Comments (13)
ecsv
commented on August 20, 2024
Just had a look at freifunk/icvpn#213 - but this pull request doesn't remove hamburg01 and nordgw0. And these are the servers which tried to connect to vogtland1 and vogtland4
from icvpn-meta.
RedDog99
commented on August 20, 2024
Hi
Am 8. September 2017 09:26:49 MESZ schrieb Sven Eckelmann <[email protected]>:
Just noticed that one of the FFV servers (vogtland3) had a full HDD and
the reason for that was a rather big daemon.log. The "culprit" was bird
which logged a lot of connection requests from unknown peers.
Unfortunately, the log on this server cannot be used anymore - but I've
checked on vogtland1 and vogtland4 for the same error messages via
sudo grep 'Unexpected connect from unknown address'
/var/log/daemon.log|sed -e 's/.*Unexpected connect from unknown
address//' -e 's/port.*$//'|sort|uniq -c |sort -n
I found following IPs:
* misconfigured servers?
- tuttlingen @kpanic23
+ `10.119.0.8`
- ulm @kerlerm
+ `10.33.80.1`
- franken @RedDog99
+ `10.83.252.14`
Opsi. Thanks for watching out.
I looked up this IP and it belongs to one of mayosemmels (in CC) machines.
@mayosemmel please take a look. And please enter this IP to our DNS service. ;)
+ `fec0::a:cf:0:17` (why was it removed in 3c89032?)
Because we don't serve Ipv6 at the moment. We are working on it, but it takes times. :(
* unknown and most likely unrelated to icvpn
- `198.20.87.98`
- `45.55.21.184`
- `71.6.135.131`
- `80.82.77.139`
- `80.82.77.33`
* entries which were disabled during the "Grossreinemachen" #507
@kpanic23
- hamburg @7adietri
+ `10.207.0.61`
+ `fec0::a:cf:0:3d`
- nord @rubo77 @Tarnatos
+ `fec0::a:cf:b:c`
The first two points are not actually a problem of icvpn-meta. But the
last point is the interesting part. Should these be re-added or should
there certificate be removed from the icvpn tinc keys repository? And
should `fec0::a:cf:0:17` be re-added for franken?
For Franken: no, thanks. :)
Kind regards
Tim
from icvpn-meta.
RedDog99
commented on August 20, 2024
Hi there,
I will look at it tonight.
Thanks for the information.
Best regards
Jan
Am 8. September 2017 10:26:58 MESZ schrieb Tim Niemeyer <[email protected]>:
…Hi
Am 8. September 2017 09:26:49 MESZ schrieb Sven Eckelmann
***@***.***>:
>Just noticed that one of the FFV servers (vogtland3) had a full HDD
and
>the reason for that was a rather big daemon.log. The "culprit" was
bird
>which logged a lot of connection requests from unknown peers.
>Unfortunately, the log on this server cannot be used anymore - but
I've
>checked on vogtland1 and vogtland4 for the same error messages via
>
>sudo grep 'Unexpected connect from unknown address'
>/var/log/daemon.log|sed -e 's/.*Unexpected connect from unknown
>address//' -e 's/port.*$//'|sort|uniq -c |sort -n
>
>I found following IPs:
>
>* misconfigured servers?
> - tuttlingen @kpanic23
> + `10.119.0.8`
> - ulm @kerlerm
> + `10.33.80.1`
> - franken @RedDog99
> + `10.83.252.14`
Opsi. Thanks for watching out.
I looked up this IP and it belongs to one of mayosemmels (in CC)
machines.
@mayosemmel please take a look. And please enter this IP to our DNS
service. ;)
> + `fec0::a:cf:0:17` (why was it removed in 3c89032?)
Because we don't serve Ipv6 at the moment. We are working on it, but it
takes times. :(
>* unknown and most likely unrelated to icvpn
> - `198.20.87.98`
> - `45.55.21.184`
> - `71.6.135.131`
> - `80.82.77.139`
> - `80.82.77.33`
>* entries which were disabled during the "Grossreinemachen" #507
***@***.***
> - hamburg @7adietri
> + `10.207.0.61`
> + `fec0::a:cf:0:3d`
> - nord @rubo77 @Tarnatos
> + `fec0::a:cf:b:c`
>
>The first two points are not actually a problem of icvpn-meta. But the
>last point is the interesting part. Should these be re-added or should
>there certificate be removed from the icvpn tinc keys repository? And
>should `fec0::a:cf:0:17` be re-added for franken?
For Franken: no, thanks. :)
Kind regards
Tim
from icvpn-meta.
mweinelt
commented on August 20, 2024
@ecsv This is related to how peer builds its network graph. Every peer may introduce other peers it knows, so we can't really get rid of peers on the VPN unless everyone upgrades.
