Networking and Other Problem

Point to Point Tunnel Protocol with Mikrotik

2007-12-16T06:00:00.000+07:00

Description

PPTP is a secure tunnel for transporting IP traffic using PPP. PPTP encapsulates PPP in virtual lines that run over IP. PPTP incorporates PPP and MPPE (Microsoft Point to Point Encryption) to make encrypted links. The purpose of this protocol is to make well-managed secure connections between routers as well as between routers and PPTP clients (clients are available for and/or included in almost all OSs including Windows).

PPTP includes PPP authentication and accounting for each PPTP connection. Full authentication and accounting of each connection may be done through a RADIUS client or locally.

MPPE 40bit RC4 and MPPE 128bit RC4 encryption are supported.

PPTP traffic uses TCP port 1723 and IP protocol GRE (Generic Routing Encapsulation, IP protocol ID 47), as assigned by the Internet Assigned Numbers Authority (IANA). PPTP can be used with most firewalls and routers by enabling traffic destined for TCP port 1723 and protocol 47 traffic to be routed through the firewall or router.

PPTP connections may be limited or impossible to setup though a masqueraded/NAT IP connection. Please see the Microsoft and RFC links at the end of this section for more information.

PPTP Client Setup

Submenu level : /interface pptp-client

Example

To set up PPTP client named test2 using username john with password john to connect to the 10.1.1.12 PPTP server and use it as the default gateway:

[admin@MikroTik] interface pptp-client> add name=test2 connect-to=10.1.1.12 \
\... user=john add-default-route=yes password=john
[admin@MikroTik] interface pptp-client> print
Flags: X - disabled, R - running
 0 X  name="test2" mtu=1460 mru=1460 connect-to=10.1.1.12 user="john"
      password="john" profile=default add-default-route=yes


[admin@MikroTik] interface pptp-client> enable 0

Monitoring PPTP Client

Command name : /interface pptp-client monitor

Example

Example of an established connection:

[admin@MikroTik] interface pptp-client> monitor test2
     uptime: 4h35s
   encoding: MPPE 128 bit, stateless
     status: Connected
[admin@MikroTik] interface pptp-client>

PPTP Server Setup

Submenu level : /interface pptp-server server

[admin@MikroTik] interface pptp-server server> print
           enabled: no
               mtu: 1460
               mru: 1460
    authentication: mschap2
   default-profile: default
[admin@MikroTik] interface pptp-server server>

Example

To enable PPTP server:
[admin@MikroTik] interface pptp-server server> set enabled=yes
[admin@MikroTik] interface pptp-server server> print enabled: yes mtu: 1460 mru: 1460 authentication: mschap2 default-profile: default
[admin@MikroTik] interface pptp-server server>

PPTP Server Users

Submenu level : /interface pptp-server

Example

To add a static entry for ex1 user:

[admin@MikroTik] interface pptp-server> add user=ex1
[admin@MikroTik] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
 #     NAME                 USER         MTU   CLIENT-ADDRESS  UPTIME   ENC...
 0  DR             ex           1460  10.0.0.202      6m32s    none
 1     pptp-in1             ex1
[admin@MikroTik] interface pptp-server>

In this example an already connected user ex is shown besides the one we just added.

PPTP Router-to-Router Secure Tunnel Example

The following is an example of connecting two Intranets using an encrypted PPTP tunnel over the Internet.

There are two routers in this example:

[HomeOffice]
Interface LocalHomeOffice 10.150.2.254/24
Interface ToInternet 192.168.80.1/24
[RemoteOffice]
Interface ToInternet 192.168.81.1/24
Interface LocalRemoteOffice 10.150.1.254/24

Each router is connected to a different ISP. One router can access another router through the Internet.

On the PPTP server a user must be set up for the client:

[admin@HomeOffice] ppp secret> add name=ex service=pptp password=lkjrht
local-address=10.0.103.1 remote-address=10.0.103.2
[admin@HomeOffice] ppp secret> print detail
Flags: X - disabled
 0   name="ex" service=pptp caller-id="" password="lkjrht" profile=default
     local-address=10.0.103.1 remote-address=10.0.103.2 routes==""

[admin@HomeOffice] ppp secret>

Then the user should be added in the PPTP server list:

[admin@HomeOffice] interface pptp-server> add user=ex
[admin@HomeOffice] interface pptp-server> print
Flags: X - disabled, D - dynamic, R - running
 #     NAME                 USER         MTU   CLIENT-ADDRESS  UPTIME   ENC...
 0     pptp-in1             ex
[admin@HomeOffice] interface pptp-server>

And finally, the server must be enabled:

[admin@HomeOffice] interface pptp-server server> set enabled=yes
[admin@HomeOffice] interface pptp-server server> print
           enabled: yes
               mtu: 1460
               mru: 1460
    authentication: mschap2
   default-profile: default
[admin@HomeOffice] interface pptp-server server>

Add a PPTP client to the RemoteOffice router:

[admin@RemoteOffice] interface pptp-client> add connect-to=192.168.80.1 user=ex \
\... password=lkjrht disabled=no
[admin@RemoteOffice] interface pptp-client> print
Flags: X - disabled, R - running
 0  R name="pptp-out1" mtu=1460 mru=1460 connect-to=192.168.80.1 user="ex"
      password="lkjrht" profile=default add-default-route=no
[admin@RemoteOffice] interface pptp-client>

Thus, a PPTP tunnel is created between the routers. This tunnel is like an Ethernet point-to-point connection between the routers with IP addresses 10.0.103.1 and 10.0.103.2 at each router. It enables 'direct' communication between the routers over third party networks.

To route the local Intranets over the PPTP tunnel – add these routes:

[admin@HomeOffice] > ip route add dst-address 10.150.1.0/24 gateway 10.0.103.2 [admin@RemoteOffice] > ip route add dst-address 10.150.2.0/24 gateway 10.0.103.1

On the PPTP server it can alternatively be done using routes parameter of the user configuration:

[admin@HomeOffice] ppp secret> print detail Flags: X - disabled 0 name="ex" service=pptp caller-id="" password="lkjrht" profile=default local-address=10.0.103.1 remote-address=10.0.103.2 routes==""
[admin@HomeOffice] ppp secret> set 0 routes="10.150.1.0/24 10.0.103.2 1" [admin@HomeOffice] ppp secret> print detail Flags: X - disabled 0 name="ex" service=pptp caller-id="" password="lkjrht" profile=default local-address=10.0.103.1 remote-address=10.0.103.2 routes="10.150.1.0/24 10.0.103.2 1"
[admin@HomeOffice] ppp secret>

Test the PPTP tunnel connection:

[admin@RemoteOffice]> /ping 10.0.103.1
10.0.103.1 pong: ttl=255 time=3 ms
10.0.103.1 pong: ttl=255 time=3 ms
10.0.103.1 pong: ttl=255 time=3 ms

ping interrupted 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max = 3/3.0/3 ms

Test the connection through the PPTP tunnel to the LocalHomeOffice interface:

[admin@RemoteOffice]> /ping 10.150.2.254
10.150.2.254 pong: ttl=255 time=3 ms
10.150.2.254 pong: ttl=255 time=3 ms
10.150.2.254 pong: ttl=255 time=3 ms

ping interrupted 3 packets transmitted, 3 packets received, 0% packet loss round-trip min/avg/max = 3/3.0/3 ms

To bridge a LAN over this secure tunnel, please see the example in the 'EoIP' section of the manual. To set the maximum speed for traffic over this tunnel, please consult the 'Queues' section.

Connecting a Remote Client via PPTP Tunnel

The following example shows how to connect a computer to a remote office network over PPTP encrypted tunnel giving that computer an IP address from the same network as the remote office has (without need of bridging over eoip tunnels)

Please, consult the respective manual on how to set up a PPTP client with the software You are using.

