Simple shut-off scripting

I had a client today who is doing some manual things as they are using Quickbooks for billing and such.  One thing they kind of struggle with is turning off people for non-payment and such.  Their current method is adding a que and throttling someone to a low-speed to make them call.  Their network is a routed network utilizing DHCP to the CPE at the customer.  Everything is in router mode and they control the addressing of the units via DHCP reservations.  So how do we make this better without adding radius and all kinds of stuff into the network?

First we set up a web-proxy

/ip proxy
set enabled=yes port=8089

/ip proxy access
add dst-host=mtin.net dst-port=80
add dst-host=*.mtin.net dst-port=80
add dst-port=53
add action=deny redirect-to=www.mtin.net

What the above code does is says anyone coming into the proxy is only allowed to go to mtin.net (used our domain as an example), use port 53 (DNS), and anything else gets redirected to www.mtin.net. We chose port 53 because they are in the process of cleaning up some of the radios and such which are using 8.8.8.8 and other DNS servers.

Next we set up a nat rule

/ip firewall nat
add action=redirect chain=dstnat dst-port=80 protocol=tcp src-address-list=\
SHUTOFF to-ports=8089

This nat rule says anyone making a port 80 request coming from our SHUTOFF address-list gets redirected to port 8089 (our proxy port setup earlier).

Our third step is to setup our address list. this is very straightforward.  Just modify and add users to this list when they are to be turned off.

/ip firewall address-list
add address=10.20.0.192 list=SHUTOFF

Lastly, we add a filter rule which denies the SHUTOFF folks from using anything except port 53 and port 80.  We do this because we can’t proxy port 443 and other SSL traffic. If folks go to a HTTPS site it simply fails.  This is a drawback of using a web-proxy.

/ip firewall filter
add action=drop chain=forward dst-port=!53,80 protocol=tcp src-address-list=\
SHUTOFF

If you have an SSL payment gateway you can modify your filter rules to allow traffic to it. This is just one quick and dirty way of letting customers know they have been turned off.

Leap second to be added in 2016

http://www.space.com/33361-leap-second-2016-atomic-clocks.html

A “leap second” will be added to the world’s official clocks on Dec. 31 at 23 hours, 59 minutes and 59 seconds Coordinated Universal Time (UTC), which corresponds to 6:59:59 p.m. EST; the clocks will read 23:59:60 before ticking over to midnight. The goal is to keep two different timescales in sync with each other.

So, why is this important to you as an ISP?
The trouble is that even as they use the leap second, UNIX and Linux define a day as something that is unvarying in length. “If a leap second happens, the operating system must somehow prevent the applications from knowing that it’s going on while still handling all the business of an operating system,” says Steve Allen, a programmer with California’s Lick Observatory.
Source:http://www.wired.com/2015/01/leap-second-rattle-internet-theres-plot-kill/

Many patches and fixes have been put in place to adjust for this in most Operating systems.  The concern, even a year after the last one, is software that has not been updated to account for dealing with leap seconds.

Mimosa G2 first look

So Scott @ On-Ramp Indiana ordered a few of these and figured I would borrow one for a few days and do a first look and review on them.

Mimosa G2 Box

Nice and compact box.  I am a fan of the cover.  If this way on a store shelf I would notice.

G2 Insert
The very first thing you see is this wireless information card. Very handy for the home user. Many of my clients throughout the years save such things so having this in a bright card is a nice touch.  Another nice feature of this card is it has sticky tape on the back.  You can actually peel it off and stick it somewhere.  Not everyone has a network rack, so affixing it to there might not be the best bet.  We are in the day and age where there are not “telephone stations”.  The only thing I could come up with might be in a desk drawer or something like that.  I could see guests asking for the key so you would want this handy.  Any thoughts on a good place to put this?

Information Card
On the back of the card is a very handy diagram on the 3 modes of this device.  You can use it as a Wifi router. You can also use it as a repeater.  In this mode it works both wired and wireless.  As with some other manufactures it will auto-configure itself to join in with the rest of the network.  It learns the configuration and away it goes.  Thirdly, is a simple pass through mode. This is helpful if there is another router involved.

G2 contents
The box contained the unit, a slip on power plug, and the compliance paperwork no one reads. Thank you Lawyers.  One of the first things I noticed about this unit is the well made feel to it.  The plastic does not feel cheap, and it feels heavy.  That is always a scientific measure right?

G2 Ports
Mimosa has done a good job of helping the uneducated user on the use of this product.  A good example of this is plug, which is in the POE port.  This plug takes a little bit of effort to remove.  As you can see in the picture, it is also marked with a red label to distinguish this from the customer side.  This is so the customer doesn’t feed 48 volt to their router, laptop or whatever gets plugged in.

IMG_3553
Also, you have holes on the top and bottom for cooling.  On the side is a very easy to get to reset button. Another nod to Mimosa paying attention to common issues home users run into is there is a very clear sticker on the top of the unit which has the Home network SSID and passphrase on it.  A user can simply walk to the unit, look down and easily read the needed information.

