routing on SWiK

Funky Routing - OptionC

Sun, 05 Oct 2008 12:08:30 -0700

DD-WRT :: firmware for airlink router

Fri, 03 Oct 2008 14:04:36 -0700

Quick Linux and Windows OpenVPN HOWTO and tutorial, including VPN routing

Fri, 03 Oct 2008 03:23:57 -0700

http://www.adamsinfo.com/quick-linux-and-windows-openvpn-howto-and-tutorial-including-vpn-routing/

OpenVPN is a popular Windows/Linux VPN Server/Client pair. I think there’s a separate GUI available for it if you’re so minded. This howto will cover command line usage only.

I’ll provide example configuration based on a Linux server and a Windows client, however the same applies pretty easily if you wanted to mix and match.

On debian, apt-get install openvpn. On any other linux distro, use your own package manager or alternatively download from source and compile.

I create my config /etc/openvpn/myvpn.conf and enter the following:

dev tun proto udp ifconfig 10.8.0.1 10.8.0.2 secret /etc/openvpn/static.key comp-lzo keepalive 10 60 daemon

In short, I’m specifying that we’ll use the ‘tun’ interface as opposed to ‘tap’, and that we’ll communicate over UDP. Next I specify that this machine’s tun0 interface will have IP 10.8.0.1 and the client will be given 10.8.0.2. My secret key is stored in /etc/openvpn/static.key which you can generate with openvpn –genkey –secret static.key. I’d like to use comp-lzo for compression and also specify a keepalive time to prevent problems on those networks that terminate idle connections. We’ll also have openvpn daemonize. For the client:

remote XX.XXX.124.95 ;server IP address dev tun ifconfig 10.8.0.2 10.8.0.1 secret static.key comp-lzo keepalive 10 60

This configure is mostly identical to the server’s above.

Now copy the static.key that you generated on the server, to the client. Then just run ‘openvpn config.conf’ it’ll print the relevant debug messages and you’ll be there. At this point, you should be able to ping 10.8.0.1from your client and 10.8.0.2 from your server. If you can, all is good.

On your server, you’ll now need to allow routing so your client is able to route it’s traffic through the VPN:

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE iptables -A FORWARD -i tun0 -s 10.8.0.0/24 -o eth0 -j ACCEPT iptables -A FORWARD -i eth0 -o tun0 -m state –state ESTABLISHED,RELATED -j ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward

…Or similar to suit your needs.

On your windows client, you’ll now need to change your default gateway:

Use route print and find out your current default gateway, then, assuming your current local default gateway is: 192.168.1.1 and server’s IP address is XX.XXX.124.95, issue the following commands:

route DELETE 0.0.0.0 route ADD XX.XXX.124.95 MASK 255.255.255.255 192.168.1.1 route ADD 0.0.0.0 MASK 0.0.0.0 10.8.0.1

The first ADD command is used to tell your client how to access the ‘new default gateway’. Without specifying your real default gateway, the client machine would have no idea how to reach your VPN server. You can specify 10.8.0.1 as your default gateway, as it is now virtually on the same LAN as your 10.8.0.2 adapter, but without the additional route to XX.XXX.124.95, your connection to the server would have to terminate and you’d lose your tun interface.

Now try and ping something – it should be successful. If not, get onto the server and run tcpdump -n tun0. If the server is seeing your traffic but not forwarding it to the outside world, chances are your iptables and masquerading is set up incorrectly. If the server isn’t even seeing any traffic from you, then chances are your windows routing setup is incorrect.

Hope this was useful! Comments and feedback are welcome as always.

APNIC Box - Linux on a Mikrotik 532a, Part 1

Fri, 03 Oct 2008 02:23:34 -0700

http://www.adamsinfo.com/apnic-box-linux-on-a-mikrotik-532a-part-1/

I put this device together for fun sometime around the start of 2007. The ideas that spawned this was using OpenWRT on a Linksys WRT54G access point. A surprisingly powerful and full linux distro with all kinds of advanced capabilities running on a Linksys wireless router which I’d previously thought to be a reasonably dumb device with computing power more comparable to a calculator than a PC. The project opened my eyes to embedded devices, and I wondered what device base I should start with. To cut a long story short and for reasons that I can’t even remember anymore I came across the Mikrotik Routerboard 532A and decided that I should start with that.

Conception APNIC Box Image 1

APNIC Box Image 1

Here’s a picture of the device from the outside with some labels, view the full image to see them.

