And have you changed the IP address of the UCSD Tunnel?

SP2GCH

2017-06-09 9:47 GMT+02:00 Josh josh@festy.org:

I'm not receiving RIP packets from the gateway, and haven't had internet connectivity for over 48 hours now. Glad to hear it's not just me, I've been pulling my hair out looking for a problem with my end ;)

Josh - VK2HFF

On 9/06/2017 4:54 PM, R P wrote:

...

Has anyone else see connectivity problems of the 44 net ?

My tunnel work but no connection to the internet

---

44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net

Josh, your problem appears to be similar to Ronen's. The ipip gateway is working normally, the routes to you appear to be correct, and I can ping your gateway on its commercial address. You should be receiving encapsulated RIP packets every five minutes from 169.228.34.84. Please check that that address is allowed through any firewalls you may have and that you have it configured as the endpoint of your tunnel to the internet. - Brian

On Fri, Jun 09, 2017 at 05:47:07PM +1000, Josh wrote:

I'm not receiving RIP packets from the gateway, and haven't had internet connectivity for over 48 hours now. Glad to hear it's not just me, I've been pulling my hair out looking for a problem with my end ;)

Josh - VK2HFF

i think it is something in the routing table in the main router as happened a week ago until u made reset or so ________________________________ From: 44Net 44net-bounces+ronenp=hotmail.com@hamradio.ucsd.edu on behalf of Brian Kantor Brian@UCSD.Edu Sent: Friday, June 9, 2017 2:45:35 AM To: AMPRNet working group Subject: Re: [44net] 44 net connectivity problems ?

Ronen, I have checked the ipip gateway here and it is functioning normally. I can connect to the various test hosts on the 44 net as usual. Further, I can ping your gateway on its 5.29.18.144 address, so things should be working unless the problem is at your end. - Brian

On Fri, Jun 09, 2017 at 06:54:16AM +0000, R P wrote:

Has anyone else see connectivity problems of the 44 net ? My tunnel work but no connection to the internet Regards Ronen - 4Z4ZQ

_________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net

im out of home and with the smartphone its hard to me to debug but after thre reset stil no conectivity i have cheked via ping.eu and the ttace stop at amprgate is there someone else here that use tunnel not bgp and have also problem from 44 net to go to the outer world ? ________________________________ From: 44Net 44net-bounces+ronenp=hotmail.com@hamradio.ucsd.edu on behalf of R P ronenp@hotmail.com Sent: Friday, June 9, 2017 3:46:12 AM To: AMPRNet working group Subject: Re: [44net] 44 net connectivity problems ?

i think it is something in the routing table in the main router as happened a week ago until u made reset or so ________________________________ From: 44Net 44net-bounces+ronenp=hotmail.com@hamradio.ucsd.edu on behalf of Brian Kantor Brian@UCSD.Edu Sent: Friday, June 9, 2017 2:45:35 AM To: AMPRNet working group Subject: Re: [44net] 44 net connectivity problems ?

Ronen, I have checked the ipip gateway here and it is functioning normally. I can connect to the various test hosts on the 44 net as usual. Further, I can ping your gateway on its 5.29.18.144 address, so things should be working unless the problem is at your end. - Brian

On Fri, Jun 09, 2017 at 06:54:16AM +0000, R P wrote:

Has anyone else see connectivity problems of the 44 net ? My tunnel work but no connection to the internet Regards Ronen - 4Z4ZQ

_________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net

I have returned home after i accidentally disabled the tunnel interface while trying to recover things using the smartphone

I have turned on the Tunnel interface and all seems to work OK

Mystery ....

Ronen - 4Z4ZQ

________________________________ From: 44Net 44net-bounces+ronenp=hotmail.com@hamradio.ucsd.edu on behalf of Brian Kantor Brian@UCSD.Edu Sent: Friday, June 9, 2017 2:45 AM To: AMPRNet working group Subject: Re: [44net] 44 net connectivity problems ?

Ronen, I have checked the ipip gateway here and it is functioning normally. I can connect to the various test hosts on the 44 net as usual. Further, I can ping your gateway on its 5.29.18.144 address, so things should be working unless the problem is at your end. - Brian

On Fri, Jun 09, 2017 at 06:54:16AM +0000, R P wrote:

Has anyone else see connectivity problems of the 44 net ? My tunnel work but no connection to the internet Regards Ronen - 4Z4ZQ

_________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net

I'm on a static IP, I did change service providers a few weeks back but everything was working fine on the new IP up until a few days ago. I've just grabbed a 10 minute log of all ipip packets in/out of my DMZ interface and all packets on my tunnel for roughly the same time period, they're at http://44.136.24.62/tcpdump/ if anyone is interested (but currently only accessible from another 44 tunnel). There's traffic there, just nothing from amprgw so it appears that the other tunnels I've tested with must have correct encap entries for my network. I've double-checked the portal and my gateway IP is correct there too.