G2 Plug

The power plug simply slides in a groove and snaps in place.  Nice clean setup.

In closing, my first impressions of this product are positive.  Packaging and instructions are put together well and easy to understand. The product feels good and has a good number of things to address common issues. Look for part two of this for a look of how this actually works, configuration, and testing.

If you are a manufacturer and have a product you think we would be interested in reviewing please contact us.

Default vs specified config

When setting up a device, especially a network router, you often have the option to leave things “default”. What does this really mean and what effect does it have on your network?

What you are basically saying when you leave something as default is “let the router determine what to do”.

This can be a problem when the default behavior changes. This is most often changed when going from one software version to another. Maybe someone determined that leaving a particular option enabled was no ideal. Maybe it caused issues, or is now being replaced by a different way of doing things.

Sometimes default configs are designed to make the product easier to configure.  This is typically true of many consumer based devices. The company wants you to have a good experience and not have to call them for technical support.

Keep these things in mind when you see a checkbox or something that says “default”.

Helpful outages web-site for network admins

http://www.outages.org/

Direct from their web-site.

How to Report
By sending a tweet with any of the following hashtag/s:
#outages
#outage
#cablecut
#fibercut
#undersea

when reporting for a service outage. Once verified we will plot it on tracker.

For e.g. #outage #loc (street, city – location name) #start (time), followed by #back (time)#planned or #unplanned (if its a planned or unexpected outage).

Download the iOS/iPhone/iPad App “Ushahidi” and add http://tracker.outages.org/ to “Settings” to start reporting.
Download the Android App “Ushahidi” and add http://tracker.outages.org/ to “Settings” to start reporting.
By sending an email:
outages@outages.org
Click to View Reports

Send comments/feedback/feature requests tovirendra[dot]rode[at]outages.org

Follow us on Twitter @outagesdotorg

Help spread the word!

Calea and the ISP

The Communications and Law Enforcement Act (CALEA) passed in 1994 is a piece of legislation every U.S. ISP should know about and be in compliance with.  If for the simple fact the government can levy heavy fines if you aren’t compliant.

For those of you wanting some background please follow these links:
https://en.wikipedia.org/wiki/Communications_Assistance_for_Law_Enforcement_Act

https://www.fcc.gov/public-safety-and-homeland-security/policy-and-licensing-division/general/communications-assistance

First of all CALEA isn’t simply sticking wireshark onto your network and sending a packet dump to a law enforcement agency. It is much more complicated than that. You have several things which the CALEA standard addresses.

1.The ability to send multiple streams, in real time, to different law enforcement agencies.
2.The ability to not interrupt the connection to a person of interest.  In other words you don’t want to interrupt their connection to insert a piece of hardware.
3.The ability to provide just the information on the warrant.  Too much information can actually violate the court order.
4.There is a difference between a typical “request for information” warrant and a CALEA request.  These are not the same.  CALEA almost always comes from a federal agency. They are expecting you to be compliant with CALEA.

Now, here is where things get a little subjective.  The FBI has https://askcalea.fbi.gov/ which is linked from the above fcc.gov web-site.  The askcalea web-site has not been updated since 2011.  The service provider login and service provider registration simply does not work. The information about CALEA is pretty outdated.

So what does this mean for you as a small ISP? Stay tuned for more information.

MTIN introduces Mnet service for Mikrotik and Ubiquiti routers

MTIN is excited to announce our newest support offering, Mnet. Mnet allows customers using Milkrotik and Ubiquiti routers an option of a tiered support level on a per device basis. This allows customers a guaranteed support level at a fixed price. This is an enterprise level support option for critical infrastructure.

The way Mnet works is a customer purchases one of our tiered plans below. They register the serial number with us and we simply provide the paid level of support on that device. This support includes technical support on that device as well as the services included with the purchased Tier.

Tier I (Overwatch) $199 per year (only $16 per month)
This tier is designed for the user who needs the occasional support but wants to make sure things like backups and software are being looked after.

  • Basic Remote monitoring & notification of device
  • Software notification of upgrades and personalized recommendations on needed action.
  • Monthly configurations backup to online secured storage
  • Next business day support of issues.
  • Hardware replacement option available
  • Initial configuration review

Tier II (Operator) $399 per year (only $34 per month)
This tier is for the user who needs that extra bit of help when it comes to configuration and wants an extra set of eyes.
Tier II includes all of the Tier I services and adds

  • Weekly configuration backup via e-mail and online secured storage
  • Enhanced monitoring & notification of devices
  • Same business day support (6 hour maximum lead time)
  • Weekend and holiday support (6 hour maximum lead time)
  • Discount on consulting services

Tier III (Spec Ops) $599 per year (only $50 per month)
This tier is for absolute mission critical devices.
Tier III includes all of the previous tiers and adds

  • Same day business support (2 hour maximum lead time)
  • Weekend and holiday support (3 hour maximum lead time)
  • Weekly backups of configuration via e-mail and online secured storage
  • Quarterly review and recommendations on configuration

 

FAQ:

Do I have to get this on every device?
No, we recommend this on your critical routers or routers doing advanced services such as BGP or core routing functions.

