a datacenter which does IPIP. Notice that for best results (and less headaches) you need to put this router directly on a public IP, not behind a provider-supplied router that does NAT. Either put the provider router in transparent (bridge) mode or omit it completely. (depending on what connection you have) Rob

2 1

RIP broadcast based AMPR gateway script for Mikrotik routers
by Marius Petrescu 25 Feb '16

25 Feb '16

Hello, For thos who like experimenting... I managed to implement the complete AMPR gateway tunnelling setup on a Mikrotik router by a scheduled script on the router only. Tested on my RB100AHx2 with ROS 6.34.2 You can find it on http://www.yo2loj.ro/hamprojects/ Direct link: http://www.yo2loj.ro/hamprojects/ampr-gw-1.0.txt Setup details are in the initial comments of the script. Enjoy. Marius, YO2LOJ

2 6

Re: [44net] RIP broadcast based AMPR gateway script for Mikrotik routers
by Rob Janssen 25 Feb '16

25 Feb '16

> I managed to implement the complete AMPR gateway tunnelling setup on a Mikrotik router by a scheduled script on the router only. That is a great idea Marius! Using that method to get the RIP data is much better than trying to download and parse the encap file. Maybe we can try again to convince MikroTik to implement mesh IPIP (I know you have tried in the past), because with this method we don't need to convince them to include ampr-ripd as well. With this method and multipoint IPIP in the router you would have the ideal combo to run amprnet on a commercial router. Rob

6 6

Re: [44net] Cisco router Config File for use as Gateway
by Rob Janssen 23 Feb '16

23 Feb '16

> If anyone needs assistance with a Cisco config, let me know. Out of curiosity (I have no intention to run a Cisco as an IPIP gateway): Did you write a script that finds the minimum config changes to go from one encap file version to the next? (that is, change existing tunnel endpoint addresses, delete tunnel interfaces, add new tunnel interfaces, delete routes, add routes) Or do you generate a fresh config from the encap you downloaded and just reload the router from that? And, how often do you download the encap and update the router config? Rob

1 0

Re: [44net] Cisco router Config File for use as Gateway
by Rob Janssen 23 Feb '16

23 Feb '16

> I have some questions (most are not technically) > 1)how much downtime you had lets say the last year (i mean downtime not because of server upgrade) i mean because server failure or software failure Nearly zero, as far as I am aware. We were offline for about 20 minutes because of the installation of the second machine that required everything to be moved and that did not go as planned because the server rack mounting rails did not fit and a solution had to be found. Last night there was router maintenance in the datacenter and we were offline for a few seconds for the VRRP (I think) switchover. This means a few alerts appeared in our monitoring. But normally we are always on. The mobile device Echolink traffic of half the globe passes through this server... (we are hosting the Echolink Relays 44.137.75.240 - 44.137.75.249 and 200 Echolink Proxy servers) > 2) where do you get budget for buying such a server and hosting at ISP farm is it a donation ? or the amateur pay this? We get the machines for free, they are left-overs from datacenters that get donated to us via amateurs working in that business. Those companies replace their servers after 3 years or so, and they are still in good condition to use. The ISP XS4ALL generously gives us the BGP announcing for free, there are radio amateurs working there who arranged this for us. Other running costs are covered by donations from amateurs. We run a lot of services that the amateur community appreciates, like a country-wide 2m and 70cm FM relay with 3 co-channel transmitters on high sites and 17 receivers spread over the country. It attracts a lot of activity, you can talk to anyone here on 70cm with just a portable from most locations. Also relays for DMR, D-Star, ATV etc. The amprnet is used as a network for that. Of course the work hours are free :-) But of course those in the team always pay a lot of the small costs, which add up as well. Fortunately the team is quite large. You can find some detail at our website http://hobbyscoop.nl/ At the moment this is only in Dutch, of course you can visit it via Google Translate. > and after all i solute you for all the services you provide there (im now trying to connect our only P25 repeater to a world wide network) its consider minor to what you do there . I am interested in that as well... we do not run P25 here I think, what network is that? Does it use some form of VPN to secure the connection? (usually this is done because those devices are not hardened enough to put directly on the internet of today) Of course everyone experiments with the things he is interested in and can collect the resources for. So I really encourage you to do experiments with what you have available! (except trying to make a fully functional IPIP gateway with a Cisco router... but that is my personal opinion:-) Rob

5 10

Re: [44net] Cisco router Config File for use as Gateway
by Rob Janssen 23 Feb '16

23 Feb '16

> What happned if I want to connect your DMR repeaters to ours (we have one DMR connected to the MARC network) and my DMR sit on Non AMPR adress ? I am not an expert on the DMR network, but I think it works with a "master" server that everyone connects his repeater to. We are running the BrandMeister master server. It is not the MARC network, it is an open network. (a 3rd network exists, it is called DMR+ ) Our new master server (currently being setup) is dual-homed, it has both an AMPR and a normal IP address. However that does not really matter as our AMPR addresses are BGP routed on internet as well. > as for the P25 it is a solution that was done by by few hams last year it consist of a server software Free one (i know of only one server currently and there are about 13 repeaters connected world wide ) you can read it herehttp://communications.support/threads/4798-IP-link-Quantar-V-24-systems-using-Cisco-routers Ok, it apparently has a serial port and the Cisco routers are used to tunnel that over IP. Nice when you already have them, if not I would go for a Raspberry Pi and a USB Serial cable. Much cheaper, much more power efficient. A 2600 or 2800 can do more useful things than working as a serial server, but of course it can do this and routing in parallel. The DMR and D-Star repeaters have an ethernet connection so they are easier to integrate with the network. We also have some Yaesu System Fusion repeaters (they are cheap), but this is crap. No network interface. They require a separate box to interface to the outside world. This still has no network interface, it has USB. Then you need a computer with USB and network to connect it. But this computer has to run Windows :-( Not good for a repeater site... And the whole thing is far, far from finished. Updates to implement even basic functionality are being promised and then being postponed all the time. I think it will not be usable before some amateurs roll up their sleeves and re-do the entire software, much like DMR+ and BrandMeister. > I still didnt leave the Cisco Gateway idea i will get tomorrow hopefully Cisco 2800 and see if it can work with 300 Tunnels if not it will go to the P25 connection Project Please understand that (also written by Brian in the meantime) that your router will never be able to perform this task standalone, you will need to have a second computer that is reconfiguring the router all the time, for every change in IP address of a gateway or other change in the gateway list you will need to make a config change. A good script can do that automatically, but you will need something like a Raspberry Pi to run it on. And the Raspberry Pi can do a better job itself, because it can track the AMPR RIP packets and does not need to download the encap file all the time. > however some good guy saw my request on the local hams facebook about the Pi Board (with the link you provided) and willing to give me a configured board for tests , if it will be reliable it tern out that ill leave the cisco idea Reliability will not be a problem (unless you have a bad SD card or bad powersupply). The only thing to worry about is if you can sysop the system on the long run. I.e. install updates sometimes, configure firewall rules as needed, etc. This will require some study but it is part of the fun, I think. > one more question (Personal one) are you the Rob Jebsen who was involved in the Jnos Software long ago ? I think I used one of your Jnos version the call sign was PE1CHL in the Days that our gateways was a Jnos/Dos Yes I am the same person, see mail address. I was not active with JNOS but I maintained a version of KA9Q NET that was used on many hybrid IP / NET/ROM nodes and BBS systems. I still run that program on the hosted Raspberry Pi that is also my gateway. Rob

