44net

44net@mailman.ampr.org

3196 discussions

Re: [44net] Time to restructure the network?
by Rob Janssen 23 Jul '19

23 Jul '19

> If anyone in Europe fancies announcing their own 44 /24 from a VPS / > ISP and doesn't have their own ASN, I can help out with that element. > Happy to apply for ASNs via my RIPE LIR account for folk from the HAM > community for free. Takes 2 or 3 days for RIPE to approve the > paperwork and issue the ASN, under current RIPE billing policy these > do not cost anything. While this is of course always welcome, please do understand that this is not related to the current discussion! What I am proposing here is to deploy an overlay network (VPN tunnels) to route the AMPRnet around the world and to connect users to it. The autorouting within that overlay network could be done using BGP. It could also be done using OSPF. This use of BGP is NOT related to announcing someone's subnet on internet using BGP! For that, you could require an AS number, amongst other things. (it is also possible that it can be announced using the AS number of your ISP) However, to operate our own overlay network, a group of routers that interconnect using BGP over VPN tunnels, we do not require AS numbers from a LIR! We just use private AS numbers. In the 32-bit AS number space there is a large range of private AS numbers that we can (and already DO) use for that. We already have an allocation scheme to split this range across countries, so we do not need a central registry for them either. Maybe we should refer to this usage of BGP as BGP44, to make clear that it is not related to the use of BGP on internet? Of course, BGP and BGP44 are the same protocol running on standard hardware, but the usage is different. Much like an intranet and the internet use the same protocols, but their usage is different. So while this contribution is of course always welcome, please (those who do not completely understand the discussion) note that it is not related to what we are discussing. That being said, once there is a deployment of VPN routers like I propose, it will be much easier to have parts of AMPRnet announced from the datacenters where these are located. That could be considered part 2 of the project. Rob

2 1

Civility on this mailing list
by Brian Kantor 23 Jul '19

23 Jul '19

On Tue, Jul 23, 2019 at 09:52:29AM +0200, Marc Williams via 44Net wrote: > I suppose recent examples would be personal attacks on named individuals. While those are never welcome, as mailing list manager, I don't like the idea of banning those persons from participating in the list because, however unlikely, they may be able to contribute usefully to discussions here. I feel that correct mailing list etiquette would be, when someone is out of line, or indeed, out of control, for list members to send him a private email reminding him that civility and rational discussion achieve more than frenzied, often hastily composed diatribes do. That said, it is possible for repeat or particularly vile offenders to be subject to moderation or struck off or banned from the list. So please, folks, no matter how angry or upset a posting here gets you, at all times remember to be civil to your fellow list members. Thank you. - Brian PS: to discourage trolls and bots, it's my policy that when a newcomer is first subscribed to the list, his 'mod' flag is turned on, so that his initial posting is reviewed before being forwarded to the list. I recognize that this causes a delay, but I believe its in the best interests of our subscribers. As soon as a valid posting is received, the 'mod' flag will be turned off. Many other mailing lists have this same policy.

1 0

Re: [44net] 44 net connectivity
by Rob Janssen 23 Jul '19

23 Jul '19

> But to be honest I would say a bigger deterrent to using 44 net is the nature of some of the discourse on here. I can't claim to be a Saint myself but honestly some people's dialog is frankly appalling. > Yes there is some improvement to be made around technology but also some rules around acceptable use of the mailing list should go hand in hand with it. It is unclear to me what you are referring to. Maybe you should be reminded that part of the people here do not have English as their first language. Their language vocabulary is limited and it is difficult for us to express the subtleties that you may want to see. Rob

2 1

Adding VPN server at UCSD ?
by R P 23 Jul '19

23 Jul '19

Hi there Now that we have a lot of money in the pocket may we consider installing a VPN server at UCSD to allow user connecting AMPRNET with VPN in addition to the IPIP tunnel ? I myself will be more then happy to move our networks from IPIP connectivity to VPN (or any other more sophisticated technology) . Thanks Forward Ronen - 4Z4ZQ

