> I saw that Microtik Routers support IPIP by default
> Is it possible to make a gateway with home routers ?
> If yes how to deal with 300 tunnels lines to the rest of the gateways on the net ? will a home router have enough memory for that ?
Look what Marius posted yesterday. He has made a script for MikroTik routers that updates the configuration using the AMPR RIP transmissions!
This is a very nice solution because it will receive all current routes automatically without requiring an external computer.
MikroTik routers are very versatile. They can run user-written programs (scripts) to do things like this.
I have a MikroTik RB2011UiAS-2HnD here, which would classify as a home router. It has 128MB RAM and 128MB flash which is more than enough for this purpose. I paid 125 euro for this nice box. They also exist in rackmount version, and we use these in our digital network.
And they have a nice web interface that actually is usable also for advanced things. (contrary to some other manufacturers products where the web interface is only for rudimentary tasks and advanced things are only possible via the command line) I
have no experience with the script that Marius posted yet, as I do not run IPIP here at home, I use IPsec VPN from the MikroTik to my Raspberry Pi in a datacenter which does IPIP. Notice that for best results (and less headaches) you need to put this
router directly on a public IP, not behind a provider-supplied router that does NAT. Either put the provider router in transparent (bridge) mode or omit it completely. (depending on what connection you have) Rob
Hello,
For thos who like experimenting...
I managed to implement the complete AMPR gateway tunnelling setup on a Mikrotik router by a scheduled script on the router only.
Tested on my RB100AHx2 with ROS 6.34.2
You can find it on http://www.yo2loj.ro/hamprojects/
Direct link: http://www.yo2loj.ro/hamprojects/ampr-gw-1.0.txt
Setup details are in the initial comments of the script.
Enjoy.
Marius, YO2LOJ
> I managed to implement the complete AMPR gateway tunnelling setup on a Mikrotik router by a scheduled script on the router only.
That is a great idea Marius!
Using that method to get the RIP data is much better than trying to download and parse the encap file.
Maybe we can try again to convince MikroTik to implement mesh IPIP (I know you have tried in the past), because with
this method we don't need to convince them to include ampr-ripd as well.
With this method and multipoint IPIP in the router you would have the ideal combo to run amprnet on a commercial router.
Rob
> If anyone needs assistance with a Cisco config, let me know.
Out of curiosity (I have no intention to run a Cisco as an IPIP gateway):
Did you write a script that finds the minimum config changes to go from one encap file version to the next?
(that is, change existing tunnel endpoint addresses, delete tunnel interfaces, add new tunnel interfaces,
delete routes, add routes)
Or do you generate a fresh config from the encap you downloaded and just reload the router from that?
And, how often do you download the encap and update the router config?
Rob
> I have some questions (most are not technically)
> 1)how much downtime you had lets say the last year (i mean downtime not because of server upgrade) i mean because server failure or software failure
Nearly zero, as far as I am aware. We were offline for about 20 minutes because of the installation of the second
machine that required everything to be moved and that did not go as planned because the server rack mounting rails
did not fit and a solution had to be found.
Last night there was router maintenance in the datacenter and we were offline for a few seconds for the VRRP (I think)
switchover. This means a few alerts appeared in our monitoring. But normally we are always on.
The mobile device Echolink traffic of half the globe passes through this server...
(we are hosting the Echolink Relays 44.137.75.240 - 44.137.75.249 and 200 Echolink Proxy servers)
> 2) where do you get budget for buying such a server and hosting at ISP farm is it a donation ? or the amateur pay this?
We get the machines for free, they are left-overs from datacenters that get donated to us via amateurs working
in that business. Those companies replace their servers after 3 years or so, and they are still in good condition to use.
The ISP XS4ALL generously gives us the BGP announcing for free, there are radio amateurs working there who arranged this for us.
Other running costs are covered by donations from amateurs. We run a lot of services that the amateur community appreciates,
like a country-wide 2m and 70cm FM relay with 3 co-channel transmitters on high sites and 17 receivers spread over the country.
