L2TP und Tunneldigger

Diese Seite befindet sich noch im Entwurfsstadium.
Hilf mit sie zu verbessern!

Seit der Firmware 20161008-beta ist der Tunneldigger für l2tp Tunnel zum Gateway mit dabei. Hier die Anleitung, wie man den Tunnelbroker auf einem Gateway installiert und konfiguriert.

Vorteile: *Weniger CPU Last auf den Gateway Servern und den Routern

Am Router

Eine Firmware ab 20161008-beta oder neuer flashen.

Es wird die Datei vpn.txt auf dem GW geprüft, wenn mit Inhalt l2tp vorhanden, dann l2tp sonst fastd.

Am Router muss nichts konfiguriert werden!

Wie man den Tunneldigger in die Firmware einbaut, findest du hier

Am Gateway

So, jetzt brauchen wir noch Gateways mit dem Broker. Nebenbei braucht der Gateway auch noch ein Webserver, die Clients fragen ob ein Gateway l2tp anbietet oder nicht.

Vorbereitungen:

Nötige Pakete holen:

apt install iproute bridge-utils libnetfilter-conntrack3 conntrack python-dev  libevent-dev ebtables python-virtualenv apache2

Module

In /etc/modules die Module eintragen:

l2tp_core
l2tp_eth
l2tp_netlink
nf_conntrack_netlink
nf_conntrack
nfnetlink

Mit modprobe "name des Moduls" kann man dann alle Module laden. Beim nächsten reboot geht das dann automatisch.

modprobe l2tp_core
modprobe l2tp_eth
modprobe l2tp_netlink
modprobe nf_conntrack_netlink
modprobe nf_conntrack
modprobe nfnetlink

Installation:

Wir benutzen momentan die Version 0.1.0 des Tunneldigger mit einigen kleinen Anpassungen. Achtung! Fuer Debian 9 geht die tunneldigger Version nicht mehr. Darum gibt es 2 Repos. In fff-tunneldigger-debian_9 ist ein neues conntrack.py drin. Das wiederum lauft auf Debian 8 nicht.

mkdir /srv/tunneldigger 

cd /srv/tunneldigger  

virtualenv env_tunneldigger  

Für Debian 8

git clone https://github.com/rohammer/fff-tunneldigger-debian_8.git
mv fff-tunneldigger-debian_8 tunneldigger

Für Debian 9

git clone https://github.com/rohammer/fff-tunneldigger-debian_9.git
mv fff-tunneldigger-debian_9 tunneldigger

Hier weiter

cd /srv/tunneldigger 

source env_tunneldigger/bin/activate 

pip install -r tunneldigger/broker/requirements.txt 

Konfiguration:

Um die Konfiguration zu erleichtern gibt es in tunneldigger/broker ein Skript:

mk-fff-broker-conf.sh

Öffnen, Daten eintragen, laufen lassen, fertig.

Anmerkung: Der hoodname darf maximal 8 Zeichen lang sein!!

Das kann man jetzt mehrfach machen mit unterschiedlichen Konfigurationen für verschiedene Hoods.

Den Routern mitteilen, dass wir l2tp anbieten

Erst aktivieren, wenn für alle Hoods des Gateways die Konfiguration gemacht wurde!!

Im DocumentRoot des Webservers die Datei vpn.txt mit Inhalt l2tp anlegen

echo l2tp > vpn.txt

Danach verbinden sich die Router mit obiger Firmware via l2tp.

Kontrolle

- über systemctl status tunneldigger-broker-xxx.service kann man den Status erfragen.

- mit ip link sieht man für jeden Router ein l2tpXXXX Device mit der entsprechenden Bridge als master.

- mit ip l2tp show tunnel sieht man die einzelnen Tunnel

- mit ip l2tp show session die entsprechenden Devices

- der Broker sollte auch die entsprechenden SNAT und DNAT Einträge gemacht haben: iptables -L -t nat

- das Log findet man in /var/log/

Broker für eine Hood wieder los werden

Beispielhood: hawaii

Service stoppen: (Tipp: Tab-Taste)

systemctl stop tunneldigger-broker-hawaii.service 

Service ausschalten:

systemctl disable tunneldigger-broker-hawaii.service 

Wenn man die ganze Konfiguration weg haben will, geht es weiter.

Unit löschen:

rm /etc/systemd/system/tunneldigger-broker-hawaii.service

systemd davon in Kenntnis setzen:

systemctl daemon-reload

Konfigdateien löschen:

find /srv/tunneldigger/tunneldigger -name '*hawaii.*' -exec rm \{\} \;

Hintergrund

Die ersten Tests haben gezeigt, dass Batman es nicht mag, wenn Interfaces kommen und gehen. Wir können also die L2-Tunnel nicht direkt an Batman hängen.

Die Slovenen schreiben:

Example hook scripts present in the scripts/ subdirectory are set up to create one bridge device per MTU and attach L2TP interfaces to these bridges. They also configure a default IP address to newly created tunnels, set up ebtables to isolate bridge ports and update the routing policy via ip rule so traffic from these interfaces is routed via the mesh routing table. Each tunnel established with the broker will create its own interface. Because we are using OLSRv1, we cannot dynamically add interfaces to it, so we group tunnel interfaces into bridges. We could put all tunnel interfaces into the same bridge, but this would actually create a performance problem. Different tunnels can have different MTU values -- but there is only one MTU value for the bridge, the minimum of all interfaces that are attached to that bridge. To avoid this problem, we create multiple bridges, one for each MTU value -- this is what the example scripts do. We also configure some ip policy rules to ensure that traffic coming in from the bridges gets routed via our mesh routing table and not the main one (see bridge_functions.sh). Traffic between bridge ports is not forwarded (this is achieved via ebtables), otherwise the routing daemons at the nodes would think that all of them are directly connected -- which would cause them to incorrectly see a very large 1-hop neighbourhood. This file also contains broker-side IP configuration for the bridge which should really be changed.

Ähnliche Probleme hatten die mit OLSR. Also haben wir mal die Config deren Vorschlägen angepasst.

Es wird für jede MTU die ankommt eine Bridge aufgemacht und da kommen dann alle Interfaces mit der gleichen MTU rein.

Beispiel-config für has und has-sued Hood auf GW von moexe (fff-has 78.47.36.148)

Die l2tp_broker-xxxxx.cfg Dateien in /srv/tunneldigger/tunneldigger/broker/

l2tp_broker-has.cfg :

[broker]
; IP address the broker will listen and accept tunnels on
address=78.47.36.148
; Ports where the broker will listen on
; Hier den entsprechenden fastd-port + 10000
port=20004
; Interface with that IP address
interface=eth0
; Maximum number of tunnels that will be allowed by the broker
max_tunnels=1024
; Tunnel port base
port_base=24000
; Tunnel id base
tunnel_id_base=4000
; Namespace (for running multiple brokers); note that you must also
; configure disjunct ports, and tunnel identifiers in order for
; namespacing to work
namespace=has
; check if all kernel module are loaded. Do not check for built-ins.
check_modules=true
; Maximum number of cached cookies, required for establishing a
; session with the broker
max_cookies=1024
; Tunnel timeout interval in seconds
tunnel_timeout=60
; Should PMTU discovery be enabled
pmtu_discovery=true

[log]
; Log filename
filename=/var/log/tunneldigger-broker-has.log
; Verbosity
verbosity=DEBUG
; Should IP addresses be logged or not
log_ip_addresses=false 

[hooks]
; Arguments to the session.{up,pre-down,down} hooks are as follows:
;
;    <tunnel_id> <session_id> <interface> <mtu> <endpoint_ip> <endpoint_port>  <local_port>
;
; Arguments to the session.mtu-changed hook are as follows:
;
;    <tunnel_id> <session_id> <interface> <old_mtu> <new_mtu>
; 