There are some options I meant to take a look at, namely TunnelServer and StrictSubnets.
from icvpn-meta.
alxndr42
commented on August 20, 2024
I'm trying to find out where this is coming from for Hamburg.
from icvpn-meta.
kpanic23
commented on August 20, 2024
Well, it seems like hamburg1 bgp had been down for quite a long time and came back a week after getting removed during Großreinemachen... So I think the solution would be to remove the comment in hamburg meta file for this host, since it seems to be working again. But I guess that should be up to the hamburgerians...
from icvpn-meta.
Tarnatos
commented on August 20, 2024
I've disabled tinc on vpn0 now. Maybe we'll check it later.
from icvpn-meta.
ecsv
commented on August 20, 2024
The logs of vogtland(1,3,4) from today contained following "offenders" with ~75k connection requests in the last 10 hours:
- Franken: @RedDog99 @mayosemmel
fec0::a:cf:0:17
- Hamburg: @7adietri @ohrensessel
10.207.0.61fec0::a:cf:0:3d
from icvpn-meta.
ohrensessel
commented on August 20, 2024
Hi,
hamburg1 is back since around mid of August. Before, tincd kept crashing and our motivation was low to fix icvpn as we nevertheless have public, unfiltered IPv6 in our mesh. tinc should now automatically be restarted in case it crashed. Additionally, all icvpn peers are now passive on our side to avoid unnecessary connection attempts from our side. Sorry for that, @ecsv.
I was not aware of Großreinemachen, otherwise I would have voted for keeping hamburg1 for the moment.
Hamburg2 will come back in a week or so.
Kind regards,
Leo
from icvpn-meta.
RedDog99
commented on August 20, 2024
Hi Sven
Am Samstag, den 09.09.2017, 03:19 -0700 schrieb Sven Eckelmann:
The logs of vogtland(1,3,4) from today contained following
"offenders" with ~75k connection requests in the last 10 hours:
Franken: @RedDog99 @mayosemmel
fec0::a:cf:0:17
Ah damit. :/
You are right. This peering IP is configured. Also there are no IPv6
networks, this host has an IPv6 peering IP.
I will fix this, sorry for the noise.
Tim
from icvpn-meta.
ecsv
commented on August 20, 2024
Looks like the relevant messages now disappeared from my logs after the mentioned communities fixed their icvpn-meta entries or disabled icvpn. @mweinelt Would you agree that this ticket can be closed now?
from icvpn-meta.
ecsv
commented on August 20, 2024
I am assuming that this is a "yes, can be closed".
@RedDog99 I see from time to time that 10.83.252.14 is trying to connect. Maybe setting it to non-multihop BGP (aka direct) sessions could work around this problem.
from icvpn-meta.
RedDog99
commented on August 20, 2024
Hi Sven
Am Sonntag, den 17.09.2017, 01:36 -0700 schrieb Sven Eckelmann:
I am assuming that this is a "yes, can be closed".
@RedDog99 I see from time to time that 10.83.252.14 is trying to
I don't see what's wrong about a connection try.
But anyway this IP is in the responsibility of mayosemmel (CC).
Kind regards
Tim
… connect. Maybe setting it to non-multihop BGP (aka direct) sessions
could work around this problem.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub, or mute the thread.
from icvpn-meta.
Related Issues (20)
- Problem mit Community Netzen HOT 3
- Are these AS numbers valid? HOT 3
- Duplicate Domain (ffwk): vfnnrw westkueste HOT 2
- duplicate ipv4, kiel3 + bielefeld1 HOT 2
- duplicate ipv4 subnet 10.31/16: Berlin vs. Hameln HOT 1
- Reservierung für private Netze HOT 6
- How do I find a free ip for a new community? HOT 1
- Check missing communities
- Too specific announced networks in celle and gera-greiz
- herne: Missing delegates in ruhrgebiet HOT 5
- ennepe-ruhr-kreis: Missing delegates in ruhrgebiet HOT 2
- rhein-neckar: unknown ASN announces networks for rhein-neckar networks HOT 3
- bielefeld: Incorrect ASN for announced networks HOT 2
- franken: Missing delegation for 10.50.60.0/22 ASN 4242420205 HOT 6
- Hamburg announces wrong network 10.83.15.0/24 HOT 3
- rhein-neckar: Bad peer AS HOT 1
- neonetwork: new nameserver breaks mkdns HOT 1
- [dnssec] Any way to add dnssec trust anchor?
- Enforce hexadecimal representation of last IPv4 octet in last IPv6 hextet HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from icvpn-meta.