Fpac issues.

Brian n1uro wrote in the news group that he had problems with “ifconfig rose0 down”. Now I have also experienced this problem. And even a “kernel panic” with fpac.

First the piece of Brian n1uro.

If you run rose and try to "ifconfig rose0 down" or if you try to remove
the module:

Nov 27 23:18:10 n1uro kernel: [398645.598318] unregister_netdevice:
waiting for rose0 to become free. Usage count = 556
Nov 27 23:18:20 n1uro kernel: [398655.836006] unregister_netdevice:
waiting for rose0 to become free. Usage count = 556
Nov 27 23:18:30 n1uro kernel: [398666.073800] unregister_netdevice:
waiting for rose0 to become free. Usage count = 556
Nov 27 23:18:41 n1uro kernel: [398676.311558] unregister_netdevice:
waiting for rose0 to become free. Usage count = 556
^Cn1uro@n1uro:~$

The kernel goes into an endless loop every 10 seconds. This began in 3.x
series kernels. On 4.2=< it tends to panic.

“ifconfig rose0 down” seems to work. But if you try again a “rsattach” you will see that he takes “rose1”. Try it against “mobprobe -r rose” and you immediately get an “unregister_netdevice”. Fairly annoying.

Here we come to the “kernel panic”. After starting and stopping fpac, it means that the rose0 interface has not been released. If you then make a rose connection from uronode to fpac you get a “kernel panic”

pd2lt@uro.pd2lt.ampr.org-IPv6: fpac
Trying pi1lap-6 @ 2040330113... <Enter> aborts.

Message from syslogd@gw at Nov 28 15:40:33 ...
 kernel:[121671.208449] Oops: 0000 [#1] SMP

Message from syslogd@gw at Nov 28 15:40:33 ...
 kernel:[121671.211078] Process fpacwpd (pid: 5892, ti=f580a000 task=f4df7ae0 task.ti=f4f7e000)

Message from syslogd@gw at Nov 28 15:40:33 ...
 kernel:[121671.211207] Stack:

Message from syslogd@gw at Nov 28 15:40:33 ...
 kernel:[121671.211780] Call Trace:

Message from syslogd@gw at Nov 28 15:40:33 ...
 kernel:[121671.212007]  <IRQ>

After stopping and starting fpac, syslog / user.log is fully spammed. It was even so bad that I got an email from my system in one day that the disk was full. Helppppppp ….. panic

Syslog and user.log were a few gigabytes in size.

Nov 29 14:37:43 gw fpad: accept error Invalid argument
Nov 29 14:37:43 gw fpad: accept error Invalid argument
Nov 29 14:37:43 gw fpad: accept error Invalid argument
Nov 29 14:37:43 gw fpad: accept error Invalid argument
Nov 29 14:37:43 gw rsyslogd-2177: imuxsock lost 884 messages from pid 5960 due to rate-limiting
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument
Nov 29 14:37:43 gw fpad: accept error Invalid argument
Nov 29 14:37:43 gw fpad: accept error Invalid argument
Nov 29 14:37:43 gw fpad: accept error Invalid argument
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument
Nov 29 14:37:43 gw fpacroute: FPAC fpacroute accept error Invalid argument

So do not stop fpac en restart it again. Reboot the system to free the rose interface. Unfortunately

Flexd and uronode

I had some problems getting the flexnet destinations in uronode. Xnet node is running with various flexnet links. Now I also want uronode to know these flexnet destinations. There appears to be a small secret in the “prompt” that flexd expects. I had a prompt “pi1lap ==>” That is not what flexd expected. Flexd expects a prompt “=>” So now I had to adjust the Xnet prompt to the expectations of flexd. (Tnx Brian n1uro for the hint)
Maybe the “pi1lap =>” prompt will work, I have to test that

There is also something with the buffer size of flexd. See the README.flexd in the source dir.

root@gw:/etc/ax25# cat /usr/local/src/uronode-2.8/README.flexd
If you find that your flexd isn't properly working, scroll down to line 120
where it says:
char  buffer[256], port[14], path[AX25_MAX_DIGIS*10]
and adjust the buffer per your neighbor's screens. The formula is:
2 data frames: 256
3 data frames: 512
4 data frames: 1024