6 10

Re: [44net] Time to restructure the network?
by Rob Janssen 22 Jul '19

22 Jul '19

> Personally, I love the idea of allowing the network to be more inclusive by allowing connections other than the current IPIP one. Rather than replace IPIP, I would suggest that we keep it and just allow people to act as hubs for those that are behind NAT/Limiting firewalls, etc. This is what we already have working, and others have that too. A local VPN server that is connected to IPIP (and in our case BGP too). However, such a setup is a bit complicated because the IPIP mesh is not well supported on many router types, and having the two different network types integrated in the same router also is kind of tricky. Not everyone gets that right: all routes have to be in the same routing table and evaluated from more-specific to less-specific. But you still need to handle cases where multiple routes to the same subnet (using different protocols) can exist. In some cases, people have resorted to having multiple routing tables and searching them in a specific sequence, but that does not work correctly in some cases. Also there is the issue of determining the correct source address. Sometimes such gateways send traffic with a non-44net source address through an IPIP tunnel, which of course is unwanted. So my proposal is to drop the IPIP mesh to remove this additional complexity, and make the system easier to rollout and maintain. > While I think BGP would be great, it adds questions like: can people announce their own non-44 space, can people use their own ASNs, how will we allocate ASNs, how do we confirm people are announcing space actually allocated to them. One thing we can do, is look at DN42 and how they work. Their network is similar to some of these suggestion with the exception that they use private space. Some of those topics have already been addressed and resolved before. For example w.r.t. the AS numbers, we have agreed to use an allocation scheme for private AS numbers so this can be delegated to individual regions without chance of collisions. The scheme is to use "42"+iso country designator+5 digits, where these 5 digits can be subdivided in a region specific way. Large countries have several iso country designators so there should be ample space using this scheme. Here we use 42204+3digits+2digits where a router in our 44.137.aaa.bbb/16 subnet gets AS 44204aaann where nn=bbb/16. Of course this network is only meant to distribute net44 addresses, our routefilters filter announcements outside that. But you can announce space for your friend inside net44. Actually the same as the current IPIP situation. Indeed very similar to what DN42 does. Rob

6 5

Re: [44net] 44.192.0.0/10 sale
by Rob Janssen 22 Jul '19

22 Jul '19

> >/I don't suggest that you would use only our VPN server, you could /> >/connect it in addition to some other to have additional redundancy /> >/and maybe a more efficient path to western europe. / > Why would I want or need to go across the Atlantic when it's not > necessary since IPIP is working fine for me. Because we are trying to draft a new solution that would not work only for you, but also for others. You do not seem to be interested in that. > >/You (or ARDC, using their money) should eastablish one or more VPN /> >/servers on the eastcoast and/or Canada, then you connect there and /> >/those servers connect back to UCSD or maybe even advertise some of /> >/the locally assigned subnets on internet BGP. / > I don't see where this would be a reasonable allocation of funds by > ARDC. Come on, it costs like $5-$10 per month per location to host such a service. And that is only when it is paid for. Last time I asked here for volunteers to host an echolink proxy farm, there were like 10 volunteers that would do (and did) it for free. It is likely that they would add such a VPN server feature to their already existing hosted system, if we would kindly ask it to them. > If ARDC were to allocate funding I would rather see it go into research > of new techologies. We as hams are not leaders anymore, we're lemmings. That would be a complete waste of money! As is clearly shown by this entire discussion, there is nothing that hams hate more than to change something that they think is working well for them, even without considering how it works for others. Again, it is much like the discussion about CW. Large groups of hams still believe that CW is the most efficient mode and can be received when all other modes fail. Utter bullshit, of course, but it was like that 50 years ago so it still must be true today. > >/Then it will improve your connectivity to internet, and connectivity /> >/to other AMPRnet systems is the same or similar. / > How will that improve my connectivity to the internet? I can and do get > around blocks by my ISP just fine - once I know what they are and I take > full advantage of the 200Mbs link I have for a residential circuit. The connectivity to internet from your 44net systems, of course! That would now go via UCSD and when you could get a local VPN server which also announces the state's network allocation on BGP, it would be faster than the trip via UCSD in many cases. > I could get another circuit with 4G backup and shell out almost > $2,000/yr additional as a business circuit but why? For people on this > list to try and tell me what to do with my circuit that I spend my money > on? I think not thank you. That's when a ham community turns into a ham > dictatorship. It is always amazing to see people on this list toggle between "but there are single points of failure in this solution, I do not like that!" and "don't tell me to do things the way you like" after explaining them how to work around those single points of failure. Apparently they bring that up only to put a spanner in the works of any discussion about change, not because they really care about it. Also I think your solution is way too expensive. My home internet connection (with fixed IPv4, native IPv6 /48, 100 Mbps, unlimited data, no silly filtering) costs me less than $600/year and it includes 4G backup up to 1GB/month. Rob