; Called after the tunnel interface goes up
session.up=/srv/tunneldigger/tunneldigger/broker/scripts/has.up
; Called just before the tunnel interface goes down
session.pre-down=/srv/tunneldigger/tunneldigger/broker/scripts/has.down
; Called after the tunnel interface goes down
session.down=
; Called after the tunnel MTU gets changed because of PMTU discovery
session.mtu-changed=/srv/tunneldigger/tunneldigger/broker/scripts/mtu_changed-has.sh

l2tp_broker-hassued.cfg :

[broker]
; IP address the broker will listen and accept tunnels on
address=78.47.36.148
; Ports where the broker will listen on
; hier den entsprechenden fastd-port + 10000
port=20005
; Interface with that IP address
interface=eth0
; Maximum number of tunnels that will be allowed by the broker
max_tunnels=1024
; Tunnel port base
port_base=21000
; Tunnel id base
tunnel_id_base=1000
; Namespace (for running multiple brokers); note that you must also
; configure disjunct ports, and tunnel identifiers in order for
; namespacing to work
namespace=hassued
; check if all kernel module are loaded. Do not check for built-ins.
check_modules=true 
; Maximum number of cached cookies, required for establishing a
; session with the broker
max_cookies=1024
; Tunnel timeout interval in seconds
tunnel_timeout=60
; Should PMTU discovery be enabled
pmtu_discovery=true

[log]
; Log filename
filename=/var/log/tunneldigger-broker-hassued.log
; Verbosity
verbosity=DEBUG
; Should IP addresses be logged or not
log_ip_addresses=false  


[hooks]
; Arguments to the session.{up,pre-down,down} hooks are as follows:
;
;    <tunnel_id> <session_id> <interface> <mtu> <endpoint_ip> <endpoint_port>  <local_port>
;
; Arguments to the session.mtu-changed hook are as follows:
;
;    <tunnel_id> <session_id> <interface> <old_mtu> <new_mtu>
; 

; Called after the tunnel interface goes up
session.up=/srv/tunneldigger/tunneldigger/broker/scripts/has-sued.up
; Called just before the tunnel interface goes down
session.pre-down=/srv/tunneldigger/tunneldigger/broker/scripts/has-sued.down
; Called after the tunnel interface goes down
session.down=
; Called after the tunnel MTU gets changed because of PMTU discovery
session.mtu-changed=/srv/tunneldigger/tunneldigger/broker/scripts/mtu_changed-has-sued.sh

Skripte in scripts/

bridge_functions-has.sh:

ensure_policy()
{
  ip rule del $*
  ip rule add $*
}

ensure_bridge()
{
#MAC aus MTU generieren (auf jedem GW eine Stelle ändern)
  mac=$(echo $MTU |  sed -E "s/^(..)/0a:00:03:01:\1:/")
  local brname="$1"
  brctl addbr $brname 2>/dev/null 

  if [[ "$?" == "0" ]]; then
    # Bridge did not exist before, we have to initialize it
    ip link set dev $brname address $mac
    ip link set dev $brname up
    # Neue Bridge batman hinzufügen
    batctl -m $BATDEV if add $brname
    # Disable forwarding between bridge ports
    ebtables -A FORWARD --logical-in $brname -j DROP
  fi
}

bridge_functions-has-sued.sh:

ensure_policy()
{
  ip rule del $*
  ip rule add $*
}

ensure_bridge()
{
#MAC aus MTU generieren (auf jedem GW eine Stelle ändern)
  mac=$(echo $MTU |  sed -E "s/^(..)/0a:00:03:02:\1:/")
  local brname="$1"
  brctl addbr $brname 2>/dev/null 

  if [[ "$?" == "0" ]]; then
    # Bridge did not exist before, we have to initialize it
    ip link set dev $brname address $mac 
    ip link set dev $brname up
    # Neue Bridge batman hinzufügen
    batctl -m $BATDEV if add $brname
    # Disable forwarding between bridge ports
    ebtables -A FORWARD --logical-in $brname -j DROP
  fi
}

has.up:

#!/bin/bash
TUNNEL_ID="$1"
INTERFACE="$3"
MTU="$4"
BATDEV=bat4

. /srv/tunneldigger/tunneldigger/broker/scripts/bridge_functions-has.sh

# Set the interface to UP state
ip link set dev $INTERFACE up mtu $MTU

# Add the interface to our bridge
ensure_bridge l2-br-has${MTU}
brctl addif l2-br-has${MTU} $INTERFACE

has-sued.up:

#!/bin/bash
TUNNEL_ID="$1"
INTERFACE="$3"
MTU="$4"
BATDEV=bat7

. /srv/tunneldigger/tunneldigger/broker/scripts/bridge_functions-has-sued.sh

# Set the interface to UP state
ip link set dev $INTERFACE up mtu $MTU

# Add the interface to our bridge
ensure_bridge l2-br-sued${MTU}
brctl addif l2-br-sued${MTU} $INTERFACE

mtu_changed-has.sh

#!/bin/bash
TUNNEL_ID="$1"
INTERFACE="$3"
OLD_MTU="$4"
NEW_MTU="$5"
BATDEV=bat4
MTU=$NEW_MTU

. /srv/tunneldigger/tunneldigger/broker/scripts/bridge_functions-has.sh

# Remove interface from old bridge
brctl delif l2-br-has${OLD_MTU} $INTERFACE

# Change interface MTU
ip link set dev $INTERFACE mtu $NEW_MTU

# Add interface to new bridge
ensure_bridge l2-br-has${NEW_MTU}
brctl addif l2-br-has${NEW_MTU} $INTERFACE

mtu_changed-has-sued.sh

#!/bin/bash
TUNNEL_ID="$1"
INTERFACE="$3"
OLD_MTU="$4"
NEW_MTU="$5"
BATDEV=bat7
MTU=$NEW_MTU

. /srv/tunneldigger/tunneldigger/broker/scripts/bridge_functions-has-sued.sh

# Remove interface from old bridge
brctl delif l2-br-sued${OLD_MTU} $INTERFACE

# Change interface MTU
ip link set dev $INTERFACE mtu $NEW_MTU

# Add interface to new bridge
ensure_bridge l2-br-sued${NEW_MTU}
brctl addif l2-br-sued${NEW_MTU} $INTERFACE

has.down

#!/bin/bash
TUNNEL_ID="$1"
INTERFACE="$3"
MTU="$4"

# Remove the interface from our bridge
brctl delif l2-br-has${MTU} $INTERFACE

has-sued.down

#!/bin/bash
TUNNEL_ID="$1"
INTERFACE="$3"
MTU="$4"

# Remove the interface from our bridge
brctl delif l2-br-sued${MTU} $INTERFACE

Nicht vergessen die Skripte ausführbar zu machen (chmod 755)

Start einrichten:

In /etc/systemd/system/ Units erstellen

tunneldigger-broker-sued.service:

[Unit]
Description=tunneldigger tunnelling network daemon using l2tpv3
After=network.target auditd.service

[Service]
Type=simple
WorkingDirectory=/srv/tunneldigger/tunneldigger
ExecStart=/srv/tunneldigger/env_tunneldigger/bin/python /srv/tunneldigger/tunneldigger/broker/l2tp_broker.py /srv/tunneldigger/tunneldigger/broker/l2tp_broker-hassued.cfg

KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target

tunneldigger-broker-has.service:

[Unit]
Description=tunneldigger tunnelling network daemon using l2tpv3
After=network.target auditd.service

[Service]
Type=simple
WorkingDirectory=/srv/tunneldigger/tunneldigger
ExecStart=/srv/tunneldigger/env_tunneldigger/bin/python /srv/tunneldigger/tunneldigger/broker/l2tp_broker.py /srv/tunneldigger/tunneldigger/broker/l2tp_broker-has.cfg

KillMode=process
Restart=on-failure

[Install]
WantedBy=multi-user.target

Jetzt noch den Service anmelden, autostart und manuell Start

systemctl daemon-reload  

systemctl enable tunneldigger-broker-sued.service tunneldigger-broker-has.service  

systemctl start tunneldigger-broker-sued.service  tunneldigger-broker-has.service