7 May
2017
7 May
'17
8:07 p.m.
After fighting with my system off and on for months I'm finally on
AMPRNET but I'm not sure If I'm on the mesh yet. I can get to google
and it looks like anywhere on the Internet and can get to my cox email
using the thunderbird email client from my workstation.
I think I had problems in the past because I had a pre-existing strong
iptables firewall and I tried to adapt the Linux configuration on the
wiki to the existing strong firewall. Yesterday I decided to start from
scratch and build using the Linux gateway instructions on the wiki. I
had it working but it seems it failed after I restarted the gateway, I
had no connectivity from my gateway to any of my local systems after the
reboot. Today I rebuilt from scratch again and it seems to be working
except it seems I can't get to anything in the 44/8 network except my
own IP block.
I've installed the latest ampr_ripd available as of today but need to
know how to tell if it's adding routes into the routing table.
My current setup is a Linux router, three Raspberry Pi and a Linux
Desktop that serves as my workstation (Yesterday it was a headless
Raspberry Pi).
Tests I've done:
1. A query on Google for "What's my IP address". I got back 44.98.63.3
(my workstation) proving I'm going through the AMPR gateway. When I
attempt to connect to some of the services linked from the wiki such as
http://n1uro.ampr.org/do.shtml and http://whatismyip.ampr.org I don't
get responses back. So my first question is how do I test to see if I
have mesh routing up to the rest of the 44Net?
2. I need to learn how to set up iptables to only accept ipencap packets
from AMPR gateways. I suspect it requires using ipset which I've used
in the past for dropping traffic from systems trying to crack into my
router which leads me to my second question. Is there anyone out there
willing to show sample code how to allow ipencap traffic only from AMPR
gateways?
3. Last night before I restarted and lost ability to use my workstation
(remotely, I have not figured out why it failed yet) I was able to log
on to my VPS at Linode from my ISP provided space and then SSH into my
workstation on my 44/8 address through the tunnel... At the time the
workstation was the headless Raspberry Pi, this worked perfectly. I also
notice my google traffic uses HTTPS and my email client is using port
465 and 993... all of these are encrypted. My third question: I know
they aren't allowed over the air, so how do we account for/deal with
software that insists on using encrypted protocols? Is SSH allowed for
remotely maintaining our nodes?
4. A couple of weeks ago, I ordered and received the parts to build a
Stratum 1 Time server that I intend to make publicly available to the
44Net as a service to the 44Net community. Once I get it online and the
security in place to prevent nefarious activity, How do I announce it?
I intend to have a web server, a time server, a DNS server and an NNTP
server online as well as a local packet node and a tunnel to the AREDN
and possibly a link to the HAMWAN out of Tampa if they'll allow me to
link to them. I'm open to suggestions on proper operating procedure.
--
Tom Cardinal/MSgt USAF (Ret)/BSCS/CASP, Security+ ce
8 May
8 May
7:53 a.m.
Tom, KI4SZJ,
You covered a bunch of inquires:
1.) I run http://whatismyip.ampr.org - If you're not receiving it, it's
highly likely you don't have my route properly loaded, installed and
configured for use. The best way to check to see if you have routing up
is to look at the route table where you have ampr-ripd placing our
routes. Also, try browsing to it from the regular Internet and do a
trace to your 44 IP. Here's a command to see if there's a route for me:
example@routerexmaple:# ip route get 44.60.44.10 from <YOUR ROUTER IP>
Also be sure you DIDN'T assign a remote IP to your tunl0, in that case,
you only have a tunnel to the Internet Gateway for AMPR (AMPRGW).
2.) Check the firewall Wiki, there's a lot of goodies there
3.) Are you delivering any portion of your connections over a Part 97
link (not just Wi-Fi)??? If not, your inquiry doesn't really come into
play. In addition, a communication (SSH) could be allowed (for example)
to control a router further downstream that goes over a radio link. I
plan to account by blocking those protocols where they aren't to control
a router or access point...although, you may want to see my writings in
some HSMM-Mesh discussion on the 'Interents' - as I propose the
"meaning" of the packets never become "obscured"...but that's a
whole
'nother story...
About the reboot - make sure you didn't clear a manual route you entered
after rebooting, you have to configure everything to be persistent upon
reboot.
