MESH Nodes with Amprnet

Hi,

I have switch my local nodes from IP 10/8 to 44.165.xx from AMPRNET and it is look better 
solution for us because our local nodes have direct access to wide Amprnet network and any 
host from AMPRNET have access to our Mesh BBHN nodes. I must change rules firewall on our 
one WRT54 which is gateway to Amprnet to pass 44/8 traffic to local nodes. We can use 
Amprent IP addresses on Mesh Nodes and setup local AmprNet gateway by register on 
http://portal.ampr.org.


73 Waldek sp2ong  

PS. It may be more desireable to build a Mesh Node from a scratch OpenWRT install.  See:
http://kb9mwr.blogspot.com/2012/10/nw-mesh.html

##############################################################
Date: Wed, 28 May 2014 10:02:39 +0200
Subject: MESh Nodes with Amprnet
From: Waldek SPdwaONG <sp2ong[at]gmail.com>
To: 


Hi, 

I have still test configuration WRT BBHN with ampr.org but at current it is
working but it maybe not all well tune.

I have computer hamnet server which is AmprNEt gateway which have 2
ethernet card.
On one ethernet card I have connected one WRT54 with BBHN 1.0 which is MESH
-<-> Amprnet gateway.

I have setup all mesh nodes with setup menu to use IP adress 44.x. On the
client mesh nodes users ony setup own IP address 44.x and not more.
Whta I do with main WR54 MESH-AMPRNETGW.
On wifi setup IP address from WIFI amprent network for example 44.165.32.254
and all my WIFI network is 44.165.32.0/24
On WAN port I have setup other IP 44.165.33.2 with mask 255.255.255.252 and
ethernet PC card with IP 44.165.32.1

Now I have change files on WRT54 use vi editor:
-------------------------------------------
/etc/config.mesh/olsrd.conf
-------------------------------------------

I have add and modify follow:
Hna4
{
  44.0.0.0 255.0.0.0
}

It is tell other that this WRT54 Mesh node is main router for 44/8 network
on WIFI
And in http://meshnode:8080 in SETUP menu I have switch ON in WAN port
"Mesh gateway"
After changes of files /etc/config.mesh/olsrd.conf you must got to
http://meshnode:8080/cgi-bin/setup and push save and next reboot
--------------------------------
 I have modify file /usr/local/bin/olsrd-config I have add use suffix "
ampr.org" with mesh node:

# add the nameservice plugin
push @file, qq(\nLoadPlugin "olsrd_nameservice.so.0.3"\n);
push @file, qq({\n);
push @file, qq(    PlParam "sighup-pid-file" "/var/run/dnsmasq.pid"\n);
push @file, qq(    PlParam "suffix" ".ampr.org"\n);

--------------------------------------------------------------------------
I have add ampr.org to menu in file
/www/cgi-bin/setup

if($config eq
"mesh")

{

    print
"&nbsp;&nbsp;&nbsp;";

    print "<button type=button onClick='window.location=\"mesh\"'
title='See what is on the mesh'>Mesh Status</button>\n";
    print
"&nbsp;&nbsp;&nbsp;";

    print "<button type=button onClick='window.location=\"http://$
node.ampr.org:1978/\ <http://node.ampr.org:1978/%5C>"' title='See the OLSR
routing details'";

I have change firewall (it is maybe not optimal but work)
/etc/init.d/firewall

 this file I have attached

After all this changes My local mesh nodes have access only to 44/8 ! and
all Mesh nodes use 44.x ip adresses and they connect with all hosts in
amprnet network

73 Waldek

###########################################################################

#!/bin/sh /etc/rc.common
# Copyright (C) 2006 OpenWrt.org

## Please make changes in /etc/firewall.user
START=45
start() {
	include /lib/network
	scan_interfaces
	config_load /var/state/network
	
	config_get WAN wan ifname
	config_get WANDEV wan device
	config_get LAN lan ifname
	config_get LAN_IP lan ipaddr
	config_get LAN_MASK lan netmask
	config_get WIFI wifi ifname
	config_get WIFI_MASK wifi netmask
	
	if [ -n "$WIFI" ]; then
		WIFI_IP=`ifconfig $WIFI | grep "inet addr" | cut -f2 -d: | cut -f1 -d' '`
		[ -n "$WIFI_IP" ] || WIFI=""
	fi

	## CLEAR TABLES
	for T in filter nat; do
		iptables -t $T -F
		iptables -t $T -X
	done
	
	iptables -N input_rule
	iptables -N input_wan
	iptables -N input_wifi
	iptables -N output_rule
	iptables -N forwarding_rule
	iptables -N forwarding_wan
	iptables -N forwarding_wifi

	iptables -t nat -N NEW
	iptables -t nat -N prerouting_rule
	iptables -t nat -N prerouting_wan
	iptables -t nat -N prerouting_wifi
	iptables -t nat -N postrouting_rule
	
	iptables -N LAN_ACCEPT
	[ -z "$WIFI" ] || iptables -A LAN_ACCEPT -i "$WIFI" -j RETURN
	[ -z "$WAN" ]  || iptables -A LAN_ACCEPT -i "$WAN"  -j RETURN
	[ -z "$WANDEV" -o "$WANDEV" = "$WAN" ] || iptables -A LAN_ACCEPT -i "$WANDEV" -j RETURN
	iptables -A LAN_ACCEPT -j ACCEPT

	### INPUT
	###  (connections with the router as destination)
	
	# base case
	iptables -P INPUT DROP
	[ -z "$WIFI" ] || iptables -A INPUT -i $WIFI -d  $WIFI_IP -j ACCEPT
	iptables -A INPUT -m state --state INVALID -j DROP
	iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
	iptables -A INPUT -p tcp --tcp-flags SYN SYN --tcp-option \! 2 -j  DROP
	
	# accept everything for the node when in dmz mode (now known as direct mode)
	[ -e /etc/config/dmz-mode ] && iptables -A INPUT -d $WIFI_IP -j ACCEPT
	
	#
	# insert accept rule or to jump to new accept-check table here
	#
	iptables -A INPUT -j input_rule
	[ -z "$WIFI" ] || iptables -A INPUT -i $WIFI -j input_wifi
	[ -z "$WAN" ]  || iptables -A INPUT -i $WAN  -j input_wan
	
	# allow
	iptables -A INPUT -j LAN_ACCEPT	# allow from lan/wifi interfaces 
	iptables -A INPUT -p icmp	-j ACCEPT	# allow ICMP
	iptables -A INPUT -p gre	-j ACCEPT	# allow GRE
	
	# reject (what to do with anything not allowed earlier)
	iptables -A INPUT -p tcp -j REJECT --reject-with tcp-reset
	iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
	
	### OUTPUT
	### (connections with the router as source)
	
	# base case
	iptables -P OUTPUT DROP
	iptables -A OUTPUT -m state --state INVALID -j DROP
	iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
	
	#
	# insert accept rule or to jump to new accept-check table here
	#
	iptables -A OUTPUT -j output_rule
	
	# allow
	iptables -A OUTPUT -j ACCEPT		#allow everything out
	
	### FORWARDING
	### (connections routed through the router)
	
	# base case
	iptables -P FORWARD DROP 
	[ -z "$WIFI" ] || iptables -A FORWARD -i $WIFI -d  $WIFI_IP -j ACCEPT
	iptables -A FORWARD -m state --state INVALID -j DROP
	iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
	iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
	
	#
	# insert accept rule or to jump to new accept-check table here
	#
	iptables -A FORWARD -j forwarding_rule
	[ -z "$WIFI" ] || iptables -A FORWARD -i $WIFI -j forwarding_wifi
	[ -z "$WAN" ]  || iptables -A FORWARD -i $WAN  -j forwarding_wan
	
	# allow
	iptables -A FORWARD -i $LAN -o $LAN -j ACCEPT
        [ -z "$WIFI" ] || iptables -A FORWARD -i $WAN -o $WIFI -j ACCEPT
        [ -z "$WIFI" ] || iptables -A FORWARD -i $WIFI -o $WAN -j ACCEPT 
	[ -z "$WIFI" ] || iptables -A FORWARD -i $LAN -o $WIFI -j ACCEPT
	[ -z "$WAN" ]  || iptables -A FORWARD -i $LAN -o $WAN  -j ACCEPT
	
	# reject (what to do with anything not allowed earlier)
	iptables -A FORWARD -j REJECT
	
	### MASQ
	if [ -z "$WIFI" -o -e /etc/config/dmz-mode ]; then
	    iptables -t nat -A PREROUTING -m state --state NEW -p tcp -j NEW 
	    iptables -t nat -A PREROUTING -j prerouting_rule
	    [ -z "$WAN" ]  || iptables -t nat -A PREROUTING -i "$WAN"  -j prerouting_wan
	    iptables -t nat -A POSTROUTING -j postrouting_rule
	    [ -z "$WAN" ]  || iptables -t nat -A POSTROUTING -o $WAN  -j MASQUERADE
	    iptables -t nat -A NEW -m limit --limit 50 --limit-burst 100 -j RETURN && \
		iptables -t nat -A NEW -j DROP
	else
	    eval `ipcalc.sh $WIFI_IP $WIFI_MASK`
        #    iptables -t nat -A PREROUTING -m state --state NEW -p tcp -j NEW 
	#    iptables -t nat -A PREROUTING -j prerouting_rule
        #	    [ -z "$WIFI" ] || iptables -t nat -A PREROUTING -i "$WIFI" -j prerouting_wifi
	#    [ -z "$WAN" ]  || iptables -t nat -A PREROUTING -i "$WAN"  -j prerouting_wan
	#    iptables -t nat -A POSTROUTING -j postrouting_rule
	#    [ -z "$WIFI" ] || iptables -t nat -A POSTROUTING -s \! $NETWORK/$PREFIX -o $WIFI -j MASQUERADE
	#    [ -z "$WAN" ]  || iptables -t nat -A POSTROUTING -o $WAN  -j MASQUERADE
	#    iptables -t nat -A NEW -m limit --limit 50 --limit-burst 100 -j RETURN && \
		iptables -t nat -A NEW -j DROP
	fi

	## USER RULES
	[ -f /etc/config/firewall.user ] && . /etc/config/firewall.user
	[ \( -n "$WAN" -o -n "$WIFI" \) -a -e /etc/config/firewall ] && {
		[ -z "$WIFI" ] || export WIFI
		[ -z "$WAN" ]  || export WAN
		eval `ipcalc.sh $LAN_IP $LAN_MASK`
		awk -f /usr/lib/common.awk -f /usr/lib/firewall.awk LAN_NET=$NETWORK/$PREFIX /etc/config/firewall | ash
	}
}

stop() {
	iptables -P INPUT ACCEPT
	iptables -P OUTPUT ACCEPT
	iptables -P FORWARD ACCEPT
	iptables -F
	iptables -X
	iptables -t nat -P PREROUTING ACCEPT
	iptables -t nat -P POSTROUTING ACCEPT
	iptables -t nat -P OUTPUT ACCEPT
	iptables -t nat -F
	iptables -t nat -X
}