Okay so how muts frames i have, let’s have a look

[3] fm PI1LAP-15 to PI1LAP ctl SABM+
[3] fm PI1LAP to PI1LAP-15 ctl UA-
[3] fm PI1LAP to PI1LAP-15 ctl I00^ pid F0 (211)
(X)net V1.39 Node PI1LAP

That are 2 frames. I had to set the buffer size to 256 and recompile flexd.c

int download_dest(char *gateway, char *fname)
{
  FILE *tmp;
  char buffer[256], port[14], path[AX25_MAX_DIGIS*10];

Also i have made a change to line 277. Also change to 256 buffer size

    if (FD_ISSET(s, &read_fd)) {
//      if ((n = read(s, buffer, 512)) == -1) break;
	if ((n = read(s, buffer, 256)) == -1) break;

Setup flexd.conf

# /etc/ax25/flexd.conf
# see man flexd.conf

# The callsign-ssid you wish to poll your flex neighbor with:

MyCall          pi1lap-15

# How often do we poll our flex neighbor (in seconds):

PollInterval    300

# The FlexNet node we're to poll:

FlexGate        pi1lap

The prompt for Xnet

root@gw:/etc/ax25# grep prompt /usr/local/xnet/AUTOEXEC.NET
my prompt =>

Let’s give it a try.

[3] fm PI1LAP-15 to PI1LAP ctl SABM+
[3] fm PI1LAP to PI1LAP-15 ctl UA-
[3] fm PI1LAP to PI1LAP-15 ctl I00^ pid F0 (211)
(X)net V1.39 Node PI1LAP

Lap = F6fbb bbs PI8LAP
Jnos = Jnos 2.0k.1 PD2LT
Dx = Cluster Dxspider PI1LAP-4
Uro = Uronode PI1LAP-15

=>
[3] fm PI1LAP-15 to PI1LAP ctl I10^ pid F0 (2)
d
[3] fm PI1LAP to PI1LAP-15 ctl I11^ pid F0 (236)

BBS     0-0     33  CE8FGC  0-0     33  CX2SA   0-0     34  CX2SA   5-5      5
DB0ERF  0-12     4  DB0ERF 13-13     3  DB0ERF 14-14    30  DB0ERF 15-15    30
DB0RES  0-9      5  DB0RES 10-10     4  DB0ZWI  0-1      6  DB0ZWI  3-3
[3] fm PI1LAP to PI1LAP-15 ctl I12^ pid F0 (236)
5
DB0ZWI  4-15     4  DH4LAR  1-1      4  DL0HBS  7-7     30  F1ZYS   8-8     10
F3KT    0-10     4  F4DUR   7-7      5  F4DUR   8-8     39  F5ZFC   0-7    132
F8KHI   3-3     39  F8KHI   7-7     39  FGCBBS  0-0     33  HB9CSR  1-1
[3] fm PI1LAP to PI1LAP-15 ctl I13^ pid F0 (236)
40
HB9CSR  3-3      5  HB9CSR  8-8     40  HB9ON   1-1     39  HB9ON   8-8     34
HB9ON   9-9     34  HB9ON  10-10     4  HB9ON  14-14     5  HG0PLA  0-0      5
HG6PGA  0-0    109  HG8IT   0-0     35  HG8LXL  0-0     31  HG8PCS  0-0

Uronode

pd2lt@uro.pd2lt.ampr.org-IPv6: d
FlexNet Destinations:
BBS     0-0     34  CE8FGC  0-0     34  CX2SA   0-0     35  CX2SA   5-5      5
DB0ERF  0-12     5  DB0ERF  13-13    4  DB0ERF  14-14   31  DB0ERF  15-15   31
DB0RES  0-9      6  DB0RES  10-10    5  DB0ZWI  0-1      7  DB0ZWI  3-3      6
DB0ZWI  4-15     5  DH4LAR  1-1      5  DL0HBS  7-7     31  F1ZYS   8-8      6
F3KT    0-10     4  F4DUR   7-7      5  F4DUR   8-8     39  F5ZFC   0-7    116
F8KHI   3-3     39  F8KHI   7-7     39  FGCBBS  0-0     34  HB9CSR  1-1     41

Yes, all looks okay.

The flexnet destinations are saved in “/usr/local/var/ax25/flex” on a debian wheezy system.

Bind bpq to ax25 interface

I’m using uronode as front end node, but i’m also like to connect to different packet software.
This time it’s linbpq. Lets go…..