The router in this example:

[RemoteOffice]
Interface ToInternet 192.168.81.1/24
Interface Office 10.150.1.254/24

The client computer can access the router through the Internet.

On the PPTP server a user must be set up for the client:

[admin@RemoteOffice] ppp secret> add name=ex service=pptp password=lkjrht local-address=10.150.1.254 remote-address=10.150.1.2
[admin@RemoteOffice] ppp secret> print detail Flags: X - disabled 0 name="ex" service=pptp caller-id="" password="lkjrht" profile=default local-address=10.150.1.254 remote-address=10.150.1.2 routes==""
[admin@RemoteOffice] ppp secret>

Then the user should be added in the PPTP server list:

[admin@RemoteOffice] interface pptp-server> add name=FromLaptop user=ex [admin@RemoteOffice] interface pptp-server> print Flags: X - disabled, D - dynamic, R - running # NAME USER MTU CLIENT-ADDRESS UPTIME ENC... 0 FromLaptop ex [admin@RemoteOffice] interface pptp-server>

And the server must be enabled:

[admin@RemoteOffice] interface pptp-server server> set enabled=yes
[admin@RemoteOffice] interface pptp-server server> print enabled: yes mtu: 1460 mru: 1460 authentication: mschap2 default-profile: default
[admin@RemoteOffice] interface pptp-server server>

Finally, the proxy APR must be enabled on the 'Office' interface:

[admin@RemoteOffice] interface ethernet> set Office arp=proxy-arp
[admin@RemoteOffice] interface ethernet> print Flags: X - disabled, R - running # NAME MTU MAC-ADDRESS ARP 0 R ToInternet 1500 00:30:4F:0B:7B:C1 enabled 1 R Office 1500 00:30:4F:06:62:12 proxy-arp
[admin@RemoteOffice] interface ethernet>

Source : www.mikrotik.com

Ad-Hoc Problem at 2,4Ghz

2007-12-08T13:21:00.000+07:00

Ad-hoc definition

ad hoc is a network connection method which is most often associated with wireless devices. The connection is established for the duration of one session and requires no base station. Instead, devices discover others within range to form a network for those computers. Devices may search for target nodes that are out of range by flooding the network with broadcasts that are forwarded by each node. Connections are possible over multiple nodes (multihop ad hoc network). Routing protocols then provide stable connections even if nodes are moving around. Sony's PlayStation Portable uses ad hoc connections for wireless multiplayer gaming, as does the Nintendo DS (although Nintendo does not officially use the term). Technically, all of the Game Boys used this method for linking up to each other in a wired (Game Link Cable) or wireless (Game Boy Color IR Port) mode.

See IEEE 802.11, Bluetooth, or ultra-wide band. The alternative is infrastructure, with a base station that manages the network for its range. The theory behind ad hoc networks falls within the Distributed Transient Network-paradigm.

The term ad hoc network can also refer to an independent basic service set (IBSS).

Ad-Hoc connection can use between two NOC, if for 2,4 Ghz distance between two NOC max 30 KM LOS and freznel zone area cofered.

source : wikipedia.

Router Tools

2007-12-03T23:11:00.000+07:00

When we install the router we must set minimal configuration, usually for router any tools can use to help network administrator when he find a problem at his network

thereis the tool : ( I use debian for example)

iftop, is tool to view bandwidth usage in our network, how to use this tool? its so simple, from your console : iftop -i [your_interface_name], example : osiris:~# iftop -i eth1 , to finish you can user shortcut crtl+c.
ifstat, like iftop but this tool view bandwidth usage by cummulative interface usage.

