44net

44net@mailman.ampr.org

3194 discussions

Re: [44net] Accessing AMPRNet via VPN
by Steve L 17 Oct '15

17 Oct '15

Nevermind, turns out one of the files I was using still had some XML stuff in it. So now I have it working with SecurePoint OpenVPN in Windows 7: http://sourceforge.net/projects/securepoint/ And CentOS 5.5 using openvpn 2.2.2, as well as on as Raspberry Pi, raspbian, openvpn 2.2.1 Roland, are you attempting to connect using the GUI in Ubuntu 15.04 or using the command line?

1 0

Re: [44net] Accessing AMPRNet via VPN
by Steve L 17 Oct '15

17 Oct '15

Interesting when I tried it the windows way. Error: private key password failed

1 0

Re: [44net] Accessing AMPRNet via VPN
by Steve L 16 Oct '15

16 Oct '15

[root@kb9mwr openvpn]# nmap 85.188.1.118 -p 1773 Starting Nmap 5.00 ( http://nmap.org ) at 2015-10-16 12:17 CDT Interesting ports on amprgw.rats.fi (85.188.1.118): PORT STATE SERVICE 1773/tcp closed unknown Nmap done: 1 IP address (1 host up) scanned in 0.52 seconds Despite this, it works for me: [root@kb9mwr openvpn]# openvpn client.conf Fri Oct 16 12:18:07 2015 OpenVPN 2.2.2 i686-redhat-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012 Fri Oct 16 12:18:07 2015 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Fri Oct 16 12:18:07 2015 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Fri Oct 16 12:18:07 2015 WARNING: file 'client.key' is group or others accessible Fri Oct 16 12:18:07 2015 LZO compression initialized Fri Oct 16 12:18:07 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ] Fri Oct 16 12:18:07 2015 Socket Buffers: R=[110592->131072] S=[110592->131072] Fri Oct 16 12:18:07 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ] Fri Oct 16 12:18:07 2015 Local Options hash (VER=V4): '41690919' Fri Oct 16 12:18:07 2015 Expected Remote Options hash (VER=V4): '530fdded' Fri Oct 16 12:18:07 2015 UDPv4 link local (bound): [undef]:1194 Fri Oct 16 12:18:07 2015 UDPv4 link remote: 85.188.1.118:1773 Fri Oct 16 12:18:07 2015 TLS: Initial packet from 85.188.1.118:1773, sid=af8cd2e6 8b7e00df Fri Oct 16 12:18:08 2015 VERIFY OK: depth=1, /O=AMPRnet/CN=OH7LZB_VPN_service_CA Fri Oct 16 12:18:08 2015 VERIFY OK: depth=0, /CN=ampr-gw.he.fi Fri Oct 16 12:18:10 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Fri Oct 16 12:18:10 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Fri Oct 16 12:18:10 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Fri Oct 16 12:18:10 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Fri Oct 16 12:18:10 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Fri Oct 16 12:18:10 2015 [ampr-gw.he.fi] Peer Connection Initiated with 85.188.1.118:1773 Fri Oct 16 12:18:12 2015 SENT CONTROL [ampr-gw.he.fi]: 'PUSH_REQUEST' (status=1) Fri Oct 16 12:18:12 2015 PUSH: Received control message: 'PUSH_REPLY,route 44.0.0.0 255.0.0.0,route 44.139.11.0 255.255.255.192,topology net30,ping 24,ping-restart 120,ifconfig 44.139.11.58 44.139.11.57' Fri Oct 16 12:18:12 2015 OPTIONS IMPORT: timers and/or timeouts modified Fri Oct 16 12:18:12 2015 OPTIONS IMPORT: --ifconfig/up options modified Fri Oct 16 12:18:12 2015 OPTIONS IMPORT: route options modified Fri Oct 16 12:18:12 2015 ROUTE default_gateway=192.168.1.1 Fri Oct 16 12:18:12 2015 TUN/TAP device tun0 opened Fri Oct 16 12:18:12 2015 TUN/TAP TX queue length set to 100 Fri Oct 16 12:18:12 2015 /sbin/ip link set dev tun0 up mtu 1500 Fri Oct 16 12:18:12 2015 /sbin/ip addr add dev tun0 local 44.139.11.58 peer 44.139.11.57 Fri Oct 16 12:18:12 2015 /sbin/ip route add 44.0.0.0/8 via 44.139.11.57 Fri Oct 16 12:18:12 2015 /sbin/ip route add 44.139.11.0/26 via 44.139.11.57 Fri Oct 16 12:18:12 2015 Initialization Sequence Completed [root@kb9mwr openvpn]# ifconfig tun0 tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:44.139.11.58 P-t-P:44.139.11.57 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:1 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:48 (48.0 b) TX bytes:0 (0.0 b)