1. Status LEDs. Blue at the bottom left shows it’s on, orange at the top right shows that there’s wifi activity. 2. Ethernet (eth0) 3. Standard Serial Console (57600, 8 N 1) 4. Ethernet (eth1) 5. Ethernet (eth2)

You’ll notice a PicoLCD unit from mini-box.com on top of the device, I’ll dedicate a separate section to that. For the moment, eth0 connects to a switch and my local lan on the 192.168.100.0/24 range. eth1 holds a public IP and is connected to my first ISP via a ADSL2+ modem (I generally get about 14mbit down and 1.5mbit up stable), and eth2 is connected to the same provider via a separate ADSL2+modem (I get about 16mbit down and 1.7mbit here). The ISP does not bond these connections – I wish :-). They are two entirely separate connections to the same ISP. This isn’t for redundancy as realistically unless you use cable which isn’t available in my area, any fault will usually be with BT (the network/telecoms provider) and so using two separate ISPs won’t really add any great redundancy factor. BETHERE (my ISP) are the only UK ISP that I know of to offer the 24mbit down/2.5mbit up service. Anyway, I guess the speed difference over the two lines is down to one connection to the exchange being slightly shorter or maybe cleaner shrug

GNU Zebra -- routing software

Thu, 02 Oct 2008 10:31:52 -0700

ebtables/iptables interaction on a Linux-based bridge

Tue, 30 Sep 2008 02:11:31 -0700

Una distribuzione Linux per server e dispositivi embedded

Wed, 24 Sep 2008 13:12:01 -0700

Bandwidth Limiting HOWTO with linux, tc and iproute2

Tue, 23 Sep 2008 07:44:34 -0700

http://www.adamsinfo.com/bandwith-limiting-with-linux-tc-and-iproute2/

I’ve recently optimized the scripts used for bandwidth management in one of our UK facilities and I thought I’d post a quick howto on it.

My setup here is a live feed entering eth0 on this linux router and leaving eth1 into a switch connected to a collection of other servers. This is set up as an unrestricted public router, routing between a /30 on eth0 and a /24 on eth1. Note: We can’t in any way restrict the amount of traffic that eth0 receives from the outside, so instead we restrict how fast eth0 sends data out, the same applies the other way round. So, if we want to limit the amount of data that the local servers can send, we shape the router’s external interface (eth0). If we want to limit the amount of data that the local servers can receive, we shape the router’s internal interface (eth1)

With Debian Etch on 2.6.x, run: apt-get install tc iproute2 bc

Then script as follows:

Set some variables #!/bin/bash EXT_IFACE=”eth0″ INT_IFACE=”eth1″ TC=”tc” UNITS=”kbit” LINE=”10000″ #maximum ext link speed LIMIT=”5000″ #maximum that we’ll allow

Set some variables for individual “classes” that we’ll use to shape internal upload speed, i.e. shaping eth0 CLS1_RATE=”200″ # High Priority traffic class has 200kbit CLS2_RATE=”300″ # Medium Priority class has 300kbit CLS3_RATE=”4500″ # Bulk class has 4500kbit
(We’ll set which ones can borrow from which later)

Set some variables for individual “classes” that we’ll use to shape internal download speed, i.e. shaping eth1 INT_CLS1_RATE=”1000″ #Priority INT_CLS2_RATE=”4000″ #Bulk

Delete current qdiscs. i.e. clean up ${TC} qdisc del dev ${INT_IFACE} root ${TC} qdisc del dev ${EXT_IFACE} root

Attach root qdiscs. We are using HTB here, and attaching this qdisc to both interfaces. We’ll label it “1:0″ ${TC} qdisc add dev ${INT_IFACE} root handle 1:0 htb ${TC} qdisc add dev ${EXT_IFACE} root handle 1:0 htb

Create root classes, with the maximum limits defined
One for eth1 ${TC} class add dev ${INT_IFACE} parent 1:0 classid 1:1 htb rate ${LIMIT}${UNITS} ceil ${LIMIT}${UNITS}
One for eth0 ${TC} class add dev ${EXT_IFACE} parent 1:0 classid 1:1 htb rate ${LIMIT}${UNITS} ceil ${LIMIT}${UNITS}

Create child classes
These are for our internal interface eth1
Create a class labelled “1:2″ and give it the limit defined above ${TC} class add dev ${INT_IFACE} parent 1:1 classid 1:2 htb rate ${INT_CLS1_RATE}${UNITS} ceil ${LIMIT}${UNITS}
Create a class labelled “1:3″ and give it the limit defined above ${TC} class add dev ${INT_IFACE} parent 1:1 classid 1:3 htb rate ${INT_CLS2_RATE}${UNITS} ceil ${INT_CLS2_RATE}${UNITS}

EXT_IF (upload) now. We also set which classes can borrow and lend.
This class is guaranteed 200kbit and can burst up to 5000kbit if available ${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:2 htb rate ${CLS1_RATE}${UNITS} ceil ${LIMIT}${UNITS}
This class is guaranteed 300kbit and can burst up to 5000kbit-200kbit=4800kbit if available ${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:3 htb rate ${CLS2_RATE}${UNITS} ceil `echo ${LIMIT}-${CLS1_RATE}|bc`${UNITS}
This class can is guaranteed 4500kbit and can’t burst past it (5000kbit-200kbit-300kbit=4500kbit).
I.e. even if our bulk traffic goes crazy, the two classes above are still guaranteed availability. ${TC} class add dev ${EXT_IFACE} parent 1:1 classid 1:4 htb rate ${CLS3_RATE}${UNITS} ceil `echo ${LIMIT}~~${CLS1_RATE}~~${CLS2_RATE}|bc`${UNITS}

