Building a Raspberry Pi AMPRNet IPIP Gateway

The boundary network can be accomplished in many ways (such as using a simple switch), but it also assumes your ISP will provide you with more than one dynamic IP. Also, in the image above, it shows a generic AMPRNet network with the CIDR notation of 44.X.Y.0/27. This is because I have a /27 network on AMPRNet that ends in .0. Keep this in mind when going though the documentation as only you know your own network allocation.

Step 2: Pi initial configuration

Before we dig right into the configuration of the AMPRNet gateway, there are a few housekeeping items required. First, make sure you install AMPR-RIPD (I used version 2.4). As the AMPRNet is a distributed network, you will require keeping your 44 net routing table up to date, which is what AMPR-RIPD does for you. We use this networking daemon in the script located in Step 5.

Another consideration is the security of this Pi. It will, after all, be directly connected to AMPRNet and likely you will add it to AMPRNet DNS so the internet will also have access to it, so we need to be sure to keep it up to date. Follow best practices here, use strong passwords and consider using SSH Keys. While the below script won’t solve all of your security concerns, it will auto-update your Pi software and reboot. I have it saved in the executable file at /root/bin/updatePi.sh and call it on a weekly basis with CRON. I suggest you do the same.

#!/bin/sh
apt-get update && apt-get full-upgrade -y

apt-get autoremove -y
apt-get autoclean -y
reboot

The cronjob I used to execute it weekly looks like this (runs every Monday morning at 2am)

0 2 * * MON sh /root/bin/updatePi.sh 2>&1 > /dev/null &

Step 3: “Fixing” the dynamic IP problem

One problem I could see running into when starting this project is, “What happens when my public dynamic IP changes on the gateway”. The answer, or course, is that my IPIP tunnel to the rest of AMPRNet will break. I could, and did, fix this by leveraging an external DNS service that I can update automatically from the Pi. I have used Cloudflare in the past to host DNS various domains, so I used it to host a single entry for my AMPRNet gateway that I can then update via the CloudFlare API.

First, make sure that the AMPRNet portal has this hostname associated with your gateway, instead of my IP. The hostname is “re-resolved” hourly by the core AMPRnet services, and with setting your DNS entry to have a TTL of only two minutes it means that your AMPRNet will only be offline for only a bit over an hour if your public IP changes. While it’s not ideal, it is good enough for me and much cheaper than paying for a static IP from my ISP.

There are other Dynamic DNS services out there as well (other than CloudFlare), so use the one that works for you. If you use Cloudflare, the following script is what I used to update my IP. Note that you require a few things from Cloudflare to make this work, and they are all the variables that you need to fill out at the top of this script. Consult Cloudflare on how to generate these required items (API token, etc.). As we require no special permissions for this script, I placed it in the pi home folder in an executable file at /home/pi/cloudflare_ip_update/cloudflare_ip_update.sh and run it every 5 minutes with cron. Oh, one more thing, I assume your public interface is eth0, you will need to change this if required.

#!/bin/bash

lastipfile=/home/pi/cloudflare_ip_update/lastip    # File that caches last/current IP
cf_zoneid="ENTER YOUR ZONE ID HERE"
cf_dnsrecordId="ENTER YOUR DNS RECORD ID HERE"
cf_dnsHostname="ENTER YOUR DNS HOSTNAME HERE"
cf_apiToken="ENTER YOUR API TOKEN HERE"
cf_authEmail="ENTER YOUR AUTH EMAIL HERE"
external_interface="eth0"                     # External interface that has dyn IP

#Find my current IP
ipv4=$(/sbin/ip -o -4 addr list $external_interface | awk '{print $4}' | cut -d/ -f1)