1 0

Cisco router Config File for use as Gateway
by Rob Janssen 23 Feb '16

23 Feb '16

> I'm trying to understand why you change the net so I need separate tunnel > to every GW. > In this case what are the benefit of using 44 net instead of "regular" ip ? > i think that adding some main GW (maybe main router to each country ) and > by that add the connectivity to 44 networks easily and every endpoint will > take care to single tunnel. That is exactly what we did here in the Netherlands. We put a machine in a datacenter that serves as an IPIP gateway for 44.137.0.0/16, and everyone who is interested in a simple tunnel can get a connection to there using one of the VPN techniques that are more in use today: OpenVPN, IPsec tunnel, GRE over IPsec transport, or also IPIP. And, this system routes towards the radio network that is in quick development right now. (Ubiquiti and MikroTik equipment for 6cm) The provider XS4ALL that hosts this system also advertises the 44.137.0.0/16 space on their routers using BGP (in close cooperation with Brian Kantor), and they statically route this traffic to the machine. So we are directly reachable from Internet as well. We explicitly chose this method because we are no experts on Internet BGP and those people at the provider are, it is their daily business. We run BGP on the 44-network as well (the radio side), but that is a different thing. There is no BGP communication across our gateway. The machine is a HP Proliant DL380 server so it is not as failure prone as the home PCs that Ronen has used. And just this weekend I have migrated it to a newer HP server that we installed with VMware ESXi on which this is one of the Virtual Machines, now we will soon install VMware ESXi on the old machine as well and we will have failover capability (manually operated cold standby, for now). We also host Echolink Proxy and Relay servers and several services related to the new digital modes, like a BrandMeister Master server, D-Star reflectors, etc, on other Virtual Machines on the same server. Of course the advantage of an IPIP mesh direct to every gateway is that there is no central point of failure. When our gateway is down, we mostly become isolated. When a gateway serving only a local subnet would be down, the other gateways can still communicate amongst eachother. That is one reason that architecture was chosen. This has not "changed". It has always worked like this. However, not everyone has understood that, and they believed that they could just send all traffic to the UCSD gateway (which is the gateway for the entire 44.0.0.0/8 subnet towards internet), and it would forward it to the proper destination. That was always a bad thing to do, because you would load that single system with all the traffic. But it worked. Now it does not work anymore and you have to do the right thing: route the traffic to where it has to go. This of course also means it will work better, because when you send traffic to a regional system it will no longer travel via California, and you will have a much shorter delay. Using our architecture it is still possible for a Dutch station to setup IPIP routing for their local subnet, because they will just become part of the IPIP mesh and the Dutch gateway is also part of that mesh. Traffic will still flow correctly. However, it is no longer a good idea to run IPIP on a regional gateway (as someone asked for this weekend), because the individual VPN routes are not known to that gateway and the routing for those will break. Therefore we route those regional gateways using BGP (on private AS numbers) so they receive all routing information dynamically. For that, they are connected to the gateway using GRE. (the situation was explained off-list to the one asking here) Of course setting this all up requires a bit more knowledge of routing and a lot more perseverance than configuring a simple IPIP gateway on a Raspberry Pi. Linux routing is really powerful, also when compared to the most established professional routers. But you have to read documentation, sometimes written by Russian and Japanese volunteers and researchers, not having English as their main language (just like me). It can be challenging, but I thing it is very rewarding to get it operating perfectly. It is like building your own station for amateur radio: some people like to build from small parts, others from a kit, and some like to buy a shiny box. They all enjoy the hobby, but building from small parts is not for everyone. To me, finding out how to do it is a big part of all the fun, and the end result ("what are the benefit of using 44 net instead of "regular" ip ?") is much less important. That is why I do not always understand those that just want directions on how to do it and copy what someone else has tinkered with. Sure it will bring you online quickly, but then leave you with the question what to do next. Rob

2 1

Re: [44net] Cisco router Config File for use as Gateway
by Rob Janssen 23 Feb '16

23 Feb '16

> Of course that following should be a route command for every 44 net gateway No... A separate "interface Tunnel" command for every 44 net gateway, and a separate route command for every subnet routed via those gateways. In all, you will need 324 "interface Tunnel" commands (each with the 5 subcommands) and 512 "route" commands to describe the IPIP network as it is today. Your 1005 router has not enough memory capacity to hold all that. I could understand you when you had a 3800 series or similar. But this one... really no! It has been end-of-life for over 10 years and it really is not up to par for this kind of job. (if any Cisco is, because this is a job not suited for general-purpose routers) Rob