Add pfifo. Read more about pfifo elsewhere, it’s outside the scope of this howto. ${TC} qdisc add dev ${INT_IFACE} parent 1:2 handle 12: pfifo limit 10 ${TC} qdisc add dev ${INT_IFACE} parent 1:3 handle 13: pfifo limit 10 ${TC} qdisc add dev ${EXT_IFACE} parent 1:2 handle 12: pfifo limit 10 ${TC} qdisc add dev ${EXT_IFACE} parent 1:3 handle 13: pfifo limit 10 ${TC} qdisc add dev ${EXT_IFACE} parent 1:4 handle 14: pfifo limit 10

Done adding all the classes, now set up some rules! ###

INT_IFACE
Note the ‘dst’ direction. Traffic that goes OUT of our internal interface and to our servers is out server’s download speed, so SOME_IMPORTANT_IP is allocated to 1:2 class for download. ${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst SOME_IMPORTANT_IP/32 flowid 1:2 ${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst SOME_OTHER_IMPORTANT_IP/32 flowid 1:2 #All other servers download speed goes to 1:3 – not as important as the above two ${TC} filter add dev ${INT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip dst 0.0.0.0/0 flowid 1:3

EXT_IFACE
Prioritize DNS requests ${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_IP/32 match ip sport 53 0xffff flowid 1:2
SSH is important ${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src IMPORTANT_IP/32 match ip sport 22 0xffff flowid 1:2
Our exim SMTP server is important too ${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src 217.10.156.197/32 match ip sport 25 0xffff flowid 1:3
The bulk ${TC} filter add dev ${EXT_IFACE} parent 1:0 protocol ip prio 1 u32 match ip src 0.0.0.0/0 flowid 1:4

I have tried not to get bogged down with too many irrelevant details here and would be happy to answer any questions or take any corrections. It’s pretty simple and it works well. Install bmon and you can confirm this yourself. The purpose of this is that I can take a 10mbit connection and limit the traffic to 5mbit ensuring that I don’t break the 95th percentile that I want to maintain at the datacenter. I can increase and decrease this at any time as traffic requires or permits respectively.

Routing With Open Standards and Data From Denmark to Italy

Tue, 23 Sep 2008 03:09:49 -0700

Until now the world of "volunteered geography" collaborative projects and the world of geographic information standards used by the GI market and defined by the Open Geospatial Consortium were still somewhat separate. OpenRouteService is trying to bring these two worlds together. It is the first routing service that uses OSM data and provides those through the standardized interfaces specified by the OGC.

ebtables/iptables interaction on a Linux-based bridge

Thu, 18 Sep 2008 04:06:34 -0700

Fridu - Fridu in Xen mini-ISP reference architecture

Thu, 18 Sep 2008 03:07:24 -0700

fridu.org, "Fridu-in-Xen" is a virtual architecture for ISP. It reproduces a typical Internet service provider but within a Xen visualized environment.

Hibernate - Dynamic Table Routing | Javalobby

Mon, 15 Sep 2008 08:03:48 -0700

The BIRD Internet Routing Daemon Project

Tue, 02 Sep 2008 21:58:28 -0700

The BIRD Internet Routing Daemon Project

Tue, 02 Sep 2008 21:57:06 -0700

Iptables Tutorial 1.2.2

Tue, 02 Sep 2008 20:54:35 -0700

OpenLS Route Service with free OSM data

Fri, 29 Aug 2008 04:57:15 -0700

Kernel Packet Traveling Diagram

Thu, 28 Aug 2008 18:01:26 -0700

pgRouting - Trac

Fri, 08 Aug 2008 11:08:40 -0700

Application Layer Packet Classifier for Linux

Thu, 07 Aug 2008 13:07:40 -0700

L7-filter is a classifier for Linux's Netfilter that identifies packets based on application layer data. It can classify packets as HTTP, Jabber...

Installation von Fli4l unter Xen3

Thu, 24 Jul 2008 07:58:57 -0700

http://almien.co.uk/OSM/Routing/

Sun, 20 Jul 2008 23:47:42 -0700

Welcome to XORP

Sun, 20 Jul 2008 16:46:20 -0700

Cisco IOS Software Release 12.4T Features and Hardware Support [Cisco IOS Software Releases 12.4 T] - Cisco Systems

Tue, 15 Jul 2008 13:49:37 -0700

Kernel Packet Traveling Diagram

Tue, 15 Jul 2008 11:46:58 -0700

Kernel Packet Traveling Diagram

http://almien.co.uk/OSM/Routing/

Sun, 06 Jul 2008 21:48:30 -0700

OSM routing, A*, cycle-filtered, python

Welcome to XORP

Sun, 29 Jun 2008 14:01:25 -0700

Hibernate - Dynamic Table Routing | Javalobby

Mon, 16 Jun 2008 03:16:26 -0700

Hibernate - Dynamic Table Routing | Javalobby

Mon, 16 Jun 2008 01:16:22 -0700

Hibernate - Dynamic Table Routing | Javalobby

Sun, 15 Jun 2008 13:16:16 -0700

Hibernate - Dynamic Table Routing | Javalobby

Fri, 13 Jun 2008 17:15:16 -0700