howto/Edgeos-Config-Example-number-2.md
... ...
@@ -1,56 +1,149 @@
1
-## EdgeRouterPro-8 DN42 config example with v1.9.0
2 1
3
-After a lot of searching and trying I [Phil/ALS7] finnaly got a working config
2
+#EdgeRouterPro-8 config example with v1.9.0
3
+
4
+After a lot of searching and trying I [Phil/ALS7] finnaly got a working config
5
+Also thanx to drathir for his patience and support
4 6
5 7
##Features
6 8
7
-* IPv4/IPv6 Tunnel via OpenVPN
8
-* dn42 DNS
9
+* IPv4/IPv6 Tunnel via OpenVPN
10
+* dn42 DNS
9 11
10 12
##How-To
11 13
12
---> still work in Progress
14
+--> still work in Progress
15
+
16
+* Basic EdgeOS knowledge is required
17
+
18
+1) you need to create all required fields in the registry --> look at [[Getting started]] page
19
+
20
+2) get a peer --> ask nice @ [[IRC]]
21
+
22
+3) You need following data from the peer
23
+
24
+--tunnel options, secret key --ASN from the peer --ip's
13 25
14
-1) you need to create all required fields in the registry --> look at [[Getting started]] page.
26
+...
15 27
16 28
The data i used are the following:
17 29
18
-Own ASN: AS4242422684
19
-Own IPv4: 172.20.4.64/27
20
-Own IPv6: fd33:ac1d:d1ce::/48
30
+Own ASN: AS111111
31
+Own IPv4: 172.AA.AA.64/27
32
+Own IPv6: fdBB:BBBB:CCCC::/48
21 33
22
-2) get a peer --> ask nice @ [[IRC]]
34
+Peer OpenVPN Remote Address: X.X.X.X
35
+Peer OpenVPN Remote Host: X.X.X.Y
36
+Peer OpenVPN IP for you: fdAA::BBB/64
37
+Peer OpenVPN IP: fdAA::CC
38
+Peer OpenVPN Port: 1194
39
+Peer OpenVPN encryption: aes256
40
+Peer ASN: AS222222
41
+Peer BGP Neighbour IPv4: Z.Z.Z.Z
42
+Peer BGP Neighbour IPv6: fdAA::CC
43
+
44
+###Copy OpenVPN key to the ErPro
45
+
46
+copy vpn key to /config/auth/giveITaName
47
+
48
+ sudo su
49
+ cd /config
50
+ mkdir auth
51
+ cd auth
52
+ cat > giveITaName
53
+
54
+now paste the key in the terminal window, hit return once and kill cat with CTRL+C
55
+last thing to do is type exit
56
+
57
+###Create IPv4 OpenVPN Interface
58
+
59
+Set up Interface vtunX -- i used vtun0
60
+
61
+ configure
62
+ set interface openssh vtun0
63
+ set interfaces openvpn vtun0 mode site-to-site
64
+ set interfaces openvpn vtun0 local-port 1194
65
+ set interfaces openvpn vtun0 remote-port 1194
66
+ set interfaces openvpn vtun0 local-address 172.AA.AA.64
67
+ set interfaces openvpn vtun0 remote-address X.X.X.X
68
+ set interfaces openvpn vtun0 remote-host X.X.X.Y
69
+ set interfaces openvpn vtun0 shared-secret-key-file /config/auth/giveITaName
70
+ set interfaces openvpn vtun0 encryption aes256
71
+
72
+ set interfaces openvpn vtun0 openvpn-option "--comp-lzo" //if your peer support compression
73
+
74
+ commit
75
+ save
76
+ exit
77
+
78
+Now the ipv4 tunnel should be up&running
79
+
80
+Check it with:
81
+
82
+ show interfaces openvpn
83
+ show interfaces openvpn detail
84
+ show openvpn status site-to-site
85
+
86
+###Create IPv4 BGP Session
87
+
88
+####Open Firewall
89
+
90
+* You need to open the firewall to local for the tunnel Interface on port 179/tcp
91
+
92
+####Configure the BGP Neighbor
93
+
94
+* You must not use AS before the as numbers !!
95
+
96
+With this step you create the basic bgp session
97
+
98
+ configure
99
+ set protocols bgp 111111 neighbor Z.Z.Z.Z remote-as 222222
100
+ set protocols bgp 111111 neighbor Z.Z.Z.Z soft-reconfiguration inbound
101
+ set protocols bgp 111111 neighbor update-source 172.AA.AA.64
102
+ commit
103
+ save
23 104
24
-3) You need following data
105
+When commit this configuration you should be able to see a BGP neighbor session start and come up.
106
+You can check this with:
25 107
26
---tunnel options, secret key
27
---ASN from the peer (in this example i use remote-as XXXXX)
28
---ip's
108
+ show ip bgp summary
29 109
30
-...
110
+####Set route to blackhole
31 111
112
+so bgp can announce the route
32 113
33
-start a ssh session to your router
114
+ set protocols static route 172.AA.AA.64/27 blackhole
115
+ commit
116
+ save
34 117
35
-copy vpn key to /config/auth/giveITaName -- Create folder if needed
118
+####Announce prefix to BGP
119
+
120
+ set protocols bgp 111111 network 172.A.A.64/27
121
+ commit
122
+ save
123
+ exit
36 124
37
-configure
38
-set interface openssh vtun0
39
-set interfaces openvpn vtun0 mode site-to-site
40
-set interfaces openvpn vtun0 local-port 1194 //you get the port from your peer
41
-set interfaces openvpn vtun0 remote-port 1194 //you get the port from your peer
42
-set interfaces openvpn vtun0 local-address 172.20.4.64 //your sife dn42 ip address
43
-set interfaces openvpn vtun0 remote-address X.X.X.X //dn42 link address from your peer
44
-set interfaces openvpn vtun0 remote-host X.X.X.Y //clearnet ip address from your peer
45
-set interfaces openvpn vtun0 shared-secret-key-file /config/auth/giveITaName // your keyfile
46
-set interfaces openvpn vtun0 openvpn-option "--comp-lzo" //if your peer support compression
47
-commit
48
-save
125
+You should now be able to see networks being advertised via
49 126
50
-Now the ipv4 tunnel should be up&running
127
+ show ip bgp neighbors Z.Z.Z.Z advertised-routes
51 128
129
+###Define Nameservers
52 130
131
+Now ping to 172.23.0.53 ... thats the nameserver we are using
132
+If everything is allright it should work
53 133
134
+####NS Config
54 135
136
+Enter the configure mode
55 137
138
+ configure
139
+ set service dns forwarding name-server 8.8.8.8
140
+ set service dns forwarding name-server 8.8.4.4
141
+ set service dns forwarding options rebind-domain-ok=/dn42/
142
+ set service dns forwarding options server=/23.172.in-addr.arpa/172.23.0.53
143
+ set service dns forwarding options server=/22.172.in-addr.arpa/172.23.0.53
144
+ set service dns forwarding options server=/dn42/172.23.0.53
145
+ commit
146
+ save
147
+ exit
56 148
149
+Now try to access any .dn42 tld