Networking

In house, I have been using Microsoft TMG 2010 Server for a while now. I use it as a firewall for some of the machines on the network, and also as a proxy for most, if not all, machines. When acting as a Firewall, all traffic flows though the machine, be it HTTP/HTTPS, SMTP/POP3/IMAP, or anything for that matter. You can also lock down ports on the box, which is a feature of most firewalls, but i like TMG due to its relitive ease of use…

In my previous post on WANProxy, i did not really go into detail about what it actually was. The direct quote from their site is WANProxy is a free, portable TCP proxy which makes TCP connections send less data, which improves TCP performance and throughput over lossy links, slow links and long links. This is just what you need to improve performance over satellite, wireless and WAN links. This is something that has interested me for a while, so i have been looking into it, and so far so good. In my last post i mentioned i was proxying Squid traffic, in todays post, i still am, but with some tweaks.

As a follow-up to yesterday’s post on RouterOS Blocking Machine access to all but one IP, I thought I would show how to add extra IPs to that list, without having a shedload of firewall filters.

• First things first, get your list of IPs you allow access to. In my case, I just did an NSLOOKUP on the name and got the IPs.
• Create an “Address List” in RouterOS. This can be done on the Web Interface by going to IP / Firewall / Address List and clicking Add. I had none previously, so I created a new rule, naming it ExpressVPN (the lads I use for VPN access) and added the first address.
• this is where things get interesting. for extra IP (for ExpressVPN, I have 4) you create a new address with the SAME name, but different IP.
• in your firewall rule, you should have either an src address or a dst address. in my case, I had both, but this was a change for the dst address. I removed the address from the rule, and I added it as a dst address list entry. If you have multiple address lists, you will see them here.

to do this at the command prompt:

So, I have a machine on my network, which should be only connecting to the internet through a VPN. I needed to tell my RouterOS box to block all access, except to this said IP address. The following should do the trick. YMMV

this will drop any packets from the srcaddress (IP address) that are not for the destination dstaddress (IP address). in my case, dstaddress is the VPN server I want to connect to. So, in theory, all packets should just go through the VPN and not leak out into the rest of the network. again, still testing this so be careful!

I am a UPC Ireland customer, and have 2 cable modems into the house, both Cisco EPC3925s. These are not exactly great modems for power users, but are grand for normal use. Me, however, being a poweruser wanted something a little more, how should I put it, powerful.

A couple of months back, a tutorial was posted on Boards.ie which showed you How to enable “bridging” on your UPC modem. When i say “Bridging”, they used DMZ, turned off firewalls, static IPs internally, turned off WiFi and DHCP, etc. It worked, quite well actually, but was “odd”. Today, however, there is a new tutorial Enabling REAL bridging on a Cisco EPC3925. I have tried this, and so far, it works! now just to set my router to work correctly, and update my IPs if they change.

As part of my ongoing plan to upgrade the house to VoIP, and as a follow up to my first VoIP stuff post, here are some more things i have found.

• I have added SipDiscount and SipGate for making and recieving calls.
• SipDiscount allows me to set pretty much any number as my Caller ID, as long as i “own” that number (they either text or call you with a code, and you enter it on their site). They also allow me to make cheap calls to Irish Mobiles (check their rates here)
• SipGate gave me a incoming UK phone number. Its an 0845 number, which I dont know what that means. but it was free, so its all good. Not sure if i can recieve text messages on it though.
• I have a Blueface account, which gives me an Irish 076 VoIP number. 076 is the standard VoIP number here in Ireland.
• I have a IpKall number, which is based in Washington State. You need to recieve a call on this line at least once every 30 days to keep it active.
• My Google Voice accepts calls and forwards them to my IpKall number, which then rings my BlueFace SIP account (since i know they will be up all the time, by my home server may be offline since i am only testing) which, if a SIP device is connected, will forward it again. if i am offline, or no sip devices are active, that call is redirected to voice mail.

Its all very complicated at the moment, but the plan will be that any incoming calls should go directly to the machine in house, which will ring the desk phone and any other SIP clients. Any incoming PSTN calls will also do the same. Outgoing calls will depend on the dialing plan, which i still need to figure out, but the theory goes as follows:

I have been running a MikroTik RouterBoard in the house for a couple of months now (the RB750G) and I am very much loving the thing. But one thing you may need to do is setup VPN connections… Here are some tips on how to create a VPN Server and Client on your RouterBoard.

Client Setup

to setup a client, you need to do the following:

What does that all do? the first line creates an l2tp-client interface, pointing at “servername” with the username and password set. encryption, etc is enabled… Line 2 then enables the client. Line 3 sets all traffic comming from networkaddress/24 (for example, 192.168.0.1/24) to be sent though the VPN. any traffic going into networkaddress (same example) is not sent though the VPN. Line 4 creates a gateway, for all addresses (0.0.0.0/0) to use the VPN address. finally, NAT Masquerading is enabled on the VPN interface.

Something I do on a regular basis is use the internet while “out and about”. This could be college, which has a semi open network, or it could be a coffee shop, which also usually has a semi open connection. There is also the possibility of using the a mobile internet connection on my iPhone, which can be slow, but at least its only shared with me… Anyway, over on RevSys.com, there is a post SSH Tunneling made simple which shows you how to open an SSH tunnel to your machine somewhere else (could be at home, as is my case, or a VPS/Dedicated server somewhere, or even on Amazon…) and use that for different things… In the case he shows, its for SMTP access. For my case, i am forwarding my local port 3128 to my Microsoft TMG 2010 Server in house on port 8080. Then my system proxy on my laptop is set to use localhost:3128 for all web and HTTPS requests. Very handy. One other tip: Using the -C flag, so your command may look like: