You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
226 lines
8.1 KiB
226 lines
8.1 KiB
+++
|
|
title = "HAMnet on the pfSense"
|
|
aliases = '/posts/2022-11-21-hamnet-on-the-pfsense'
|
|
summary = """A short guide on how I installed my L2TP tunnel on my
|
|
router/firewall. Routes get announced to new DHCP clients."""
|
|
date = "2022-11-21T20:13:08+01:00"
|
|
#lastmod = ""
|
|
categories = ["amateur-radio"]
|
|
tags = ["hamnet","pfsense","networking","linux"]
|
|
|
|
+++
|
|
|
|
The usual approach to connect your computer to the
|
|
<abbr title="Highspeed Amateurradio Multimedia NETwork">HAMNET</abbr> is to
|
|
create a <abbr title="Virtual Private Network">VPN</abbr> tunnel using
|
|
<abbr title="Point-to-Point Tunneling Protocol">PPTP</abbr>. Most of recent
|
|
operating systems stopped supporting this protocol because it is outdated and
|
|
insecure.
|
|
|
|
In my recent
|
|
[post about HAMNET]({{< ref "posts/2022/29-vpn-tunnel-into-hamnet-on-fedora-36" >}})
|
|
I created an <abbr title="Layer 2 Tunneling Protocol">L2TP</abbr> tunnel to the
|
|
german VPN Server at the RWTH Aachen University on my laptop. Routes have been
|
|
added manually -- the network was only available on this particular computer.
|
|
No other device was able to connect to the HAMNET.
|
|
|
|
Now I made some changes to my home network where I finally was able to create
|
|
the tunnel on my main router/firewall.
|
|
|
|
## Creating a new <abbr title="Point-to-Point Protocol">PPP</abbr> device
|
|
|
|
Select <kbd>Interfaces</kbd> → <kbd>Assignments</kbd> → <kbd>PPPs</kbd>
|
|
|
|
|
|
|
|
Click on the green <kbd>+ Add</kbd> button on the bottom right and create the
|
|
new PPP interface with the following specs:
|
|
|
|
| Settings name | value |
|
|
| :--------------------- | :--------------------------------- |
|
|
| Link Type | **L2TP** |
|
|
| Link interface(s) | **WAN** |
|
|
| Username | **N0CALL** (your callsign usually) |
|
|
| Password | (your password) |
|
|
| Local IP | (leave empty) |
|
|
| Gateway IP or hostname | **vpn.afu.rwth-aachen.de** |
|
|
|
|
<!-- You can change `vpn.afu.rwth-aachen.de` with the IP address of the server if you
|
|
like. That may help if you don't have a working DNS setup in your network. At the
|
|
moment the DNS entry points to `137.226.79.99`. -->
|
|
|
|
|
|
|
|
## Create a new L2TP device
|
|
|
|
|
|
|
|
My screenshot looks a bit different because I have already assigned the
|
|
interface. You should see the option <kbd>Available network ports</kbd> in the
|
|
last row combined with a green <kbd>+ Add</kbd> button on the right side (just
|
|
below the red buttons). Select the newly created L2TP interface (which should
|
|
look like `L2TP (igb0) - HAMNET_VPN` -- or something like that) and click the
|
|
green button.
|
|
|
|
Then click on the new interface and set it up.
|
|
|
|
| Settings name | value |
|
|
| :---------------------- | :---------------------------------------- |
|
|
| Description | **VPN_HAMNET** (a meaningful description) |
|
|
| IPv4 Configuration Type | **L2TP** |
|
|
| IPv6 Configuration Type | **None** (or SLAAC if you use IPv6) |
|
|
| Username | **N0CALL** (your callsign usually) |
|
|
| Password | (your password) |
|
|
| Remote IP address | **vpn.afu.rwth-aachen.de** |
|
|
|
|
|
|
|
|
## Add static routes on the firewall/router
|
|
|
|
Click on the green <kbd>+ Add</kbd> button on the bottom right. Add the
|
|
networks `44.0.0.0/9` and `44.128.0.0/10` to the list; use the interface from
|
|
above as the gateway.
|
|
|
|
|
|
|
|
## The tunnel should be up and running
|
|
|
|
Go to <kbd>Status</kbd> → <kbd>Gateways</kbd> and look if it is online.
|
|
|
|
|
|
|
|
## Send this routing configuration to DHCP clients
|
|
|
|
We can send this configuration to DHCP clients when they get their IP address.
|
|
|
|
Go to <kbd>Services</kbd> → <kbd>DHCP Server</kbd> and select the interface
|
|
that you want to configure with these routes. Then scroll down to the section
|
|
<kbd>Other Options</kbd> and look for the last setting
|
|
<kbd>Additional BOOTP/DHCP Options</kbd>. Those settings are hidden per default,
|
|
so click on <kbd>Display Advanced</kbd>. Below you can now enter the additional
|
|
configuration.
|
|
|
|
You see three fields, <kbd>Number</kbd>, <kbd>Type</kbd> and <kbd>Value</kbd>.