#Get Last IP
lastip=`cat $lastipfile`

if [ "$ipv4" == "$lastip" ]; then
   echo "IP Has not changed, not updating"
   exit 0;
fi

echo "IP Changed, updating CF DNS"
echo $ipv4 > $lastipfile

generate_post_data()
{
  cat <<EOF
{
  "type":"A",
  "name":"$cf_dnsHostname",
  "content":"$ipv4",
  "ttl":120,
  "proxied":false
}
EOF
}


# Echo to the screen what we are submitting
echo $(generate_post_data);

# Update the CloudFlare DNS
curl -X PUT "https://api.cloudflare.com/client/v4/zones/$cf_zoneid/dns_records/$cf_dnsrecordId" \
     -H "X-Auth-Email: $cf_authEmail" \
     -H "X-Auth-Key: $cf_apiToken" \
     -H "Content-Type: application/json" \
     --data "$(generate_post_data)"

Here is the crontab entry I used to run this every 5 minutes. Again, this is run as the Pi user, so it’s in the Pi’s crontab, not root’s.

*/5 * * * * /home/pi/bin/cloudflare_ip_update.sh 2>&1 > /dev/null

This script does three fundamental things:

• Creates an AMPRNet tunnel (interface tunl0)
• Creates a routing table for AMPRNet (table 44)
  • This routing table is updated dynamically using the AMPR-RIPD daemon.
• Configures and enables a basic firewall using iptables that is configured as follows:
  • It operates the same as a home router does with connection tracking. Any outbound established traffic can receive the traffic coming back; Otherwise, incoming traffic is dropped by default.
  • SSH and Ping are explicitly allowed to connect to the gateway itself, as well as hosts on the network.
  • If you have any specific ports you want opened up to your clients, add them in the “## Allow ssh/icmp connections to my AmprNet” section. For example, I have added a rule allowing destination port 80 to my D-Star hotspot, which allows me to see the dashboard remotely (not shown in above script).

The disabling script essentially just reverts everything. It tears down the tunnel and disables the iptables firewall. Here is the script, which I stored in the executable file that I saved at /etc/amprgwSvc/disable_amprgw.

#!/bin/bash

#####
# Variables
#
my_ampr_network="44.X.Y.Z/BITMASK"   # My CIDR AMPRNet Network
internal_interface="eth0.44"         # Local AMPRNet Interface

### DISABLE IP FORWARDING ###
sysctl -w net.ipv4.ip_forward=0

### Take the tunnel offline ###
ifconfig tunl0 down

### Remove the table 44 routes ###
ip route delete default dev tunl0 via 169.228.34.84 onlink table 44

# Deletes local 44 network to Table 44
ip route delete $my_ampr_network dev $internal_interface table 44

########################################
### STOPS THE ampr-ripd ROUTER DAMEON
killall -KILL ampr-ripd

########################################
# reset the iptables firewall
# Flushing all rules
iptables -F
iptables -X

# Setting default filter policy
iptables -P INPUT ACCEPT        # By default allow all incoming connections
iptables -P FORWARD ACCEPT      # by default allow all forwarding connections
iptables -P OUTPUT ACCEPT       # By default allow outgoing connections

Test everything. Easiest way is to execute the enable and disable scripts as root to confirm it brings up and takes down the gateway. The next step is to make it a service and enable it to run on boot. To do this, create a service file called /etc/systemd/system/amprgw.service with the following contents:

[Unit]
Description=AmprGwService
After=network-online.target
Wants=network-online.target


[Service]
Type=oneshot
RemainAfterExit=true
ExecStart=/etc/amprgwSvc/enable_amprgw
ExecStop=/etc/amprgwSvc/disable_amprgw

[Install]
WantedBy=multi-user.target

Then, enable the service with systemctl:

systemctl enable amprgw

Future considerations

Some future considerations I may explore include

• Installing OpenVPN on the gateway to allow for remote access into my local AMPRNet, leveraging my AMPRnet IP’s.
• Adding DHCP to the AMPRNet gateway to provide dynamic addressing within my AMPRnet network.
• Adding a DNS resolver for the local AMPRNet clients.