2 1

Re: [44net] 44Net Digest, Vol 4, Issue 144
by Rob Janssen 15 Oct '15

15 Oct '15

> I just followed this, for a CentOS 5 system and it took right off: > > http://wiki.ampr.org/index.php/AMPRNet_VPN > > Make sure you have these files in your /etc/openvpn directory: > amprnet-vpn-ca.crt > client.conf > client.crt > client.key Actually with a modern openvpn client it is possible to combine everything in a single .conf file. (or .ovpn when you want to use it on Windows) The certificates and keys van be put in the file "inline". I use this method for distribution of openvpn configs that can be used with our national VPN gateway (only available for Dutch stations), for which we generate certificates and send them to the users. The file for the amprnet vpn system would look like this: client dev tun proto udp remote amprnet-vpn1.aprs.fi 1773 resolv-retry infinite persist-key persist-tun comp-lzo verb 3 ca [inline] cert [inline] key [inline] <ca> contents of the amprnet-vpn-ca.crt file </ca> <cert> contents of the client.crt file </cert> <key> contents of the client.key file </key> This makes it easier to move the certificate around, use it on Windows, etc. Only really old versions of the openvpn client, today only found on devices like NAS that have not updated for a long time, do not support the [inline] construct. Rob

2 1

Re: [44net] Accessing AMPRNet via VPN
by Steve L 14 Oct '15

14 Oct '15

I just gave it a try for the first time ever. A couple years back I applied for a Log of the World certificate and never really took it any further. I guess I forgot. Mistake #1 for me was only backing up the KB9MWR.p12 and KB9MWR.tq6 files a couple years ago. That was on a former computer. I should have backup up the whole, C:\Documents and Settings\your-username\Application Data\TrustedQSL directory, or just completed the process and made the openvpn keys back then. Anyway no big deal, just a few more hoops to have the certificates re-issued. I just followed this, for a CentOS 5 system and it took right off: http://wiki.ampr.org/index.php/AMPRNet_VPN Make sure you have these files in your /etc/openvpn directory: amprnet-vpn-ca.crt client.conf client.crt client.key Aside from that we are going to need a bit more detail to further help you. What does the openvpn daemon say when you start it?

1 0

Subject: PTD
by Rob Janssen 12 Oct '15

12 Oct '15

> Subject: > [44net] PTD > From: > Brian <n1uro(a)n1uro.ampr.org> > Date: > 10/10/2015 04:13 AM > > To: > 44net(a)hamradio.ucsd.edu > > > Is anyone on PTD.net that's running SNMP? Please MAKE SURE that you block all incoming SNMP traffic from internet to amprnet! (especially when you are using community names like "public") The bad guys use SNMP as an attack amplifier. One time I moved a switch to another address and it became exposed, and within 3 days I had an abuse report. Now I have a general rule that drops all SNMP at our gateway. (of course the real problem is the ISPs that refuse to implement BCP38, source address filtering) Rob