First of all bpq32.cfg
Change the comport to COMPORT=/dev

PORT
 PORTNUM=1
 ID=Link Local
 TYPE=ASYNC
 PROTOCOL=KISS
 FULLDUP=0
 COMPORT=/dev
 SPEED=19200
 CHANNEL=A
 NOKEEPALIVES=0
 PERSIST=160
 SLOTTIME=180
 TXDELAY=180
 TXTAIL=23
 QUALITY=192
 MINQUAL=100
 MAXFRAME=4
 FRACK=5000
 RESPTIME=1000
 RETRIES=25
 PACLEN=128
 UNPROTO=APBPQ1,PI1LAP-5
 BCALL=PI1LAP-9
 L3ONLY=0
 DIGIFLAG=1
 DIGIPORT=0
 USERS=0
ENDPORT

Axports

root@gw:/usr/local/linbpq# cat /etc/ax25/axports
ax1     PI1LAP-9        19200   256     2       Linbpq pi1lap-9

Now the linbpq start file

setcap "CAP_NET_ADMIN=ep CAP_NET_RAW=ep CAP_NET_BIND_SERVICE=ep" linbpq

# Link local pi1lap-9
        echo "Starting ax1 "
        if grep ax1 /etc/ax25/axports ; then
        tmpfile="/tmp/$.startax5.pts"
        kissnetd -p 2 > "$tmpfile" &
        sleep 2
        attachthem () {
                read PTS1 PTS2
                kissattach -l $PTS1 ax1 44.137.31.73 || return=$rc_failed
                ifconfig ax1 44.137.31.73 netmask 255.255.255.224 up
                sleep 1
                sed -i "s,COMPORT=/dev/.*$,COMPORT=$PTS2," /usr/local/linbpq/bpq32.cfg
        }

        tail -n 1 $tmpfile | attachthem
        rm $tmpfile
        sleep 3
        else
               echo  "Error ax1 not found in the file axports"
                return="Failed"
        fi
        echo "$1 $return"

cd /usr/local/linbpq
sudo ./linbpq  >/dev/tty4

Ok let’s look it ok now

ps ax | grep kissattach

root@gw:/usr/local/linbpq# ps ax | grep kissattach
 5910 ?        S      0:00 kissattach -l /dev/pts/16 ax1 44.137.31.73
 6504 pts/19   S+     0:00 grep kissattach

Now have a look in bpq32.cfg

root@gw:/usr/local/linbpq# grep COMPORT=/dev bpq32.cfg
 COMPORT=/dev/pts/17

Here you see there is a PTS couple /dev/pts/16 and /dev/pts/17

So we are good to go.

pd2lt@uro.pd2lt.ampr.org-IPv6: r
Routes:
Link Intface Callsign  Qual Nodes Lock  QSO
---- ------- --------- ---- ----- ----  ---
>    ax1     PI1LAP-9   203     2         0

The route to pi1lap-9 is there in uronode. Let’s try a connect.

pd2lt@uro.pd2lt.ampr.org-IPv6: c pi1lap-9
Trying LAPBPQ:PI1LAP-9... <Enter> aborts.
Virtual circuit established to LAPBPQ:PI1LAP-9
Connected to PI1LAP-9.
Packet/Switch Node, Kortgene JO11VN

LAPBPQ:PI1LAP-9} BBS,URO,FPAC,APP,RMS,DX,JNOS,CHAT,C,B,I,N,R,P,U,V,S,MH
l
LAPBPQ:PI1LAP-9} Links
PI1LAP-5 PI1LAP-9 S=5 P=1 T=3 V=2

😉

Check of the services are online

I have written a script that checks whether the services are still running, if not, I will receive an email and can take action. The script writes the data in a file. This file is in /var/www/up and is called up.htm. Now I can view the file via the browser. http://ip-adres/up/up.htm

http://gw.pd2lt.ampr.org/up/up.htm  # Only amprnet

I have add a cronjob for it. The cronjob runs the script every 5 minutes

*/5  *    * * *   root    /usr/local/etc/ax25/ax-up

The output look like this

Here is the script

#!/bin/sh
mail=pd2lt( @ )packet-radio.net;
S1=netromd;
S2=ax25d;
S3=ax25rtd;
S4=flexd;
S5=mheardd;
S6=beacon;
S7=xfbbd;
S8=jnos;
S9=linuxnet;
S10=ax25ipd;
S11=ax25udp;
S12=rstatrxd;
S13=slattach;
S14=socat;
S15=kissnetd;
S16=kissattach;
S17=apache2;