It attracts a lot of activity, you can talk to anyone here on 70cm with just a portable from most locations.
Also relays for DMR, D-Star, ATV etc. The amprnet is used as a network for that. Of course the work hours are free :-)
But of course those in the team always pay a lot of the small costs, which add up as well. Fortunately the team is quite large.
You can find some detail at our website http://hobbyscoop.nl/
At the moment this is only in Dutch, of course you can visit it via Google Translate.
> and after all i solute you for all the services you provide there (im now trying to connect our only P25 repeater to a world wide network) its consider minor to what you do there .
I am interested in that as well... we do not run P25 here I think, what network is that?
Does it use some form of VPN to secure the connection?
(usually this is done because those devices are not hardened enough to put directly on the internet of today)
Of course everyone experiments with the things he is interested in and can collect the resources for.
So I really encourage you to do experiments with what you have available!
(except trying to make a fully functional IPIP gateway with a Cisco router... but that is my personal opinion:-)
Rob
> What happned if I want to connect your DMR repeaters to ours (we have one DMR connected to the MARC network) and my DMR sit on Non AMPR adress ?
I am not an expert on the DMR network, but I think it works with a "master" server that everyone connects his repeater to.
We are running the BrandMeister master server. It is not the MARC network, it is an open network.
(a 3rd network exists, it is called DMR+ )
Our new master server (currently being setup) is dual-homed, it has both an AMPR and a normal IP address.
However that does not really matter as our AMPR addresses are BGP routed on internet as well.
> as for the P25 it is a solution that was done by by few hams last year it consist of a server software Free one (i know of only one server currently and there are about 13 repeaters connected world wide )
you can read it herehttp://communications.support/threads/4798-IP-link-Quantar-V-24-systems-using-Cisco-routers
Ok, it apparently has a serial port and the Cisco routers are used to tunnel that over IP.
Nice when you already have them, if not I would go for a Raspberry Pi and a USB Serial cable.
Much cheaper, much more power efficient.
A 2600 or 2800 can do more useful things than working as a serial server, but of course it can do this and routing in parallel.
The DMR and D-Star repeaters have an ethernet connection so they are easier to integrate with the network.
We also have some Yaesu System Fusion repeaters (they are cheap), but this is crap.
No network interface. They require a separate box to interface to the outside world. This still has no network interface,
it has USB. Then you need a computer with USB and network to connect it. But this computer has to run Windows :-(
Not good for a repeater site...
And the whole thing is far, far from finished. Updates to implement even basic functionality are being promised and
then being postponed all the time. I think it will not be usable before some amateurs roll up their sleeves and
re-do the entire software, much like DMR+ and BrandMeister.
> I still didnt leave the Cisco Gateway idea i will get tomorrow hopefully Cisco 2800 and see if it can work with 300 Tunnels if not it will go to the P25 connection Project
Please understand that (also written by Brian in the meantime) that your router will never be able to perform this task standalone,
you will need to have a second computer that is reconfiguring the router all the time, for every change in IP address of a gateway
or other change in the gateway list you will need to make a config change. A good script can do that automatically, but you will
need something like a Raspberry Pi to run it on.
And the Raspberry Pi can do a better job itself, because it can track the AMPR RIP packets and does not need to download the encap
file all the time.
> however some good guy saw my request on the local hams facebook about the Pi Board (with the link you provided) and willing to give me a configured board for tests , if it will be reliable it tern out that ill leave the cisco idea
Reliability will not be a problem (unless you have a bad SD card or bad powersupply).
The only thing to worry about is if you can sysop the system on the long run.
I.e. install updates sometimes, configure firewall rules as needed, etc.
This will require some study but it is part of the fun, I think.
> one more question (Personal one) are you the Rob Jebsen who was involved in the Jnos Software long ago ? I think I used one of your Jnos version the call sign was PE1CHL in the Days that our gateways was a Jnos/Dos
Yes I am the same person, see mail address.
