EdgeRouter Lite v1.9.7+hotfix.4

Rebooted, tried to access the router with the browser and ssh.  Was denied access for about 10 minutes.  Could ping the device and access internet though.

IIRC when I upgraded to plain 1.9.7 from 1.9.1.1, reboot was pretty fast.  It's like that since I iinstalled hotfix.4.  I upgraded directly from 1.9.7 to hotfix.4, skipping the intermediate hotfixes.

/var/log/messages:

(...)

Feb 12 10:11:21 ubnt pppd[1568]: peer from calling number xx:xx:xx:xx:xx:xx authorized
Feb 12 10:11:22 ubnt pppd[1568]: local IP address x.x.x.x
Feb 12 10:11:22 ubnt pppd[1568]: remote IP address x.x.x.x
Feb 12 10:11:22 ubnt pppd[1568]: primary DNS address x.x.x.x
Feb 12 10:11:22 ubnt pppd[1568]: secondary DNS address x.x.x.x
Feb 12 10:11:24 ubnt ubnt-service-gui: waiting for netplugd to be started...
Feb 12 10:11:25 ubnt ntpd_intres[1474]: host name not found: 0.ubnt.pool.ntp.org
Feb 12 10:11:25 ubnt ntpd_intres[1474]: host name not found: 1.ubnt.pool.ntp.org
Feb 12 10:11:25 ubnt ntpd_intres[1474]: host name not found: 2.ubnt.pool.ntp.org
Feb 12 10:11:25 ubnt ntpd_intres[1474]: host name not found: 3.ubnt.pool.ntp.org
Feb 12 10:11:26 ubnt dhcpd: WARNING: Host declarations are global. They are not limited to the scope you declared them in.
Feb 12 10:11:26 ubnt dhcpd:
Feb 12 10:11:26 ubnt dhcpd: No subnet declaration for peth0 (192.168.168.1).
Feb 12 10:11:26 ubnt dhcpd: ** Ignoring requests on peth0. If this is not what
Feb 12 10:11:26 ubnt dhcpd: you want, please write a subnet declaration
Feb 12 10:11:26 ubnt dhcpd: in your dhcpd.conf file for the network segment
Feb 12 10:11:26 ubnt dhcpd: to which interface peth0 is attached. **
Feb 12 10:11:26 ubnt dhcpd:
Feb 12 10:11:28 ubnt ntpd[1467]: ntpd exiting on signal 15
Feb 12 10:11:31 ubnt ntpd[1897]: ntpd 4.2.6p2@1.2194-o Thu Aug 3 08:25:56 UTC 2017 (1)
Feb 12 10:11:31 ubnt ntpd[1898]: proto: precision = 47.910 usec
Feb 12 15:20:18 ubnt ubnt-service-ssh: waiting for netplugd to be started...
Feb 12 15:20:20 ubnt ubnt-service-gui: waiting for netplugd to be started...
Feb 12 15:21:18 ubnt ubnt-service-ssh: waiting for netplugd to be started...
Feb 12 15:21:20 ubnt ubnt-service-gui: waiting for netplugd to be started...
Feb 12 15:22:19 ubnt ubnt-service-ssh: waiting for netplugd to be started...
Feb 12 15:22:21 ubnt ubnt-service-gui: waiting for netplugd to be started...
Feb 12 15:22:53 ubnt netplugd: Starting network plug daemon: netplugd.
Feb 12 15:22:58 ubnt ubnt-service-ssh: starting the SSH service (see messages from sshd).
Feb 12 15:23:00 ubnt ubnt-service-gui: starting the GUI service.

I am having an issue with DHCP on an ER-8 Pro.  The DHCP server stopped issuing dhcp requests altogether. Watching the packet captures, the requests would come in the router interface, the router would allocate an address, and then simply not do anything else.  It never offiers the address it puts into its DHCP table.  

Due to this, and reconfiguring twice to no solution, I reverted firmware back to 1.9.7 hf4, and the issue continued.  In a hurried solution, we removed the dhcp server from the router altogether, and setup a dhcp relay to a BMU( We are using PowerCode), and let the billing system manage our ip environment on that segment.  This worked fine for about 48 hours.  We came in this morning to every customer offline on that site again.  In looking, the DHCP Relay server on the EdgeRouter stopped forwarding packets around 7 am Sunday morning.  

Looking at the packet captures, we are seeing the requests come in, but not being passed on.  If we delete the dhcp-relay service, and recreate it with the exact same settings, it works for about 5 minutes, long enough for customers to get an ip address and be good for the lease duration.  But then the relay server stops forwarding again.  We have had to delete, and reacreate the exact same setting about 10 times today to keep all customers up and happy.  I am pretty sure we have encountered some type of bug, and would like to know what your thoughts are on this.  