# Remove the old one
rm -f /var/www/up/up.htm
    echo "<h2> Check services on pi1lap/pi8lap</h2>" >> /var/www/up/up.htm
    echo "#########################################<br/>" >> /var/www/up/up.htm
    echo "Services check script v2.0.32<br/>" >> /var/www/up/up.htm
    echo "E-mail : pd2lt@packet-radio.net<br/>" >> /var/www/up/up.htm
    echo "https://packet-radio.net<br/>" >> /var/www/up/up.htm
    echo "#########################################<br/><br/>" >> /var/www/up/up.htm
    echo "Uptime Pi1lap -" `uptime` "<br/>" >> /var/www/up/up.htm
    echo `uname -a` "<br/><br/>" >> /var/www/up/up.htm
# netromd
if P1=$(pgrep $S1)
then
    echo "1. $S1 is up and running, PID is $P1 - Uptime" `ps -o etime= -p "$P1"` "<br/>" >> /var/www/up/up.htm
else
    echo "1. $S1 is not running" | mail -s "$S1 down" $mail
fi
# ax25d
if P2=$(pgrep $S2)
then
    echo "2. $S2 is up and running, PID is $P2 - Uptime" `ps -o etime= -p "$P2"` "<br/>" >> /var/www/up/up.htm
else
    echo "2. $S2 is not running" | mail -s "$S2 down" $mail
fi
# ax25rtd
if P3=$(pgrep $S3)
then
    echo "3. $S3 is up and running, PID is $P3 - Uptime" `ps -o etime= -p "$P3"` "<br/>" >> /var/www/up/up.htm
else
    echo "3. $S3 is not running" | mail -s "$S3 down" $mail
fi
# flexd
if P4=$(pgrep $S4)
then
    echo "4. $S4 is up and running, PID is $P4 - Uptime" `ps -o etime= -p "$P4"` "<br/>" >> /var/www/up/up.htm
else
    echo "4. $S4 is not running" | mail -s "$S4 down" $mail
fi
#mheardd
if P5=$(pgrep $S5)
then
    echo "5. $S5 is up and running, PID is $P5 - Uptime" `ps -o etime= -p "$P5"` "<br/>" >> /var/www/up/up.htm
else
    echo "5. $S5 is not running" | mail -s "$S5 down" $mail
fi
# beacon
if P6=$(pgrep $S6)
then
    echo "6. $S6 is up and running, PID is $P6 <br/>" >> /var/www/up/up.htm
else
    echo "6. $S6 is not running" | mail -s "$S6 down" $mail
fi
# xfbbd
if P7=$(pgrep $S7)
then
    echo "7. $S7 is up and running, PID is $P7 - Uptime" `ps -o etime= -p "$P7"` "<br/>" >> /var/www/up/up.htm
else
    echo "7. $S7 is not running" | mail -s "$S7 down" $mail
fi
# jnos
if P8=$(pgrep $S8)
then
    echo "8. $S8 is up and running, PID is $P8 - Uptime" `ps -o etime= -p "$P8"` "<br/>" >> /var/www/up/up.htm
else
    echo "8. $S8 is not running" | mail -s "$S8 down" $mail
fi
# linuxnet
if P9=$(pgrep $S9)
then
    echo "9. $S9 is up and running, PID is $P9 - Uptime" `ps -o etime= -p "$P9"` "<br/>" >> /var/www/up/up.htm
else
    echo "9. $S9 is not running" | mail -s "$S9 down" $mail
fi
# ax25ipd
if P10=$(pgrep $S10)
then
    echo "10. $S10 is up and running, PID is $P10 - Uptime" `ps -o etime= -p "$P10"` "<br/>" >> /var/www/up/up.htm
else
    echo "10. $S10 is not running" | mail -s "$S10 down" $mail
fi
# ax25udp
if P11=$(pgrep $S11)
then
    echo "11. $S11 is up and running, PID is $P11 - Uptime" `ps -o etime= -p "$P11"` "<br/>" >> /var/www/up/up.htm
else
    echo "11. $S11 is not running" | mail -s "$S11 down" $mail
fi
# rstatrxd
if P12=$(pgrep $S12)
then
    echo "12. $S12 is up and running, PID is $P12 - Uptime" `ps -o etime= -p "$P12"` "<br/>" >> /var/www/up/up.htm
else
    echo "12. $S12 is not running" | mail -s "$S12 down" $mail
fi
# slattach
if P13=$(pgrep $S13)
then
    echo "13. $S13 is up and running, PID is $P13 - Uptime" `ps -o etime= -p "$P13"` "<br/>" >> /var/www/up/up.htm
else
    echo "13. $S13 is not running" | mail -s "$S13 down" $mail
fi
# socat
if P14=$(pgrep $S14)
then
    echo "14. $S14 is up and running, PID is $P14 <br/>" >> /var/www/up/up.htm
else
    echo "14. $S14 is not running" | mail -s "$S14 down" $mail
fi
# kissnetd
if P15=$(pgrep $S15)
then
    echo "15. $S15 is up and running, PID is $P15 <br/>" >> /var/www/up/up.htm
else
    echo "15. $S15 is not running" | mail -s "$S15 down" $mail
fi
# kissattach
if P16=$(pgrep $S16)
then
    echo "16. $S16 is up and running, PID is $P16 <br/>" >> /var/www/up/up.htm
else
    echo "16. $S16 is not running" | mail -s "$S16 down" $mail
fi
# apache2
if P17=$(pgrep $S17)
then
    echo "17. $S17 is up and running, PID is $P17 <br/>" >> /var/www/up/up.htm
else
    echo "17. $S17 is not running" | mail -s "$S17 down" $mail
fi

