صفحهٔ اصلی گشت‌و‌گذار راهنما
ورود
mark22k
/
dn42-wiki
mirrorاز https://codeberg.org/mark22k/dn42-wiki.git
دنبال کردن 1
ستاره دار 0
انشعاب 0
پرونده‌ها مشکلات 0 ویکی
شاخه: pages
شاخه‌ها تگ‌ها
dn42-wiki
/
howto
/
EdgeOS-Config.html

EdgeOS-Config.html 11 KB
لینک دائمی تاريخچه خام

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310 
  1. <!DOCTYPE html>
    2. 

  2. <html lang="en">
    3. 

  3.     <head>
    4. 

  4. <meta charset="UTF-8">
    5. 

  5. 

  6. 

  7. 

  8. <title>EdgeOS | dn42 wiki</title>
    9. 

  9. 

  10. <meta name="viewport" content="width=device-width, initial-scale=1.0">
    11. 

  11. <meta name="robots" content="index, follow">
    12. 

  12. <meta name="keywords" content="dn42,wiki,routing,bgp">
    13. 

  13. 

  14. <link rel="canonical" href="https://dn42.obl.ong/howto/EdgeOS-Config.html">
    15. 

  15. <link rel="icon" type="image/x-icon" href="/favicon.ico">
    16. 

  16. <link rel="shortcut icon" type="image/x-icon" href="/favicon.ico">
    17. 

  17. 

  18. <link rel="author" type="text/html" href="/docs/people">
    19. 

  19. 

  20. <link rel="stylesheet" href="/css/normalize.css">
    21. 

  21. <link rel="stylesheet" href="/css/simple.min.css">
    22. 

  22. <link rel="stylesheet" href="/css/style.css">
    23. 

  23. <link rel="stylesheet" href="/css/menu.css">
    24. 

  24. 

  25. 

  26. </head>
    27. 

  27.     
    28. 

  28.     <body>
    29. 

  29. 

  30.         <header>
    31. 

  31. 

  32. 

  33. <b>dn42 wiki / EdgeOS</b>
    34. 

  34. 

  35. <div id="dn42_header">
    36. 

  36.     
    37. 

  37.     <p><a href="/"><img src="/dn42.png" alt="dn42" /></a></p>
    38. 

  38. 

  39. </div>
    40. 

  40. </header>
    41. 

  41. 

  42.         <main>
    43. 

  43.             <h1 id="edgeos">EdgeOS</h1>
    44. 

  44. 

  45. <p>This document describes some possibilities for connecting to dn42 using an Ubiquiti EdgeRouter:</p>
    46. 

  46. 

  47. <ul>
    48. 

  48.   <li>IPv4/IPv6 tunnel via:
    49. 

  49.     <ul>
    50. 

  50.       <li>OpenVPN - support built into EdgeOS already - covered below</li>
    51. 

  51.       <li>IPsec/IKEv2 - support built into EdgeOS already - not covered here</li>
    52. 

  52.       <li>QuickTun - see <a href="https://github.com/neilalexander/vyatta-quicktun">vyatta-quicktun package</a> - not covered here</li>
    53. 

  53.     </ul>
    54. 

  54.   </li>
    55. 

  55.   <li>Route exchange using BGP</li>
    56. 

  56.   <li>DNS resolution for the .dn42 TLD</li>
    57. 

  57. </ul>
    58. 

  58. 

  59. <h2 id="first-steps">First Steps</h2>
    60. 

  60. 

  61. <ol>
    62. 

  62.   <li>Create the required objects in the Registry - see <a href="/howto/Getting-Started">Getting Started</a></li>
    63. 

  63.   <li>Find a peer - ask nicely in <a href="/services/IRC">IRC</a>!</li>
    64. 

  64.   <li>Get the following details:
    65. 

  65.     <ul>
    66. 

  66.       <li>Tunnel configuration (OpenVPN, IPsec, QuickTun)</li>
    67. 

  67.       <li>AS numbers</li>
    68. 

  68.     </ul>
    69. 

  69.   </li>
    70. 

  70. </ol>
    71. 

  71. 

  72. <h3 id="tunnel-configuration">Tunnel Configuration</h3>
    73. 

  73. 

  74. <h3 id="openvpn">OpenVPN</h3>
    75. 

  75. 

  76. <p>Using the below as examples:</p>
    77. 

  77. 

  78. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>Own ASN: AS111111
    79. 

  79. Own IPv4 Space: 172.AA.AA.64/27
    80. 

  80. Own IPv6 Space: fdBB:BBBB:CCCC::/48
    81. 

  81. Own IPv4 If-Address: 172.AA.AA.65
    82. 

  82. Own IPv6 If-Address: fdBB:BBBB:CCCC::1
    83. 

  83. 