All is well for about 10 minutes, then it stops forwarding again.  Watching the packet capture on the customer facing interfaces shows the requests coming into the router, but after it stops responding, the packets are discarded due to no service to do anything with them.  

The only way for me to fix this is to reload the configuration for the dhcp relay as i am not certain how to restart the daemon for it, which is what that does.  Here is my config:

ubnt@109# show service dhcp-relay
interface eth0
interface eth0.10
interface eth0.301
relay-options {
relay-agents-packets forward
}
server My IP Address

eth0 is customer facing, eth0.10 is management for cpe, and eth0.301 is a vlan for the backhaul of a ceragon radio that i am powering through the PoE Switch.  

In order to restore DHCP service, i delete the dchp-relay and reconfigure these lines only, and my service is restored for a short time.  I am having to do this multiple times a day at this point, and reverting back to 1.9.7 hf 4 did not change the behavior.  This was not happening prior to upgradeing to 1.10.  i have two tower sites exhibiting this same behavior.  The rest are working without issue.  

Hi guys,

First of all, sorry for offtop, the question is not related to EdgeMAX this time but to x86 Linux routing. Previous times I've seen a lot of people here understand networks much better than I do and this knowledge spans further than EdgeMAX product line so I hope someone could help me, give some clues to work on. Dear moderators, I hope posting this here is not that bad. :/

In short the issue is that remote ipsec client of Strongswan sees the Linux router Strongswan runs on but cannot see other hosts on the same subnet router is on. The devil is in the details: the configuration of the router is quite complicated - it's works as gateway to internet, firewall, LAN router, ipsec (server?) endpoint, virtual services host and fileserver. Works flawlessly but there is this issue with ipsec.

Router has one physical interface, let's call it eth0. eth0 is physically connected to a switch that serves LAN without VLAN (untagged) and WAN with VLAN3 (switch untags this traffic when it goes to ISP). 

eth0 has no IP configured. 

eth0v3 is VLAN3 of eth0 and gets IP via DHCP directly from ISP through switch. 

eth0p0 is MACVLAN of eth0 and has IP 192.168.0.1/24. 

Docker is installed on router and there are several services running as docker containers. They all use Docker MACVLAN network whose parent is eth0. For those who doesn't know Docker but knows Linux network namespaces - essentially the services inside docker containers run using macvlan of eth0 each in its own network namespace (ip netns). 

One of docker containers is Strongswan configured as an IPSEC endpoint (without L2TP or anything, just IKEv2 IPSEC). Its IP is 192.168.0.130/24 (MACVLAN of eth0). 

There is another docker container with IP 192.168.0.129/24 (MACVLAN of eth0). There is another LAN host physically connected to the switch (untagged) with IP 192.168.0.5/24. Both are pingable from the Strongswan docker container. 

IPSEC ports are DNATed from eth0v3 IP to 192.168.0.130. 

Strongswan is configured to give out IPs from subnet 192.168.103.0/24 to clients. 

Router has static route to reach this subnet via docker container: 192.168.103.0/24 via 192.168.0.130 dev eth0p0. 

There is a remote IPSEC client that connects over the internet to eth0v3 IP. It gets IP 192.168.103.1/24. It routes all traffic through IPSEC (i. e. send all traffic through VPN).

It can ping 192.168.0.130 (Strongswan docker container), 192.168.0.1 (router itself) but it can't ping other docker containers (e. g. 192.168.0.129) and other physical hosts on the same subnet (e. g. 192.168.0.5). 

I think I know where the problem lies but I don't know how to fix it. 

Remote client starts pinging another docker container (same situation with physical hosts on the same subnet). 

If one tcpdumps icmp traffic from inside Strongswan container he'll see that inside container there comes a packet

srcip 192.168.103.1 srcmac {MAC of eth0p0} dstip 192.168.0.129 dstmac {MAC of Strongswan container MACVLAN interface}

then there is a packet

srcip 192.168.103.1 srcmac {MAC of Strongswan container MACVLAN interface} dstip 192.168.0.129 dstmac {MAC of another container MACVLAN interface}.

On the router side tcpdump only shows the second packet which makes sense

srcip 192.168.103.1 srcmac {MAC of Strongswan container MACVLAN interface} dstip 192.168.0.129 dstmac {MAC of another container MACVLAN interface}

and then icmp reply

srcip 192.168.0.129 srcmac {MAC of another container MACVLAN interface} dstip 192.168.103.1 dstmac {MAC of eth0p0}. 

So reply comes straight to the router LAN interface which of course knows nothing about IPSEC encapsulation. Strongswan container sees no reply at all. Thus remote client sees no reply at all as well. 

All in all the route of the icmp packet seems to be: remote client over the internet -> physically eth0 -> logically eth0v3 -> eth0p0 -> Strongswan MACVLAN interface -> IPSEC de-encapsulation -> another container MACVLAN interface -> reply goes directly to eth0p0 instead of Strongswan MACVLAN interface for IPSEC encapsulation. 

ip neigh both on router and inside another container shows no entry for 192.168.103.1 so it seems the only other place that might trigger this behaviour is if Linux MACVLAN implementation somehow learns that 192.168.103.1 is behind eth0p0 without knowing IPSEC encapsulation is necessary to reach it. 

Am I right to assume this or do I miss anything? Is there a way to debug what MACs MACVLAN bridge has learnt? Or is the problem in a different area? Can it be fixed somehow? 

Thank you for the time you spent to read all this and for the help!

If any other information is necessary, please let me know. 

P. S. There is a slight connection to EdgeMAX - after fixing this issue ERLite-3 will become another remote client of this IPSEC server. Need to transparently connect 2 distant locations. 

i have an ERPOE-5 with  1.10.0 firmware using comcast residential as my isp (california)

back on 1.7 firmware everything worked fine using the following settings:

at some point ipv6 stopped working; not sure which firmware update broke it, but none of the settings changed.  eth0 used to show both a ipv4 and ipv6 address, now just the ipv4.

any ideas?  i did a search and found posts on hwnat having some issues with another model router, but that was already disabled so that isnt it.  maybe something changed with comcast residential that i missed?  or with the router?

thanks for any ideas

I am testing an edge router on my LAN, meaning, I have the WAN port of the edge router (eth0) getting an IP from my LAN DHCP server, I have my laptop plugged into eth1. The edge router gets an IP from my DHCP server on the LAN, we'll call it 10.10.10.119 (this would be a WAN IP from the ISP, in a real world scenario). My laptop gets an IP from the edge router, 192.168.1.135.

I am on another PC on my LAN, 10.10.10.144, and I want to access the WAN IP of the edge router, 10.10.10.119. At first, a ping, SSH, and https session didn't work, so I logged into the edge router, from the laptop connected directly to the edge router, and created a WAN LOCAL ICMP allow rule, dragged it to the second spot (from the two default rules) and once saved, I could see replies from the laptop that I was testing from which was previously failing. Ok, great sign, that was easy enough. Now I wanted to replicate the ICMP rule and add two rules for SSH and HTTPS GUI access. I created the rules, clicked enable, allow tcp 22 and 443, respectively, but SSH and HTTPS don't work from the laptop on the 10.10.10.0 /24 network. Ping worked immedately, but SSH and HTTPS are not working.

Established, invalid, new, related...I left those unchecked, didn't work. Then I checked new, didn't work. After a few other variations, I gave up as I'm not sure what I am doing wrong.

The documents/posts I've read all stated that WAN LOCAL are for services that terminate on the router itself and WAN IN would be for incoming requests that the router needs to pass through the router, for example, a web server.

What am I missing/doing wrong? I assume this firewall works like other firewalls in that it processes rules in order of first match which is why I thought to drop down the invalid rule (default number 2) into the very last spot.

Do I need to power cycle the router after making WAN LOCAL changes/additions?

Thanks.

I just got a Netgear CM1000 modem and an EdgeRouter X and I am attempting to set them up. The modem works fine and has no issues connecting to the computer. However, whenever I connect the ER to the computer via the eth0 port, the eth0 light does not stay lit and keeps flashing off and on. When it's on, my computer shows that the LAN is connected, but when it's off, it is disconnected.

I have been able to get to EdgeOS three times, and each time I set it up so that eth0 is DHCP and the rest (eth1-eth4) are just normal LAN ports. I then applied the changes and EdgeOS said they were applied correctly. Then I clicked to have the router reboot.

The first time I did this, it said it was rebooting, and it was taking awhile, so I thought it wanted me to disconnect the PC from eth0, reconnect it to eth1, and connect the modem to eth0 (which is how everything is supposed to end up eventually), so I did. I believe doing this is what screwed everything up in the first place.

When I did this, EdgeOS gave me an error message, and from that point on the router would not form a stable connection with my PC. For the next few hours I tried many different combinations of power-cycling the router, resetting the router, and disconnecting and reconnecting the ethernet cable. Also, the other two times I connected to EdgeOS, when the router was in the process of rebooting, it disconnected midway through and would not reconnect.

At this point I am tired and annoyed and I have no idea what to try next. Please give me any advice you can think of to help my situation. Thank you in advance.

My goal is to wake up a PC with the Plex server by use of any Plex client (local).

But being completely new to EdgeOS (Edgemax X) and CLI based router setup I'm not able to get any of the tips I find to work.

The server pc has a static IP (with plex port forwarding) and all clients are on the same network. I'm also able to wake up the pc with the command etherwake (router) and mc-wol (pc), but not from the Plex clients. Do I need a script running? Somebody able to give a noob description of what's needed?

