- NZNOG - lists.nznog.org

Keeping it local
by Martin Kealey 15 Dec '13

15 Dec '13

I have a question which I'm hoping the NZNOG community can help me with. Within NZ, what is the maximum number of hops from APE to any consumer's interface device? (smarty-phone, ADSL modem, whatever)? Or more pragmatically, let's say the 99th percentile, as in, fewer than 1% of customers are more than X hops away from APE. If this information is already available, I'd appreciate a pointer, otherwise... If you are an ISP could you give me an indicative number of hops from APE to your customers' CPE. If you can include a prefix length reflecting the number of affected customers that would help too. (Ideally the maximum across all your customers, but if you have a few oddball customers with longer paths, just the 99% will do.) If you're an ISP customer and would like to tell me your hop-count to APE (counting from your CPE, not from your computer) and your ISP's name, that would also be appreciated. Replies off-list and I will summarize back to the list. Here's the background: I'm investigating ways of limiting traffic so that it does not leave New Zealand, that can be configured on an application-by-application basis. Obviously if one has an upstream to "global" and a separate upstream to APE or WIX, then it's simple to filter traffic at those egresses. However for the average end-user, it's difficult to get multiple VLANs to their provider, let alone multiple physical links. In an ideal world, one would simply set some QoS bits and your upstream would understand them and do the filtering based on *their* egress, but in practice I haven't heard of any suppliers offering such a service. So I'm looking at DIY options ... In particular, I'm looking at setting the TTL on outgoing packets. We know how many hops it is from "our" hosts to APE, and I guestimate no more than 2 hops from a consumers border device (modem, whatever) to their client devices; So far it looks like setting the TTL so that it's down to 5 at APE will mean most of NZ is reachable, and most of the rest of the world isn't, assuming the international provider is as many hops from me as APE. But I'd really like to get a firmer idea of "how much of NZ will be unreachable given an egress hop limit of X?" (The idea is to find X where the list of exception prefixes is small enough to manage manually, while still blocking the majority of foreign traffic.) What I'd like to find out from the NZNOG community is the distribution of customers at various hop-counts from APE. -Martin

3 3

ISC/F-Root has returned to APE...
by Peter Losher 11 Dec '13

11 Dec '13

FYI - the Auckland node of F.ROOT-SERVERS.NET has been offline for the past couple of years due to HW failure, access issues @SkyTower, changes with our hosts (contacts and access to said data center). I am happy to report that the node is finally back online and advertising F's prefixes to the APE fabric as I type... So come and send your DNS root server queries locally instead of sending them off-shore. We are AS23710 @APE, so if you don't peer with us already, pop us a note at peering(a)isc.org. Yes, Telecom NZ, I am looking at you. Yes, you... (a guy can dream, even if it is hopeless) ;) There are many folks to thank as ISC could not do it alone including: - NZRS (Jay, Sebastian and Dave) for sponsoring the new server gear. - APNIC for sponsoring the new routers. (sorry to see the old Juniper kit go though) - Sebastian and Mike Jager for dealing with my numerous remote hands requests from the other side of the world. - The Kiwi Internet Mafia (Joe Abley, AJ, Jonny) for their support and access to their contacts to keep things moving. - Vodafone NZ and FX Networks for (now redundant) transit over IPv4 and IPv6. - Our peers at APE that have put up with us for being down so long... :) O.k., commercial over; back to serving packets again. Best Wishes - Peter -- [ plosher(a)isc.org | Senior Operations Architect | ISC | PGP E8048D08 ]

5 5

Web Servers: Dual-homing or DNAT/Port Forwarding?
by Christoph Berthoud 10 Dec '13

10 Dec '13

Hi All, I'm curious to know which of the following methods is more widely used/accepted today for publishing web servers to the Internet. 1) Dual-home the server - place one NIC on the internet and a second NIC on an internal network for administration, or 2) DNAT/Port Forward my external IP to my internal IP 3) Both - Dual home the server onto two private subnets (external/internal) and DNAT/Port Forward the public IP to the external subnet IP In either case: a) I will be hiding behind a dedicated firewall appliance and not relying on the OS firewalls b) the internal network will still be in its own subnet firewalled away from the rest of the network c) Only HTTP/HTTPS will be permitted from the internet, no RDP, SSH etc d) I will be deploying IPv6 to this machine in the next 12 months which makes option 1 more attractive I personally like option 1 but I'm looking to see if theres any facepalm reasons I shouldn't do it this way. Happy holidays! -- Thanks Christoph

9 10

JANOG 33 Program Published
by Daniel Griggs 09 Dec '13

09 Dec '13

Dear Colleagues, We have published the program for JANOG 33 and welcome you to join us in Beppu City, Japan, from 23rd-24th Jan 2014. Most sessions are in Japanese only but there are a few sessions in English. You are also welcome to connect with us through facebook and twitter for updates in English. The JANOG SNS accounts are open to everyone, including those who are not able to attend the meeting. See you in Beppu. Cheers, Shinichi Yamamoto, Chin Sze Yih, Izumi Okutani JANOG Internationalization team for JANOG 33 ----- JANOG 33 Program : ------------------------ The Program is available in English at: http://www.janog.gr.jp/en/index.php?JANOG33%20Programs%2FJANOG33%20Program%… Translations of the program titles and abstracts were supported by volunteers on the best efforts basis. Note: During the meeting, there will be no official interpretations in English, except for the sessions marked as (English session). Registration : ------------------------ You can register online at: https://regist.e-side.co.jp/product_info.php?products_id=427&language=en 　Deadline: 10th Jan 2014 JST 15:00 SNS Accounts : ------------------------ Facebook : https://www.facebook.com/janogmeetingi18n Twitter : https://twitter.com/janog_i18n -- Daniel Griggs e + j: daniel(a)pch.net c: +64 (21) 845158

1 0

Re: [nznog] Help block out China please.
by Pete Mundy 08 Dec '13

08 Dec '13

A story along a similar line that reinforces this view: I put a phone on public IP space a few weeks back, then got sidetracked while configuring it. Before I had even returned to enter a new admin password and the correct SIP details (only 1/2hr later!), the phone had already been attempting to dial out on it's own. Turns out a robot had found it on it's public IP with port 80 open and started issuing it dial commands before I even had a chance to go about locking it down. It was unable to dial out as it hadn't had the correct SIP server or login details configured, but it just goes to show that the device really need to be locked down _before_ being put on any publicly accessible IP space, even if just for provisioning purposes! Pete On 8/12/2013, at 3:17 PM, "Dobbins, Roland" <rdobbins(a)arbor.net> wrote: > > On Dec 8, 2013, at 8:46 AM, Don Gould <don(a)bowenvale.co.nz> wrote: > >> Clearly you can't even put a quick and dirty box in place to just prove a concept without having to bolt it down. > > Correct - it simply isn't viable to expose an unpatched/unsecured box to the Internet at all, due to all the automated scanning/hacking activities taking place. > > +1 to the other folks who recommended more workable solutions - 'GeoIP' isn't exact at all, and not all bad nodes (of any nationality) are in China. > > Roland Dobbins

9 9

Re: [nznog] Help block out China please.
by Regan Murphy 07 Dec '13

07 Dec '13

Build the box behind a firewall and don't open incoming ports until its ready to go. Sent from my Windows Phone ________________________________ From: Don Gould<mailto:don(a)bowenvale.co.nz> Sent: ‎8/‎12/‎2013 9:54 p.m. To: nznog(a)list.waikato.ac.nz<mailto:nznog(a)list.waikato.ac.nz> Subject: Re: [nznog] Help block out China please. How do I download the current patch set for Windows 2012 R2 so I can apply it before putting the box on the network? This seems a bit chicken and egg. (And yes I agree this really is a Geekzone or Whirlpool type question now, but I'm a bit interested in what advice operators are keen for us to be dishing to folk.) Beer. D On 8/12/2013 4:36 p.m., Pete Mundy wrote: > locked down_before_ being put on any publicly accessible IP space > -- > Don Gould > 31 Acheson Ave > Mairehau > Christchurch, New Zealand > Ph: + 64 3 348 7235 > Mobile: + 64 21 114 0699 > Ph: +61 3 9111 1821 (Melb) > > I'M COLLECTING COFFEE CUPS FOR PROJECT COFFEE CUP. > > Deja vue (missing the French accent mark) - literally means already seen, that sense of haven't we been here before. _______________________________________________ NZNOG mailing list NZNOG(a)list.waikato.ac.nz http://list.waikato.ac.nz/mailman/listinfo/nznog

1 0

Help block out China please.
by Don Gould 07 Dec '13

07 Dec '13

Hi, I've got a machine that's been hacked twice in the past week from IP ranges in China. I have it behind a Mikrotik router. There is no reason for anything outside of NZ and AU to be looking at this box so I'm keen to just block the rest of the world from it. I'm currently thinking an address list to just block out the world or an address list to include Au and Nz. Keen for ideas. D -- Don Gould 31 Acheson Ave Mairehau Christchurch, New Zealand Ph: + 64 3 348 7235 Mobile: + 64 21 114 0699 Ph: +61 3 9111 1821 (Melb) I'M COLLECTING COFFEE CUPS FOR PROJECT COFFEE CUP. Deja vue (missing the French accent mark) - literally means already seen, that sense of haven't we been here before.

5 7

SoapUI with WOMBL?
by Michael Fincham 04 Dec '13

04 Dec '13

Afternoon all, Has anyone managed to get Chorus's WOMBL B2B test environment working in SoapUI? One complimentary beer, redeemable at NZNOG 2014, for anyone who can share the settings in SoapUI required to make this work :) -- Michael Fincham

1 1

Domain registration scammers
by LRW Longhurst 04 Dec '13

04 Dec '13

Hi all, Sorry, and "beer" because this is more of an Aussie question, maybe someone can direct me to somewhere more appropriate. One of our execs received one of those "domain name available" letters in the form of an invoice, inviting him to register a name in .net.au that's similar to another name we own. This seems to have come via snail-mail but it invites payment at domainnamegroup.com.au. Do we do anything about such scammers? Suing them for wasting our time springs to mind, but I'm thinking more in terms of reporting to an authority. I know this practice has been around for a while but it's the first time I've encountered it directly. -- Lesley Longhurst (previously Walker) Linux Systems Administrator Opus International Consultants Ltd Email lesley.longhurst(a)opus.co.nz Tel +64 4 471 7002, Fax +64 4 473 3017 http://www.opus.co.nz Level 9 Majestic Centre, 100 Willis Street, PO Box 12 343 Wellington, New Zealand

6 5

Need C2T breakout cable in sky tower kinda urgent
by Alexander Neilson 03 Dec '13

03 Dec '13

Hey Everyone Beer, as required (and a big beer - or drink of choice - for my saviour) I am up working in our racks in sky tower and was doing a scheduled reboot of a server to move some power cables. Now the machine won’t complete booting and I suspect the CMOS battery may have died and the complete removal of power has lost the cmos settings stopping at least part of the boot cycle. I have a keyboard, mouse and screen here but it seems to use a C2D breakout cable to connect up to what looks like a larger than normal DVI port. Does anyone have a cable to get a standard VGA monitor signal out of an IBM eServer xSeries 335 machine anywhere in auckland (nearer sky tower the better) and even better if I can come grab it now. It seems to be one of two adapters I don’t have in my kit with me (this will be fixed) but any white knights would be really appreciated. Regards Alexander Alexander Neilson Neilson Productions Limited alexander(a)neilson.net.nz 021 329 681 022 456 2326

1 0