From crest at cyb0rg.org Wed Sep 1 21:40:38 2010 From: crest at cyb0rg.org (Crest) Date: Wed, 01 Sep 2010 21:40:38 +0200 Subject: [dn42] Peering In-Reply-To: References: <4C7A9E8A.1050402@ccc.de> <20100830123415.GB2170790@jupiter.n2.diac24.net> <4C7C10B9.9090806@cyb0rg.org> Message-ID: <4C7EAC36.1090104@cyb0rg.org> Ahamed Bauani [http://bd-servers.net] schrieb: > Thanks for your email reply with details of information. > > As most of us are too lazy or too busy, don't care to read the > documentation. Like nobody (I think 99.1% ) tech public don't ready RFC like > documents. This is a natural process of human being to read plan text with 3 > or 4 page . Try and error alone won't get you up and running. But their's the IRC channel to get more or less realtime help. >>> I am Technology Advisor of an ISP here in Dhaka, Bangladesh. My plan is >> to >>> give access to my user in both DN42 Network and Public Internet. Few of >> my >>> customer want to access DNS42 from their home. >> Their are few services in the dn42. Even fewer which i expect to be of >> interest to an average ISP customer. The most important goal of the dn42 >> is to enable it's participants to learn about routing protocols in the >> wild. Offering access to the dn42 via their default route to your >> customers you would take this from opportunity to learn from them. > > Sure, I will guide them, if possible take a class of 1 or 2 hour in week so > that they can understand the process and by joining with DN42, they can use > it as a LAB, hand to hand practice. Sry I misunderstood you. I thought you wanted to provide access to the dn42 to clueless endusers. Given BGP's time proven resilience against local failures i don't see how this could go wrong. Let them experiment. If you where to use a (small) continues block of as numbers the rest can filter them if the need arises. >> So, If I can create a gateway, which have DN42 Peering Information (BGP >>> Info) then I can redirect my users request to their destination. >> Than you have taken them the opportunity to learn who to get access >> themself. That said please don't bring the Eternal September [3] over us. >> > I am not forcing any traffic to DN42, Actually the the people ask me to > give access to your private network. Other thing, the subscriber who ask for > access to DN42 is not average user, Most of them is student and my low level > network operating center's staff, who want to learn real world experience of > BGP and Internet Routing both for IPv4 & 6. A fair amount of the current participants comes from this background. This shouldn't create the problems I was afraid of (see above). They will be the first ones with a local babysitter. Let's see how this works out. >>> I will be glad if you inform me how I can get DN42 IPv4 address , if >>> possible IPv6 also. IPv6 in the dn42 is one big mess because their is no equivalent to RFC1918 for IPv6 and we don't have an offical dn42 /48 (or larger) to allocate from everybody just takes prefixes allocated to them by some tunnelbroker. This results in pretty long filter lists. This topic pops up from time to time. A provider independent /48 would be the clean solution ... but nobody wants to do the paperwork, be responsible to the outside world etc. > Last of all, Thank you for your friendly discussion, due to the Time Zone > factor it might not possible for join with you guys on IRC, but everything > has exception. Right. Hope to be in IRC one day. What's lost in trying? GMT+2 (CEST Summertime) and GMT+6 aren't that incompatible. From dn42-net at bauani.org Wed Sep 1 23:46:27 2010 From: dn42-net at bauani.org (Ahamed Bauani [http://bd-servers.net]) Date: Thu, 2 Sep 2010 03:46:27 +0600 Subject: [dn42] Peering In-Reply-To: <4C7EAC36.1090104@cyb0rg.org> References: <4C7A9E8A.1050402@ccc.de> <20100830123415.GB2170790@jupiter.n2.diac24.net> <4C7C10B9.9090806@cyb0rg.org> <4C7EAC36.1090104@cyb0rg.org> Message-ID: Please see bellow for BGP & IPv6 Allocation. On Thu, Sep 2, 2010 at 1:40 AM, Crest wrote: > Ahamed Bauani [http://bd-servers.net] schrieb: > > Thanks for your email reply with details of information. > > > > As most of us are too lazy or too busy, don't care to read the > > documentation. Like nobody (I think 99.1% ) tech public don't ready RFC > like > > documents. This is a natural process of human being to read plan text > with 3 > > or 4 page . > > Try and error alone won't get you up and running. But their's the IRC > channel to get more or less realtime help. > > >>> I am Technology Advisor of an ISP here in Dhaka, Bangladesh. My plan is > >> to > >>> give access to my user in both DN42 Network and Public Internet. Few of > >> my > >>> customer want to access DNS42 from their home. > >> Their are few services in the dn42. Even fewer which i expect to be of > >> interest to an average ISP customer. The most important goal of the dn42 > >> is to enable it's participants to learn about routing protocols in the > >> wild. Offering access to the dn42 via their default route to your > >> customers you would take this from opportunity to learn from them. > > > > Sure, I will guide them, if possible take a class of 1 or 2 hour in week > so > > that they can understand the process and by joining with DN42, they can > use > > it as a LAB, hand to hand practice. > > Sry I misunderstood you. I thought you wanted to provide access to the > dn42 to clueless endusers. Given BGP's time proven resilience against > local failures i don't see how this could go wrong. Let them > experiment. If you where to use a (small) continues block of as numbers > the rest can filter them if the need arises. > > >> So, If I can create a gateway, which have DN42 Peering Information (BGP > >>> Info) then I can redirect my users request to their destination. > >> Than you have taken them the opportunity to learn who to get access > >> themself. That said please don't bring the Eternal September [3] over > us. > >> > > I am not forcing any traffic to DN42, Actually the the people ask me to > > give access to your private network. Other thing, the subscriber who ask > for > > access to DN42 is not average user, Most of them is student and my low > level > > network operating center's staff, who want to learn real world experience > of > > BGP and Internet Routing both for IPv4 & 6. > > A fair amount of the current participants comes from this background. > This shouldn't create the problems I was afraid of (see above). They > will be the first ones with a local babysitter. Let's see how this works > out. > > >>> I will be glad if you inform me how I can get DN42 IPv4 address , if > >>> possible IPv6 also. > > IPv6 in the dn42 is one big mess because their is no equivalent to > RFC1918 for IPv6 and we don't have an offical dn42 /48 (or larger) to > allocate from everybody just takes prefixes allocated to them by some > tunnelbroker. This results in pretty long filter lists. This topic pops > up from time to time. A provider independent /48 would be the clean > solution ... but nobody wants to do the paperwork, be responsible to the > outside world etc. > Someone should take responsibility to do the job. As you (actually me too) is member of DN42, let me try to get an /32 of address from APNIC. Before that I need to know that do you have any 'Official / Government Registration for This Community / Project'? If yes, where is your main registered office. If it is under APNIC, I might help you to get an /32 of IPv6 Allocation so that project can run with own resource. By the way, I was awarded on 2006 by APNIC as of 'Best Hostmaster' which include Free Registration on Annual Meeting, Air Fear of one way, Accommodation on shared bedroom on a 5 star hotel & a prize money of USD$1000. Isn't cool enough? I think if one of your office has a registration under APNIC coverage, they will refused for an allocation of /32 RnD. Let's see how it goes. If all failed, I have /32, from where I can allocate-non-portable /40 Allocation so that you can start allocating your own /64 or /46 anything you prefer to interested community. Let's hope for the best, I have also need to talk APNIC about it. Only hope is they are very flexible on IPv6 but totally opposite in regards IPv4;) > > Last of all, Thank you for your friendly discussion, due to the Time Zone > > factor it might not possible for join with you guys on IRC, but > everything > > has exception. Right. Hope to be in IRC one day. > > What's lost in trying? GMT+2 (CEST Summertime) and GMT+6 aren't that > incompatible. > Actually when I return home, I felt too tired which force me to go bed as soon as possible, though there are some different night, when I enjoy talking with friends, writing scripts, fixing a bug or just write any article (non-tech) for newspaper. Talk to you people very soon guys. Till not I found the community is too cool where people like you are there. -- Best Regards Noor Ahamed Bauani Chief Technology Advisor