<div dir="ltr">The current plan is to block all unsolicited incoming traffic from the internet on the edge routers before it gets to the RF portions of the network. However, we don't want to do that until we have automation in place to maintain those rules and until we have a self-service way for you to poke holes in that configuration should you want to allow incoming traffic from the world to one of your IP addresses. If you want to block traffic from all sources (including other hams), then adding firewall rules to your own device is the correct way to accomplish that.<div>
<br></div><div>The rules are well established for auto-patches that connect voice repeaters to the PSTN. Even incoming telephone calls are allowed as long as they are "expected" by the ham. Because the parallels between these systems are fairly clear, the plan above puts us in the best position to make sure our users are able to maintain their part 97 compliance.</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Sat, Mar 15, 2014 at 11:25 PM, Dean Gibson AE7Q <span dir="ltr"><<a href="mailto:hamwan@ae7q.net" target="_blank">hamwan@ae7q.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<small><tt><big>OK, after seeing the number of "random" IP addresses
hitting the radio from outside the 44.0.0.0 net, I didn't like
the fact that the firewall filters were removed in the web
site's suggested configuration, so I decided to start from
scratch. I learned a couple things ...</big><br>
<font color="#000099"><br>
</font></tt><font color="#000099"><i><tt># -- Restore the radio
to a factory fresh state --</tt></i><i><tt><br>
</tt></i><i><tt>/system reset</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt># === At this point you must connect via MAC
address ===</tt></i><i><tt><br>
</tt></i><i><tt>/user set admin password="This is not it ..."</tt></i><i><tt><br>
</tt></i><i><tt>/console clear-history</tt></i><i><tt><br>
</tt></i><i><tt>/system identity set name="CALL-Paine"</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt>/ip</tt></i><i><tt><br>
</tt></i><i><tt>dns set allow-remote-requests=no</tt></i><i><tt><br>
</tt></i><i><tt>address remove [find]</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt>/ip firewall mangle</tt></i><i><tt><br>
</tt></i><i><tt>add action=change-mss chain=output
new-mss=1378 protocol=tcp tcp-flags=syn tcp-mss=!0-1378</tt></i><i><tt><br>
</tt></i><i><tt>add action=change-mss chain=forward
new-mss=1378 protocol=tcp tcp-flags=syn tcp-mss=!0-1378</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt>/ip dhcp-server</tt></i><i><tt><br>
</tt></i><i><tt>remove [find]</tt></i><i><tt><br>
</tt></i><i><tt>network remove [find]</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt>/ip dhcp-client</tt></i><i><tt><br>
</tt></i><i><tt>add add-default-route=no
dhcp-options=hostname,clientid disabled=no interface=ether1
use-peer-dns=no</tt></i><i><tt><br>
</tt></i><i><tt># -- The following is already configured --</tt></i><i><tt><br>
</tt></i><i><tt>#add add-default-route=yes
dhcp-options=hostname,clientid disabled=no interface=wlan1</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt># -- Do the following if you need to move the
radio to a different network --</tt></i><i><tt><br>
</tt></i><i><tt>/system shutdown</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt># === At this point you can connect via IP
address ===</tt></i><i><tt><br>
</tt></i><i><tt>/system logging</tt></i><i><tt><br>
</tt></i><i><tt>action set remote bsd-syslog=yes
remote=my.lcl.log.svr remote-port=514 src-address=my.lcl.ether.ip
syslog-facility=local1 syslog-severity=info</tt></i><i><tt><br>
</tt></i></font><i><tt><font color="#000099">add action=remote
disabled=no prefix="" topics=!debug,!snmp</font><br>
</tt></i></small><br>
<small><big>Note that I have "bsd-syslog" set to "yes". This <b>appears
to be necessary</b> if you want a remote system to see
"syslog-facility" and "syslog-severity" (the radio doesn't
save/display those settings otherwise).<br>
</big><i><tt><br>
</tt></i><font color="#000099"><i><tt>/system ntp client set
enabled=yes mode=unicast primary-ntp=my.lcl.ntp.svr1
secondary-ntp=my.lcl.ntp.svr2</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt>/interface wireless </tt></i><i><tt><br>
</tt></i><i><tt>channels add band=5ghz-onlyn comment="Cell
site sector centered at 360 degrees" frequency=5920
list=HamWAN name="Sector300-060" width=5</tt></i><i><tt><br>
</tt></i><i><tt>channels add band=5ghz-onlyn comment="Cell
site sector centered at 120 degrees" frequency=5905
list=HamWAN name="Sector060-180" width=5</tt></i><i><tt><br>
</tt></i><i><tt>channels add band=5ghz-onlyn comment="Cell
site sector centered at 240 degrees" frequency=5890
list=HamWAN name="Sector180-300" width=5</tt></i><i><tt><br>
</tt></i><i><tt>/delay 5</tt></i><i><tt><br>
</tt></i><i><tt>set 0 radio-name="CALL/Location-Paine"</tt></i><i><tt><br>
</tt></i><i><tt>set 0 disabled=no frequency-mode=superchannel
scan-list=HamWAN ssid=HamWAN wireless-protocol=nv2</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt>/tool dns-update dns-server=my.lcl.dns.svr
key="MD5 key ..." key-name=ddns ttl=3600 zone=<a href="http://ae7q.net" target="_blank">ae7q.net</a>
name=hamwan-1 address=my.ham.wan.ip</tt></i><i><tt><br>
</tt></i><i><tt>/console clear-history</tt></i><i><tt><br>
</tt></i><i><tt><br>
</tt></i><i><tt>monitor 0</tt></i></font><i><tt><br>
</tt></i></small><br>
I like my sector names better than just numbers...<br>
<br>
These "scripts" (when altered) can just be pasted into a command
window (otherwise the "/delay 5" above is not necessary).<br>
<br>
Oh, I can sometimes connect through my CLOSED window, but that's not
reliable enough for anything useful.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- Dean<br>
<br>
</font></span></div>
<br>_______________________________________________<br>
PSDR mailing list<br>
<a href="mailto:PSDR@hamwan.org">PSDR@hamwan.org</a><br>
<a href="http://mail.hamwan.org/mailman/listinfo/psdr_hamwan.org" target="_blank">http://mail.hamwan.org/mailman/listinfo/psdr_hamwan.org</a><br>
<br></blockquote></div><br></div>