4.) I surmise your time comes from CDMA or GPS...I also host NTP, DNS
and a HTTP server, welcome aboard! Simply assign IPs from your
allocation to these devices. Make sure there's a DNS entry through your
regional coordinator.
73,
- Lynwood
KB3VWG
8:03 a.m.
Hi,
I just set this up which you might find useful:
https://u4477715.ct.sendgrid.net/wf/click?upn=Ki4chJONuNfM0VomxEE-2BoZH6yGO…
It hasn't been extensively tested yet so if you can speak to other
hosts but not my test server it's probably my end, however it might
tell you something that points you in the right direction.
Thanks,
Mike, M6XCV
On 8 May 2017 at 01:07, Tom Cardinal <ki4szj(a)gmail.com> wrote:
(Please trim inclusions from previous messages)
_______________________________________________
After fighting with my system off and on for months I'm finally on AMPRNET
but I'm not sure If I'm on the mesh yet. I can get to google and it looks
like anywhere on the Internet and can get to my cox email using the
thunderbird email client from my workstation.
I think I had problems in the past because I had a pre-existing strong
iptables firewall and I tried to adapt the Linux configuration on the wiki
to the existing strong firewall. Yesterday I decided to start from scratch
and build using the Linux gateway instructions on the wiki. I had it working
but it seems it failed after I restarted the gateway, I had no connectivity
from my gateway to any of my local systems after the reboot. Today I
rebuilt from scratch again and it seems to be working except it seems I
can't get to anything in the 44/8 network except my own IP block.
I've installed the latest ampr_ripd available as of today but need to know
how to tell if it's adding routes into the routing table.
My current setup is a Linux router, three Raspberry Pi and a Linux Desktop
that serves as my workstation (Yesterday it was a headless Raspberry Pi).
Tests I've done:
1. A query on Google for "What's my IP address". I got back 44.98.63.3 (my
workstation) proving I'm going through the AMPR gateway. When I attempt to
connect to some of the services linked from the wiki such as
https://u4477715.ct.sendgrid.net/wf/click?upn=ZiTkFo6Q8gi-2B-2FtCxNB4PAqv5Z…
and
https://u4477715.ct.sendgrid.net/wf/click?upn=L7qqYgwPvTwMbUijAihV1joigbbl6…
I don't get
responses back. So my first question is how do I test to see if I have mesh
routing up to the rest of the 44Net?
2. I need to learn how to set up iptables to only accept ipencap packets
from AMPR gateways. I suspect it requires using ipset which I've used in
the past for dropping traffic from systems trying to crack into my router
which leads me to my second question. Is there anyone out there willing to
show sample code how to allow ipencap traffic only from AMPR gateways?
3. Last night before I restarted and lost ability to use my workstation
(remotely, I have not figured out why it failed yet) I was able to log on to
my VPS at Linode from my ISP provided space and then SSH into my workstation
on my 44/8 address through the tunnel... At the time the workstation was the
headless Raspberry Pi, this worked perfectly. I also notice my google
traffic uses HTTPS and my email client is using port 465 and 993... all of
these are encrypted. My third question: I know they aren't allowed over the
air, so how do we account for/deal with software that insists on using
encrypted protocols? Is SSH allowed for remotely maintaining our nodes?
4. A couple of weeks ago, I ordered and received the parts to build a
Stratum 1 Time server that I intend to make publicly available to the 44Net
as a service to the 44Net community. Once I get it online and the security
in place to prevent nefarious activity, How do I announce it?
I intend to have a web server, a time server, a DNS server and an NNTP
server online as well as a local packet node and a tunnel to the AREDN and
possibly a link to the HAMWAN out of Tampa if they'll allow me to link to
them. I'm open to suggestions on proper operating procedure.
--
Tom Cardinal/MSgt USAF (Ret)/BSCS/CASP, Security+ ce
_________________________________________
44Net mailing list
44Net(a)hamradio.ucsd.edu
https://u4477715.ct.sendgrid.net/wf/click?upn=vS4GjSiF-2F5vYmfX5tr6ez81-2Fe…
2755
days inactive
2755
days old
2 comments
3 participants
participants (3)
-
lleachii＠aol.com -
M6XCV (Mike) -
Tom Cardinal