I was not active with JNOS but I maintained a version of KA9Q NET that was used on many hybrid IP / NET/ROM nodes and BBS systems.
I still run that program on the hosted Raspberry Pi that is also my gateway.
Rob
> I'm trying to understand why you change the net so I need separate tunnel
> to every GW.
> In this case what are the benefit of using 44 net instead of "regular" ip ?
> i think that adding some main GW (maybe main router to each country ) and
> by that add the connectivity to 44 networks easily and every endpoint will
> take care to single tunnel.
That is exactly what we did here in the Netherlands. We put a machine in a
datacenter that serves as an IPIP gateway for 44.137.0.0/16, and everyone who
is interested in a simple tunnel can get a connection to there using one of the
VPN techniques that are more in use today: OpenVPN, IPsec tunnel, GRE over IPsec transport,
or also IPIP. And, this system routes towards the radio network that is in
quick development right now. (Ubiquiti and MikroTik equipment for 6cm)
The provider XS4ALL that hosts this system also advertises the 44.137.0.0/16
space on their routers using BGP (in close cooperation with Brian Kantor), and
they statically route this traffic to the machine. So we are directly reachable
from Internet as well. We explicitly chose this method because we are no experts
on Internet BGP and those people at the provider are, it is their daily business.
We run BGP on the 44-network as well (the radio side), but that is a different
thing. There is no BGP communication across our gateway.
The machine is a HP Proliant DL380 server so it is not as failure prone as the home
PCs that Ronen has used. And just this weekend I have migrated it to a newer HP
server that we installed with VMware ESXi on which this is one of the Virtual Machines,
now we will soon install VMware ESXi on the old machine as well and we will have
failover capability (manually operated cold standby, for now).
We also host Echolink Proxy and Relay servers and several services related to the
new digital modes, like a BrandMeister Master server, D-Star reflectors, etc,
on other Virtual Machines on the same server.
Of course the advantage of an IPIP mesh direct to every gateway is that there is
no central point of failure. When our gateway is down, we mostly become isolated.
When a gateway serving only a local subnet would be down, the other gateways can
still communicate amongst eachother. That is one reason that architecture was
chosen.
This has not "changed". It has always worked like this. However, not everyone has
understood that, and they believed that they could just send all traffic to the
UCSD gateway (which is the gateway for the entire 44.0.0.0/8 subnet towards internet),
and it would forward it to the proper destination. That was always a bad thing to
do, because you would load that single system with all the traffic. But it worked.
Now it does not work anymore and you have to do the right thing: route the traffic
to where it has to go. This of course also means it will work better, because when
you send traffic to a regional system it will no longer travel via California, and
you will have a much shorter delay.
Using our architecture it is still possible for a Dutch station to setup IPIP
routing for their local subnet, because they will just become part of the IPIP mesh
and the Dutch gateway is also part of that mesh. Traffic will still flow correctly.
However, it is no longer a good idea to run IPIP on a regional gateway
(as someone asked for this weekend), because the individual VPN routes are not
known to that gateway and the routing for those will break. Therefore we route
those regional gateways using BGP (on private AS numbers) so they receive all routing
information dynamically. For that, they are connected to the gateway using GRE.
(the situation was explained off-list to the one asking here)
Of course setting this all up requires a bit more knowledge of routing and a lot
more perseverance than configuring a simple IPIP gateway on a Raspberry Pi.
Linux routing is really powerful, also when compared to the most established
professional routers. But you have to read documentation, sometimes written by
Russian and Japanese volunteers and researchers, not having English as their
main language (just like me). It can be challenging, but I thing it is very
rewarding to get it operating perfectly. It is like building your own station
for amateur radio: some people like to build from small parts, others from a kit,
and some like to buy a shiny box. They all enjoy the hobby, but building from
small parts is not for everyone. To me, finding out how to do it is a big part of
all the fun, and the end result ("what are the benefit of using 44 net instead
of "regular" ip ?") is much less important. That is why I do not always understand
those that just want directions on how to do it and copy what someone else has
tinkered with. Sure it will bring you online quickly, but then leave you with the
question what to do next.
Rob
> Of course that following should be a route command for every 44 net gateway
No...
A separate "interface Tunnel" command for every 44 net gateway, and a separate route command for every subnet routed via those gateways.
In all, you will need 324 "interface Tunnel" commands (each with the 5 subcommands) and 512 "route" commands to describe the IPIP network as it is today.
Your 1005 router has not enough memory capacity to hold all that.
I could understand you when you had a 3800 series or similar. But this one... really no!
It has been end-of-life for over 10 years and it really is not up to par for this kind of job.
(if any Cisco is, because this is a job not suited for general-purpose routers)
Rob
> I relay don't know why you are so objecting a gateway with CISCO
> I used to work a lot with Cisco when i have worked at the System team of Israel largest ISP .
Because a Cisco is not suitable for setting up an IPIP gateway. It is reliable, but it cannot do this job.
It can do other jobs but that is not relevant. You would not recommend a truck when someone asks what car
to use to get to the office, either.
> Indeed it is much more complicated these days that UCSD dont do anymore 44 net forwarding and a routing line needed for every gateway ..
This is crucial. And also, the fact that more people now use dynamic addresses.
> I get a very reliable solution with Zero money (my Cisco 1005 was taken from the trash cost me nothing)
I recommend you to put it back there... and I think most people here will agree.
The Raspberry Pi was developed 15 years after this box, has a 10 times faster CPU, 10 times more memory
and uses a lot less power. (and costs less than a 10th of what this thing must have cost when it was new)
> However im willing to listen to your advice and test the Rasberry Pi
> If there is someone here that can direct me step by step until a working system and then i may consider testing it
As I said, it can be found on www.ampr.org
More specific, on this page: http://wiki.ampr.org/index.php/Ubuntu_Linux_Gateway_Example
I have a Raspberry Pi running as a gateway for over 2.5 years now and it has been without any problem.
It has never crashed. Good, because I have never touched it nor ever seen it. It has been mail-ordered and directly sent
to a datacenter where it was powered up may 25, 2013 and has worked ever since (of course sometimes rebooted for updates).
The above example was written by someone partly drawing from the example configuration I posted on this mailinglist
some years ago.
> Im not familiar with what have been told about the multi tunnel that a Cisco can not do ... (actually im not understand what the problem or the limitation is )
It is clear from your posted example (btw, it is not a good idea to post Cisco config files because now everyone
can log in to your router, the passwords are in the config!).
In a Cisco, a Tunnel interface has a "tunnel destination". One. But there are 324 tunnel destinations in the network.
So you need 324 tunnel interfaces.
In Linux, a single tunnel interface can serve as many destinations as you want, by setting a route with a nexthop
that serves the function of the "tunnel destination" in Cisco. Every route has its own nexthop (gateway).
And this route table can be updated automatically with ampr-ripd, so you never need to download any encap file.
> I know that at least two gateways are running and operating currently with CIsco
But most likely not a 1005!
Rob
> Hi there Cisco Gateways operators
> Has anyone of you a Mechanism that take the encap fiile which is not a Cisco route routing line syntax and makes from it route lines for Cisco ?
A Cisco cannot use route lines to operate a multipoint IPIP encap interface like Linux can (and JNOS).
Marius has already explained that yesterday.
I know it may be a disappointment to you, but your Cisco router really is not a good choice for use as an IPIP amprnet gateway.
A Raspberry Pi will be much easier to get going, especially when you are not a software guy. And it will perform better
in the real world where some people are on dynamic addresses, because the nice ampr-ripd software that Marius has
written will automatically maintain the routes immediately when they are changing, instead of the oldfashioned method
of downloading an encap file.
(directions can be found how to do this on www.ampr.org, that you just need to copy and modify the IP addresses)
Rob