  84. Peer OpenVPN Remote Address: 172.X.X.X  //that's the peers OpenVPN IF IP
    85. 

  85. Peer OpenVPN Remote Host: X.X.X.Y  //that's the peers clearnet IP
    86. 

  86. Peer OpenVPN IP for you: fdAA::BBB/64
    87. 

  87. Peer OpenVPN IP: fdAA::CC
    88. 

  88. Peer OpenVPN Port: 1194
    89. 

  89. Peer OpenVPN encryption: aes256
    90. 

  90. Peer ASN: AS222222
    91. 

  91. Peer BGP Neighbour IPv4: Z.Z.Z.Z
    92. 

  92. Peer BGP Neighbour IPv6: fdAA::CC
    93. 

  93. </code></pre></div></div>
    94. 

  94. 

  95. <h4 id="copy-openvpn-key-to-the-edgerouter">Copy OpenVPN key to the EdgeRouter</h4>
    96. 

  96. 

  97. <p>Copy the VPN key to <code class="language-plaintext highlighter-rouge">/config/auth/SomeSharedKey.key</code>:</p>
    98. 

  98. 

  99. <div class="language-sh highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nb">sudo cat</span> <span class="o">&gt;</span> /config/auth/SomeSharedKey.key
    100. 

  100. </code></pre></div></div>
    101. 

  101. 

  102. <p>Paste the key in the terminal window, hit return once and kill <code class="language-plaintext highlighter-rouge">cat</code> with CTRL+C. Then type <code class="language-plaintext highlighter-rouge">exit</code>.</p>
    103. 

  103. 

  104. <h4 id="create-ipv4-openvpn-interface">Create IPv4 OpenVPN Interface</h4>
    105. 

  105. 

  106. <p>Create the OpenVPN virtual interface, i.e. using <code class="language-plaintext highlighter-rouge">vtun0</code>:</p>
    107. 

  107. 

  108. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>configure
    109. 

  109. set interfaces openvpn vtun0
    110. 

  110. set interfaces openvpn vtun0 mode site-to-site
    111. 

  111. set interfaces openvpn vtun0 local-port 1194
    112. 

  112. set interfaces openvpn vtun0 remote-port 1194
    113. 

  113. set interfaces openvpn vtun0 local-address 172.AA.AA.65
    114. 

  114. set interfaces openvpn vtun0 remote-address 172.X.X.X
    115. 

  115. set interfaces openvpn vtun0 remote-host X.X.X.Y
    116. 

  116. set interfaces openvpn vtun0 shared-secret-key-file /config/auth/SomeSharedKey.key
    117. 

  117. set interfaces openvpn vtun0 encryption aes256
    118. 

  118. 

  119. set interfaces openvpn vtun0 openvpn-option "--comp-lzo"  //if your peer support compression
    120. 

  120. 

  121. commit
    122. 

  122. save
    123. 

  123. exit
    124. 

  124. </code></pre></div></div>
    125. 

  125. 

  126. <p>The OpenVPN tunnel should now be up and running.</p>
    127. 

  127. 

  128. <p>Check it with:</p>
    129. 

  129. 

  130. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>show interfaces openvpn
    131. 

  131. show interfaces openvpn detail
    132. 

  132. show openvpn status site-to-site
    133. 

  133. </code></pre></div></div>
    134. 

  134. 

  135. <h3 id="create-bgp-session">Create BGP Session</h3>
    136. 

  136. 

  137. <h4 id="open-firewall">Open Firewall</h4>
    138. 

  138. 

  139. <p>You need to open the firewall to local for the tunnel Interface on port 179/tcp</p>
    140. 

  140. 

  141. <h4 id="configure-the-bgp-neighbor">Configure the BGP Neighbor</h4>
    142. 

  142. 

  143. <p>When entering AS numbers, do not include the “AS” prefix, i.e. enter AS111111 as just 111111.</p>
    144. 

  144. 

  145. <p>Build the BGP session with your peer:</p>
    146. 

  146. 

  147. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>configure
    148. 

  148. set protocols bgp 111111 neighbor Z.Z.Z.Z remote-as 222222
    149. 

  149. set protocols bgp 111111 neighbor Z.Z.Z.Z soft-reconfiguration inbound
    150. 

  150. set protocols bgp 111111 neighbor Z.Z.Z.Z update-source 172.AA.AA.65
    151. 

  151. commit
    152. 

  152. save
    153. 

  153. </code></pre></div></div>
    154. 

  154. 

  155. <p>Check that the BGP session has come up:</p>
    156. 

  156. 

  157. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>show ip bgp summary
    158. 

  158. </code></pre></div></div>
    159. 

  159. 

  160. <h4 id="create-blackhole-route">Create Blackhole Route</h4>
    161. 

  161. 

  162. <p>so bgp can announce the route</p>
    163. 