3 2

Re: [44net] route lines from encap file for CISCO Router
by Rob Janssen 22 Feb '16

22 Feb '16

> I relay don't know why you are so objecting a gateway with CISCO > I used to work a lot with Cisco when i have worked at the System team of Israel largest ISP . Because a Cisco is not suitable for setting up an IPIP gateway. It is reliable, but it cannot do this job. It can do other jobs but that is not relevant. You would not recommend a truck when someone asks what car to use to get to the office, either. > Indeed it is much more complicated these days that UCSD dont do anymore 44 net forwarding and a routing line needed for every gateway .. This is crucial. And also, the fact that more people now use dynamic addresses. > I get a very reliable solution with Zero money (my Cisco 1005 was taken from the trash cost me nothing) I recommend you to put it back there... and I think most people here will agree. The Raspberry Pi was developed 15 years after this box, has a 10 times faster CPU, 10 times more memory and uses a lot less power. (and costs less than a 10th of what this thing must have cost when it was new) > However im willing to listen to your advice and test the Rasberry Pi > If there is someone here that can direct me step by step until a working system and then i may consider testing it As I said, it can be found on www.ampr.org More specific, on this page: http://wiki.ampr.org/index.php/Ubuntu_Linux_Gateway_Example I have a Raspberry Pi running as a gateway for over 2.5 years now and it has been without any problem. It has never crashed. Good, because I have never touched it nor ever seen it. It has been mail-ordered and directly sent to a datacenter where it was powered up may 25, 2013 and has worked ever since (of course sometimes rebooted for updates). The above example was written by someone partly drawing from the example configuration I posted on this mailinglist some years ago. > Im not familiar with what have been told about the multi tunnel that a Cisco can not do ... (actually im not understand what the problem or the limitation is ) It is clear from your posted example (btw, it is not a good idea to post Cisco config files because now everyone can log in to your router, the passwords are in the config!). In a Cisco, a Tunnel interface has a "tunnel destination". One. But there are 324 tunnel destinations in the network. So you need 324 tunnel interfaces. In Linux, a single tunnel interface can serve as many destinations as you want, by setting a route with a nexthop that serves the function of the "tunnel destination" in Cisco. Every route has its own nexthop (gateway). And this route table can be updated automatically with ampr-ripd, so you never need to download any encap file. > I know that at least two gateways are running and operating currently with CIsco But most likely not a 1005! Rob

3 2

Re: [44net] route lines from encap file for CISCO Router
by Rob Janssen 22 Feb '16

22 Feb '16

> Hi there Cisco Gateways operators > Has anyone of you a Mechanism that take the encap fiile which is not a Cisco route routing line syntax and makes from it route lines for Cisco ? A Cisco cannot use route lines to operate a multipoint IPIP encap interface like Linux can (and JNOS). Marius has already explained that yesterday. I know it may be a disappointment to you, but your Cisco router really is not a good choice for use as an IPIP amprnet gateway. A Raspberry Pi will be much easier to get going, especially when you are not a software guy. And it will perform better in the real world where some people are on dynamic addresses, because the nice ampr-ripd software that Marius has written will automatically maintain the routes immediately when they are changing, instead of the oldfashioned method of downloading an encap file. (directions can be found how to do this on www.ampr.org, that you just need to copy and modify the IP addresses) Rob

3 2

Pings from 44.151.178.254
by lleachii＠aol.com 22 Feb '16

22 Feb '16

All, Is anyone else receiving pings from 44.515.178.254? Approximately two echo-requests are received every 2-5 minutes. - Lynwood KB3VWG

3 3

Pings from 44.151.178.254
by Rob Janssen 22 Feb '16

22 Feb '16

> Approximately two echo-requests are received every 2-5 minutes. I would not notice them in the 2 megabits/second of crap coming in all day... And certainly not worry. Rob

1 0

Configure tunnel on Pfsense
by Tal Raveh 22 Feb '16

22 Feb '16

Hello, I'm trying to configure my gateway to 44 net on my pfsense FW. I configure GRE tunnel: Remote tunnel endpoint IP address:169.228.66.251 Local tunnel IP address: 44.138.2.254 (my segment is 44.138.2.0 ) Remote tunnel IP address: 44.0.0.0/8 Mobile encapsulation: check (also try to unchecked) The firewall is open but i cannot ping any address on 44 net. any idea? Best Regards, Tal 4z7tal

6 5

ICMP: A small request
by Marius Petrescu 21 Feb '16

21 Feb '16

Since we are trying to tackle connectivity problems a lot of times, could you please enable ICMP replies on your gateways, at least for other 44net requestors? It will certainly not ruin the gateway’s safety and security and would help a lot other OMs. Tnx, Marius, YO2LOJ

4 3

another OpenWrt gateway
by Daftcho Tabakov 21 Feb '16

21 Feb '16

Hi, I have tried to put my gateway in a new box - my tp-link 1043 nd router. I used to use an old pc with Debian for this purpose. I followed this wiki article http://wiki.ampr.org/index.php/Setting_up_a_gateway_on_OpenWRT and i can ping to different 44net IPs from the router's console. The gateway's IP is 44.185.22.1 аnd I would someone to test if it is reachable. I am also a little bit confused how my other devices will connect to the gateway. There was a pptpd server on the pc and it was easy. Now there is another VLAN on the router and I assume that I need to configure some of the lan ports (the switch) to use this new VLAN. This is good for the local connections. Can I use again pptpd and connect to my gateway from Internet like I used to do? -- 73! Daftcho, LZ1DAF

5 9

Re: [44net] DNS cleanup
by Rob Janssen 20 Feb '16

20 Feb '16

Arno Verhoeven wrote: > I just want to add 44.137.24.0/22 to a gateway but noticed that it had > been deleted from my list of allocations. Please don't route regional subnets this way anymore. because then it can be reached both over radio and via the gateway. It is now routed with BGP to PE1RDP who will route it to the access point until arrangements have been made for a more direct routing. IPIP is still available for user subnets when you wish to route a network. > In its place I now have 44.137.27.193/32 in my allocation list. Which is > strange because I never requested it and it is a single host assigned to > someone who has his own gateway. This was probably a copy/paste error made when updating the portal entry. I have corrected it (it belongs to PE5YES) Rob