After upgrading to 1.10, I configured ssh-recovery as follows:

     ssh-recovery {
        lifetime 60
        listen-on br0.1337
        port 61337
     }

That, however, seems to make the router unable to boot:

Feb 13 01:27:10 pro ssh-recovery[568]: starting...
Feb 13 01:27:11 pro ssh-recovery[568]: if=(br0.1337) port=(61337) terminate-timeout=(60)
Feb 13 01:27:12 pro ssh-recovery[568]: enabling link on interfaces...
Feb 13 01:27:12 pro ssh-recovery[568]: br0.1337 :: mac=()
Feb 13 01:27:13 pro ssh-recovery[568]: waiting for interface/address initialization...
Feb 13 01:27:14 pro kernel: ip_set: protocol 6
Feb 13 01:27:15 pro NSM[701]:  NSM-6: Initializing memdbg: ptr=0x692e64 history-size=1024 memdbg-size=143552
Feb 13 01:27:16 pro NSM[711]:  NSM-6: ioctl() returned illegal value. Setting bandwidth to 0
Feb 13 01:27:16  NSM[711]: last message repeated 15 times
Feb 13 01:27:16 pro RIB[714]:  RIB-6: Initializing memdbg: ptr=0x587084 history-size=1024 memdbg-size=143552
Feb 13 01:27:16 pro NSM[711]:  NSM-4: Could not create VRF table with identifier 1 in the MPLS Forwarder
Feb 13 01:27:16 pro RIB[719]:  RIB-6: RIBd (1.2.0) starts
Feb 13 01:27:21 pro IMI[698]:  IMI-6: imi_server_send_config called (PM 1)
Feb 13 01:27:22 pro IMI[698]:  IMI-6: imi_server_send_config called (PM 42)
Feb 13 01:27:23 pro ssh-recovery[568]: br0.1337 has no IPv6 link-local address, skipping...
Feb 13 01:27:23 pro ssh-recovery[568]: all listening interfaces down, quitting...
Feb 13 01:27:23 pro rl-system.init: Checking/creating SSH host keys.
Feb 13 01:30:12 pro boot-config-loader: Commit failed at boot.

Disabling ssh-recovery (via serial console) seems to have brought it back to life.

So there are two issues apparenty - that it can't use the interface, and that a failure in ssh-recovery makes the whole boot process fail somehow.

Full config too large for this forum's limit, but available on request.

Does anyone know of any small hardware devices that can display the currently bandwidth utilisation on a link in a similar way to the Amplifi HD/ Ufiber Nano do?

We recently upgraded from an Amplifi HD system in the office to a Unifi/EdgeSwitch/EdgeRouter setup and it's working great. However, I miss the realtime visual display of bandwidth utilisation that we got from the Amplifi HD. We have a very slow internet connection (rual location) and trying to run a business with 10+ work stations on it is challenging. It's useful to see, at a quick glance, the current throughput to see if $x website is just responding slowly or if something in the office is hogging the bandwidth.

I know that the EdgeRouter UI gives me the throughput on the interfaces via it's UI, but having to login to check it is a faff - the Amplifi HD base station allowed me to quickly glance over. I guess I could put together some sort of homebrew system to give the same view using a Raspberry Pi or something, but I'd rather something off the shelf.

The currently setup is Unifi APs into the EdgeSwitch, then a single uplink from the EdgeSwitch network into the EdgeRouter and then out of the ISP from there. I'm thinking about something that can sit inbetween the EdgeSwitch and EdgeRouter or the EdgeRouter and the ISP modem.

Any ideas appreciated!

Thanks

Hi All,

We have rollout a heap of these EdgeRouter Infinity devices, our network services around 1500 residential and business customers for internet access so the connection limits need to be massive, we have noticed the conntrack defaults are not good enough based on the hardware specs of Infinity has anyone got any idea what we can set without causing any performance issues.

We have a 10Gbps link and 2x 1Gbps links pertty much we hover around 65% utilization across all links on peak hours.

Thank you in advance.

Hello all!

I have 35 ER-4 units.  I configured one of the ER-4 routers with basic information to use as my "base" config.  I've been able to restore this config to 3 other ER-4 devices without a problem.  Now I'm working on the 5th ER-4 and for some reason, it does not want to restore the config. I ended up resetting the router back to defaults (from the web gui) and am still experiencing the same error.  I then went ahead and tried to upload the same firmware v1.9.8 again hoping that it would fix some things.  The firmware uploaded fine but still getting the same error when uploading the config file.  The config worked flawlessly for the previous devices but this one seems to hate me.

The error states: ""There was an error upgrading the configuration CONFIG request failed".

Browser: Chrome

Firmware: Edgerouter 4 v1.9.8

Maybe it's a dumb question.

Is it possible to have different route for computers on the LAN subnet (say 10.0.0.0/24) and router with two WAN links (say 1.1.1.1 and 2.2.2.2)?