 

Linux commando “ps ax”

 2604 ?        S      0:00 /usr/bin/perl /usr/local/sbin/rip44d -p passwd -t 44
 2609 tty3     Ss+    0:01 ./jnos -C -g2 -u3 -f nos.cfg -i
 2610 ?        Ss     0:00 /bin/su -c /usr/bin/perl -w /spider/perl/cluster.pl sysop
 2704 ?        Ss     0:00 sh -c /usr/bin/perl -w /spider/perl/cluster.pl
 2705 ?        S      0:01 /usr/bin/perl -w /spider/perl/cluster.pl
 5007 ?        S      0:00 kissattach /dev/ttyUSB0 ax0
 5430 ?        S      0:00 kissattach /dev/ttyUSB1 ax1
 5494 pts/2    S+     0:00 listen -acirt
 5498 pts/1    S      0:00 kissnetd -p 2
 5505 ?        S      0:00 kissattach -l /dev/pts/3 ax2 44.137.31.73
 5516 pts/1    S      0:00 kissnetd -p 2
 5523 ?        S      0:00 kissattach -l /dev/pts/5 ax3 44.137.31.73
 5534 pts/1    S      0:00 socat -d -d -ly PTY,link=/dev/ttyq1 PTY,link=/dev/ptyq1
 5536 pts/1    S      0:00 slattach -s 38400 -p slip /dev/ptyq1
 5549 pts/1    S      0:00 socat -d -d -ly PTY,link=/dev/ttyq2 PTY,link=/dev/ptyq2
 5554 ?        S      0:00 kissattach -m 256 /dev/ptyq2 ax4 44.137.31.73
 5561 ?        S      0:00 ax25udp -c /etc/ax25/ax25ipd-10093.conf
 5564 pts/1    S      0:00 socat -d -d -ly PTY,link=/dev/ttyq3 PTY,link=/dev/ptyq3
 5569 ?        S      0:00 kissattach -m 256 /dev/ptyq3 ax5 44.137.31.73
 5574 ?        S      0:00 ax25ipd -c /etc/ax25/ax25ipd-axip.conf
 5579 pts/1    S      0:00 socat -d -d -ly PTY,link=/dev/ttyq4 PTY,link=/dev/ptyq4
 5585 ?        S      0:00 kissattach -m 256 /dev/ptyq4 ax6 44.137.31.73
 5606 pts/1    S      0:00 ./linuxnet
 5607 pts/1    S      0:00 ./rstatrxd /var/www/cgi-bin/postat/
 5616 ?        S      0:00 beacon -c PI1LAP-15 -t 10 -d ID ax3 Network node PI1LAP-15 Zeeland, JO11VN
 5617 ?        S      0:00 beacon -c PI1LAP-15 -t 10 -d ID ax2 Network node PI1LAP-15 Zeeland, JO11VN
 5618 ?        S      0:00 beacon -c PI1LAP-15 -t 10 -d ID ax0 Network node PI1LAP-15 Zeeland, JO11VN
 5619 ?        S      0:00 beacon -c PI1LAP-15 -t 10 -d ID ax1 Network node PI1LAP-15 Zeeland, JO11VN
 5620 ?        S      0:00 /usr/local/sbin/ax25d
 5622 ?        S      0:00 /usr/local/sbin/mheardd
 5624 pts/1    S      0:00 /usr/local/sbin/ax25rtd
 5626 ?        S      0:00 /usr/local/sbin/flexd
 5628 ?        S      0:00 /usr/local/sbin/netromd -c -i -p 1 -t 15
 5636 pts/1    S      0:00 /bin/bash /usr/local/sbin/fbb -s -a
 5638 pts/1    S      0:00 /usr/local/sbin/xfbbd -s -a

 

iptables allow traceroute / axip / rip protocol

#!/bin/bash
ipt="/sbin/iptables"
$ipt -P INPUT DROP
$ipt -P FORWARD DROP
$ipt -P OUTPUT ACCEPT
# Ampr.org
# Port 520 RIP,Routing protocol
$ipt -A INPUT -p udp --dport 520 -j ACCEPT
# Allow traceroute. Je moet de udp poort 33434 en 33523 niet droppen. Een reject is goed.
# Als je hem dropt wordt een traceroute niet mogelijk
$ipt -A INPUT -p icmp --icmp-type 8 -j ACCEPT
$ipt -A INPUT -p udp --dport 33434:33523 -j REJECT
# Proto 4 = IPv4 encapsulation / Proto 93 = ax.25 / Proto 94 = IPIP
# Hier wordt alles toegelaten van en naar het 44 netwerk.
# Wil je alleen het 44net toelaten
# $ipt –I INPUT –s ACCEPT –s 44.0.0.0/8 –d 44.0.0.0/8
#
$ipt -I INPUT -j ACCEPT -s 44.0.0.0/8 -d 0.0.0.0
$ipt -I INPUT -j ACCEPT -s 0.0.0.0 -d 44.0.0.0/8
$ipt -I FORWARD -j ACCEPT -s 44.0.0.0/8 -d 0.0.0.0/0
$ipt -I FORWARD -j ACCEPT -s 0.0.0.0/0 -d 44.0.0.0/8
$ipt -I INPUT -j ACCEPT --proto 4
$ipt -I INPUT -j ACCEPT --proto 93
$ipt -I INPUT -j ACCEPT --proto 94
$ipt -I FORWARD -j ACCEPT --proto 4
$ipt -I FORWARD -j ACCEPT --proto 94
$ipt -I FORWARD -j ACCEPT --proto 93

 

Allowing traceroutes to succeed with iptables

Traceroute from Windows machines typically uses ICMP Type 8 packets.  Traceroute from Unixlike machines typically uses UDP packets with sequentially increasing destination ports, from 33434 to 33534.  So your server (the traceroute destination) must not drop incoming ICMP Type 8 or UDP 33434:33534.

Here’s where it gets tricky: it really doesn’t need to accept those packets either, which the vast majority of sites addressing this issue recommends.  It just needs to be able to reject them, which won’t happen if they’re being dropped.  If you implement the typical advice – accepting those packets – traceroute basically ends up sort of working by accident: those ports shouldn’t be in use by any running applications, and since nothing is monitoring them, the server will issue an ICMP Type 3 response (destination unreachable).  However, if you’re accepting packets to these ports, then a rogue application listening on those ports also becomes reachable – which is the sort of thing your firewall should be preventing in the first place.

The good news is, DROP and ACCEPT aren’t your only options – you can REJECT these packets instead, which will do exactly what we want here: allow traceroutes to work properly without also potentially enabling some rogue application to listen on those UDP ports.

So all you really need on your server to allow incoming traceroutes to work properly is:

# allow ICMP Type 8 (ping, ICMP traceroute)
-A INPUT -p icmp --icmp-type 8 -j ACCEPT
# enable UDP traceroute rejections to get sent out
-A INPUT -p udp --dport 33434:33523 -j REJECT

 

Policy based routing Amprnet

Setup een amprnet gateway met policy based routing.

