Le 15/02/2016 10:44, Jean-Marc Magnier a écrit :

F5PBG (f5pbg@free.fr) can help you, he is one of the French Hamnet admins. It still remains, if I'm right, some free B subnets for FR. So ask him.

Hi Jean-Marc,

I'm already in contact with Ludovic F5PBG, which gave us the IP we're using on our test gateway (44.151.20.1).

Anyway, I'm now designing our future network, and I'd like to know if it would be possible to get a /16 to affirm our identity. If so, that would be the best option for us. If not, we'll use a 44.151.20.x subnet from Ludovic.

Anyway, your BGP capabilities seem to be interesting, could we discuss about as I have some difficulties to set up my IPIP tunnel. BGP should be better I guess.

Actually, I only have an IP-IP tunnel, on the IP address 44.151.20.1, and it works fine. It's a kind of "proof of concept", to help us designing our future network.

I'm planning installation in a new datacenter for my company. Then, I'm also thinking about the amateur project, so that our radio-club can benefit of my company's investments. BGP will be available there, in a few months (I hope !).

Anyway, networking between Corsica and France uses submarine fiber optics, and adds high latency. "Announcing" French networks in Corsica via BGP, then routing the corresponding traffic to you through our slow links, would not have much sense. Then, I'm also investigating about how to "announce" BGP subnets from datacenters in France, at pricing compatible with amateur budgets ;-)

As said before, for now, I'm on the "design" and "alpha tests" phases. I'll open a WEB/mail server, and probably a mailing-list, about our "TKNet" network. I'll invite you, and we'll be able to discuss technical/local aspects, also with Ludovic and others. But you'll have to wait a few weeks ;-)

Hi,

Le 15/02/2016 11:37, Marius Petrescu a écrit :

The Hamnet uses private 16 (legacy) and 32 bit AS and is not related in any way to the world wide BGP announcements so no need to wait for anything, since we are doing it inside the 44net address space.

Sorry, but I don't understand that. I never used BGP before.

Here's a example. Please correct if I'm misunderstading something : - Let's assume I'm managing the 44.151.20.0/24 subnet locally in my area - Let's assume 44.151.20.1 is a web server located in my local datacenter, in a DMZ : HamNet users with 44.x IPs can access it; but I want it to be accessible also from Internet

Actually, I'm using an IP-IP tunnel. The actual route from Internet to 44.151.20.1 is via amprgw.sysnet.ucsd.edu, in California.

Then, an user on Internet located just near me, that wants to reach my web server, has to go to ucsd (via Internet), then back to me (via IP-IP tunnel). This implies a 350ms latency !!!

The purpose of BGP would be to announce the 44.151.20.0/24 locally from my datacenter. This would be a world wide BGP announcement, on Internet. Then, people from Internet needing to reach my web server, would get a shorter path, without having to transit via California.

Did i miss, or misunderstand something ?

See also: http://en.wikipedia.org/wiki/Mobile_country_code on how the ASN are proposed to be used

Sorry, this link is about "mobile country code"...

Le 15/02/2016 14:01, Marius Petrescu a écrit :

But if the user near you is not an authorized ham radio operator, and if he will use ham radio links, that is illegal. So, unless you can guarantee that there will be no ham specific on-the-air activity, it is ok.

You are true :-) But, on a networking point of view, this is not a "routing" problem. This is a "firewall" problem, which should be handled in upper layers.

But usually, since this is a amateur radio network, there is no reason why a regular internet user should have direct access to the 44 address space.

In my design, all communications between Internet and hamnet will be firewalled, of course with very restrictive rules ! Regular users must not have direct access to ham networks, but anybody should be able to listen ham QSOs. I see several situations where information should be accessed both by hams and Internet users. For example, a WEB server presenting the project and the ham activities, where people could listen the QSOs on our VHF/UHF networks through a WEB interface, a reverse-beacon system, etc... This will be handled through a "DMZ". The Internet users will have "read only" access.

I see several ways of doing that : 1/ A central gateway, with one public (Internet) IP address, and one 44.x address. This gateway would act as a router/firewall/VPN server, and would handle all trafic between different networks. Access to servers in DMZ is achieved via NAT. 2/ Publicly available machines (those in DMZ) have dual IP addressing : one public WAN IP (for accessing from Internet) and one 44.x address (for accessing from hamnet). Anyway, this makes administration more complicated. I'm not a fan of dual addresses. 3/ All hamnet machines have 44.x addresses (whether they can be accessed from Internet or not). They are organized in smaller subnets, or "zones", and a firewall allows/forbids trafic between zones according to our general policy

Actually, our test network is built as in 1. But the solution 3 seems better to me on an engineering point of view. I think it's easier to manage and to reconfigure. The final setup has not been decided yet, and will probably be a mix of the three.

Moreover, there are "special" situations that need to be investigated. For example, one of our sites will host a VHF repeater, that will be connected to the central VoIP server, through a pure hamnet link. But this site also hosts a meteo station and a webcam, whose results are not reserved to ham people, but need to be shared over Internet. And this site is also used as a contest station, where operators in "assisted mode" want to be able to access to Internet, and update their Facebook status during the 48h of the contest :-) What type of addressing should we use for that site ? 44.x ? Public Internet ? Private 10.x ? The answer is not as easy as "regular users should not have access to 44.x address space" ;-)

The ampr gateway actually creates a filter, by preventing direct forwarding between ampr subnets and selective IP access, so a regular internet user can only connect via tunnels to registered hosts (in this case meaning hosts with an DNS entry).

ampr.org provides those facilities in standard. But, as we want to be "autonomous", we will provide our own tunnels (IPSEC for site to site VPNs, OpenVPN for end-users). Then, my idea would be to handle all this locally, on our central firewall/gateway, so that we can fine-tune the rules to our needs. That's why routing the whole 44.x subnet via BGP to our gateway seems interesting to me.

Comments and ideas are welcome.

73 de TK1BI

Le 15/02/2016 14:16, Marius Petrescu a écrit :

Internally, in this 44net address space, how we use ASNs is up to us. Fur this reason, an allocation schema has been proposed, and is partly implemented, based on private ASN, so that if somehow BGP announcements "escape" to the wild, they will be dropped.

The next step, announcing a public BGP subnet to the internet, is a whole new issue. For this you need to coordinate with Brian Kantor, which is the official administrator/owner of the 44 address space, to allow that (and there is some paperwork involved, from both sides, including your ISP, which has to adopt your 44 subnet into his ASN).

Thank you for clarification about internal and external routing. I thought only RIP was used for internal routing, I didn't know about BGP.

Of course, I was talking about public/external routing, via a paper agreement between Brian Kantor and my ISP. That's what I'm planning to do, when I will in my new datacenter.

Ronen,

Most routers in the Hamnet are Mikrotik routers, which all support BGP, no matter the model, since they all run the same RouterOS firmware. Each subnet directly connected to a router is entered into its BGP table and forwarded to its neighbour(s). Some other nodes run Quagga on Linux for this purposes, Quagga being also available on OpenWRT.

So basically that's it.

For more info you can check http://hamnetdb.net which is the networks management core (a nice map is available on a button in the top right).

Marius, YO2LOJ

-----Original Message----- From: R P Sent: Monday, February 15, 2016 16:27 To: AMPRNet working group Subject: Re: [44net] BGP announcement questions ?

How do you do BGP ? for the inside hamnet ? do you use router that announce it ? If yes what type ? CISCO Other etc ? do you have any document of the BGP implementation you use there ?? Ronen - 4Z4ZQ http://www.ronen.org

Hi Ronen

Mikrotik Routers support many features out of the box, IPIP, GRE, PPT, L2TP Tunnels are a few of them. Routing protocols are BGP, OSPF, RIP out of the box. You get these pieces in several levels. Some of them are very powerfull e.g. 72-Core-Routers (tilera processors). You may have a look at

http://routerboard.com http://www.mikrotik.com http://download2.mikrotik.com/what_is_routeros.pdf

73s de Egbert DD9QP

Am 17.02.2016 um 08:56 schrieb R P:

(Please trim inclusions from previous messages) _______________________________________________ Do they support IPIP tunneling as well ?

Ronen - 4Z4ZQ http://www.ronen.org

---

From: 44Net 44net-bounces+ronenp=hotmail.com@hamradio.ucsd.edu on behalf of Marius Petrescu marius@yo2loj.ro Sent: Monday, February 15, 2016 7:08 AM To: AMPRNet working group Subject: Re: [44net] BGP announcement questions ?

(Please trim inclusions from previous messages) _______________________________________________ Ronen,

Most routers in the Hamnet are Mikrotik routers, which all support BGP, _________________________________________ 44Net mailing list 44Net@hamradio.ucsd.edu http://hamradio.ucsd.edu/mailman/listinfo/44net

Cisco and Mikrotik support IPIP tunnels. But AFAIK they support only peer to peer connections. This means that you have to set up an IPIP tunnel for each ampr partner in the mesh. And this has to be done by scripting, since we talk about some 400 tunnels.

For Mikrotik, such scripting is available, but the script needs to run on an external machine supporting python. On mipsbe based Mikrotik routers, there is the possibility to run a virtual machine using OpenWRT in parallel to router OS, which can then use ampr-ripd to set up dynamic tunneling.

Marius, YO2LOJ

-----Original Message----- From: R P Sent: Wednesday, February 17, 2016 10:14 To: AMPRNet working group Subject: Re: [44net] BGP announcement questions ?

(Please trim inclusions from previous messages) _______________________________________________ Thank you Edgar I look for Hardware solutions for making our gateways I know Cisco can serve as Gateway Now i start to understand that Microtik also can do it Do you know if anyone is doing a GateWay with Microtik ? if yes may I get the config to do IPIP for the 44 net ? Thanks Forward Ronen - 4Z4ZQ http://www.ronen.org

On Wed, 17 Feb 2016, Toussaint OTTAVI wrote:

Thank you about the infos. I didn't take time to evaluate those products yet. But i'll do !

An interesting feature is the availability of RouterOS in a "cloud" version, ie a virtual machine. Downloadable images are provided for quite any virtualization platform (VMWare, HyperV, KVM, etc...), and the "free" version does allow all the features, with a limited bandwidth of 1 Mbps. Going up to 1 Gbps costs only $45.

Web interface seems to be quite user-friendly, and should be easier to use for beginners than a bare Linux or OpenWRT system.

You might also look into using VyOS, real or virtual.

Antonio Querubin e-mail: tony@lavanauts.org xmpp: antonioquerubin@gmail.com