What I want is that packets sent from 10.0.0.0/24 for 92.1.1.92 go via 1.1.1.1 and that all packets sent from router itself as a response to packets from 92.1.1.92 go via 2.2.2.2.

Since my upgrade to 1.10 my logs have started filling up with the following errors, didn't see these at all in previous versions, and so far I have not seen any performace issues from them. Have attached a full log and config to help.

Error:

Feb 10 08:02:44 ERL-Home kernel: skbuff: Gotcha2 800000041c9dc000 800000041c9dc142 -4

Feb 10 08:02:44 ERL-Home kernel: CPU: 0 PID: 0 Comm: swapper/0 Tainted: P           O 3.10.107-UBNT #1

Feb 10 08:02:44 ERL-Home kernel: Stack : 00000000000000a8 0000000050008ce1 0000000000200000 0000000000000007

Feb 10 08:02:44 ERL-Home kernel:          0000000000000000 0000000000000000 ffffffffc0660000 00000000000000a8

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc064ec58 ffffffffc0520000 00000000000000a8 302e3130372d5542

Feb 10 08:02:44 ERL-Home kernel:          0000000000000005 ffffffffc0651b18 ffffffffc0660000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          800000041d4c8980 fffffffffffffffc 800000041cafd000 800000041c9dc142

Feb 10 08:02:44 ERL-Home kernel:          0000000000000040 0000000000000000 0000000000000001 800000041cafd000

Feb 10 08:02:44 ERL-Home kernel:          0000000000000005 0000000000000001 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc04dc000 ffffffffc04df760 0000000000000000 ffffffffc032423c

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc050ff60 ffffffffc0484d88 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          0000000000000000 ffffffffc006f0a4 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          ...

Feb 10 08:02:44 ERL-Home kernel: Call Trace:

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc006f0a4>] show_stack+0x6c/0xf8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc032423c>] skb_push+0xa4/0xb0

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc03d93a4>] packet_rcv+0xdc/0x4c0

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc032e7b0>] __netif_receive_skb_core+0x498/0x8c8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc03329b8>] netif_receive_skb+0x28/0xa8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc087fac8>] cvm_oct_napi_poll_38+0x4d0/0xa70 [octeon_ethernet]

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0333230>] net_rx_action+0x228/0x2b8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0095294>] __do_softirq+0x1dc/0x228

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc00953b0>] do_softirq+0x68/0x70

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0095a80>] irq_exit+0x70/0x80

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc00073a4>] plat_irq_dispatch+0x4c/0xd8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc006a834>] handle_int+0x114/0x11c

Feb 10 08:02:44 ERL-Home kernel: 

Have been seeing the errors below since upgrading my ER-L to 1.10, didn't see these at all in previous verisons. I can't say I have seen any router issues, just my logs filling with the errors. Have attached my logs and scrubbed config as well.

Feb 10 08:02:44 ERL-Home kernel: skbuff: Gotcha2 800000041c9dc000 800000041c9dc142 -4

Feb 10 08:02:44 ERL-Home kernel: CPU: 0 PID: 0 Comm: swapper/0 Tainted: P           O 3.10.107-UBNT #1

Feb 10 08:02:44 ERL-Home kernel: Stack : 00000000000000a8 0000000050008ce1 0000000000200000 0000000000000007

Feb 10 08:02:44 ERL-Home kernel:          0000000000000000 0000000000000000 ffffffffc0660000 00000000000000a8

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc064ec58 ffffffffc0520000 00000000000000a8 302e3130372d5542

Feb 10 08:02:44 ERL-Home kernel:          0000000000000005 ffffffffc0651b18 ffffffffc0660000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          800000041d4c8980 fffffffffffffffc 800000041cafd000 800000041c9dc142

Feb 10 08:02:44 ERL-Home kernel:          0000000000000040 0000000000000000 0000000000000001 800000041cafd000

Feb 10 08:02:44 ERL-Home kernel:          0000000000000005 0000000000000001 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc04dc000 ffffffffc04df760 0000000000000000 ffffffffc032423c

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc050ff60 ffffffffc0484d88 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          0000000000000000 ffffffffc006f0a4 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          ...

Feb 10 08:02:44 ERL-Home kernel: Call Trace:

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc006f0a4>] show_stack+0x6c/0xf8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc032423c>] skb_push+0xa4/0xb0

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc03d93a4>] packet_rcv+0xdc/0x4c0

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc032e7b0>] __netif_receive_skb_core+0x498/0x8c8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc03329b8>] netif_receive_skb+0x28/0xa8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc087fac8>] cvm_oct_napi_poll_38+0x4d0/0xa70 [octeon_ethernet]

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0333230>] net_rx_action+0x228/0x2b8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0095294>] __do_softirq+0x1dc/0x228

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc00953b0>] do_softirq+0x68/0x70

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0095a80>] irq_exit+0x70/0x80

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc00073a4>] plat_irq_dispatch+0x4c/0xd8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc006a834>] handle_int+0x114/0x11c

Feb 10 08:02:44 ERL-Home kernel: 

This may not be possible but here is what I'm looking to do. 

We have an EdgeMax X SFP v1.9.7 Hotfix 4. This is connected to a gateway on our companies network on eth0 on 10.10.205.0/24 network. eth1-3 are connected to 172.16.0.0/16 and eth4 is connected to a device on 10.10.205.0/24. (currently in a lab)

I need to setup remote connection to the devices on the 172.16.0.0/16 network (which i have working). But in order to setup the connection I need to setup DNAT and add the IP to the WAN interface.

My question is: Is there some way to set it up so that I don't need to put the IP in both places.

Putting IP 10.10.205.11 on the WAN port, then DNAT 10.10.205.11 -> 172.16.1.10 will all me remote connection

Only putting 10.10.205.100 ->172.16.1.100 in DNAT will not allow the remote connection. Which im assuming is because the router doesnt know where 10.10.205.100 is since it only exists in the DNAT table.

Ideally I would like the WAN port to passthrough all 10.10.205.0/24 and then NAT anything I have in the table. This router is currently under evaluation and if we decide to use it then we would have around 20 devices on the 172.16.0.0/16 network we would need remote access to. Then we would have 20-30 of these routers for different 10.10 subnets. These routers would then be moved around and we would need to go an change the IPs in both locations each time. (router will be used for the engineering departmet in manufacturing for their machines not in IT. Main function for the rouer will be NAT)

Again, I am just looking to see if its possible (and if it is maybe get some help setting it up) to set the IPs for NAT in 1 location

I have inserted my config. I have a masquerade and arp-proxy on but it is just something i am playing with and has no effect on what I am trying to do (effects are the same  with it on or off)