Neem een kijkje op deze website voor de uitleg.
http://wiki.ampr.org/wiki/Startampr

############# tunnel ampr.org ################################
ifconfig tunl0 up 44.137.31.65/27 multicast
ip tunnel change ttl 64 mode ipip tunl0
ip link set dev tunl0 up
################# default route naar gw-44-137.ampr.org ##################
ip route add default dev tunl0 via 213.222.29.194 onlink table 44
######################## route ampr.org #################################
ip rule add to 44.0.0.0/8 table 44 priority 44
ip rule add from 44.137.31.64/27 table 44 priority 45
# Xnet Route
ip route add 44.137.31.70 dev sl0 table 44 src 44.137.31.69
# Jnos Route
ip route add 44.137.31.67 dev tun0 table 44 src 44.137.31.68
ip rule add from 44.137.31.64/27 to 192.168.1.0/24 table main priority 22
ip rule add to 44.137.31.64/27 table main priority 44
ip rule add dev tunl0 table 44 priority 45
ip rule add dev eth0 table 44 priority 46
ip rule add from 44.137.31.64/27 table 44 priority 47

### STARTS THE ampr-ripd ROUTER DAMEON
# -s saves routes to /var/lib/ampr-ripd/encap.txt
# -r use raw socket instead of multicast
# -t routing table to use
# -i tunnel interface to use
# -p RIPv2 password (latest ampr-ripd defaults to the current valid password)
# -a ampr subnets to be ignored (remove your allocation from the table)
/usr/sbin/ampr-ripd -s -r -t 44 -i tunl0 -L pi1lap@jo11vn

Traceroute -m 64 bad.horse

root@pi1lap:~# traceroute -m 64 bad.horse
traceroute to bad.horse (162.252.205.157), 64 hops max, 60 byte packets
18  bad.horse (162.252.205.130)  138.709 ms  140.816 ms  139.755 ms
19  bad.horse (162.252.205.131)  149.362 ms  148.325 ms  147.516 ms
20  bad.horse (162.252.205.132)  154.015 ms  150.660 ms  150.547 ms
21  bad.horse (162.252.205.133)  162.613 ms  152.024 ms  153.963 ms
22  he.rides.across.the.nation (162.252.205.134)  168.164 ms  167.627 ms  157.998 ms
23  the.thoroughbred.of.sin (162.252.205.135)  161.472 ms  165.656 ms  166.011 ms
24  he.got.the.application (162.252.205.136)  169.413 ms  168.101 ms  192.127 ms
25  that.you.just.sent.in (162.252.205.137)  187.624 ms  175.584 ms  174.123 ms
26  it.needs.evaluation (162.252.205.138)  187.203 ms  178.079 ms  188.922 ms
27  so.let.the.games.begin (162.252.205.139)  194.090 ms  190.662 ms  189.273 ms
28  a.heinous.crime (162.252.205.140)  192.752 ms  188.997 ms  193.715 ms
29  a.show.of.force (162.252.205.141)  202.382 ms  202.387 ms  203.915 ms
30  a.murder.would.be.nice.of.course (162.252.205.142)  234.657 ms  203.534 ms  200.304 ms
31  bad.horse (162.252.205.143)  206.686 ms  205.931 ms  205.938 ms
32  bad.horse (162.252.205.144)  211.575 ms  215.600 ms  218.457 ms
33  bad.horse (162.252.205.145)  216.021 ms  222.228 ms  222.077 ms
34  he-s.bad (162.252.205.146)  222.613 ms  229.693 ms  228.600 ms
35  the.evil.league.of.evil (162.252.205.147)  227.446 ms  235.141 ms  235.604 ms
36  is.watching.so.beware (162.252.205.148)  228.613 ms  229.605 ms  229.793 ms
37  the.grade.that.you.receive (162.252.205.149)  244.729 ms  238.574 ms  243.192 ms
38  will.be.your.last.we.swear (162.252.205.150)  243.546 ms  245.120 ms  238.522 ms
39  so.make.the.bad.horse.gleeful (162.252.205.151)  244.504 ms  244.750 ms  244.333 ms
40  or.he-ll.make.you.his.mare (162.252.205.152)  287.329 ms  258.506 ms  249.524 ms
41  o_o (162.252.205.153)  257.108 ms  259.796 ms  258.953 ms
42  you-re.saddled.up (162.252.205.154)  260.623 ms  260.135 ms  257.166 ms
43  there-s.no.recourse (162.252.205.155)  263.938 ms  263.962 ms  266.667 ms
44  it-s.hi-ho.silver (162.252.205.156)  284.177 ms  278.989 ms  271.777 m