44net

44net@mailman.ampr.org

1 participants
3194 discussions

Re: [44net] 44 net connectivity
by Rob Janssen 23 Jul '19

23 Jul '19

> But to be honest I would say a bigger deterrent to using 44 net is the nature of some of the discourse on here. I can't claim to be a Saint myself but honestly some people's dialog is frankly appalling. > Yes there is some improvement to be made around technology but also some rules around acceptable use of the mailing list should go hand in hand with it. It is unclear to me what you are referring to. Maybe you should be reminded that part of the people here do not have English as their first language. Their language vocabulary is limited and it is difficult for us to express the subtleties that you may want to see. Rob

2 1

Adding VPN server at UCSD ?
by R P 23 Jul '19

23 Jul '19

Hi there Now that we have a lot of money in the pocket may we consider installing a VPN server at UCSD to allow user connecting AMPRNET with VPN in addition to the IPIP tunnel ? I myself will be more then happy to move our networks from IPIP connectivity to VPN (or any other more sophisticated technology) . Thanks Forward Ronen - 4Z4ZQ

6 10

Re: [44net] Time to restructure the network?
by Rob Janssen 23 Jul '19

23 Jul '19

> Personally, I love the idea of allowing the network to be more inclusive by allowing connections other than the current IPIP one. Rather than replace IPIP, I would suggest that we keep it and just allow people to act as hubs for those that are behind NAT/Limiting firewalls, etc. This is what we already have working, and others have that too. A local VPN server that is connected to IPIP (and in our case BGP too). However, such a setup is a bit complicated because the IPIP mesh is not well supported on many router types, and having the two different network types integrated in the same router also is kind of tricky. Not everyone gets that right: all routes have to be in the same routing table and evaluated from more-specific to less-specific. But you still need to handle cases where multiple routes to the same subnet (using different protocols) can exist. In some cases, people have resorted to having multiple routing tables and searching them in a specific sequence, but that does not work correctly in some cases. Also there is the issue of determining the correct source address. Sometimes such gateways send traffic with a non-44net source address through an IPIP tunnel, which of course is unwanted. So my proposal is to drop the IPIP mesh to remove this additional complexity, and make the system easier to rollout and maintain. > While I think BGP would be great, it adds questions like: can people announce their own non-44 space, can people use their own ASNs, how will we allocate ASNs, how do we confirm people are announcing space actually allocated to them. One thing we can do, is look at DN42 and how they work. Their network is similar to some of these suggestion with the exception that they use private space. Some of those topics have already been addressed and resolved before. For example w.r.t. the AS numbers, we have agreed to use an allocation scheme for private AS numbers so this can be delegated to individual regions without chance of collisions. The scheme is to use "42"+iso country designator+5 digits, where these 5 digits can be subdivided in a region specific way. Large countries have several iso country designators so there should be ample space using this scheme. Here we use 42204+3digits+2digits where a router in our 44.137.aaa.bbb/16 subnet gets AS 44204aaann where nn=bbb/16. Of course this network is only meant to distribute net44 addresses, our routefilters filter announcements outside that. But you can announce space for your friend inside net44. Actually the same as the current IPIP situation. Indeed very similar to what DN42 does. Rob

6 5

Re: [44net] 44.192.0.0/10 sale
by Rob Janssen 22 Jul '19

22 Jul '19

> >/I don't suggest that you would use only our VPN server, you could /> >/connect it in addition to some other to have additional redundancy /> >/and maybe a more efficient path to western europe. / > Why would I want or need to go across the Atlantic when it's not > necessary since IPIP is working fine for me. Because we are trying to draft a new solution that would not work only for you, but also for others. You do not seem to be interested in that. > >/You (or ARDC, using their money) should eastablish one or more VPN /> >/servers on the eastcoast and/or Canada, then you connect there and /> >/those servers connect back to UCSD or maybe even advertise some of /> >/the locally assigned subnets on internet BGP. / > I don't see where this would be a reasonable allocation of funds by > ARDC. Come on, it costs like $5-$10 per month per location to host such a service. And that is only when it is paid for. Last time I asked here for volunteers to host an echolink proxy farm, there were like 10 volunteers that would do (and did) it for free. It is likely that they would add such a VPN server feature to their already existing hosted system, if we would kindly ask it to them. > If ARDC were to allocate funding I would rather see it go into research > of new techologies. We as hams are not leaders anymore, we're lemmings. That would be a complete waste of money! As is clearly shown by this entire discussion, there is nothing that hams hate more than to change something that they think is working well for them, even without considering how it works for others. Again, it is much like the discussion about CW. Large groups of hams still believe that CW is the most efficient mode and can be received when all other modes fail. Utter bullshit, of course, but it was like that 50 years ago so it still must be true today. > >/Then it will improve your connectivity to internet, and connectivity /> >/to other AMPRnet systems is the same or similar. / > How will that improve my connectivity to the internet? I can and do get > around blocks by my ISP just fine - once I know what they are and I take > full advantage of the 200Mbs link I have for a residential circuit. The connectivity to internet from your 44net systems, of course! That would now go via UCSD and when you could get a local VPN server which also announces the state's network allocation on BGP, it would be faster than the trip via UCSD in many cases. > I could get another circuit with 4G backup and shell out almost > $2,000/yr additional as a business circuit but why? For people on this > list to try and tell me what to do with my circuit that I spend my money > on? I think not thank you. That's when a ham community turns into a ham > dictatorship. It is always amazing to see people on this list toggle between "but there are single points of failure in this solution, I do not like that!" and "don't tell me to do things the way you like" after explaining them how to work around those single points of failure. Apparently they bring that up only to put a spanner in the works of any discussion about change, not because they really care about it. Also I think your solution is way too expensive. My home internet connection (with fixed IPv4, native IPv6 /48, 100 Mbps, unlimited data, no silly filtering) costs me less than $600/year and it includes 4G backup up to 1GB/month. Rob

3 3

Re: [44net] Adding VPN server at UCSD ?
by Rob Janssen 22 Jul '19

22 Jul '19

> No need to use UCSD. Cloud based server(s) work just fine. Places like > AWS drip with bandwidth. Is AWS able to run an IPIP gateway? I am currently trying to migrate an IPIP gateway from the "Hosted Raspberry Pi" that it is now to a VM that is being offered as a replacement, but it turns out that the "Apache Cloudstack" that this (and apparently many other) hoster uses to deploy VMs is unable to pass other network traffic than TCP and UDP. (and replies to outgoing traffic) Good enough for OpenVPN and will probably work with IPsec and other VPN protocols, but not suitable for an IPIP gateway that also accepts incoming traffic. I am now looking for a solution. Of course I can make a VPN to our gateway, but this system was a test environment for an IPIP gateway. When IPIP goes away, I no longer need it. However, I could also use it to draft an example of how to setup a VPN service on a Linux machine. Rob

3 2

Re: [44net] Adding VPN server at UCSD ?
by Rob Janssen 22 Jul '19

22 Jul '19

> You can also host it in vultr. I would have to check, but IPIP should not be a problem there and it costs indeed about 5$ per month Toussaint TK1BI is also using that, isn't it? It seems one can even advertise BGP space there. I see they also host in Amsterdam. In fact, when we would deploy a VPN server in all 16 datacenters they offer we already would have covered most of the world. But that is another topic, this query is mainly intended for my personal colocation server. (it serves my mail, my website, an IPIP gateway for testing, and an echolink proxy server for testing) Rob

1 0

Re: [44net] 44.192.0.0/10 sale
by Rob Janssen 22 Jul '19

22 Jul '19

> No it is not possible with my ISP. To run any local services is a > violation of the ToS agreement. The ports and services they close they > will not open. I've tried. They also incorporate a watchdog on all > sockets that destroys them after so many minutes of "birth". This kills > client services such as VPN, SSH, etc. Web services often aren't > affected since most web elements are downloaded within 300 seconds +/-. I would go away. How do you get IPIP working over that? Probably not working correctly either. > IMHO the dependency is a moot issue. If I used your VPN I'd be dependent > on you... but you're suggesting that you can still reach me if my ISP's > edge router dies and this is not true. Also if I were on your VPN, I > would have to travel all the way to the netherlands and back half way > across the US to reach say Indiana. So very inefficient. I don't suggest that you would use only our VPN server, you could connect it in addition to some other to have additional redundancy and maybe a more efficient path to western europe. You (or ARDC, using their money) should eastablish one or more VPN servers on the eastcoast and/or Canada, then you connect there and those servers connect back to UCSD or maybe even advertise some of the locally assigned subnets on internet BGP. Then it will improve your connectivity to internet, and connectivity to other AMPRnet systems is the same or similar. Furthermore, you can buy a 4G router and use that as a backup for when your ISP link or -router dies, and you can switchover all your routing to that path automatically within seconds. Even when its address is dynamic and probably even when they have such idiotic policies as your ISP appears to have (because the VPN will just re-establish when it fails). Rob

2 1

ARIN services now possible
by Scott Nicholas 22 Jul '19

22 Jul '19

Now that the space isn't legacy we can begin to use ARIN services. Delegated RPKI definitely needs to happen. What about SWIP? Looking forward to helping anyway I can. I believe most of the lift for RPKI would be for the portal programmer. Regards, Scott. ki4cuw

2 2

Re: [44net] Adding VPN server at UCSD ?
by Rob Janssen 22 Jul '19

22 Jul '19

> I don't think BGP has a problem working over IPIP tunnels. In the end it is just a TCP connection to one or mre endpoints. In principle yes, but unfortunately the current IPIP tunnel implementation handles both the tunnel establishment and the routing. The routing is static. You cannot setup BGP sessions because you do not know the other side's address and AS. Possibly one could work around that by adding the 44net endpoint address and the BGP AS number of each tunnel gateway, so the endpoints could connect eachother for the BGP routing. However that would be another major change and I'm not sure everyone would want to BGP peer with everyone else. That could also introduce new scaling problems. Rob

2 1

Re: [44net] Adding VPN server at UCSD ?
by Rob Janssen 22 Jul '19

22 Jul '19

> Oh, I misunderstood maybe. I considered that the Israelian BGP subnet will be announced from the VPN Server’s ASN. It will not go to UCSD and traffic to it will not come via UCSD. > Having UCSD in the middle for non-North America is 200+ ms bonus per packet, so most people want to avoid it. He repeatedly indicates that it his beyond his capabilities to arrange such things. However, once we have a flexible overlay network in place, he could connect to some more nearby gateway and try to get it arranged that this gateway also announces the Israelian subnet. Then he has a shorter roundtrip to internet without having to set it up himself.

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net