3 3

Re: [44net] Adding VPN server at UCSD ?
by Rob Janssen 22 Jul '19

22 Jul '19

> No need to use UCSD. Cloud based server(s) work just fine. Places like > AWS drip with bandwidth. Is AWS able to run an IPIP gateway? I am currently trying to migrate an IPIP gateway from the "Hosted Raspberry Pi" that it is now to a VM that is being offered as a replacement, but it turns out that the "Apache Cloudstack" that this (and apparently many other) hoster uses to deploy VMs is unable to pass other network traffic than TCP and UDP. (and replies to outgoing traffic) Good enough for OpenVPN and will probably work with IPsec and other VPN protocols, but not suitable for an IPIP gateway that also accepts incoming traffic. I am now looking for a solution. Of course I can make a VPN to our gateway, but this system was a test environment for an IPIP gateway. When IPIP goes away, I no longer need it. However, I could also use it to draft an example of how to setup a VPN service on a Linux machine. Rob

3 2

Re: [44net] Adding VPN server at UCSD ?
by Rob Janssen 22 Jul '19

22 Jul '19

> You can also host it in vultr. I would have to check, but IPIP should not be a problem there and it costs indeed about 5$ per month Toussaint TK1BI is also using that, isn't it? It seems one can even advertise BGP space there. I see they also host in Amsterdam. In fact, when we would deploy a VPN server in all 16 datacenters they offer we already would have covered most of the world. But that is another topic, this query is mainly intended for my personal colocation server. (it serves my mail, my website, an IPIP gateway for testing, and an echolink proxy server for testing) Rob

1 0

Re: [44net] 44.192.0.0/10 sale
by Rob Janssen 22 Jul '19

22 Jul '19

> No it is not possible with my ISP. To run any local services is a > violation of the ToS agreement. The ports and services they close they > will not open. I've tried. They also incorporate a watchdog on all > sockets that destroys them after so many minutes of "birth". This kills > client services such as VPN, SSH, etc. Web services often aren't > affected since most web elements are downloaded within 300 seconds +/-. I would go away. How do you get IPIP working over that? Probably not working correctly either. > IMHO the dependency is a moot issue. If I used your VPN I'd be dependent > on you... but you're suggesting that you can still reach me if my ISP's > edge router dies and this is not true. Also if I were on your VPN, I > would have to travel all the way to the netherlands and back half way > across the US to reach say Indiana. So very inefficient. I don't suggest that you would use only our VPN server, you could connect it in addition to some other to have additional redundancy and maybe a more efficient path to western europe. You (or ARDC, using their money) should eastablish one or more VPN servers on the eastcoast and/or Canada, then you connect there and those servers connect back to UCSD or maybe even advertise some of the locally assigned subnets on internet BGP. Then it will improve your connectivity to internet, and connectivity to other AMPRnet systems is the same or similar. Furthermore, you can buy a 4G router and use that as a backup for when your ISP link or -router dies, and you can switchover all your routing to that path automatically within seconds. Even when its address is dynamic and probably even when they have such idiotic policies as your ISP appears to have (because the VPN will just re-establish when it fails). Rob

2 1

ARIN services now possible
by Scott Nicholas 22 Jul '19

22 Jul '19

Now that the space isn't legacy we can begin to use ARIN services. Delegated RPKI definitely needs to happen. What about SWIP? Looking forward to helping anyway I can. I believe most of the lift for RPKI would be for the portal programmer. Regards, Scott. ki4cuw

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net