4 Nov
2021
4 Nov
'21
4:45 p.m.
That's because that setup does not allow that, because replies will go
out your main default route, from table main.
There should be another routing table, let's say 45, holding only a
single default route:
ip route add default dev ampr0 via 169.228.34.84 onlink table 45
And you need to connection mark any incoming new connection from ampr0
NOT in 44.0.0.0/9 or 44.128.0.0/10 with that connection mark, and then
mark any packet with that connection mark with routing mark 45.
This will ensure the replies coming from ampr0 go back the way they came
in...
So basically you need this:
iptables -t mangle -A PREROUTING -i ampr0 -s 44.0.0.0/9 -j RETURN
iptables -t mangle -A PREROUTING -i ampr0 -s 44.128.0.0/10 -j RETURN
iptables -t mangle -A PREROUTING -i ampr0 -j CONNMARK --set-mark 45
iptables -t mangle -A OUTPUT -m connmark --mark 45 -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING ! -i ampr0 -m connmark --mark 45 -j CONNMARK
--restore-mark
But be aware, this will get the door wide open from the internet to your
internal network, so setting up some firewall rules would be useful...
Marius, YO2LOJ
On 04/11/2021 23:28, KUN LIN via 44Net wrote:
Oh, when I run find_pass.sh again, I did get the ripv4
broadcast and found the password.
And then I proceed to setup rc.local as documented in that wiki article. However, I still
can't ping my AMPR IP from Internet.
-- rc.local
###
## Create AMPRNet Tunnel and routing
##
## Configure Tunnel (put your ISP you received from your ISP Here).
ip tunnel add ampr0 mode ipip local 209.141.42.9 ttl 255
## Bring it up
ip link set dev ampr0 up
## Enable Multicast in order to receive routes
ifconfig ampr0 multicast
## Configure Policy Based routing
# Packets to 44/8 network use routing table 44
ip rule add to 44.0.0.0/8 table 44 priority 44
# Packets from our 44 subnet use table 44 (put your AMPRNet Subnet here)
ip rule add from 44.26.0.168/29 table 44 priority 45
## Configure static routes
# Default route for table 44 is to send traffic to amprnet gateway at UCSD
ip route add default dev ampr0 via 169.228.34.84 onlink table 44
# Route packets for our net to local interface (put your AMPRNet Subnet here)
ip route add 44.26.0.168/29 dev ens3 table 44
## Start ampr-ripd to learn rest of mesh routes
# Be sure to substitute the password you found earlier for <SecretPassword>
# Put your static IP you received from your ISP here.
/usr/bin/ampr-ripd -s -i ampr0 -a 209.141.42.9 -t 44 -p <thepassword I received>
________________________________
From: 44Net <44net-bounces+dnwk=linkun.info(a)mailman.ampr.org> on behalf of Steve L
via 44Net <44net(a)mailman.ampr.org>
Sent: Wednesday, November 3, 2021 18:46
To: 44Net general discussion <44net(a)mailman.ampr.org>
Cc: Steve L <kb9mwr(a)gmail.com>
Subject: Re: [44net] Tunnel setup help: Debian 11
I have configured the public IP in the AMPR
portal as gateway.
If you just did this, wait a while like a half hour.
When I try to run find_password.sh in
ampr-ripd-2.4, I am stopped at Waiting for RIPv2 broadcasts... and never retrieve a
password.
You don't need to run the find password script or specify a password
if you are using ampr-ripd above version 1.14 (its hardcoded in the
program). But I do believe even if you run that, it should retrieve
it.
I usually start off really stripped down, with all firewall stuff off
till I know I am receiving the protocol 4 rip broadcasts.
Do you see anything with tcpdump ?
tcpdump -i eth0 -vvv host amprgw.ucsd.edu or ip proto \\icmp
If not, then something upstream is blocking protocol 4 from reaching
you. Seems like it might be outside of your home if your configuring
the interface directly with a public IP
In the iptables world, here is the ipencap (protocol 4) syntax:
iptables -A INPUT -p 4 -j ACCEPT
On Wed, Nov 3, 2021 at 6:11 PM KUN LIN via 44Net <44net(a)mailman.ampr.org> wrote:
> I have been trying to configure the AMPRtunnel for a while without success. Could
someone please point me to the right direction.
>
> I am running Debian 11 with public IP. I have configured the public IP in the AMPR
portal as gateway.
>
> I am trying to follow this document
https://wiki.ampr.org/wiki/Ubuntu_Linux_Gateway_Example
>
When I try to run find_password.sh in
ampr-ripd-2.4, I am stopped at Waiting for RIPv2 broadcasts... and never retrieve a
password.
>
> Here is what I have done so far.
>
> in /etc/network/interfaces, I added
>
> auto ens3:1
> iface ens3:1 inet static
> address 44.26.0.168
> netmask 255.255.255.248
>
> Then I created ipip tunnel using following commands
>
> ip tunnel add ampr0 mode ipip local 209.141.42.9 ttl 255
> ip link set dev ampr0 up
> ifconfig ampr0 multicast
> ip rule add to 44.0.0.0/8 table 44 priority 44
> ip rule add from 44.26.0.168/29 table 44 priority 45
> ip route add default dev ampr0 via 169.228.34.84 onlink table 44
> ip route add 44.26.0.168/29 dev ens3 table 44
>
> Then, I run ampr-ripd -d -v -i ens3 to get the password in order to plug into lat
command
> ampr-ripd -s -i ampr0 -a 209.141.42.9-t 44 -p <SecretPassword>
>
> However, the find_password.sh stopped at waiting for ripv2 broadcast. Here is the
logs for command
>
> Using metric 0 for routes.
> Using TCP window 840 for routes.
> Using gateway 209.141.42.1 for direct 44net endpoints via interface ens3.
> Waiting for RIPv2 broadcasts...
>
> Any idea on what am I doing wrong?
> Thanks
>
> Kun
>
> _________________________________________
> 44Net mailing list
> 44Net(a)mailman.ampr.org
> https://mailman.ampr.org/mailman/listinfo/44net
_________________________________________
44Net mailing list
44Net(a)mailman.ampr.org
https://mailman.ampr.org/mailman/listinfo/44net
_________________________________________
44Net mailing list
44Net(a)mailman.ampr.org
https://mailman.ampr.org/mailman/listinfo/44net