exampe :
osiris:~# ifstat -b
eth0 eth2 eth1
Kbps in Kbps out Kbps in Kbps out Kbps in Kbps out
0.00 0.00 1376.12 748.64 26.32 396.27
0.00 0.00 934.94 561.51 51.62 211.63
0.00 0.00 1250.46 641.03 37.02 281.65
0.00 0.00 1166.52 620.98 77.10 387.06
0.00 0.00 1064.70 572.87 53.04 380.86

ipcalc tools for calculate ip address subnetting

osiris:~# rcconf
osiris:~# ipcalc 192.168.0.24/24 -b
Address: 192.168.0.24
Netmask: 255.255.255.0 = 24
Wildcard: 0.0.0.255
=>
Network: 192.168.0.0/24
HostMin: 192.168.0.1
HostMax: 192.168.0.254
Broadcast: 192.168.0.255
Hosts/Net: 254 Class C, Private Internet

links tools for browse site from console, just you write : links [your favorite site].
rcconf tools to activate / deactivate some service at our router, for exampe, if we wan't run apache, we can do that with this tool

mtr, tools for trace the route of website. we usually use yahoo site for our checking internasional connection

Just that, but if you want to add many tools you can tray and get its from internet.

Connection Refused

2007-11-27T23:46:00.000+07:00

After fix this problem, now that server can't open any website, such as www.hotmail.com, i thing this is cause of squid, so the squid is shutted down, but this problem can't solve.

This Night I try to make the IP public form my network, cause now that IP is the IP NAT, not Public anymore.

but still same, any website can't opened, any one can solve this problem?

Wifi Connection Blocked by MAC address Filter

2007-11-23T20:16:00.000+07:00

This day... my partner set the Wireless bridge Senao for customer, but after he set the pointing to BTS, while scanning wireless cant find our SSID. but can look other SSID..

Setup spend much time but, the wireless bridge still could'nt get SSID. To find the problem, i check the IP address Configuration, shaper configuration, but i cant fine what happen.

after that, i remember that at my Access Point, the mac address filter is enabled hehehe... sorry my friends :), so when i disabled the filter I can ping wireless brigde at customer.

So if we protect our network from foreign signal and mac address we can use Senao feature to set filtering mac address. so list the mac address wireless bridge our customer and put at filter option than enable this filter ==>> save ==> reboot, why i use this option? because when i open the access point configuration i find other mac address that not at my network list and so different, i think its notebook mac address or PCMCIA mac address.

Configuration for this wireless access point is very simple things, so many manual to describe howto use this wireless access point.

For my Partner, sorry i forget to disable the filter..

Clear Cache log on Debian

2007-11-22T15:24:00.000+07:00

Today my squid server has trouble, any website can opened cause blocked by squid. and when i check the log, is full, so i clear it.

To Clear cache log i use this command :

first : shutdown squid with command : squid -k shutdown, then
second : remove log with command : rm -rf /var/log/squid/* , the (*) is refer to clear access.log, cache.log and store.log
third : remake swap file : squid -z
fourt : restart squid : /etc/init.d/squid restart

after all... please redirect again the network and check squid log with : tail -f /var/log/squid/access.log.

just that and my squid running well again :)

Computer Network

2007-11-21T16:44:00.000+07:00

computer network is an interconnection of a group of computers. Networks may be classified by what is called the network layer at which they operate according to basic reference models considered as standards in the industry such as the four-layer Internet Protocol Suit model. While the seven-layer Open Systems Interconnection (OSI) reference model is better known in academia, the majority of networks use the Internet Protocol Suite (IP) as their network model.

Network Topology
Computer networks may be classified according to the network topologyupon which the network is based, such as Bus Network, Star Network, Ring Network, Mesg Network, Star-bus network, Tree or Hierarchical topology network etc.

Network Topology signifies the way in which intelligent devices in the network see their logical relations to one another. The use of the term "logical" here is significant. That is, network topology is independent of the "physical" layout of the network. Even if networked computers are physically placed in a linear arrangement, if they are connected via a hub, the network has a Star topology, rather than a Bus Topology. In this regard the visual and operational characteristics of a network are distinct; the logical network topology is not necessarily the same as the physical layout.

Source : wikipedia