Dhaka Wireless http://www.dhaka-wireless.net/ An IPv6 Ready ISP in Bangladesh, Need an IPv6 Connectivity? Just Knock us! HP: +880-1818-BAUANI (SMS Only, No Direct Call Please) -------------- next part -------------- An HTML attachment was scrubbed... URL: From tobias at linuxdingsda.de Tue Sep 7 10:20:58 2010 From: tobias at linuxdingsda.de (Tobias Winter) Date: Tue, 07 Sep 2010 10:20:58 +0200 Subject: [dn42] [REQ] change remote of AS64822 - pending move Message-ID: <4C85F5EA.5080906@linuxdingsda.de> Hi, due to a pending move of AS64822, please change the remote line from 212.227.133.71 or dn42.azubi.web.de to as64822.serverteil.de Thank you -- wintix -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 261 bytes Desc: OpenPGP digital signature URL: From tobias at linuxdingsda.de Fri Sep 10 15:03:33 2010 From: tobias at linuxdingsda.de (Tobias Winter) Date: Fri, 10 Sep 2010 15:03:33 +0200 Subject: [dn42] [REQ] change remote of AS64822 - pending move In-Reply-To: <4C85F5EA.5080906@linuxdingsda.de> References: <4C85F5EA.5080906@linuxdingsda.de> Message-ID: <4C8A2CA5.5010501@linuxdingsda.de> I just moved the host to another IP. Please check if everything is fine and take the appropriate measures. -- wintix -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 261 bytes Desc: OpenPGP digital signature URL: From dn42 at bon-ix.de Sun Sep 12 01:46:41 2010 From: dn42 at bon-ix.de (=?UTF-8?Q? Bonix_[Simon_Z=C3=B6llner] ?=) Date: Sun, 12 Sep 2010 01:46:41 +0200 Subject: [dn42] =?utf-8?q?=5BIMPORTANT=5D_Please_set_rp=5Ffilter_and_ip=5F?= =?utf-8?q?forwarding_se__ttings_correctly=2C_otherwise=3A_routing_problem?= =?utf-8?q?s!?= Message-ID: Hi @ all, Some of you seem to have NOT switched off "rp_filter" for all their dn42 tunnel interfaces and switched on "ip_forwarding" for all their dn42 tunnel interfaces. This is very important, because otherwise there will be heavy routing problems, because packets will be "frozen" when entering your system! For some of you who don't know: rp_filter checks if the packet which goes out through interface tun-xyz also entered through it. If not it'll stop the packet delivery. This feature must be always set to "0"/off when using dn42 because you'll have multiple interfaces and packets going out through other interfaces than they came in for sure, as it is part of the dn42 topology! ip_forwarding controls whether the system does IP forwarding between interfaces. Execute this in your command line to edit the settings (Debian/Ubuntu): "echo 0 > /proc/sys/net/ipv4/all/rp_filter && 0 > /proc/sys/net/ipv4/default/rp_filter && echo 1 > /proc/sys/net/ipv4/conf/all/forwarding && echo 1 > /proc/sys/net/ipv4/conf/default/forwarding && echo 1 > /proc/sys/net/ipv4/ip_forward" and then restart all OpenVPN-Interfaces: "sudo /etc/init.d/openvpn restart"! (I'm not using Tinc, so I can't say anything about it beside that these values should be set correctly for it too! ;-) ) If you use IPv6 you'll have to set ip6_forwarding too! Please check if this settings also stay after a reboot. If not, add it to your startup scripts! Kind regards Bonix alias Simon Z?llner From dn42 at bon-ix.de Sun Sep 12 01:55:11 2010 From: dn42 at bon-ix.de (=?UTF-8?Q? Bonix_[Simon_Z=C3=B6llner] ?=) Date: Sun, 12 Sep 2010 01:55:11 +0200 Subject: [dn42] =?utf-8?q?Sorry=2C_send_wrong_command_for_setting_rp=5Ffil?= =?utf-8?q?ter_and_ip=5F__forwarding=2E_Here_comes_the_right=2E?= Message-ID: <3a1f2a6b16c2cf84eda3bd9f9f9e1d27@simon-zoellner.de> Hi @ all, I'm sorry I've send you a wrong command for setting rp_filter and ip_forwarding in my last E-mail. This is the right: "echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter && echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter && echo 1 > /proc/sys/net/ipv4/conf/all/forwarding && echo 1 > /proc/sys/net/ipv4/conf/default/forwarding" Kind regards Bonix alias Simon Z?llner From equinox at diac24.net Sun Sep 12 02:46:40 2010 From: equinox at diac24.net (David Lamparter) Date: Sun, 12 Sep 2010 02:46:40 +0200 Subject: [dn42] Peering Agreement (was: [IMPORTANT] Please set rp_filter and ip_forwarding...) In-Reply-To: References: Message-ID: <20100912004639.GA1162929@jupiter.n2.diac24.net> On Sun, Sep 12, 2010 at 01:46:41AM +0200, =?UTF-8?Q? Bonix_[Simon_Z=C3=B6llner]?