1 0

Re: [44net] DNS cleanup
by Rob Janssen 20 Feb '16

20 Feb '16

> Prior to flaming me, perhaps you should get your facts straight? > I have done several maintenance jobs and bug fixes on the Portal over the past couple of years, as and when they are reported to me. I’m working on a new feature right now that was requested. > If you have a problem you only need to contact me and ask for assistance, but I am not good at reading minds I’m afraid. > As for the DNS code in the Portal, it has been ready for over a year now, but Brian wanted me to hold off making it live until the current DNS can be cleaned up - hence this push to do just that. > As to your other comments regarding how the portal operates, that’s your opinion, which you are entitled to, but I originally wrote the code based on requirements and input from other folk, I didn’t just “make it up” myself. > Of course, if you want to offer your time re-write some of the code, or add new functionality then please lets talk, I’ve been asking for help on this for some time now, but apart from Tom who kindly provided (and still provides) the Polish translation, no-one else has done anything. And before anyone goes on about “open source” again, the code IS open source to the amateur radio community, just not the general public as it doesn’t need to be, if you want access to the code repository you only need to ask and it will be provided. Chris, I have brought up the topic of (impossibility of) editing subnets a long time ago. I have also reported the problem with registration of existing allocations (the user cannot specify what they want to register, only request a new allocation), and requested a way to delete open requests that cannot be completed. And a few months ago I requested that, facing the impossibility to delete a subnet without also deleting all its children and realizing that adding this may be nontrivial, you manually delete the 44.137.24.0/22 subnet that was erroneously created long ago, without deleting the subnets that are now under it. Apparently in the requirements and input you received the migration of existing allocations was not included. I seem to remember that this has been discussed and apparently it was downplayed as not important, but I don't agree with that. In my opinion, it should be possible to migrate existing allocations to the portal system when the holder desires to do that. Without such functionality, we cannot request all the existing users to register themselves and find out what to do next. I am doing a lot for the local amateur digital network here, and I have to select what other projects I join. I cannot be active in all of them. You have to understand that, contrary to some other areas, we are actively developing and using the network, and we require a system that works for us. So until now we have chosen to not register all the IP allocations via the portal, but only the required minimum that is the IPIP tunneled space, waiting for suitable functionality. In the DL/OE HAMNET the situation is the same, and there they developed their own system, HamnetDB. I understand that it is a spare time effort and other activities have priority, but we cannot live with a system part that keeps us back from progress forever. When there are problems or changes, there has to be some outlook that they will be fixed some day. Does not need to be tomorrow. Maybe you should join efforts with the HamnetDB people to merge the part that now handles the IPIP tunnel system with their system, which in other areas is much much more flexible and more like what we require. (although of course there always are wishlist items, e.g. because of things that are incompatible with our local license system) Rob

2 2

Re: [44net] ICMP: A small request
by Rob Janssen 20 Feb '16

20 Feb '16

> Subject: > Re: [44net] ICMP: A small request > From: > "Marc, LX1DUC" <lx1duc(a)laru.lu> > Date: > 02/19/2016 06:37 PM > > To: > AMPRNet working group <44net(a)hamradio.ucsd.edu> > > > Especially as we are all running tunnels, you (well your systems) really want to receive ICMP 3:4 (Fragmentation required, and DF flag set) messages. > > The "Ping of death" is not an issue anymore, and ICMP Flooding isn't really frequent anymore either. Nowadays neither of both require rejecting all kind of ICMP messages. Usually a fair rate limiting in the INPUT chain does the trick. > > 73 de Marc, LX1UDC Unfortunately people like Steve Gibson have done a lot of damage by misinformation - likely more than the damage ever caused by replying to a PING. It is still hard to convince some people they should not block all ICMP. At work I am currently trying to solve a problem caused by dropping the above ICMP packet combined with the "blackhole detect" misfeature that means the connection is not just completely breaking down (and the bad firewall operator noticing his mistake), but becoming much slower. As bad as a site that has IPv6 in DNS but not actually working... Rob

2 1

Re: [44net] ampr-ripd for openwrt
by Peter Mallett 20 Feb '16

20 Feb '16

I can not ping or access the http page yet again. I wonder if Jean-Marc has taken it down ? Regards ..... Peter ZL2BAU

7 49

Re: [44net] another OpenWrt gateway
by lleachii＠aol.com 19 Feb '16

19 Feb '16

Daftcho, Your configuration appears to be correct; but you performed traceroute on your WAN IP address, and not the 44net IP. Attempt to perform traceroute using the interface argument: 'traceroute whatismyip.ampr.org -i br-amprlan' 73, - Lynwood KB3VWG

1 0

BGP stats for AMPRNet
by Assi Friedman 19 Feb '16

19 Feb '16

Hi Brian: I am curious about BGP routing; since the agreements all go through you, here are a few questions: 1) How many AMPRNet subnets are currently being advertised via BGP? 2) Do you have any notion if specific ISPs are more open to allow BGP advertising than others? 3) Have any AMPRNet users had luck getting BGP agreements with home class service? Assi

6 19

Re: [44net] another OpenWrt gateway
by lleachii＠aol.com 18 Feb '16

18 Feb '16

Absolutely. Anything using Internet Protocol should work. BTW, I was unable to traceroute you. Feel free to use: http://44.60.44.10/tools/trace/php-trace44.php - Lynwood KB3VWG -----Original Message----- Can I use again pptpd and connect to my gateway from Internet like I used to do?