  163. 

  164. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>set protocols static route 172.AA.AA.64/27 blackhole
    165. 

  165. commit
    166. 

  166. save
    167. 

  167. </code></pre></div></div>
    168. 

  168. 

  169. <h4 id="announce-route-to-bgp">Announce Route to BGP</h4>
    170. 

  170. 

  171. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>set protocols bgp 111111 network 172.A.A.64/27
    172. 

  172. commit
    173. 

  173. save
    174. 

  174. exit
    175. 

  175. </code></pre></div></div>
    176. 

  176. 

  177. <p>You should now be able to see networks being advertised to your peer:</p>
    178. 

  178. 

  179. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>show ip bgp neighbors Z.Z.Z.Z advertised-routes
    180. 

  180. </code></pre></div></div>
    181. 

  181. 

  182. <h3 id="set-dns-forwarding">Set DNS Forwarding</h3>
    183. 

  183. 

  184. <p>Try to ping <code class="language-plaintext highlighter-rouge">172.23.0.53</code> (anycast DNS resolver). If you get a response then you are good to continue.</p>
    185. 

  185. 

  186. <p>Add the DNS forwarder:</p>
    187. 

  187. 

  188. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>configure
    189. 

  189. set service dns forwarding options server=/23.172.in-addr.arpa/172.23.0.53
    190. 

  190. set service dns forwarding options server=/22.172.in-addr.arpa/172.23.0.53
    191. 

  191. set service dns forwarding options server=/dn42/172.23.0.53
    192. 

  192. commit
    193. 

  193. save
    194. 

  194. exit
    195. 

  195. </code></pre></div></div>
    196. 

  196. 

  197. <h3 id="create-nat-rule">Create NAT rule</h3>
    198. 

  198. 

  199. <div class="language-plaintext highlighter-rouge"><div class="highlight"><pre class="highlight"><code>set service nat rule 5013 outbound-interface vtun0
    200. 

  200. set service nat rule 5013 type masquerade
    201. 

  201. set service nat rule 5013 description "Masquerade for dn42"
    202. 

  202. </code></pre></div></div>
    203. 

  203. 

  204. <p>You should now be able to access .dn42 domains.</p>
    205. 

  205. 

  206. 

  207. 

  208.             <div id="menu-container" class="menu-container">
    209. 

  209.                 <hr>
    210. 

  210.                 <div id="menu" class="menu">
    211. 

  211.                     
    212. 

  212.                     <ul>
    213. 

  213.   <li><a href="/Home">Home</a>
    214. 

  214.     <ul>
    215. 

  215.       <li><a href="/howto/Getting-Started">Getting Started</a></li>
    216. 

  216.       <li><a href="/howto/Registry-Authentication">Registry Authentication</a></li>
    217. 

  217.       <li><a href="/howto/Address-Space">Address Space</a></li>
    218. 

  218.       <li><a href="/howto/BGP-communities">BGP communities</a></li>
    219. 

  219.       <li><a href="/FAQ">FAQ</a></li>
    220. 

  220.     </ul>
    221. 

  221.   </li>
    222. 

  222.   <li>How-To
    223. 

  223.     <ul>
    224. 

  224.       <li><a href="/howto/wireguard">Wireguard</a></li>
    225. 

  225.       <li><a href="/howto/openvpn">Openvpn</a></li>
    226. 

  226.       <li><a href="/howto/IPsec-with-PublicKeys">IPsec With Public Keys</a></li>
    227. 

  227.       <li><a href="/howto/tinc">Tinc</a></li>
    228. 

  228.       <li><a href="/howto/GRE-on-FreeBSD">GRE on FreeBSD</a></li>
    229. 

  229.       <li><a href="/howto/GRE-on-OpenBSD">GRE on OpenBSD</a></li>
    230. 

  230.       <li><a href="/howto/IPv6-Multicast">IPv6 Multicast (PIM-SM)</a></li>
    231. 

  231.       <li><a href="/howto/multicast">SSM Multicast</a></li>
    232. 

  232.       <li><a href="/howto/mpls">MPLS</a></li>
    233. 

  233.       <li><a href="/howto/Bird2">Bird2</a></li>
    234. 

  234.       <li><a href="/howto/frr">FRRouting</a></li>
    235. 

  235.       <li><a href="/howto/OpenBGPD">OpenBGPD</a></li>
    236. 

  236.       <li><a href="/howto/mikrotik">Mikrotik RouterOS</a></li>
    237. 

  237.       <li><a href="/howto/EdgeOS-Config">EdgeRouter</a></li>
    238. 

  238.       <li><a href="/howto/Static-routes-on-Windows">Static routes on Windows</a></li>
    239. 

  239.       <li><a href="/howto/networksettings">Universal Network Requirements</a></li>
    240. 

  240.       <li><a href="/howto/vyos1.4.x">VyOS</a></li>
    241. 

  241.       <li><a href="/howto/nixos">NixOS</a></li>
    242. 

  242.     </ul>
    243. 

  243.   </li>
    244. 

  244.   <li>Services
    245. 

  245.     <ul>
    246. 

  246.       <li><a href="/services/IRC">IRC</a></li>
    247. 

  247.       <li><a href="/services/Whois">Whois registry</a></li>
    248. 

  248.       <li><a href="/services/DNS">DNS</a></li>
    249. 

  249.       <li><a href="/services/IX-Collection">IX Collection</a></li>
    250. 

  250.       <li><a href="/services/Clearnet-Domains">Public DNS</a></li>
    251. 

  251.       <li><a href="/services/Looking-Glasses">Looking Glasses</a></li>
    252. 

  252.       <li><a href="/services/Automatic-Peering">Automatic Peering</a></li>
    253. 

  253.       <li><a href="/services/Repository-Mirrors">Repository Mirrors</a></li>
    254. 

  254.       <li><a href="/services/Distributed-Wiki">Distributed Wiki</a></li>
    255. 

  255.       <li><a href="/services/Certificate-Authority">Certificate Authority</a></li>
    256. 

  256.       <li><a href="/services/Route-Collector">Route Collector</a></li>
    257. 

  257.     </ul>
    258. 

  258.   </li>
    259. 

  259.   <li>Internal
    260. 

  260.     <ul>
    261. 

  261.       <li><a href="/internal/Internal-Services">Internal services</a></li>
    262. 

  262.       <li><a href="/internal/Interconnections">Interconnections</a></li>
    263. 

  263.       <li><a href="/internal/APIs">APIs</a></li>
    264. 

  264.       <li><a href="/internal/ShowAndTell">Show and Tell</a></li>
    265. 

  265.       <li><a href="/internal/Historical-Services">Historical services</a></li>
    266. 

  266.     </ul>
    267. 

  267.   </li>
    268. 

  268.   <li>Historical
    269. 

  269.     <ul>
    270. 

  270.       <li><a href="/historical/Bird">Bird 1</a></li>
    271. 

  271.       <li><a href="/historical/Quagga">Quagga</a></li>
    272. 

  272.     </ul>
    273. 

  273.   </li>
    274. 

  274.   <li>External Tools
    275. 

  275.     <ul>
    276. 

  276.       <li><a href="https://paste.dn42.us">Paste Board</a></li>
    277. 

  277.       <li><a href="https://git.dn42.dev">Git Repositories</a></li>
    278. 

  278.     </ul>
    279. 

  279.   </li>
    280. 

  280. </ul>
    281. 

  281. 

  282. <hr />
    283. 

  283. 

  284. 

  285.                 </div>
    286. 

  286.             </div>
    287. 

  287.         </main>
    288. 

  288.         
    289. 

  289.         <footer><div class="center">
    290. 

  290.     <div id="dn42_footer">
    291. 

  291.         
    292. 

  292.         <table>
    293. 

  293.   <tbody>
    294. 

  294.     <tr>
    295. 

  295.       <td>Hosted by: <a href="mailto:dn42@burble.com">BURBLE-MNT</a>, <a href="mailto:nurtic-vibe@grmml.net">GRMML-MNT</a>, <a href="mailto:xuu@dn42.us">XUU-MNT</a>, <a href="mailto:janeric@ortgies.it">JAN-MNT</a>, <a href="mailto:lare@lare.cc">LARE-MNT</a>, <a href="mailto:danny@saru.moe">SARU-MNT</a>, <a href="mailto:androw95220@gmail.com">ANDROW-MNT</a>, <a href="mailto:dn42@mk16.de">MARK22K-MNT</a></td>
    296. 

  296.       <td>Accessible via: <a href="https://wiki.dn42">dn42</a>, <a href="https://dn42.dev/">dn42.dev</a>, <a href="https://dn42.eu/">dn42.eu</a>, <a href="https://wiki.dn42.us/">wiki.dn42.us</a>, <a href="https://dn42.de/">dn42.de</a> (IPv6-only), <a href="https://dn42.cc/">dn42.cc</a> (wiki-ng), <a href="https://dn42.wiki/">dn42.wiki</a>, <a href="https://dn42.pp.ua/">dn42.pp.ua</a>, <a href="https://dn42.obl.ong/">dn42.obl.ong</a></td>
    297. 

  297.     </tr>
    298. 

  298.   </tbody>
    299. 

  299. </table>
    300. 

  300. 

  301.     </div>
    302. 

  302. </div>
    303. 

  303. </footer>
    304. 

  304. 

  305.         
    306. 

  306. 

  307.     </body>
    308. 

  308. 

  309. </html>
    310. 

  310.