firewall {                                                                      
    all-ping enable                                                             
    broadcast-ping disable                                                      
    group {                                                                     
        address-group 172network {                                              
            address 172.16.0.0/16                                               
            description ""                                                      
        }                                                                       
    }                                                                           
    ipv6-receive-redirects disable                                              
    ipv6-src-route disable                                                      
    ip-src-route disable                                                        
    log-martians enable                                                         
    name WAN_IN {                                                               
        default-action accept                                                   
        description "WAN to internal"                                           
        rule 20 {                                                               
            action accept                                                       
            description "Accept All"                                            
            log disable                                                         
            p2p {                                                               
                all                                                             
            }                                                                   
            protocol all
            state {                                                             
                established enable                                              
                invalid enable                                                  
                new enable                                                      
                related enable                                                  
            }                                                                   
        }                                                                       
    }                                                                           
    name WAN_LOCAL {                                                            
        default-action accept                                                   
        description "WAN to router"                                             
        rule 1 {                                                                
            action accept                                                       
            description "Accept All"                                            
            log disable                                                         
            p2p {                                                               
                all                                                             
            }                                                                   
            protocol all                                                        
            state {                                                             
                established enable                                              
                invalid enable                                                  
                new enable
                related enable                                                  
            }                                                                   
        }                                                                       
    }                                                                           
    name WAN_OUT {                                                              
        default-action accept                                                   
        description "WAN to network"                                            
        rule 20 {                                                               
            action accept                                                       
            description "Accept All"                                            
            log disable                                                         
            p2p {                                                               
                all                                                             
            }                                                                   
            protocol all                                                        
            state {                                                             
                established enable                                              
                invalid enable                                                  
                new enable                                                      
                related enable                                                  
            }                                                                   
        }                                                                       
    }
    receive-redirects disable                                                   
    send-redirects enable                                                       
    source-validation disable                                                   
    syn-cookies enable                                                          
}                                                                               
interfaces {                                           
    ethernet eth0 {                                                             
        description WAN                                                         
        duplex auto                                                             
        firewall {                                                              
            in {                                                                
                name WAN_IN                                                     
            }                                                                   
            local {                                                             
                name WAN_LOCAL                                                  
            }                                                                   
            out {
                name WAN_OUT                                                    
            }                                                                   
        }                                                                       
        ip {                                                                    
        }                                                                       
        poe {                                                                   
            output off                                                          
        }                                                                       
        speed auto                                                              
    }                                                                           
    ethernet eth1 {                                                             
        description Comp1                                                  
        duplex auto                                                             
        poe {                                                                   
            output off                                                          
        }                                                                       
        speed auto                                                              
    }                                                                           
    ethernet eth2 {                                                             
        description Comp2                                                         
        duplex auto                                                             
        poe {                                                                   
            output off
        }                                                                       
        speed auto                                                              
    }                                                                           
    ethernet eth3 {                                                             
        description "NAS 172"                                               
        duplex auto                                                             
        poe {                                                                   
            output off                                                          
        }                                                                       
        speed auto                                                              
    }                                                                           
    ethernet eth4 {                                                             
        description "NAS 10"                                                 
        duplex auto                                                             
        poe {                                                                   
            output off                                                          
        }                                                                       
        speed auto                                                              
    }                                                                           
    ethernet eth5 {                                                             
        duplex auto                                                             
        speed auto                                                              
    }
    loopback lo {                                                               
    }                                                                           
    switch switch0 {                                                            
        address 172.16.0.1/16                                                   
        address 10.10.205.2/24                                                  
        address 10.10.205.11/24                                                 
        description Local                                                       
        firewall {                                                              
            in {                                                                
                name WAN_IN                                                     
            }                                                                   
            local {                                                             
                name WAN_LOCAL                                                  
            }                                                                   
            out {                                                               
                name WAN_OUT                                                    
            }                                                                   
        }                                                                       
        ip {                                                                    
            enable-proxy-arp                                                    
        }                                                                       
        mtu 1500                                                                
        switch-port {
            interface eth0 {                                                    
            }                                                                   
            interface eth1 {                                                    
            }                                                                   
            interface eth2 {                                                    
            }                                                                   
            interface eth3 {                                                    
            }                                                                   
            interface eth4 {                                                    
            }                                                                   
            vlan-aware disable                                                  
        }                                                                       
    }                                                                           
}                                             
port-forward {                                                                  
    auto-firewall disable
    hairpin-nat disable                                                         
    wan-interface eth0                                                          
}                                                                               
protocols {                                                                     
    static {                                                                    
    }                                                                           
}                                                                               
service {                                                                       
    dns {                                                                       
        forwarding {                                                            
            cache-size 150                                                      
            listen-on switch0                                                   
        }                                                                       
    }                                                                           
    gui {                                                                       
        http-port 80                                                            
        https-port 443                                                          
        older-ciphers enable                                                    
    }                                                                           
    nat {                                                                       
        rule 1 {                                                                
            description Comnp1                                              
            destination {
                address 10.10.205.11                                            
            }                                                                   
            inbound-interface switch0                                           
            inside-address {                                                    
                address 172.16.1.11                                             
            }                                                                   
            log disable                                                         
            protocol all                                                        
            type destination                                                    
        }                                                                       
        rule 2 {                                                                
            description Comp2                                                     
            destination {                                                       
                address 10.10.205.100                                           
            }                                                                   
            inbound-interface eth+                                              
            inside-address {                                                    
                address 172.16.1.100                                            
            }                                                                   
            log disable                                                         
            protocol all                                                        
            type destination                                                    
        }
        rule 5001 {                                                             
            description "172 Network"                                           
            exclude                                                             
            log disable                                                         
            outbound-interface switch0                                          
            protocol all                                                        
            source {                                                            
                group {                                                         
                    address-group 172network                                    
                }                                                               
            }                                                                   
            type masquerade                                                     
        }                                                                       
    }                                                                           
    ssh {                                                                       
        port 22                                                                 
        protocol-version v2                                                     
    }                                                                           
    unms {                                                                      
        disable                                                                 
    }                                                                           
}                                                                               
system {
    gateway-address 10.10.205.1                                                 
    host-name ubnt                                                              
    ip {                                                                        
        arp {                                                                   
            table-size 8192                                                     
        }                                                                       
    }                                                       
    static-host-mapping {                                                       
    }                                                                           
    syslog {                                                                    
        global {                                                                
            facility all {                                                      
                level notice                                                    
            }                                                                   
            facility protocols {                                                
                level debug                                                     
            }                                                                   
        }                                                                       
    }                                                                           
    time-zone America/Chicago                                                   
    traffic-analysis {                                                          
        dpi disable                                                             
        export disable                                                          
    }                                                                           
}             

Guys,

I recently followed this guide to configure my EdgeMax ERLite‑3 to use OpenVPN for working with VPN services provider IPVanish. The set up has been quite successful and I can confirm all my network traffic is now being routed through IPVanish. My configuration uses a single internal network rather than two that the guide deals with but that should make no difference for the purpose of this query.

However, as several members have already pointed out, this kind of a setup is a bandwidth killer. In my case, speeds have taken a severe beating with my download having plummeted from 220 Mbps to just about 8 Mbps or so over the VPN. Also, the router CPU is maxed out at 8 Mbps. Clearly, that's a deal breaker.

I understand there are at least 2 alternative ways to connect to IPVanish viz L2TP/IPsec and PPTP. Of these PPTP, I believe, is not quite secure (though I am not aware of the exact deficiencies) and therefore I am down to trying out L2TP/IPsec. But despite an intense googling effort, I can't seem to find a definitive guide to setting up L2TP/IPsec on an ER-X router.