I think my next step is to contact my service provider, it is possible that they saw "suspicious" ipip traffic coming from amprgw to me so blocked it.

Josh - VK2HFF

On 10/06/2017 12:42 PM, lleachii--- via 44Net wrote:

Josh and Ronen,

Do you happen to have dynamic IPs assigned from your ISP?

Have they changed recently?

It’s back online now - more DDOS unfortunately

Chris

On 11 Jun 2017, at 08:11, SP2L@wp.pl wrote:

Greetings.

portal.ampr.org seem to be offline for couple of hours...

No way to login, no way to download encap.txt file.

Best regards.

-- Tom - SP2L

---

It is nice to be important. But it is more important to be nice!

On 10/06/2017 4:28 PM, Josh wrote:

I think my next step is to contact my service provider, it is possible that they saw "suspicious" ipip traffic coming from amprgw to me so blocked it.

I've now confirmed with my service provider that they are not blocking traffic either to or from amprgw. About 12 hours ago I started logging inbound ipip connections on my wan interface, but so far have seen nothing from 169.228.34.84.

# Pkts Traffic Action Prot Fl In Out Source Dest Options 6 0 0.00 B ACCEPT 4 -- * * 169.228.34.84 0.0.0.0/0 - 7 0 0.00 B ACCEPT 4 -- * * 169.228.66.251 0.0.0.0/0 - 8 7652 9.94 MB LOG 4 -- * * 0.0.0.0/0 0.0.0.0/0 LOG flags 0 level 4 prefix "(IPIP)"

I've run out of things to try, and am pretty well convinced that the ipip packets from amprgw are not getting to my WAN interface. I can ping amprgw, and a traceroute makes it as far as rci-nodem-p2p.ucsd.edu (which I think is amprgw's gateway?) so there are no obvious routing issues. I added a rule at the top of my input table an hour ago to log all inbound connections from amprgw, and so far the only matches have been the 4 ICMP replies from my ping test. Any thoughts on where the problem might be?

Josh - VK2HFF

Josh,

I'm more than happy to see if you are sending IPENCAP (IP Protocol No. 4)...but you're not receiving...

Let's first make sure:

- Who is your ISP? - Let's make sure you're receiving IPENCAAP (IP Protocol No. 4) - What's the make and model of router? - how are your configuring your device to receive IPENCAP and processes them?

If you WERE receiving them and they disappeared, did you (or your ISP) make any known changes?

- Lynwood KB3VWG

You may want to read my white page about being bitten by the dog.

Thanks Brian. I have no trouble getting to other 44 gateways via my tunnel including yours (after loading routes from encap.txt via ampr-ripd) so it's not a case of protocol 4 being blocked by my vdsl modem. Since last night I've logged over 10,000 ipip connections on my gateway - just nothing from amprgw.

I was expecting to get a form letter response from my service provider's helpdesk when I asked, but to my surprise it was escalated to their network engineering team who appear to have actually investigated before responding.

Testing from http://kb3vwg-010.ampr.org/tools/trace/php-trace44.php shows that my tunnel is reachable:

traceroute to 44.136.24.60 (44.136.24.60), 30 hops max, 60 byte packets 1 kb3vwg-001.ampr.org (44.60.44.1) 0.999 ms 1.021 ms 1.148 ms 2 vk2hff.ampr.org (44.136.24.60) 525.972 ms 548.696 ms 572.350 ms

Also from http://yo2tm.ampr.org/nettools.php:

traceroute to 44.136.24.60 (44.136.24.60), 30 hops max, 60 byte packets 1 router.yo2loj.ampr.org (44.182.21.254) 0.279 ms 2 net.vk2hff.ampr.org (44.136.24.60) 687.700 ms

I've tried connecting to a random selection of the gateways that had recently checked in to yo2tm's map and no issues there either.

Josh - VK2HFF

On 16/06/2017 11:25 AM, Brian wrote:

Josh;

On Fri, 2017-06-16 at 10:40 +1000, Josh wrote:

...

I've now confirmed with my service provider that they are not blocking traffic either to or from amprgw. About 12 hours ago I started logging inbound ipip connections on my wan interface, but so far have seen nothing from 169.228.34.84.

You may want to read my white page about being bitten by the dog. ISPs will *never* grant you the integrity of admitting to what they're doing as they feel it's not a customer's business what the ISP does on the ISPs network.

This is slowly becoming an epidemic globally with ISPs deploying CPEs with faulty firmware... deliberately. There are alternatives and tests to see if you are bitten. Considering you're having issues you may not be able to see the document but it's at: https://n1uro.ampr.org/linuxconf/amprcable.html

---

73 de Brian - N1URO/AFT1BR email: (see above) Web: http://www.n1uro.net/ Ampr1: http://n1uro.ampr.org/ Ampr2: http://nos.n1uro.ampr.org Linux Amateur Radio Services axMail-Fax & URONode http://uronode.sourceforge.net http://axmail.sourceforge.net AmprNet coordinator for: Connecticut, Delaware, Maine, Maryland, Massachusetts, New Hampshire, New Jersey, Pennsylvania, Rhode Island, and Vermont.

On Fri, Jun 16, 2017 at 10:40:20AM +1000, Josh wrote:

I've now confirmed with my service provider that they are not blocking traffic either to or from amprgw. About 12 hours ago I started logging inbound ipip connections on my wan interface, but so far have seen nothing from 169.228.34.84.

This may be of interest:

# traceroute -n -P 4 110.175.89.41 traceroute to 110.175.89.41 (110.175.89.41), 64 hops max, 40 byte packets 1 169.228.34.82 0.268 ms 0.206 ms 0.208 ms 2 132.239.254.178 0.255 ms 0.222 ms 0.238 ms 3 132.239.254.162 0.274 ms 0.241 ms 0.238 ms 4 132.239.254.149 0.291 ms 0.291 ms 0.306 ms 5 137.164.23.57 3.034 ms 2.987 ms 2.963 ms 6 137.164.11.2 5.529 ms 5.415 ms 5.394 ms 7 * 4.35.156.65 5.372 ms 5.311 ms 8 * * * 9 4.68.62.106 5.265 ms 5.388 ms 5.221 ms 10 63.243.205.65 14.564 ms 13.385 ms 13.322 ms 11 63.243.205.2 13.394 ms 13.246 ms 13.925 ms 12 64.86.21.150 215.916 ms 215.933 ms 216.003 ms 13 203.29.134.2 217.874 ms 216.001 ms 215.935 ms 14 203.219.107.86 223.699 ms 223.964 ms 224.025 ms 15 203.219.35.202 190.371 ms 190.465 ms 190.584 ms 16 * * * 17 * * *

--- vs ---

# traceroute -n 110.175.89.41 traceroute to 110.175.89.41 (110.175.89.41), 64 hops max, 40 byte packets 1 169.228.34.82 0.375 ms 1.037 ms 0.273 ms 2 132.239.254.178 0.249 ms 0.246 ms 0.230 ms 3 132.239.254.162 0.325 ms 0.243 ms 0.255 ms 4 132.239.254.149 0.313 ms 0.310 ms 0.294 ms 5 137.164.23.57 3.005 ms 2.902 ms 2.934 ms 6 137.164.11.2 5.531 ms 5.553 ms 5.429 ms 7 4.35.156.65 5.365 ms 5.368 ms 5.364 ms 8 * * * 9 4.68.62.106 5.318 ms 5.373 ms 5.559 ms 10 63.243.205.65 13.297 ms 13.341 ms 14.143 ms 11 63.243.205.2 13.390 ms 13.346 ms 13.149 ms 12 64.86.21.150 214.013 ms 215.975 ms 216.021 ms 13 203.29.134.2 215.013 ms 215.982 ms 215.926 ms 14 203.219.107.86 221.514 ms 223.975 ms 223.946 ms 15 203.219.35.202 190.589 ms 190.382 ms 190.583 ms 16 * * * 17 110.175.89.41 211.795 ms 211.134 ms 213.325 ms

The first traceroute is done using protocol 4 (IPIP) packets, the second using UDP. Note that the IPIP packets are not getting to hop 17.

Hop 16 doesn't respond to traceroute probes, no matter what protocol I use. I have no way of telling whether it is dropping IPIP or not.

The problem seems to be within a couple of hops to your end of things. - Brian

I get dynamic IP from the ISP

I use no-ip.org service to make name for it and this name apear in the Portal so far so good all works fine for about a year

Lucky me that the IP dont change for weeks / month es so even if it change it takes about an hour of no connectivity until all the system of the portal and amprgate sync to the new address

in my last case i have found the root cause

it is a bug (probably) in the mikrotik

I had two Tunnels defined during the change of the address of the AMPRGATE one pointing for the old address to get the inbound traffic and one pointing to the new address to route the outbound traffic

when the change has done i have changed the old Tunnel IP to point to the new address and disabled the new tunnel interface (didnt delete it only disabled it)

and when the router rebooted (i had Powerfail at home) for some strange reason it get mixed by two interfaces have same IP address as destination and didnt work

solution i have changed the disabled tunnel destination ip to something else and now after reboot all works ok

ill keep this setup for a while and then erase the disabled tunnel for good

Ronen - 4Z4ZQ

________________________________ From: 44Net 44net-bounces+ronenp=hotmail.com@hamradio.ucsd.edu on behalf of lleachii--- via 44Net 44net@hamradio.ucsd.edu Sent: Friday, June 9, 2017 7:42 PM To: 44net@hamradio.ucsd.edu Cc: lleachii@aol.com Subject: Re: [44net] 44 net connectivity problems ?

Josh and Ronen,

Do you happen to have dynamic IPs assigned from your ISP?

Have they changed recently?

73,

- Lynwood KB3VWG

_________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net