Jump to content

This is the support site for Andrews & Arnold Ltd, a UK Internet provider. Information on these pages is generally for our customers but may be useful to others, enjoy!

Ubuntu 16.04 Full Stack Configuration (with Bonding Config): Difference between revisions

Content deleted Content added
Pet0r (talk | contribs)
Reedy (talk | contribs)
clean up, typos fixed: ie. → i.e. , controled → controlled, eg: → e.g.:
 
(7 intermediate revisions by 2 users not shown)
Line 1: Line 1:
<indicator name="Front">[[File:Menu-bonding.svg|link=:Category:Bonding|30px|Back up to the Bonding Page]]</indicator>

[[Category:Routers]]
[[Category:Routers]]
[[Category:Bonding Configuration]]
[[Category:3rd Party Routers]]
[[Category:3rd Party Routers]]
= Preface =
= Preface =
Line 80: Line 83:
linkname aa_wan1
linkname aa_wan1


Note the additional “unit” and “linkname” instructions from the linked guide, “unit” is in the index of the ppp connection created (ie. unit = 0 creates ppp0).
Note the additional “unit” and “linkname” instructions from the linked guide, “unit” is in the index of the ppp connection created (i.e. unit = 0 creates ppp0).


=== /etc/ppp/chap-secrets ===
=== /etc/ppp/chap-secrets ===
Line 268: Line 271:
# Accept established connections from AAISP Line 2 (Bonding only)
# Accept established connections from AAISP Line 2 (Bonding only)
iptables -A INPUT -i pppoe-AA_2 -m state --state RELATED,ESTABLISHED -m comment --comment "Allow return traffic" -j ACCEPT
iptables -A INPUT -i pppoe-AA_2 -m state --state RELATED,ESTABLISHED -m comment --comment "Allow return traffic" -j ACCEPT
# Allow related traffic from AAISP Modem Stats 1
# Reject anything else (not really needed as we will change default policy to drop later)
iptables -A INPUT -m comment --comment "Reject all remaining traffic" -j REJECT --reject-with icmp-port-unreachable
iptables -A INPUT -s 192.168.2.1/32 -i DEV_AA_WAN1_C -m state --state RELATED,ESTABLISHED -j ACCEPT
# Allow related traffic from AAISP Modem Stats 2 (Bonding only)
iptables -A INPUT -s 192.168.3.1/32 -i DEV_AA_WAN1_C -m state --state RELATED,ESTABLISHED -j ACCEPT
# AAISP Line 1 MSS Clamping
# AAISP Line 1 MSS Clamping
iptables -A FORWARD -o pppoe-AA_1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --
iptables -A FORWARD -o pppoe-AA_1 -p tcp -m tcp --tcp-flags SYN,RST SYN -m comment --
Line 304: Line 309:
iptables -t nat -A POSTROUTING -o DEV_AA_WAN2_C -m comment --comment NAT -j MASQUERADE
iptables -t nat -A POSTROUTING -o DEV_AA_WAN2_C -m comment --comment NAT -j MASQUERADE
# Default drop everything from outside
# Default drop everything from outside
# Note that these drops are *important* because we don't reject any traffic in the rules themselves, without these, stuff will be wide open
iptables -P FORWARD DROP
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables -P INPUT DROP
Line 581: Line 587:
START_DAEMON=1
START_DAEMON=1
# Define here the external interface connected to the WAN (eg: the public
# Define here the external interface connected to the WAN (e.g.: the public
# IP address NIC)
# IP address NIC)
MiniUPnPd_EXTERNAL_INTERFACE="pppoe-AA_1"
MiniUPnPd_EXTERNAL_INTERFACE="pppoe-AA_1"
Line 587: Line 593:
# IP that the daemon should listen on.
# IP that the daemon should listen on.
# Note that you do *not* want this to be 0.0.0.0, as you don't want
# Note that you do *not* want this to be 0.0.0.0, as you don't want
# your MiniUPnPd to be controled by anyone on the internet.
# your MiniUPnPd to be controlled by anyone on the internet.
MiniUPnPd_LISTENING_IP=”DEV_LAN”
MiniUPnPd_LISTENING_IP=”DEV_LAN”
Line 617: Line 623:
chmod 0755 /etc/ppp/ip-up.d/fix-upnp
chmod 0755 /etc/ppp/ip-up.d/fix-upnp
chmod +x /etc/ppp/ip-up.d/fix-upnp
chmod +x /etc/ppp/ip-up.d/fix-upnp

= Bonus: Run dslstats in Docker on Ubuntu =
I'll add this section because some people may find it useful if you either want dslstats for your own use directly or to submit to something like [https://www.mydslwebstats.co.uk/ MyDSLWebStats].

== Install Docker ==
Install Docker, we'll get a better version than what is in the normal repos:

apt-get install apt-transport-https ca-certificates curl software-properties-common
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
# Assuming amd64
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
apt-get update
apt-get install docker-ce

== Download & Run Container ==
Now we have docker, all we need to do is download and run the container, which can be done in a single command. This command will do the following:
* Names the container "dslstats_1"
* Opens a VNC server on 192.168.1.1:5900 (you should specifically set the router IP like I have to make sure it's only accessible privately)
* Opens a tcp listener on port 192.168.1.1:8080 - this won't actually do anything unless you enable the web server for dslstats
* Sets the password to login to VNC to "dslstats"
* Sets the path for the dslstats configurtion to be '''/etc/dslstats_1/''' on the '''host'''
* Mounts /etc/localtime from the host to use the correct timezone data
* Restarts the container as soon as the Docker daemon starts (should be on each reboot)

docker run -d \
--name=dslstats_1 \
-p 192.168.1.1:5900:5900 \
-p 198.168.1.1:8080:8080 \
-e "VNC_PASSWORD"="dslstats"
-v /etc/dslstats_1:/config \
-v /etc/localtime:/etc/localtime:ro \
--restart=always
rossallan/dslstats

Obviously if you are running 2 modems you wish to report stats for, you will need a second MyDSLWebStats account (if you are submitting there), and to modify this command for the second container to use different ports and configuration directory.

For more information about Docker installation, see [https://docs.docker.com/engine/installation/linux/ubuntu/#install-using-the-repository here], and for more information about the dslstats Docker container, see [https://hub.docker.com/r/rossallan/dslstats/ here].


= Bonus: Port based policy routing to a third WAN =
= Bonus: Port based policy routing to a third WAN =
Line 640: Line 683:
iptables -t nat -A POSTROUTING -o DEV_VM_WAN -m comment --comment NAT -j MASQUERADE
iptables -t nat -A POSTROUTING -o DEV_VM_WAN -m comment --comment NAT -j MASQUERADE


Don’t forget '''netfilter-persistent save && netfilter-persistent''' reload afterwards.
Don’t forget '''netfilter-persistent save && netfilter-persistent reload''' afterwards.


== Fix Routing ==
== Fix Routing ==