Port Forwarding with Private Internet Access VPN Service

I had a hard time finding details on how to setup port forwarding with Private Internet Access so I wanted to share the details on how to set it up on a Debian system. The following directions will help you find your local IP access, request a port from Private Internet Access for Port Forwarding, configure your local firewall to allow inbound connections, and confirm that your application is listening on the specified port.

Here is a overview of the network topology with a remote user requesting to talk to your machine at home over the VPN connection to Private Internet Access with Port Forwarding setup on port 12345.

2014-10-22_port_forward_detail

  1. Obtain the VPN IP address by looking at the IP addresses in ifconfig. On my machine, the interface is a tun0 interface.
  2. Create a unique client ID with head -n 100 /dev/urandom | md5sum | tr -d ” -” > ~/.pia_client_id
  3. Request a port for port forwarding with curl -d “user=your_username&pass=your_password&client_id=$(cat ~/.pia_client_id)&local_ip=10.xxx.xxx.xxx” https://www.privateinternetaccess.com/vpninfo/port_forward_assignment
  4. Modify firewall to allow inbound traffic with sudo iptables -A INPUT -p tcp –dport 12345:12345 -j ACCEPT
  5. Set your application to listen on port 12345
  6. Confirm that your application is listening with sudo netstat -anp | grep 12345

Advanced Light Source User Meeting

I was at the Advanced Light Source User Meeting as a representative of LBLnet today talking about the architecture of the Science DMZ to enable big data transfers across the WAN. We had an elegant poster that showed how the DMZ architecture fits into the enterprise design. There are still groups that are saving large data sets to hard drives and shipping them to the destination location rather than attempting to utilize the network and we want to help change that paradigm.

Credit for the majority of the design goes to my co-worker Michael at smitasin.com.

IMG_0199

IMG_0200

TP-LINK Powerline Adapter Performance

For the longest time I would never advocate Poweline Ethernet as a viable solution for getting connectivity into a troublesome area. I felt that the technology was prone to interference and therefore an unreliable solution that could never deliver a consistent connection.

After a few failed attempts to trace Cat5 cable into the garage in my San Francisco apartment in order to connect two pairs to get 100MBPS connectivity between the front and back of the apartment, I decided to try out a Powerline Ethernet solution. I picked up a pair of TP-LINK 200Mbps units and was surprised at the setup procedure. It was fairly easy and I had the units connected in under five minutes.

Of course I wanted to test performance so I started to graph latency to the wireless router on the other side of the apartment.

2014-07-07_device_ping

An iperf test also showed a solid 28.9 Mbits/second transfer rate.

C:\tools>iperf -c 10.10.1.27 -p 200 -t 120
------------------------------------------------------------
Client connecting to 10.10.1.27, TCP port 200
TCP window size: 8.00 KByte (default)
------------------------------------------------------------
[156] local 10.10.1.60 port 58742 connected with 10.10.1.27 port 200
[ ID] Interval       Transfer     Bandwidth
[156]  0.0-120.0 sec   413 MBytes  28.9 Mbits/sec

C:\tools>

Overall I’ve been impressed by the performance and now have Ethernet extended to the other half of the apartment. Not bad for a $30 connectivity solution.

Junos Optical Power Display Bug

EX-2200 and EX-3300 series switches running 12.3R3.4 have a bug where Receiver signal average optical power values don’t display correctly. The recommended version that contains a fix for this bug is12.3R4-S1. We’ve tested this update on a few switches and it had resolved the bug.

12.3R3.4:

user@j33s> show interfaces diagnostics optics ge-0/1/0
Physical interface: ge-0/1/0
Laser bias current : 5.566 mA
Laser output power : 0.2820 mW / -5.50 dBm
Module temperature : 31 degrees C / 88 degrees F
Module voltage : 3.3680 V
Receiver signal average optical power : 0.0000 mW / - Inf dBm

12.3R4-S1:

user@j33> show interfaces diagnostics optics ge-0/1/0
Physical interface: ge-0/1/0
Laser bias current : 5.508 mA
Laser output power : 0.2810 mW / -5.51 dBm
Module temperature : 31 degrees C / 88 degrees F
Module voltage : 3.3680 V
Receiver signal average optical power : 0.2811 mW / -5.51 dBm

Blocking CDP in Junos

Cisco Discovery Protocol (CDP) is an invaluable protocol that was created to ease troubleshooting by providing remote device identification. On multi-vendor networks, the use of this propitiatory protocol can cause headaches as it may pass though non-Cisco equipment and falsely identify remote devices. We’ve instituted a standard it to use the Link Layer Discovery Protocol (LLDP) in favor of CDP.

To help clean up excess multicast traffic, we’ve applied the following filter on our Juniper devices that face Cisco equipment.

Lab Topology

Cisco Catalyst connected to an EX switch over a LACP connection. The filter gets applied to the native vlan, which in my lab testing is was vlan 1. 2014-06-11 CDP Blocking

Firewall Filter

Use the load merge terminal command to easily import the following filter. The count cdp-count term is optional and you may find that you have no use for it.

firewall {
    family ethernet-switching {
        filter block-cdp {
            term block-cdp {
                from {
                    destination-mac-address {
                        01:00:0c:cc:cc:cc/48;
                    }
                }
                then {
                    discard;
                    count cdp-count;
                }
            }
            term traffic-allow {
                then accept;
            }
        }
    }
}

Use filter counters to confirm that the filter is being hit or confirm by issuing a show cdp neighbors command on your Cisco devices.

root> show firewall filter block-cdp

Filter: block-cdp
Counters:
Name                                                Bytes              Packets
cdp-count                                            4760                   24

Cisco Live 2014

This was my first year at a Cisco Live and I was truly amazed. The caliber of the speakers, the venue, and atmosphere makes the event well worth attending.

Schedule

TECCRS-2932 — Campus LAN Switching Architecture
BRKSPG-2206 — Towards Massively Scalable Ethernet: Technologies and Standards
BRKRST-2044 — Enterprise Multi-Homed Internet Edge Architectures
PSODCT-1407 — Building Highly scalable 40/100G Fabrics with Nexus 7700
BRKARC-2350 — IOS Routing Internals
BRKRST-3321 — Advanced – Scaling BGP
BRKOPT-2116 — High Speed Optics 40G, 100G & Beyond – Data Center Fabrics & Optical Transport
BRKSEC-2003 — IPv6 Security Threats and Mitigations

Exams

CCNP Switch (642-813) *passed*

Pictures

IMG_20140519_124557IMG_20140519_123527IMG_20140522_084855IMG_20140522_084813

IMG_20140523_090902

20140522_140817