= wrote: > Some of you seem to have NOT switched off "rp_filter" for all their dn42 > tunnel interfaces and switched on "ip_forwarding" for all their dn42 tunnel > interfaces. This is very important, because otherwise there will be heavy > routing problems, because packets will be "frozen" when entering your > system! [...] While this is the most significant misconfiguration, it is only one variety of the general rules: - DO NOT ANNOUNCE ROUTES IF YOU DO NOT FORWARD - DO NOT FORWARD UNLESS YOU FORWARD CORRECTLY Forwarding "correctly" means forwarding packets _unmodified_, i.e. with unchanged IP and port numbers, options, flags, etc. - caveat conntracking & NAT! We've had several very weird routing problems caused by SPI firewalls / connection tracking / NAT. (yes, there are exceptions, no, if you ask about them then they don't apply to you.) > echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter && > echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter && > echo 1 > /proc/sys/net/ipv4/conf/all/forwarding && > echo 1 > /proc/sys/net/ipv4/conf/default/forwarding && > echo 1 > /proc/sys/net/ipv4/ip_forward (quotation made readable) These are reasonable base settings, however * you should change "default" before "all" since default gets applied to new interfaces * the last command (ip_forward) is a "macro", it changes several settings at once (cf. /usr/src/linux/Documentation/networking/ip-sysctl.txt) - it should therefore be executed FIRST. > and then restart all OpenVPN-Interfaces: "sudo /etc/init.d/openvpn restart"! You do not need to restart any routing daemons after these changes. -equinox P.S.: for debugging, please also consider accept_source_routing = 1 P.P.S.: we all have proper firewalls, right? dn42 is NOT A TRUSTED NETWORK. -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available URL: From allo at laxu.de Sun Sep 12 02:57:20 2010 From: allo at laxu.de (Allo) Date: Sun, 12 Sep 2010 02:57:20 +0200 Subject: [dn42] Peering Agreement In-Reply-To: <20100912004639.GA1162929@jupiter.n2.diac24.net> References: <20100912004639.GA1162929@jupiter.n2.diac24.net> Message-ID: <4C8C2570.8090106@laxu.de> Hi! > P.P.S.: we all have proper firewalls, right? dn42 is NOT A TRUSTED NETWORK. What is the best way of firewalling pass-through traffic, so it only can go from dn42 to dn42? restricting -i vpn1 -o vpn2, -i vpn1 -o vpn3, ... -i vpnN -o vpnN-1 is somewhat complicated because i have many tunnels. firewalling my services is not that complicated, INPUT table handles dn42 packets like packets from the internet. but what is the best method of making sure dn42 traffic does not leave dn42? allo From equinox at diac24.net Sun Sep 12 04:40:59 2010 From: equinox at diac24.net (David Lamparter) Date: Sun, 12 Sep 2010 04:40:59 +0200 Subject: [dn42] Peering Agreement In-Reply-To: <4C8C2570.8090106@laxu.de> References: <20100912004639.GA1162929@jupiter.n2.diac24.net> <4C8C2570.8090106@laxu.de> Message-ID: <20100912024058.GA12848@jupiter.n2.diac24.net> On Sun, Sep 12, 2010 at 02:57:20AM +0200, Allo wrote: > > P.P.S.: we all have proper firewalls, right? dn42 is NOT A TRUSTED NETWORK. > What is the best way of firewalling pass-through traffic, so it only can > go from dn42 to dn42? > restricting -i vpn1 -o vpn2, -i vpn1 -o vpn3, ... -i vpnN -o vpnN-1 is > somewhat complicated because i have many tunnels. netfilter/iptables supports matching on interface names with wildcards. try "-i vpn+ -o vpn+" highly also recommended: "-t raw -j NOTRACE" makes netfilter/iptables not do any conntrack/NAT on the packets. also saves conntrack entries :) *bsd probably has some similar feature. -equinox -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 198 bytes Desc: not available URL: From crest at cyb0rg.org Sun Sep 12 17:48:36 2010 From: crest at cyb0rg.org (Crest) Date: Sun, 12 Sep 2010 17:48:36 +0200 Subject: [dn42] Peering Agreement In-Reply-To: <20100912024058.GA12848@jupiter.n2.diac24.net> References: <20100912004639.GA1162929@jupiter.n2.diac24.net> <4C8C2570.8090106@laxu.de> <20100912024058.GA12848@jupiter.n2.diac24.net> Message-ID: <4C8CF654.3010406@cyb0rg.org> David Lamparter schrieb: > On Sun, Sep 12, 2010 at 02:57:20AM +0200, Allo wrote: >>> P.P.S.: we all have proper firewalls, right? dn42 is NOT A TRUSTED NETWORK. >> What is the best way of firewalling pass-through traffic, so it only can >> go from dn42 to dn42? >> restricting -i vpn1 -o vpn2, -i vpn1 -o vpn3, ... -i vpnN -o vpnN-1 is >> somewhat complicated because i have many tunnels. > > netfilter/iptables supports matching on interface names with wildcards. > try "-i vpn+ -o vpn+" > > highly also recommended: "-t raw -j NOTRACE" makes netfilter/iptables not > do any conntrack/NAT on the packets. also saves conntrack entries :) > > *bsd probably has some similar feature. > PF has "pass quick ... no state" From nick at srn.dn42 Thu Sep 16 21:09:12 2010 From: nick at srn.dn42 (SRN) Date: Thu, 16 Sep 2010 19:09:12 +0000 (UTC) Subject: [dn42] wiki.dn42 Message-ID: As you all probably know by now, helios has been trying to move wiki.dn42 off of his infrastructure for the past few months. Now, in keeping with the dn42 philosophy, a few of us spent no small amount of effort in trying to get ikiwiki with a monotone back-end to work, and while some of us got further than others, all of us eventually failed at some point. By now, every single one of the people who were working on it to the best of my knowledge has given up on the prospect of putting our wiki in the registry. However, helios still wants to move wiki.dn42 elsewhere. I'd like to volunteer a short-term plan that can convert into a long-term plan at some point in the future (if anybody ever manages to get ikiwiki/mtn working). Specifically, I'd like to move wiki.dn42 onto ikiwiki/git for now, if nobody has any objections. So, if anyone among you sees a reason why ikiwiki and git should not be united in wikimony, please speak now or forever hold your peace ;-) -- Q: What's the difference between a liberal voter and a liberal politician? A: The former asks "Are you my mother?" The latter asks "Are you my baby?" From fabian at datensalat.eu Thu Sep 16 23:42:32 2010 From: fabian at datensalat.eu (Fabian Fingerle) Date: Thu, 16 Sep 2010 23:42:32 +0200 Subject: [dn42] wiki.dn42 In-Reply-To: References: Message-ID: <201009162342.36775.fabian@datensalat.eu> Hi, On Thursday 16 September 2010 21:09:12 SRN wrote: > So, if anyone among you sees a reason why > ikiwiki and git should not be united in wikimony, please speak now or > forever hold your peace ;-) I never tried ikiwiki, but we may also try raki [1], which is used by the chaostreff heilbronn (germany) [2]. Have a look?! Yours otih [1] http://github.com/ydkn/raki [2] http://www.cthn.de/ -------------- n?chster Teil -------------- Ein Dateianhang mit Bin?rdaten wurde abgetrennt... Dateiname : nicht verf?gbar Dateityp : application/pgp-signature Dateigr??e : 198 bytes Beschreibung: This is a digitally signed message part. URL : From nick at srn.dn42 Thu Sep 16 22:02:26 2010 From: nick at srn.dn42 (SRN) Date: Thu, 16 Sep 2010 20:02:26 +0000 (UTC) Subject: [dn42] wiki.dn42 References: <201009162342.36775.fabian@datensalat.eu> Message-ID: fabian at datensalat.eu (Fabian Fingerle) writes: >Hi, >On Thursday 16 September 2010 21:09:12 SRN wrote: >> So, if anyone among you sees a reason why >> ikiwiki and git should not be united in wikimony, please speak now or >> forever hold your peace ;-) >I never tried ikiwiki, but we may also try raki [1], which is used by the=20 >chaostreff heilbronn (germany) [2]. Have a look?! >Yours > otih >[1] http://github.com/ydkn/raki >[2] http://www.cthn.de/ If raki also stores its pages as plain ordinary files in a standard directory hierarchy, then raki and ikiwiki are compatible (assuming that raki supports one of the many page formats that ikiwiki supports - raki documentation is extremely sparse). -- Q: What's the difference between a liberal and an anarchist? A: The liberal actually thinks that slavery is a good thing. From admin at crystalnet.eu Wed Sep 22 18:03:49 2010 From: admin at crystalnet.eu (Lukas Wingerberg) Date: Wed, 22 Sep 2010 18:03:49 +0200 Subject: [dn42] Server update / changing OS Message-ID: Hi dn42, My server is undergoing some maintanance, all my peers wont be able to reach my tunnel endpoint for about one week beginning tomorrow. Thanks for your understandment Greets Cronix -------------- next part -------------- An HTML attachment was scrubbed... URL: From nustyle at me.com Wed Sep 22 18:07:42 2010 From: nustyle at me.com (Sascha Siegel) Date: Wed, 22 Sep 2010 18:07:42 +0200 Subject: [dn42] Server update / changing OS In-Reply-To: References: Message-ID: Hi, geht ok :-) :P Von meinem iPhone gesendet Am 22.09.2010 um 18:03 schrieb Lukas Wingerberg : > Hi dn42, > My server is undergoing some maintanance, all my peers wont be able to reach my tunnel endpoint for about one week beginning tomorrow. > Thanks for your understandment > Greets Cronix > _______________________________________________ > dn42 mailing list > dn42 at lists.spaceboyz.net > http://lists.spaceboyz.net/mailman/listinfo/dn42