Ubuntu 16.04 Full Stack Configuration (with Bonding Config): Difference between revisions
Appearance
Content deleted Content added
clean up, typos fixed: ie. → i.e. , controled → controlled, eg: → e.g.: |
|||
| (7 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
<indicator name="Front">[[File:Menu-bonding.svg|link=:Category:Bonding|30px|Back up to the Bonding Page]]</indicator> |
|||
[[Category:Routers]] |
[[Category:Routers]] |
||
[[Category:Bonding Configuration]] |
|||
[[Category:3rd Party Routers]] |
[[Category:3rd Party Routers]] |
||
= Preface = |
= Preface = |
||
| Line 80: | Line 83: | ||
linkname aa_wan1 |
linkname aa_wan1 |
||
Note the additional “unit” and “linkname” instructions from the linked guide, “unit” is in the index of the ppp connection created ( |
Note the additional “unit” and “linkname” instructions from the linked guide, “unit” is in the index of the ppp connection created (i.e. unit = 0 creates ppp0). |
||
=== /etc/ppp/chap-secrets === |
=== /etc/ppp/chap-secrets === |
||
| Line 268: | Line 271: | ||
# Accept established connections from AAISP Line 2 (Bonding only) |
# Accept established connections from AAISP Line 2 (Bonding only) |
||
iptables -A INPUT -i pppoe-AA_2 -m state --state RELATED,ESTABLISHED -m comment --comment "Allow return traffic" -j ACCEPT |
iptables -A INPUT -i pppoe-AA_2 -m state --state RELATED,ESTABLISHED -m comment --comment "Allow return traffic" -j ACCEPT |
||
# Allow related traffic from AAISP Modem Stats 1 |
|||
# Reject anything else (not really needed as we will change default policy to drop later) |
|||
iptables -A INPUT - |
iptables -A INPUT -s 192.168.2.1/32 -i DEV_AA_WAN1_C -m state --state RELATED,ESTABLISHED -j ACCEPT |
||
# Allow related traffic from AAISP Modem Stats 2 (Bonding only) |
|||
iptables -A INPUT -s 192.168.3.1/32 -i DEV_AA_WAN1_C -m state --state RELATED,ESTABLISHED -j ACCEPT |
|||
# AAISP Line 1 MSS Clamping |
# AAISP Line 1 MSS Clamping |
||
iptables -A FORWARD -o pppoe-AA_1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment -- |
iptables -A FORWARD -o pppoe-AA_1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment -- |
||
| Line 304: | Line 309: | ||
iptables -t nat -A POSTROUTING -o DEV_AA_WAN2_C -m comment --comment NAT -j MASQUERADE |
iptables -t nat -A POSTROUTING -o DEV_AA_WAN2_C -m comment --comment NAT -j MASQUERADE |
||
# Default drop everything from outside |
# Default drop everything from outside |
||
# Note that these drops are *important* because we don't reject any traffic in the rules themselves, without these, stuff will be wide open |
|||
iptables -P FORWARD DROP |
iptables -P FORWARD DROP |
||
iptables -P INPUT DROP |
iptables -P INPUT DROP |
||
| Line 581: | Line 587: | ||
START_DAEMON=1 |
START_DAEMON=1 |
||
# Define here the external interface connected to the WAN ( |
# Define here the external interface connected to the WAN (e.g.: the public |
||
# IP address NIC) |
# IP address NIC) |
||
MiniUPnPd_EXTERNAL_INTERFACE="pppoe-AA_1" |
MiniUPnPd_EXTERNAL_INTERFACE="pppoe-AA_1" |
||
| Line 587: | Line 593: | ||
# IP that the daemon should listen on. |
# IP that the daemon should listen on. |
||
# Note that you do *not* want this to be 0.0.0.0, as you don't want |
# Note that you do *not* want this to be 0.0.0.0, as you don't want |
||
# your MiniUPnPd to be |
# your MiniUPnPd to be controlled by anyone on the internet. |
||
MiniUPnPd_LISTENING_IP=”DEV_LAN” |
MiniUPnPd_LISTENING_IP=”DEV_LAN” |
||
| Line 617: | Line 623: | ||
chmod 0755 /etc/ppp/ip-up.d/fix-upnp |
chmod 0755 /etc/ppp/ip-up.d/fix-upnp |
||
chmod +x /etc/ppp/ip-up.d/fix-upnp |
chmod +x /etc/ppp/ip-up.d/fix-upnp |
||
= Bonus: Run dslstats in Docker on Ubuntu = |
|||
I'll add this section because some people may find it useful if you either want dslstats for your own use directly or to submit to something like [https://www.mydslwebstats.co.uk/ MyDSLWebStats]. |
|||
== Install Docker == |
|||
Install Docker, we'll get a better version than what is in the normal repos: |
|||
apt-get install apt-transport-https ca-certificates curl software-properties-common |
|||
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - |
|||
# Assuming amd64 |
|||
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" |
|||
apt-get update |
|||
apt-get install docker-ce |
|||
== Download & Run Container == |
|||
Now we have docker, all we need to do is download and run the container, which can be done in a single command. This command will do the following: |
|||
* Names the container "dslstats_1" |
|||
* Opens a VNC server on 192.168.1.1:5900 (you should specifically set the router IP like I have to make sure it's only accessible privately) |
|||
* Opens a tcp listener on port 192.168.1.1:8080 - this won't actually do anything unless you enable the web server for dslstats |
|||
* Sets the password to login to VNC to "dslstats" |
|||
* Sets the path for the dslstats configurtion to be '''/etc/dslstats_1/''' on the '''host''' |
|||
* Mounts /etc/localtime from the host to use the correct timezone data |
|||
* Restarts the container as soon as the Docker daemon starts (should be on each reboot) |
|||
docker run -d \ |
|||
--name=dslstats_1 \ |
|||
-p 192.168.1.1:5900:5900 \ |
|||
-p 198.168.1.1:8080:8080 \ |
|||
-e "VNC_PASSWORD"="dslstats" |
|||
-v /etc/dslstats_1:/config \ |
|||
-v /etc/localtime:/etc/localtime:ro \ |
|||
--restart=always |
|||
rossallan/dslstats |
|||
Obviously if you are running 2 modems you wish to report stats for, you will need a second MyDSLWebStats account (if you are submitting there), and to modify this command for the second container to use different ports and configuration directory. |
|||
For more information about Docker installation, see [https://docs.docker.com/engine/installation/linux/ubuntu/#install-using-the-repository here], and for more information about the dslstats Docker container, see [https://hub.docker.com/r/rossallan/dslstats/ here]. |
|||
= Bonus: Port based policy routing to a third WAN = |
= Bonus: Port based policy routing to a third WAN = |
||
| Line 640: | Line 683: | ||
iptables -t nat -A POSTROUTING -o DEV_VM_WAN -m comment --comment NAT -j MASQUERADE |
iptables -t nat -A POSTROUTING -o DEV_VM_WAN -m comment --comment NAT -j MASQUERADE |
||
Don’t forget '''netfilter-persistent save && netfilter-persistent''' |
Don’t forget '''netfilter-persistent save && netfilter-persistent reload''' afterwards. |
||
== Fix Routing == |
== Fix Routing == |
||