|
|
|
|
| Number | Type | Value |
|
|
| :----- | :------- | :------------------------------------------ |
|
|
| `121` | `String` | `09:2c:00:c0:a8:0a:01:0a:2c:80:c0:a8:0a:01` |
|
|
|
|
{{< alert >}}
|
|
Do not copy this configuration into your pfSense. This setting is somewhat
|
|
encoded and routes the HAMNET IPs to my routers IP address. You have to create
|
|
your own configuration!
|
|
{{< /alert >}}
|
|
|
|
Create your own configuration with help of this script:
|
|
|
|
```bash
|
|
#!/bin/bash
|
|
check_ip(){
|
|
local n=0 val=1
|
|
for i in ${1//./ }; do
|
|
[ $i -lt 0 -o $i -gt 255 ] && val=0
|
|
n=$[n+1]
|
|
done
|
|
[ $n -ne 4 ] && val=0
|
|
if [ $val -ne 1 ] ; then
|
|
echo "Invalid IP: $1" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
to_bin(){
|
|
local BIN=({0..1}{0..1}{0..1}{0..1}{0..1}{0..1}{0..1}{0..1})
|
|
for i in ${1//./ }; do
|
|
echo -n ${BIN[$i]}
|
|
done
|
|
}
|
|
|
|
while [ $# -gt 0 ] ; do
|
|
nw=${1%/*}; nm=${1#*/}; gw=$2
|
|
check_ip $nw; check_ip $gw
|
|
if [ ${#nm} -gt 2 ] ; then
|
|
check_ip $nm
|
|
nmbin=$(to_bin $nm)
|
|
if echo $nmbin | grep -q "01" ; then
|
|
echo "Invalid netmask: $nm" >&2
|
|
exit 1
|
|
else
|
|
nmbin=${nmbin//0/}
|
|
fi
|
|
nm=${#nmbin}
|
|
echo $nm
|
|
fi
|
|
gwhex=$(printf "%02x:%02x:%02x:%02x" ${2//./ })
|
|
nwhex=$(printf "%02x:%02x:%02x:%02x" ${nw//./ })
|
|
nmhex=$(printf "%02x" ${nm//./ })
|
|
[ $nm -le 24 ] && nwhex=${nwhex%:*}
|
|
[ $nm -le 16 ] && nwhex=${nwhex%:*}
|
|
[ $nm -le 8 ] && nwhex=${nwhex%:*}
|
|
echo -n $nmhex:$nwhex:$gwhex
|
|
shift 2
|
|
[ $# -gt 0 ] && echo -n ":"
|
|
done
|
|
echo
|
|
```
|
|
|
|
Source: [mgergi.hu](https://mgergi.hu/en/it-blog/static-route-dhcp-pfsense)
|
|
|
|
Script was cited/hardcopied because I hate it when linked websites ain't
|
|
available any more. But there is a nice explanation on that website that
|
|
you should read.
|
|
|
|
Replace `192.168.10.1` with your routers IP address!
|
|
|
|
```console
|
|
$ hexroute.sh 44.0.0.0/9 192.168.10.1
|
|
09:2c:00:c0:a8:0a:01
|
|
$ hexroute.sh 44.128.0.0/10 192.168.10.1
|
|
0a:2c:80:c0:a8:0a:01
|
|
```
|
|
|
|
You see, you get two values. All you have to do is concatenate those two values
|
|
and separate them with colons. Insert the new string into the <kbd>Value</kbd>
|
|
field and save those options.
|
|
|
|
|
|
|
|
{{< alert >}}
|
|
**WARNING:** Not all clients will add both the default gateway and the classless
|
|
static routes as per [RFC 3442](https://www.rfc-editor.org/rfc/rfc3442.html#page-5)
|
|
clients must ignore the router option.
|
|
{{< /alert >}}
|
|
|
|
You will be fine if you use NetworkManager. Connections managed by NetworkManager
|
|
usually add the gateway and the classless static routes.
|
|
|
|
This is totally different on a Raspberry Pi. These do not use NetworkManager
|
|
(well, maybe they do when they run a desktop environment but not on console).
|
|
The best way (for me) was to ignore the static routes for my Raspberry Pis and
|
|
add the static routes manually.
|
|
|
|
In `/etc/dhcpcd.conf`, uncomment `classless_static_routes`:
|
|
|
|
```aconf {linenos=inline,linenostart=26,hl_lines=3}
|
|
# A list of options to request from the DHCP server.
|
|
#option domain_name_servers, domain_name, domain_search, host_name
|
|
#option classless_static_routes
|
|
# Respect the network MTU. This is applied to DHCP routes.
|
|
option interface_mtu
|
|
```
|
|
|
|
and let **dhcpcd** add the static routes automatically. Create the file
|
|
`/etc/dhcpcd.exit-hook` and add the routes manually with this script:
|
|
|
|
```bash
|
|
/sbin/route add -net 44.0.0.0/9 gw 192.168.10.1
|
|
/sbin/route add -net 44.128.0.0/10 gw 192.168.10.1
|
|
```
|
|
|
|
## More resources
|
|
|
|
- https://support.aa.net.uk/L2TP_Client:_pfSense
|
|
- https://id3145.com/2017/blog/5-pfSense-Add-Static-Routes-to-pfSense-DHCP-Clients.html
|
|
- https://www.iana.org/assignments/bootp-dhcp-parameters/
|
|
- https://www.rfc-editor.org/rfc/rfc3442.html
|