My questions to the community are:

1. Is there a way to stick to OpenVPN and still have speeds of 50 Mbps or more?
2. Is it possible to set up L2TP/IPsec to IPVanish on an ER-X?
3. If so, can someone please point me to some instructions on how to achieve it?
4. If at all IPsec works, what kind of bandwidths can I expect?
5. How does L2TP/IPsec compare with PPTP when it comes to security?

Your thoughts are most appreciated. Thanks in advance.

Regards,

Utopia

Hi Everyone! 

I have old virtual pfsense firewall which i havent upgraded! :-( (i know naughty me!) The reason i havent touched it is, is because like Edgemax its just floorless! it just works! Its pure amazing! 

So... i am looking to upgrade! and debating to go to Edgemax! 

So is there any benefit from moving from a virtual firewall to a physical Edgemax Pro? 

Really not sure what to do! I use Edgemax everywhere for my customers that need a physical appliance! And Edgemax is my perfence of choice every time, when it comes to hardware! 

I am a lover of pfsense, but where it makes sense! especially in the virtual world.  UBNT is pretty cool as well! in terms of performance etc! Thin OS, based on Vyetta! some commands any guru would recognize! 

So im on the fence with what i should do! 

Any help to decide from anyone would be good! 

Is it possible to configure eth0 to allow traffic through for a VLAN that is set up on another port (port 7 in this case)?  I have my backhaul in eth0 which provides my service connection and use a managment VLAN on port 7 that I would like to monitor that BH with.

We have a second ER-8 that we want to configure a backup for cold failover. We've done this in the past with other brands of routers, but not sure how best to do it with the ER-8. Basically, what I want, is 2 routers that are exactly the same except for the IP address of one of the ethernet ports (the one we refer to as Local) - so that that the router can be online and accessible to allow for firmware updates and to be able to keep it current with the primary.

Right now, the only way I can think to do this is:

1. Get the most current config (.gz file)
2. Extract that (to a TAR file, but has no extension)
3. Extract that
4. Edit config.bot and change eth2 address to 192.168.0.18/24
5. Tar that folder
6. Gzip that folder (have to find a tool that can do this one Windows)
7. Upload and hope for the best

Is there a better way?

Since my upgrade to 1.10 my logs have started filling up with the following errors, didn't see these at all in previous versions, and so far I have not seen any performace issues from them. Have attached a full log and config to help.

Error:

Feb 10 08:02:44 ERL-Home kernel: skbuff: Gotcha2 800000041c9dc000 800000041c9dc142 -4

Feb 10 08:02:44 ERL-Home kernel: CPU: 0 PID: 0 Comm: swapper/0 Tainted: P           O 3.10.107-UBNT #1

Feb 10 08:02:44 ERL-Home kernel: Stack : 00000000000000a8 0000000050008ce1 0000000000200000 0000000000000007

Feb 10 08:02:44 ERL-Home kernel:          0000000000000000 0000000000000000 ffffffffc0660000 00000000000000a8

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc064ec58 ffffffffc0520000 00000000000000a8 302e3130372d5542

Feb 10 08:02:44 ERL-Home kernel:          0000000000000005 ffffffffc0651b18 ffffffffc0660000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          800000041d4c8980 fffffffffffffffc 800000041cafd000 800000041c9dc142

Feb 10 08:02:44 ERL-Home kernel:          0000000000000040 0000000000000000 0000000000000001 800000041cafd000

Feb 10 08:02:44 ERL-Home kernel:          0000000000000005 0000000000000001 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc04dc000 ffffffffc04df760 0000000000000000 ffffffffc032423c

Feb 10 08:02:44 ERL-Home kernel:          ffffffffc050ff60 ffffffffc0484d88 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          0000000000000000 ffffffffc006f0a4 0000000000000000 0000000000000000

Feb 10 08:02:44 ERL-Home kernel:          ...

Feb 10 08:02:44 ERL-Home kernel: Call Trace:

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc006f0a4>] show_stack+0x6c/0xf8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc032423c>] skb_push+0xa4/0xb0

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc03d93a4>] packet_rcv+0xdc/0x4c0

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc032e7b0>] __netif_receive_skb_core+0x498/0x8c8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc03329b8>] netif_receive_skb+0x28/0xa8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc087fac8>] cvm_oct_napi_poll_38+0x4d0/0xa70 [octeon_ethernet]

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0333230>] net_rx_action+0x228/0x2b8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0095294>] __do_softirq+0x1dc/0x228

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc00953b0>] do_softirq+0x68/0x70

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc0095a80>] irq_exit+0x70/0x80

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc00073a4>] plat_irq_dispatch+0x4c/0xd8

Feb 10 08:02:44 ERL-Home kernel: [<ffffffffc006a834>] handle_int+0x114/0x11c

Feb 10 08:02:44 ERL-Home kernel: