Vyatta vRouter Appliance: Using BGP to distribute 'firewall' rules

A while ago I attended a Mikrotik User Meeting or MUM for short. For those of you that don't know, Mikrotik are a Latvian company that make networking hardware and an operating system known as RouterOS, that will act as a router and firewall. Their 'USP' is value for money. £22 will get you a home router that will support OSPF, BGP, MPLS et and £2736 will get you a router that will route almost 80Gb/s. Nice.

The MUM consisted of various presentations and demonstrations and one which caught my eye was a presentation from Barry Higgins from Allness, who demonstrated using OSPF to distribute a black list of bad guys which were then null routed, a nice method of distributing 'firewall' rules on a bunch of routers automagically. You can view his presentation on Youtube.

I've recently been playing Vyatta vRouter appliances and wondered if I could apply a similar method of injecting a black list from an IDS (Intrusion Detection System) and having it distributed via BGP.

Discovering and updating a guests hostname from the GNS3 API.

In a previous post, I reinvented the wheel whilst trying to discover the hostname of the GNS3 API from within a guest. Once I'd wasted an evening reinventing DNS, it was time to move onto the main objective - allowing a guest to discover its GNS3 hostname from the API and update the relevant entries in /etc/hostname and /etc/hosts, so next time the puppet agent ran it would pull the appropriate configuration.

I've chosen to use Python as it's the language I'm most confident with. You can view the GNS3 API documentation here

This script was created for Debian and Ubuntu based hosts but will probably work for other distros with minimal tweaking. If you want to skip the blog post and view the code, it's on github

Using a Raspberry Pi 3 as a WiFi Client and Access Point simultaneously.

The Raspberry Pi 3 has a built in Wifi chip, which supports client mode (Connecting to a network) and access point mode (Hosting the network other clients connect to). It can also do these simultaneously, allowing the Pi to connect to a network via Wifi (Or Ethernet, or 3G) and share its connection with other devices.

This can be useful in the case of public Wifi that requires some kind of login or registration. As I run my Pi 'headless', I can't authenticate via the Pi itself, but I can now connect to the Pi's access point and go through the registration process. It also means on networks that block client-to-client communication, a device can still access services hosted on the Pi and still access the internet.

Please find the instructions below.

Using a Cisco 887 Router as a VDSL Modem

I've had a Cisco 887 Router lying around gathering dust for a while and thought I'd put it to use as a VDSL Modem, replacing the existing Openreach box. In theory this will give me more visibility on line stats allowing me to do more logging and troubleshooting.

I tried it a while ago but had some MTU issues so it was banished back into storage. My ISP, Plusnet support 'Baby Jumbos' of 1508 Bytes which allows for a 1500 Byte frame + 8 Bytes of PPPoE overhead, so this time I configured the relelvant interfaces with a 1508 Byte MTU and its working nicely.

The configuration is pretty basic, partly due to limitations of the router. Ethernet0 (The DSL port) has a subinterface for Vlan 101 which is required by the VDSL infrastructure supplied by Plusnet / BT. Vlans 1 and 101 are transparently bridged to allow PPPoE passthrough, and I've added an IP on the bridge for management with some access lists for security.

The configuration is below. I can't make any guarantees it will work or it's secure, and I've redacted some of the sensitive information. Hopefully someone will find it useful or make suggestions for improvements.