Dieses Wiki ist ein Archiv bis 2023. Das aktuelle Wiki findet sich unter https://wiki.hamburg.ccc.de/
Difference between revisions of "Freifunk:VPN1"
m |
m (Corrected ASN and enabled Wien1) |
||
| Line 215: | Line 215: | ||
neighbor 10.207.0.12 description stuttgart2 | neighbor 10.207.0.12 description stuttgart2 | ||
neighbor 10.207.0.12 peer-group ff-peers | neighbor 10.207.0.12 peer-group ff-peers | ||
| − | + | neighbor 10.207.1.1 remote-as 35492 | |
| − | + | neighbor 10.207.1.1 description wien1 | |
| − | + | neighbor 10.207.1.1 peer-group ff-peers | |
| − | ! neighbor 10.207.1. | + | ! neighbor 10.207.1.2 remote-as 35492 |
| − | ! neighbor 10.207.1. | + | ! neighbor 10.207.1.2 description wien2 |
| − | ! neighbor 10.207.1. | + | ! neighbor 10.207.1.2 peer-group ff-peers |
distance bgp 150 150 150 | distance bgp 150 150 150 | ||
! | ! | ||
Revision as of 17:58, 30 April 2007
Dieser Node besteht momentan aus einem Soekris 4501 Board und soll die Verbindung zwischen den einzelnen Funkwolken in Hamburg und Freifunk Initiativen in anderen Staedten herstellen. Als VPN Software wird Tinc-VPN eingesetzt, wobei allerdings in Zukunft vermutlich auch andere VPN Protokolle unterstuetzt werden koennen.
Interfaces
Hier eine kurze Uebersicht ueber die verschiedenen Netzwerk-Interfaces.
eth0
Das eth0 Interface ist momentan noch ungenutzt.
Interface Name: eth0 IP Adresse : none Hostname : none Description : not used yet Bandwidth : 0bit
eth1
Das eth1 Interface ist zwar up, wird aber in der Regel ebenfalls nicht genutzt.
Interface Name: eth1 IP adresse : 193.158.228.140 Hostname : none Description : secondary uplink Bandwidth : 1500kbit/s
eth2
Ueber das eth2 Interface wird momentan die ganze VPN Geschichte abgewickelt. Es ist moeglich per SSH sich einzuloggen, sofern man den dafuer noetigen Account, oder Exploit hat. Das Tinc-VPN lauscht hier auf den Ports 655 und 656.
Interface Name: eth2 IP adresse : 62.206.27.20 Hostname : vpn1.hamburg.freifunk.net Description : primary uplink Bandwidth : 4000kbit/s
ffhh
Dieses Interface ist fuer das Hamburger Freifunk Netz eingerichtet. Tinc-VPN setzt dieses Interface in den TAP-Modus, damit Pakete zwischen den einzelnen VPN Clients wie bei einem Switch verschickt werden koennen. Der OLSR Daemon sendet seine Pakete an die Broadcast-Adresse (10.127.255.255) ueber dieses Interface.
Interface Name: ffhh IP Adresse : 10.112.1.1/12 Hostname : none Description : Freifunk Hamburg Software : tinc-vpn, olsrd Tinc-Port : 656
ffvpn
Fuer das InterCity-VPN wurde dieses Interface eingerichtet. Tinc-VPN setzt auch dieses Interface in den TAP-Modus und die Quagga Routing Suite kuendigt den Hamburger Freifunk IP-Bereich an entfernte BGP-Router. Wir verwenden die interne AS-Nummer 65044 fuer das BGP-Peering.
Interface Name: ffvpn IP Adresse : 10.207.0.9/16 Hostname : hamburg-r1.hamburg.freifunk.net Description : tunnel staedtekopplung Software : tinc-vpn, quagga(bgpd) Tinc-Port : 655 AS-Number : 65044
Konfigurationen
Tinc-VPN
Hamburger Freifunk VPN (ffhh)
ffhh/tinc.conf
AddressFamily=ipv4 Name = vpn1 PrivateKeyFile = /etc/tinc/ffhh/rsa_key.priv Mode = Switch PingTimeout = 30 Port = 656 BindToAddress = 62.206.27.20 Hostnames=yes ConnectTo = vpn2
ffhh/tinc-up
#!/bin/sh ip addr add dev $INTERFACE 10.112.1.1/12 broadcast 10.127.255.255 ip link set dev $INTERFACE up
ffhh/tinc-down
#!/bin/sh ip link set dev $INTERFACE down ip addr del 10.112.1.1 dev $INTERFACE
ffhh/hosts/vpn1
Address = vpn1.hamburg.freifunk.net Cipher=blowfish Compression=0 Digest=sha1 IndirectData=no Port = 656 -----BEGIN RSA PUBLIC KEY----- MIGJAoGBAKVI9lNEiJ3JVDuXhsLKdqhE+k14bCM8cYaAReNrzBSDODxuLm+pPKwo +7SgYW2/vAdnbFX689yKIs9inbQGNrakQQS/84pQ4TyN+H1dkhmxn5hweF/Ci3Qp UxzfjeVmeH2L+ecVOgWK10aoUhfVGvCVB3UpoCT6GrQwOa8gB5vfAgMBAAE= -----END RSA PUBLIC KEY-----
InterCity VPN (ffvpn)
ffvpn/tinc.conf
Name = hhvpn1 ConnectTo = hhvpn2 ConnectTo = berlin1 PrivateKeyFile = /etc/tinc/ffvpn/rsa_key.priv Mode = Switch PingTimeout = 30 #TCPOnly = yes Port = 655 Hostnames=yes BindToAddress = 62.206.27.20
ffvpn/tinc-up
#!/bin/sh ip addr add dev $INTERFACE 10.207.0.9/16 broadcast 10.207.255.255 ip link set dev $INTERFACE up
ffvpn/tinc-down
#!/bin/sh ip link set dev $INTERFACE down ip addr del 10.207.0.9 dev $INTERFACE
ffvpn/hosts/hhvpn1
Address = vpn1.hamburg.freifunk.net Port = 655 -----BEGIN RSA PUBLIC KEY----- MIGJAoGBAL5ld4OnWv52XD8q0MbfW+DLUe2lCaHLyf4XacwqOhjvS5RH+iAyPgIc BZJEtmKjW+FrPRLTtJVeptlLWGJr+EE2/G3fq0/AbQDhzIT7OnqCNGrMC1YzNOZm C8CVyiPwELdvBL+Z7j6Jq545/1zZ/H+z1EK6xuucjhwITFqMQrdxAgMBAAE= -----END RSA PUBLIC KEY-----
ffvpn/hosts/berlin1
address = vpn-freifunk.leo34.net -----BEGIN RSA PUBLIC KEY----- MIGJAoGBALfEgQh1Po7B5/IP57pZT0iRjY+8GVfGgkYB7dFIANk/iSWjThe9pERm x4GGx2NNoiNoDVdUtSz41oIc65bd651G01e2A1bnFQ9qRc9rZ/S91SqpO0+KheYw judU2Mc81XkKQ38e9rgtU/OvWOF1Hq2EOOork2cePsC8QRa9oAa5AgMBAAE= -----END RSA PUBLIC KEY-----
Quagga
InterCity-VPN
bgpd.conf
! ! Zebra configuration saved from vty ! 2007/04/19 08:19:20 ! hostname hh-r1 password 8 pophase enable password 8 blasehase log file /var/log/bgpd.log informational log syslog informational service advanced-vty service password-encryption ! debug bgp events ! router bgp 65044 bgp router-id 10.207.0.9 bgp log-neighbor-changes network 10.112.0.0/13 network 10.120.0.0/14 network 10.124.0.0/15 network 10.126.0.0/16 neighbor ff-peers peer-group neighbor ff-peers update-source 10.207.0.9 neighbor 10.207.0.1 remote-as 65041 neighbor 10.207.0.1 peer-group ff-peers neighbor 10.207.0.1 description leipzig-r1 neighbor 10.207.0.2 remote-as 65041 neighbor 10.207.0.2 description leipzig-r2 neighbor 10.207.0.2 peer-group ff-peers neighbor 10.207.0.3 remote-as 65042 neighbor 10.207.0.3 description weimar-r1 neighbor 10.207.0.3 peer-group ff-peers neighbor 10.207.0.4 remote-as 65042 neighbor 10.207.0.4 description weimar-r2 neighbor 10.207.0.4 peer-group ff-peers neighbor 10.207.0.5 remote-as 65040 neighbor 10.207.0.5 description berlin1 neighbor 10.207.0.5 peer-group ff-peers neighbor 10.207.0.6 remote-as 65040 neighbor 10.207.0.6 description berlin-r2 neighbor 10.207.0.6 peer-group ff-peers neighbor 10.207.0.7 remote-as 65043 neighbor 10.207.0.7 description erfurt-r1 neighbor 10.207.0.7 peer-group ff-peers neighbor 10.207.0.8 remote-as 65043 neighbor 10.207.0.8 description erfurt-r2 neighbor 10.207.0.8 peer-group ff-peers neighbor 10.207.0.11 remote-as 65045 neighbor 10.207.0.11 description stuttgart1 neighbor 10.207.0.11 peer-group ff-peers neighbor 10.207.0.12 remote-as 65045 neighbor 10.207.0.12 description stuttgart2 neighbor 10.207.0.12 peer-group ff-peers neighbor 10.207.1.1 remote-as 35492 neighbor 10.207.1.1 description wien1 neighbor 10.207.1.1 peer-group ff-peers ! neighbor 10.207.1.2 remote-as 35492 ! neighbor 10.207.1.2 description wien2 ! neighbor 10.207.1.2 peer-group ff-peers distance bgp 150 150 150 ! access-list access permit 127.0.0.1/32 access-list access deny any access-list all deny 192.168.0.0/16 access-list all deny 10.112.0.0/12 access-list all permit any ! line vty access-class access !