1 0

Re: [44net] how can i know what network allocated to me ?;
by Rob Janssen 18 Feb '16

18 Feb '16

> Subject: > Re: [44net] how can i know what network allocated to me ?; > From: > R P <ronenp(a)hotmail.com> > Date: > 02/18/2016 07:14 PM > > To: > AMPRNet working group <44net(a)hamradio.ucsd.edu> > > > Dear Marius > There are several solutions for that > i did it with Cisco 20 years ago and I know that there is at least one gateway that use Cisco active and running now > So im not the first one who use Cisco > Best Regards > Ronen - 4Z4ZQ Maybe you will be able to get it to work between your net-44 network and outside internet, but to get connectivity to the other IPIP gateways will be very difficult for you. Getting an IPIP gateway to work requires some understanding of networking and system configuration, and it is a lot easier to do it on Linux than on your Cisco. But in any case you will need to study the matter and learn how to solve problems. In fact, that is most of the fun. As soon as it starts working, it is time to move on to other things... When you don't like it, you have probably chosen the wrong project. Rob

1 0

Re: [44net] Obtaining a /16 network for a specific DXCC country (TK) ?
by Rob Janssen 18 Feb '16

18 Feb '16

> Subject: > [44net] Obtaining a /16 network for a specific DXCC country (TK) ? > From: > Toussaint OTTAVI <t.ottavi(a)bc-109.com> > Date: > 02/15/2016 10:31 AM > > To: > <44net(a)hamradio.ucsd.edu> > > > Hi, > > I'm TK1BI, and I'm living in Corsica. It's a small island in the Mediterranean sea. It's a French "department". But it's a specific DXCC country : TK. > > With my friend TK5EP, we are managing the TK5KP radio-club, which has been very active for years. We are now designing a hamnet network for our island. I'm wondering if it would be possible to obtain a /16 subnet for our "country". If so, what > would be the requirements ? How many radio amateurs are there in Corsica, and how many of them are likely to be active on the digital network? There are 134 callsigns in the QRZ.COM list for TK*. Maybe only those that voluntarily listed themselves are there? I think other countries of similar population size got a /20 assigned... Not that we have a shortage of address space, and not that I want to withhold you a /16, but it seems a bit large. Rob

10 26

Re: [44net] BGP announcement questions ?
by Rob Janssen 18 Feb '16

18 Feb '16

> Subject: > Re: [44net] BGP announcement questions ? > From: > R P <ronenp(a)hotmail.com> > Date: > 02/17/2016 09:14 AM > > To: > AMPRNet working group <44net(a)hamradio.ucsd.edu> > > > Thank you Edgar > I look for Hardware solutions for making our gateways > I know Cisco can serve as Gateway > Now i start to understand that Microtik also can do it > Do you know if anyone is doing a GateWay with Microtik ? if yes may I get the config to do IPIP for the 44 net ? > Thanks Forward > Ronen - 4Z4ZQ I would not recommend Cisco or MikroTik to run an IPIP gateway. It is all much too complicated. Get a Linux box. Seriously. Or BSD when you like that better. With a few simple configuration steps you have an IPIP router that works automatically and does not need manual attention or complicated scripts to update its configuration all the time. MikroTik is ideal for use as internal router in a radio network: point-to-point links and user accesses, and running BGP on the private AS numbers. That is not the same as running BGP towards internet! To announce BGP subnets on internet I would recommend to get this service from an ISP. They know this matter because they use it to advertise their own subnets, and a good ISP can advertise your subnet to internet and statically route the traffic to your router. Rob

5 5

Re: [44net] BGP stats for AMPRNet
by Steve L 18 Feb '16

18 Feb '16

curl -s http://thyme.rand.apnic.net/current/data-add-ARIN | grep " 44\." >And if we talk on the subject >is there any tool on the net that can show the Sub nets that advertised for the BGP for the >AMPRNET ? >I used to see BGP advertisements in one of the looking glass tools of the biggest ISP tools page >Regards >Ronen - 4Z4ZQ >http://www.ronen.org

1 0

Re: [44net] BGP announcement questions ?
by Steve L 18 Feb '16

18 Feb '16

Ronen, I am with Tom on this. Cisco routers/Mikrotik have their place later down in the network. By far the most logical way to do an IPIP gateway is with a Linux box. Look into the the various single board computers, you don't need a spinning hard drive if you are worried about dish crashes etc. Brian Kantor runs the whole thing at UCSD on a dual-core 3.2 Ghz Xeon processor with two 1 GbE ports running a BSD variant on a Compact flash storage device, if I remember correctly.

1 0

Obtaining a /16 network for a specific DXCC country (TK) ?
by Toussaint OTTAVI 17 Feb '16

17 Feb '16

Hi, I'm TK1BI, and I'm living in Corsica. It's a small island in the Mediterranean sea. It's a French "department". But it's a specific DXCC country : TK. With my friend TK5EP, we are managing the TK5KP radio-club, which has been very active for years. We are now designing a hamnet network for our island. I'm wondering if it would be possible to obtain a /16 subnet for our "country". If so, what would be the requirements ? Here are some arguments : - In the ham radio world, Corsica is a separate DXCC country. - On an administrative point of view, Corsica is a department of France. But it's an island, and there's 300 km of sea between us and France. So, it's an independant geographical unit. - On a political point of view, Corsica has a specific language (similar to Italian), and a local government that would tend to more autonomy inside France and Europe. - On a historical point of view, Corsica has been one of the first republics in the world (30 years before France), and its Constitution, written in 1755 by Pasquale PAOLI, was used as a reference for the constitution of the United States of America (https://en.wikipedia.org/wiki/Pasquale_Paoli). - On a technical point of view, we're already using the 44.151.20.0/24 subnet (from France). And it would be technically enough to handle all our future needs. The "internal" net is built on 10.x.y.0/24 subnets, and only the external gateway has a 44.x address. Anyway, having a /16 would allow us to separate each region and city in /24 subnets, and use 44.x adresses everywhere (no more 10.x). As you can see, this request is not really based on technical needs; It's mostly a request to affirm our identity in the hamradio world. I'm a Systems Engineer, specialized in network and telecom. I'll host the backbone of the network in my professional datacenters (one in France/OVH, and one here in Corsica). My company will give free hosting, free VMs, free IP addresses and free bandwidth to the radio-club, so that the network will benefit of latest technologies at no cost. We'll also have BGP capabilities. TK5EP and I will be the sysadmins. Then, would it be possible to get a /16 subnet for Corsica ? Thank you in avance. 73 de TK1BI