5 8

PTD
by Brian 09 Oct '15

09 Oct '15

Is anyone on PTD.net that's running SNMP? 24.115.114.195.res-cmts.flt.ptd.net.54321 > gw.ct.ampr.org.snmp: [udp sum ok] { SNMPv2c C=AMPRNet_RO { GetRequest(34) R=198102558 E:14988.1.1.1.1.1.7.0 } } 22:08:32.571779 IP (tos 0x0, ttl 114, id 15043, offset 0, flags [none], proto UDP (17), length 81) 24.115.114.195.res-cmts.flt.ptd.net.54321 > gw.ct.ampr.org.snmp: [udp sum ok] { SNMPv2c C=AMPRNet_RO { GetRequest(34) R=198102560 E:14988.1.1.1.1.1.4.0 } } 22:08:32.571848 IP (tos 0x0, ttl 114, id 15044, offset 0, flags [none], proto UDP (17), length 81) 24.115.114.195.res-cmts.flt.ptd.net.54321 > gw.ct.ampr.org.snmp: [udp sum ok] { SNMPv2c C=AMPRNet_RO { GetRequest(34) R=198102562 E:14988.1.1.1.1.1.3.0 } } 22:08:32.571914 IP (tos 0x0, ttl 114, id 15045, offset 0, flags [none], proto UDP (17), length 81) 24.115.114.195.res-cmts.flt.ptd.net.54321 > gw.ct.ampr.org.snmp: [udp sum ok] { SNMPv2c C=AMPRNet_RO { GetRequest(34) R=198102564 E:14988.1.1.1.1.1.2.0 } } -- Dolphins are so smart that within a few weeks of captivity, they can train people to stand on the very edge of the pool and throw them fish. 73 de Brian - N1URO email: (see above) Web: http://www.n1uro.net/ Ampr1: http://n1uro.ampr.org/ Ampr2: http://nos.n1uro.ampr.org Linux Amateur Radio Services axMail-Fax & URONode http://uronode.sourceforge.net http://axmail.sourceforge.net AmprNet coordinator for: Connecticut, Delaware, Maine, Maryland, Massachusetts, New Hampshire, Pennsylvania, Rhode Island, and Vermont.

1 0

Portal API "Heads Up"
by G1FEF 08 Oct '15

08 Oct '15

For those of you using the Portal’s API, this is a “heads up” to check your client code… It was pointed out to me that the JSON encoding the API returns was slightly non-standard. Having looked into the issue this seems to be the case, so I have today corrected the error and bumped the version. Just check your client is still decoding the output correctly - most libraries would have happily accepted the JSON variant I was using, so chances are you won’t need to change anything, but if you coded your own JSON decode routine… Regards, Chris

1 0

Attention PY2ZEN
by Brian 03 Oct '15

03 Oct '15

You may want to fix this... ax0: fm PY2ZEN-15 to QST ctl UI pid=CC(IP) len 161 IP: len 161 10.1.1.5->239.255.255.250 ihl 20 ttl 1 DF prot UDP UDP: len 141 52618->1900 Data 133 0000 M-SEARCH * HTTP/1.1..MX: 2..HOST: 239.255.255.250:1900..MAN: "ss 0040 dp:discover"..ST: urn:schemas-upnp-org:service:WANPPPConnection: 0080 1.... ax0: fm PY2ZEN-15 to QST ctl UI pid=CC(IP) len 161 IP: len 161 10.1.1.5->239.255.255.250 ihl 20 ttl 1 DF prot UDP UDP: len 141 52618->1900 Data 133 0000 M-SEARCH * HTTP/1.1..MX: 2..HOST: 239.255.255.250:1900..MAN: "ss 0040 dp:discover"..ST: urn:schemas-upnp-org:service:WANPPPConnection: 0080 1.... ax0: fm PY2ZEN-15 to QST ctl UI pid=CC(IP) len 160 IP: len 160 10.1.1.5->239.255.255.250 ihl 20 ttl 1 DF prot UDP UDP: len 140 52618->1900 Data 132 0000 M-SEARCH * HTTP/1.1..MX: 2..HOST: 239.255.255.250:1900..MAN: "ss 0040 dp:discover"..ST: urn:schemas-upnp-org:service:WANIPConnection:1 0080 .... -- Dolphins are so smart that within a few weeks of captivity, they can train people to stand on the very edge of the pool and throw them fish. 73 de Brian - N1URO email: (see above) Web: http://www.n1uro.net/ Ampr1: http://n1uro.ampr.org/ Ampr2: http://nos.n1uro.ampr.org Linux Amateur Radio Services axMail-Fax & URONode http://uronode.sourceforge.net http://axmail.sourceforge.net AmprNet coordinator for: Connecticut, Delaware, Maine, Maryland, Massachusetts, New Hampshire, Pennsylvania, Rhode Island, and Vermont.

1 0

Reverse Delegation
by Fredric Moses 02 Oct '15

02 Oct '15

I know a couple of groups now have proper reverse delegation of DNS for their subnets… Wondering who to drop a line to so I can get 44.103.0.0/19 delegated to a.ns.mi6wan.net and b.ns.mi6wan.net ? Didn’t see it in the portal or wiki and my notes from a few months ago are foggy... -- Fredric Moses - W8FSM - WQOG498 fred(a)moses.bz

6 6

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net