44net

44net@mailman.ampr.org

3196 discussions

Re: [44net] Time to restructure the network?
by Rob Janssen 21 Jul '19

21 Jul '19

> Then, the question becomes : > - Is it better to keep full mesh / standalone endpoints (such as current > IP-IP) ? But if so, how to handle Plug and Play and NAT traversal ? > - Or is it better to have small local gateways managed by skilled teams, > and end-users connecting to those gateways with simpler PnP VPN systems ? > > We choosed the second option, with fully home-made design (OpenWRT, > OpenVPN, OSPF), because it best suited our needs, and because we are an > island, with few inter-connects with the rest of the world. Same thing here. We are not an island but still we feel that we need to use a local gateway where everyone is connected using modern technologies compatible with today's internet connections and equipment. Our gateway is still connected to the IPIP mesh but the individual stations are connected using another VPN type. > It seems lots of people in the world are using similar designs, with a > central gateway and enpoints connecting to it via VPNs. Maybe we just > have to share our experiences, and adopt some kind of "standardized" > rules for our gateways ? That is what I am trying to do... and reduce their compexity by dropping the old IPIP mesh and use some newer technologies that are available in standard routers, so it will become easier to setup a gateway. Rob

4 3

44.192.0.0/10 sale
by Phil Karn 21 Jul '19

21 Jul '19

Hello all, I've not been active here, but some of you may remember me as the guy who first got TCP/IP going on amateur packet radio way back in 1986. At one time, my name was registered as the owner of the block. This makes me one of a VERY small group of people with any arguable personal property interest in network 44. And yes, 25% of this space, which is VERY unlikely to ever be used by hams, has been sold to Amazon. Rather than try to personally profit from this, we all readily agreed to place the *entire* proceeds of this sale into a 501(c)(3) charity chartered to support amateur digital radio and related developments. No one is buying a yacht or a mansion. As a tax-exempt charity, our tax returns and related documents will be publicly available so you can see what is being done. Like the rest of the amateur community, all of you will have the opportunity to apply for grants and do good things for amateur radio with them. 73, Phil

12 17

Re: [44net] 44.192.0.0/10 sale
by Rob Janssen 21 Jul '19

21 Jul '19

> Please consider using part of the money for reserving us (buying ?) IPV6 address for future use .. I think there is quite universal agreement that we should not buy/reserve special IPv6 addresses as a group but rather everyone should obtain addresses from their own local internet provider and we should arrange some way to distribute the list of IP addresses in use amongst the participants. This makes it unnecessary to use a tunneling system which simplifies the network and makes the routing much faster (no need to go via UCSD anymore!). And these addresses are normally included with your internet service for free. Rob

2 1

Re: [44net] Time to restructure the network?
by Rob Janssen 21 Jul '19

21 Jul '19

> I'll +1 your comments and raise you with this: > > As President and engineer of EastNet, let me go over some bullet points > for those especially NOT in our country or region. > > o The average age of those sysops on EastNet is 70+ > o They grew up without technology and are most happy to remain ignorant > about it > o BGP, IPIP, GRE are initial groupings they could care less about. > o Many of these guys can't even type in a URL without their hands held. > o Virtual Private Network to them sounds like the evil doings of the > dark web and they want nothing to do with it. > o If it's not standard equipment from my ISP it must be against my > contract with them. > o If HRO doesn't sell a pre-made appliance to plug in and use for > this amprnet thing then it can't be any good or work. Do you really think that the abundancy of elderly users in the amateur radio community is to be used as a reason not to change anything anymore until they all are dead? Should there be no development anymore just because these people cannot learn? Should we all stand still just because of that? Don't you think that the scarce newcomers we have (and need) will be running away in laughter when they see such statements being made?? > I could go on but I'll stop right there. As Charles tried to mention, > just because a very small percentage of hams are familiar with amateur > IP or amateur wired internet that doesn't mean the bulk of hams are or > that they even wish to learn. Most still immediately think IP = wired > only period and that's not what they took a license test for... and they > find it to actually be offensive in regards to amateur RADIO. If it's > not HF Contesting, it's not "ham radio" it's wire and they don't need > nor want to learn about this... but they do wish to offer the services. I am in no way proposing that any radio amateur is to be joining the AMPRnet! When they are happy working in CW on HF, or to be contesting, just let them do it! The AMPRnet is for those interested in networking and when they ar not interested in amateur IP there is no need for them to become familiar with it. > The current IPIP mesh network does indeed work... I suppose if it works > don't fix it no longer applies? I'm on it and the fact you see this > mail is a PoC it works. That is a very narrowminded view. The fact that you could make it work does not mean that it works for everyone. We sometimes see the struggles here when people try to join, and I can tell you that joining the system I propose (and that we have had running here for several years, and is running in some other regions as well) is much easier to join. There is NO NEED anymore to fiddle with ISP routers to make forwardings or DMZ settings, NO NEED to install specialized software on routers or systems, just buy a suitable router (e.g. the MikroTik hEX, list price $59,95, or even smaller and cheaper models), apply some simple configuration steps that can be written up in a document, and you are online. And you can make a wireless connection to a friend or to some local access point and the routing will be fully automatic. Traffic to your friend will be over your link and other traffic will be via the internet. As an example of what you need to connect this way, this is an example of all configuration required in such a router to connect (an actual export of a router): /interface l2tp-client add allow=mschap2 connect-to=213.222.29.196 disabled=no ipsec-secret=\ HAMNET-L2TP max-mru=1400 max-mtu=1400 name=l2tp-241 password=12345678 \ profile=default use-ipsec=yes user=l2tp-pd2ebh /routing bgp instance set default as=4220401109 router-id=44.137.11.158 /routing bgp network add network=44.137.11.144/28 /routing bgp peer add in-filter=hamnet-in name=gw-44-137 nexthop-choice=force-self out-filter=\ hamnet-out remote-address=44.137.61.254 remote-as=4220406100 ttl=1 \ update-source=l2tp-241 /routing filter add bgp-communities=44137:10050 chain=hamnet-in set-bgp-local-pref=50 add bgp-communities=44137:10200 chain=hamnet-in set-bgp-weight=200 add action=accept chain=hamnet-in prefix=44.0.0.0/8 prefix-length=8-32 add action=accept bgp-as-path=4220406100 chain=hamnet-in prefix=0.0.0.0/0 add action=discard chain=hamnet-in add action=accept chain=hamnet-out prefix=44.0.0.0/8 prefix-length=8-32 add action=accept bgp-as-path=4220406100 chain=hamnet-out prefix=0.0.0.0/0 add action=discard chain=hamnet-out That is all! With this configuration, that user connects to our VPN server with L2TP/IPsec which passes NAT and can be on a dynamic address, advertises the local network and receives the routes. This can be copied to another user and just be modified for the different user,password,AS number, router ID and local network. This is the text version of the configuration, it can be modified in a GUI when desired. Sure you can keep saying "but my 70+ years old users don't understand it and they have their JNOS box running IPIP so they don't want to change that" but do you really think this can be used as a reason to keep everything the same and not to allow others to join much more easily? That is like saying the new hams should learn CW because the old ones also did, and the new digital modes (e.g. FT-8) are evil because the CW operators don't understand them. Rob

3 2

Re: [44net] Time to restructure the network?
by Rob Janssen 21 Jul '19

21 Jul '19

> As far as we are thinking about possible evolutions, we can also add new > criteria. Ability to change link "weight" according to link quality (or > other parameters) may be an intesring thing. Well, as soon as something is changed in the protocol you lose the big advantage of running standard protocols available in standard firmware, see the AMPR RIP thing. > I don't know if BGP has some "weight" parameter. OSPF has. It can not > change the weight dynamically, but it's possible to change that weight > by an external script. That's nice, and that's the reason why we choose > OSPF for our "internal" network. I have considered doing similar things in BGP (adjusting prepend or local-pref dynamically based on SNMP monitoring of the link). We have not experimented with OSPF yet, I read in many places that it has problems with scaling when the CPU power on routers is limited (like on old RB750s) Rob

5 7

Time to restructure the network?
by Rob Janssen 21 Jul '19

21 Jul '19

Now that we are all going to have to dive into our router configurations, wouldn't it be a good time to make some changes that are long overdue? Like getting rid of the IPIP mesh and replace it with something more modern and supported by off-the-shelf routers, works behind NAT, etc? I would say setup some routers with VPN of different types around the world, have everyone connect to there using a suitable VPN protocol, run BGP on it to announce the gateway subnets. A $50 MikroTik can do those jobs, for those that still want to run a JNOS system on MS-DOS they can put one in front of their box and still use it. People are already using it for IPIP mesh, a change in topology would be only a config change for them. And other routers mentioned here can do it too, without having to get external programs installed on them. Those that want direct connection without a centralized system in the path can simply setup a VPN connection between them and configure the BGP peers, it will automatically work. There is no need to use only a single protocol in such a network, only the peers have to agree, so you can select from anything like L2TP/IPsec, OpenVPN, Wireguard, just plain GRE or even IPIP, etc etc. Just at this time I am trying to move my colocated machine that runs as an IPIP mesh member and I face that stupid "protocol 4 is not passed by the firewall" problem again. Arghh!! Also we could get that IPv6 idea going. Remember it has been discussed many times and the only things we still need is some agreement on how to register and distribute the "list of AMPRnet prefixes in IPv6 space". Again that could be done using BGP, no need to setup yet another registration portal with downloadable files. Note that Daniel EA4GPZ put some ideas around IPv6 on his site: https://destevez.net/ipv6-for-amateur-radio/ Rob

9 10

Re: [44net] Time to restructure the network?
by Rob Janssen 21 Jul '19

21 Jul '19

> I saw that. Messages are readable on Android, but appears blank in Thunderbird. When we answer, the answer remains blank (but the text is readable in the message source) > Will check... Mail isn't what it used to be. Programs like Thunderbird auto-decide whether to send the mail in text or HTML, and somewhere along there are linebreaks inserted in the messages that I do not insert myself and that do not appear in my Sent folder, which fouls up the layout. I see that with some other people's messages as well, so the fault may be in the mailing list software. The funny thing is that sometimes when my messages, that appear broken when posted, get quoted by other people they suddenly are OK. It is now completely unclear to me whether I am supposed to breakup paragraphs by line or to type everything on a single line. Both ways things are getting fouled up. Rob

4 4

Re: [44net] IPv6 adoption (was: address sale)
by Rob Janssen 21 Jul '19

21 Jul '19

W.r.t. the issue of /64 or smaller addresses, my plan is as follows: - we have a /16 network within AMPRnet (44.137.0.0/16) - it is very easy to get a /48 network in IPv6 (every home customer at my ISP gets one of them, I have one as well. it would be easy to get a /48 assigned to our gateway where 44.137.0.0/16 is BGP routed now - I want to make a 1:1 mapping of every assigned address in our IPv4 subnet to a /16 network within that /48 space. E.g. when we get 1234:5678:abcd::/48 from our ISP, I would map 44.137.0.1 to 1234:5678:abcd:0001::/64, up to 44.137.255.255 mapped to 1234:5678:abcd:ffff::/64 - This means every single address allocated in IPv4 gets a /64 subnet in IPv6, any /28 in IPv4 (common subnet size for hams) gets a /60 subnet, etc. This way, standard practices for using IPv6 addresss can be used, and the proposal of Daniel EA4GPZ can be followed to encode the callsign and service in the lower 64 address bits as desired (for convenience only). We would "just" have to add IPv6 addresses to all routers in our network, but it can be done in an almost automated way because the IPv6 addresses and subnets can be calculated from the IPv4 addresses already configured using a simple tool. Of course it still requires quite some work, and causes double maintenance on things like firewalls and routing filters, so I have not done it yet. But it sure would be possible. Rob

6 7

Re: [44net] IPv6 adoption (was: address sale)
by Rob Janssen 21 Jul '19

21 Jul '19

> > - I want to make a 1:1 mapping of every assigned address in our IPv4 > > subnet to a /16 network within that /48 space. > > E.g. when we get 1234:5678:abcd::/48 from our ISP, I would map > > 44.137.0.1 to 1234:5678:abcd:0001::/64, up to 44.137.255.255 mapped > > to 1234:5678:abcd:ffff::/64 > I'm a bit lost at what you're suggesting, and the practical way it would > be implemented. At first glance, this looks like a recipe for > suboptimal routing to the outside world. The above is an idea how to add IPv6 addresses to the 44.137.0.0/16 network that is BGP connected in a datacenter and where users are connected via VPN and radio paths. The added IPv6 addresses would be from the datacenter space and would be routed along the same paths as the 44.137 traffic. Of course that is suboptimal, but it works for users that do not have IPv6 themselves. > I have 2 AMPRnet IPv4 allocations - one BGP connected, one IPIP > connected. Both sites have IPv6 available. Here, where the IPIP mesh > terminates has a /56. I currently have a /64 on the VPS, but as there's > only one host, it wouldn't be difficult to carve that into AMPRnet and > non AMPRnet parts, because IPs are assigned by hand and are all on the > same interface. In my opinion it is not a good idea to deploy a system based on splitting a /64 net in smaller subnets. You could do that locally, but you would not want to give other local users an IPv6 network that is smaller than a /64. This is going to cause all kinds of difficulties. That is why my intention is to give every user at least a /64. Rob

2 1

Re: [44net] Time to restructure the network?
by Rob Janssen 21 Jul '19

21 Jul '19

> > Setting up BGP on a MikroTik is much much much easier than getting > > IPIP mesh to run on anything! > I see an opportunity here to learn BGP. I'm for this idea. I posted an example configuration above. Of course this is not the same as "learn BGP", but I think many users of the current IPIP mesh also did not "learn IPIP" and "learn RIP" but only copied an example configuration and fiddled with it until it worked. Of course when you want to setup a regional VPN server you need some configuration for that as well, but when such a system would be deployed of course examples for that can be given as well. BGP for such a small closed network is not that complicated. Basically every system maintains a TCP connection (port 179) with all its peers, and it sends the networks that it can route. It receives the same information from the other side, and fills the route table. The active route is selected on a couple of criteria, where the least number of hops is usually preferred. It is possible to send tags along each route (called bgp-communities) that can be used to prefer certain routes over others, e.g. to prefer routes over radio when both a radio and a VPN path exist. There are some issues with BGP, e.g. the total lack of security in the protocol. Anyone can claim that they have a subnet and all the others will happily route all traffic for that subnet to them. The routing filters are an attempt to work around the most severe problems, but as can be seen on the internet (which also uses BGP) it is difficult to make it completely failsafe. Also, in our world it is a bit of a nuisance that there is no way to incorporate some form of dynamically determined link quality in the routing decision. Links are either up or down. But for this proposed use (replacement of the IPIP mesh) that is not a problem, it mainly affects the use of BGP on the radio links in our network. Rob

2 1

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

44net