6 16

Is ENCAP.TXT available via FTP
by Jay Nugent 15 Feb '16

15 Feb '16

Greetings fellow AMPRnetters, Is the encap.txt file still available via anonymous FTP any longer? That method was sweet and easy. I find the API rather clunky and so prone to scripting errors (on my end). I'm trying to automate updating the encap routes daily, and FTP has always been tried and true. NO! Not interested in RIP as during emergencies when we need to manually make changes to the routing tables they get overwritten by RIP. So that is NOT a solution in an EMCOM environment, sorry. So is plain-jane FTP still available??? Thanks! --- Jay Nugent WB8TKL Ypsilanti, Michigan Hamgate.Washtenaw.AMPR.org () ascii ribbon campaign in /\ support of plain text e-mail o Averaging at least 3 days of MTBWTF!?!?!? o The solution for long term Internet growth is IPv6. +------------------------------------------------------------------------+ | Jay Nugent jjn(a)nuge.com (734)484-5105 (734)649-0850/Cell | | Nugent Telecommunications [www.nuge.com] | | Internet Consulting/Linux SysAdmin/Engineering & Design | | ISP Monitoring [www.ispmonitor.org] ISP Performance Monitoring | +------------------------------------------------------------------------+ 08:01:01 up 37 days, 4:49, 4 users, load average: 0.36, 0.22, 0.17

3 2

Re: [44net] ampr-ripd for openwrt (Jean-Marc Magnier)
by F6CNB 15 Feb '16

15 Feb '16

Jean-Marc, An easy way to check your system and to know if you are going thru Internet or thru ampr.org is to ping my IPIP gateway at either 44.151.91.7 or 44.168.12.6 If the ping time is around 300ms you are coming in from Internet via ucsd.edu and if the ping time is less than 100ms you are coming in thru the IPIP tunnel. For testing purpose, you can just manually create a few IPIP tunnels and routes on your openwrt router. . Feel free to contact me directly as I am only a few km (Bures sur Yvette) from your QRA. You should even be able to connect the 44.168.x.x network via radio on the 5.7MHz band. 73 Remi F6CNB

2 2

Filtering...
by Rob Janssen 14 Feb '16

14 Feb '16

On a somewhat related note: people, please include some filtering in your gateways to drop the packets with an RFC1918 source or destination address (the 192.168 networks etc) before forwarding them over tunnels. There are several other filters that you can apply, depending on the position of your gateway in the network, including the verification that the source address of packets is within your gatewayed subnet. I have filters with logging on the tunnel interfaces and it is unbelievable how many 192.168.88.x and 10.x.y.z packets I see being dropped. A little output filtering does not hurt! Rob

4 3

ampr-ripd for openwrt
by Steve L 14 Feb '16

14 Feb '16

Lynwood managed to cross-compile ampr-ripd v1.13 OpenWrt-ar71xx-for-mips_34kc back in August 2015. You can look at this lists archives around that time for any other notes. His binary and some other things can be found at http://44.60.44.10/amprnet_docs/ Note: Only accessible via 44net, else 403: >Hi, > >Does anyone know where I can find a compiled version of ampr-ripd for >openwrt (backfire) ? I can't find gcc for Backfire :-( >Same nightmare about rip44d, perl multicast not available for Backfire. > >Thanks in advance > >73 from F1SCA

3 4

Re: [44net] 44Net Digest, Vol 5, Issue 34
by Pedja YT9TP 13 Feb '16

13 Feb '16

For some reason list switched to send me digests. How can i switch back to single messages? There is no info in digest email. Pedja YT9TP --- This email has been checked for viruses by Avast antivirus software. https://www.avast.com/antivirus

4 3

44.135.88.0/24 Toronto
by Michael Durrant (VE3PNX) 11 Feb '16

11 Feb '16

Just a heads up. I have had the Toronto, Ontario subnet 44.135.88.0/24 subnet dark for a few years now and plan to get it back online in a few weeks. For those in the GTA, Bob, etc .. please drop me a private email so I can coordinate bringing the Toronto AMPRnet GW back online. Michael Durrant ve3pnx(a)andier.com www.packetradio.ca

1 0

banned 44.140.63.5
by Michael Fox (N6MEF) 11 Feb '16

11 Feb '16

The IP address 44.140.63.5 just tried multiple ssh attempts using invalid logins against six of our 44-net machines. The attempts were caught and blocked. But beware. Is there an abuse policy and, if so, what is it? Michael N6MEF

5 7

Re: [44net] HAMNet France
by F6CNB 10 Feb '16

10 Feb '16

Hi Brian, My name is Remi F6CNB and I am in charge of developing the HAMNET network in France BUT I am not the IP address coordinator. The subnets are distributed by the coordinator outside the portail. I am using the hamnetdb.net to keep track of them. There are more than 50 sites currently active on the network. The network is growing fast in the Paris area with a lot of high speed backbones (typically 10 to 70Mbps). A lot of additional isolated subnets are existing in France including the very remote La Reunion island. They all are connected to the Paris area network thru gre tunnels. The main usages of the network are: VOIP, DMR/STAR repeater links, DATV repeater, Webcam, APRS ...... I got a script from our german hamnet friends to automatically update by email the main 44.0.0.0 DNS server from hamnetdb.net. I need to adapt it to handle the 44.168.0.0/16 network. Could you send me a description of the current way to update the DNS server by email and give me the privilege to do it? We also have a lot of issues with the current portail like I cannot assign 44.168.0.0/16 to my main ipip gateway (200Mbps connection both way) or the DNS registration not working. That is probably the main reason of poor DNS update. 73 Remi F6CNB (also W5/F6CNB 50% of the time)

2 1

Re: [44net] A bit OT
by William Lewis 10 Feb '16

10 Feb '16

The method is there. It's just almost hidden. When you click "Database", you will see only data from 2011 and newer. While looking at the right-side frame, each entry has an "update" option. Look closely at the very first one, and just above the word "update" you will see the word "New" Click "New" to add your entry. When you enter your data, the website will then attempt to use your computers default email program to submit a new entry via email. Depending on your email program, it may or may not try to warn you that another device is attempting to use your email program to send data somewhere. Cheers Peter. Bill Lewis / KG6BAJ At 04:03 PM 2/9/2016, you wrote: >(Please trim inclusions from previous messages) >_______________________________________________ >Hi All, > > Sorry for my off topic question, I shall be brief. > >Does anyone know where or how to update the listing on > >http://www.ampr-gates.net/frame_e.htm

2 2

A bit OT
by Peter Mallett 10 Feb '16

10 Feb '16

Hi All, Sorry for my off topic question, I shall be brief. Does anyone know where or how to update the listing on http://www.ampr-gates.net/frame_e.htm Is there another site ? Regards ..... Peter ZL2BAU

1 0

Re: [44net] 44Net Digest, Vol 5, Issue 32
by f5pbg＠free.fr 09 Feb '16

09 Feb '16

Hello Brian, French Hamnet works fine on 44.151 subnet like you can see. This is the historic network, no problem on it. REF association ask for a new 44.168 subnet for their project. For 44.168 subnet, contact the coord F1TZV at f1tzv(a)evc.net I read the Hamlist of REF association http://ref-union.net/Hamnet/ and there is nothing since fews months. I just write a message on this list in order to know what happend. If i have a answer, i will put it here. Best regards, Ludovic - F5PBG. Le 09/02/2016 20:00, 44net-request(a)hamradio.ucsd.edu a écrit : > Message: 5 > Date: Tue, 9 Feb 2016 08:21:33 -0800 > From: Brian Kantor<Brian(a)UCSD.Edu> > To:44net@hamradio.ucsd.edu > Subject: [44net] HAMNet France > Message-ID:<20160209162133.GA14859(a)UCSD.Edu> > Content-Type: text/plain; charset=us-ascii > > Can anyone advise me of the status of the French HAMNet project? > > I've not heard anything from those folks in over a year, and the > coordinator for 44.168.0.0/16 hasn't logged into the portal since > May of 2015. > - Brian

2 1

HAMNet France
by Brian Kantor 09 Feb '16

09 Feb '16

Can anyone advise me of the status of the French HAMNet project? I've not heard anything from those folks in over a year, and the coordinator for 44.168.0.0/16 hasn't logged into the portal since May of 2015. - Brian

3 2

Re: [44net] DNS cleanup
by Rob Janssen 09 Feb '16

09 Feb '16

> Why does an hostname of an isolated system need to be resolved in a world > wide DNS? > It has no connection to the internet via the gw or to the tunnelling system, > so that DNS resolution will allways lead to an unreachable host. Because there really is no relation between IP allocation and routing. For example, back in the days when we ran a lowspeed IP packet network here and in surrounding countries (1987-2003 or thereabouts), it was strictly forbidden in the regulations to have a connection between a radio station and a public communication line. We had thousands of stations active but none reachable from internet. hostfiles were used instead of DNS, but the information in the hostsfiles was always replicated to the public DNS, to indicate what addresses are allocated to whom. Also, it would have been possible (had the software on the typical station supported it) to download a zonefile and use it offline. Now that we have linking over- and to internet, we are in fact still doing that. Our gateway downloads the zonefile from hamradio.ucsd.edu daily, and loads it in a local DNS server on 44-net, only reachable from the radio side. So even when we lose our internet connection, we can still resolve .ampr.org addresses as they were valid just before the breakdown. I don't think that "reachable from the internet" or "reachable from net-44 systems that tunnel over internet" should be a criterion for being in the .ampr.org DNS. (this does not even consider that there may be firewalls that make it impossible to detect for outsiders that a system is connected, while the system itself can perfectly make outgoing connections) Rob

9 11

Re: [44net] DNS cleanup
by Rob Janssen 08 Feb '16

08 Feb '16

> If you look in the file that Brian posted you will see that there are no > 44.137.X.X (or 44.130.X.X) records in the list to be deleted. > So your DNS records should be okay. I know that, and that is why I am taking up the job myself. (I think it is a bit strange that the networks that are BGP or IPIP routed would not have to be cleaned) Rob

3 3

Re: [44net] DNS cleanup
by Rob Janssen 08 Feb '16

08 Feb '16

> Since we cleaned up 44.130/16 a while ago, we have some hints for your > first cleanup round. Maybe you should consider taking obsolete CNAME- > and MX-records into account. Example: > to-be-deleted.txt: > g7suh IN A 44.131.254.242 > ampr.org: > 2e1arm IN CNAME g7suh Yes, please take good notice of that! Some time ago I have made a lot of effort to delete all dangling CNAME and MX records, hundreds of them. Apparently there have been cleanups where entire subnets worth of A records were deleted, but many MX and CNAME records still referred to them. It looks like at some time, for every A record created in certain US subnets, a corresponding MX record (just "call IN MX 10 call") had been created. A bit pointless, but worse is that those were not removed when the A records were removed. This time around, please make sure that whenever some record is removed, all records that point to it are also removed. As Jann correctly points out, there are MX records that point to external servers (although sometimes the trailing period was forgotten, making them inoperative). During the above cleanup, I found several of those that do not exist in DNS anymore, and deleted them as well. I did not check if the ones that still resolve would offer SMTP service and would accept mail to the specific domain name (in .ampr.org!). Probably lots of them don't. This weekend I sent out a mailing about renewing registration by tacking @amsat.org @veron.nl and @vrza.nl to all callsigns (the latter are two amateur societies here) and of course I got many delivery failures back where the address at the aliasing service exists, but the address the mail is forwarded to no longer exists. We are not the only one with this cleanup problem... Rob

1 0

encap.txt
by Don Moore 08 Feb '16

08 Feb '16

I downloaded the encap.txt file just now and it doesn't match the gateway list. Is it not being updated or has something gone wrong in the process? 73, Don

2 1

Re: [44net] DNS cleanup
by Rob Janssen 08 Feb '16

08 Feb '16

> People -- we need the cleanup. I say, be aggressive. If an active DNS > record gets deleted, just recreate it -- Sheesh. Maybe you have not understood it, but we are actually *using* the network. For places where it is just a leftover of the packet radio days, I agree. Today I deleted a number of old BBS records, and a few hours later I got a mail back that one that was still in use. We cannot do that for all 3000 active records. Rob

5 4

Re: [44net] DNS cleanup
by Rob Janssen 08 Feb '16

08 Feb '16

> No, expectation is that people getting AMPR address space should > have the subnet they're in registered with the portal. That includes > non-connected hosts and /32s. Is it really a good idea to base the cleanup on data in the portal? I mean, the guy running the portal clearly does not have the resources (or the motivation?) to do even minor maintenance on it, let alone finish work on features like the DNS registration that have been in incompleted state for years. Is it a good idea to make our entire network dependent on that? I cannot remove a subnet that was erroneously added in the past (and where user subnets where added inside) without deleting those, and a request to the maintainer to do that outside the portal UI that I sent months ago is still not processed. I also cannot add any regional subnets for which parts are already registered to users. The whole implementation of subnet hierarchy and record ownership is much too strict, it only works when everything is done "the correct way" on the first try, which simply is not realistic. Compare it to HamnetDB where you can simply reshuffle the whole subnetting by inserting, deleting or editing existing records within the existing hierarchy. I also don't like the idea to send a request to all users to "register themselves" and then being bombarded with allocation request mails from the portal that all need to be manually edited because the requesting user cannot specify an existing allocation to be registered. Users that do not understand the whole mechanism cannot be ignored, because either you don't process the request and it remains on the todo list, or you reject the request and those users just click the links in the rejection mail which results in the same request being posted again :-( In 44.137.0.0/16, really only the users that want to run an IPIP tunnel are registered in the portal, there are many other users that connect in a different way. Luckily we are not affected by this cleanup because we are BGP routed, but at the same time that also shows how this method is failing. After all, what does the routing method have to do with the DNS contents? Basically nothing. Why should all our inactive records remain there while those of other countries are deleted even when they may be active? When we want to clean the DNS, we should look at the situation on a country by country base. I am all for deleting entries for callsigns that have expired, and in fact I regularly do that. Probably other countries also have lists of active callsigns and a quick scan can be made to delete all expired callsigns and probably also those records that are not related to callsigns. We could request all coordinators to send a list of active callsigns, and we could process those lists to generate a deletion list like I already do for my area. We could also ask each coordinator what is the state of IP packet or other use of those addresses in their country, and maybe get whole networks deleted when they no longer exist. I will try to dig in the old data I still have saved (for my area) to generate a list of callsigns and the date of last registration or reconfirmation, and try again to contact all callsigns with records before a certain date and delete them when there is no reply. This should clean out more records than the previous run, where I only deleted those registrations where the owner replied they no longer required them. Rob

16 26

Re: [44net] Dumb question - 44.130 IP address?
by Dg7nef 08 Feb '16

08 Feb '16

Hi group, hello Thomas, IIRC the initial assignment was in fact given to me by you and Paul, so I'm happy to hear from you again. :) On 02/07/16 23:55, Thomas Osterried wrote: > Hello, > > well, a longer tradition than the quite new portal are the country-wide IP-Koordinators. > > In DL, we have the coordination team of three people (dd9qp, dg8ngn, dl9sau) and we delegate the responsibility of the local assignments to the regional coordinators. This concept goes back to the last century. > From the regional coordinator, Wolfgang had got the initial assignment of his IP addresses. That is correct. And that was kind of "status quo" when I had to quit Packet Radio activity. But the first thing I found when I searched for infos on the current state of IP in PR was that my IP's no longer do exist (which in fact is not really the problem for me, as I really was not active for a long time. So, no complaints on that from me, that's perfectly OK if there's some need for IPs. > Some time ago, we did a clean-up of the old 44.130 packet-radio block in communication with the regional coordinators. > > What's with the portal? - I think we need discuss that. It had been no relevance for us (since no one requested it), and I'm not sure, how it fits in a concept of the country coordinator system (unless a country coordinator defines a do-what-you-want-netblock for self-allocation - but how this may be integrated in a working routing concept??). I think the portal would not work that good with a concept like the formerly used one with using the IP for granular routing over PR network. But I seem to remember discussions that the "routing feature" would not be needed any more and the whole german IP PR network should be seen as one big block (which I do not really support from my standpoint as sysadmin). > Region ofr.de (44.130.62.0/24) was resigned 2013-07-31. Regional Coordinator was DL1NAT. > The zone file of that region expired with serial 2004041601. Nine years after the last update. forward- and reverse- entries were inconsistent: the reverse file had the serial number 2002062201 (I assume 2 years before). > > I do not like to blame anyone, but it may be useful in that discussion. 9 (or 11) years after the last coordination of the subnet and 2.5 years after your regional coordinator stated that all records could be removed, you recognize that dg7nef, dg7nef-2 and dg7nef-gate ( 44.130.62.20, .18, .19) have been passed back. And that lead to my problem with portal.ampr.org as I still had my own local acting DNS serving as "Master" for the zone on requests from my network, so I could at least keep the IP adresses I did contact in a state that did work for me. Yes, split DNS and multiple masters are an ugly thing. But it did work locally then. > This emphasizes both, the difficulties we'll get, even years after a clean-up, and on the other site the need to have a clean-up (the /24 had 57 entries (22%) and we finally got one complain (Wolfgang had 3 addresses -> 5 %). For most cleaned subnets we got 0 responses at all). Well, in fact no complains from me so far, just a bit confusion on my side. ;) > And imho, it also shows the country- / regional-wide coordination concept makes sense. Currently, we've 35866 IN A records in ampr.org. Imagine we'll have 10 requests a day on the list of the pool of every user, we all will have to read the next 10 years about every individual issue.

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net