Does this replace your normal consulting services?
No. This is an add-on to our consulting services. We find we have customers who need help with certain aspects of their network and this fills that gap.

Can I get quantity discounts?
Yes, contact us for a quote

I want to upgrade my router. How will this affect mNET?
We would simply transfer your support contract from the old device to the new one. Upgrade support is included.

What configuration support is included?
Technical support including configuration and troubleshooting is included on supported devices. Other devices can be included at our normal hourly consulting rate.

Do you make changes?
All changes are explained and signed off by customer before being implemented. Changes are done during an agreed upon maintenance window with a change management process.

How do I obtain support?
Customer is provided a login to the MTIN portal. Online tickets are the best method for opening a case. Telephone support is also included, but tickets are normally quicker.

How does the lead time work?
MTIN strives to meet customer expectations. Lead times are the maximum amount of time it will take. Some days this time may be measured in minutes, other times it may be longer.

Do you cover other devices?
Yes, we have plans for AirFiber, Mimosa, and other platforms.

Can I upgrade to a higher Tier?
yes, However it will take 3 business days for upgrades to process. During this time your Tier level will remain the same.

How is payment handled?
Payment is due at device registration.

Can I pay monthly?
No. If you need occasional support please see about hourly consultation services.

If you would like more information please fill out the form below.

Why every ISP should be deploying hAP Lite to customers

So Mikrotik has a very cheap hAP Lite coming out.   This is a 4 port, 2.4 b/g/n router/access point which retails for $21.95. Baltic networks has pre-orders for $18.95.

Why should you deploy this little gem and how? We have found over the years routers account for more than half of the support issues. In some networks this number is closer to 80-90%. Whether it be a substandard router, one with out of date firmware, or poor placement by the customer.

Deployment of the hAP lite can be approached in one of two ways.  Both ways accomplish the same goal for the ISP. That goal is to have a device to test from that closely duplicates what the customer would see. Sure you can run tests from most modern wireless CPE, but it’s not the same as running tests m the customer side of the POE.

Many ISPs are offering a managed router service to their customers.  Some charge a nominal monthly fee, while others include it in the service.  This is a pretty straightforward thing.  The customer DMARC becomes the wireless router.  The ISP sets it up, does firmware updates, and generally takes care of it should there be issues.  The managed router can be an additional revenue stream in addition to providing a better customer experience.  Having a solid router that has been professionally setup by the ISP is a huge benefit to both the provider and the customer.  We will get into this a little later.

Second option lends itself better to a product such as the hAP lite. With the relative cheap cost you can install one as a “modem” if the customer chooses their own router option.  The actual method of setup can vary depending on your network philosophy.  You can simply bridge all the ports together and pass the data through like a switch.  The only difference is you add a “management ip” to the bridge interface on your network. This way you can reach it.  Another popular method, especially if you are running PPPoE or other radius methods, is to make the “modem” the PPPoE client.  This removes some of the burden from the wireless CPE onto something a little more powerful.   There are definite design considerations and cons for this setup.  We will go into those in a future article. But for now let’s just assume the hAP is just a managed switch you can access.

So what are the benefits of adding one of these cheap devices?
-You can run pings and traceroutes from the device.  This is helpful if a customer says they can’t reach a certain web-site.
-Capacity is becoming a larger and larger issue in the connected home.  iPads, gaming consoles, tvs, and even appliances are all sharing bandwidth.  If you are managing the customer router you can see the number of connected devices and do things like Torch to see what they are doing. If a customer calls and says its slow, being able to tell them that little Billy is downloading 4 megs a second on a device called “Billy’s xbox” can help a customer. It could also lead to an upsell.
-Wireless issues are another huge benefit.  If the customer bought their own router and stuck it in the basement and now their internet is slow you have a couple of tricks to troubleshoot without a truck roll.  If the hAP is in bridge mode simply enable the wireless, setup an SSID for the customer to test with and away you go.  This could uncover issues in the house, issues with their router, or it might even point to a problem on your side.
-Physical issues and ID10T errors can be quickly diagnosed.  If you can’t reach your device it’s either off or a cabling issue.  If you can reach the hAP and the port has errors it could be cabling or POE.

These are just a few benefits you can gleam from sticking a $20 Mikrotik device on your customer side network. It becomes a troubleshooting tool, which makes it money back if it saves you a single truck roll. The implementation is not as important as having a tool closer to the customer.  There several vendoars you can order the hAP lite from.  Baltic Networks is close to me so they are my go-to.  http://www.balticnetworks.com/mikrotik-hap-lite-tc-2-4ghz-indoor-access-point-tower-case-built-in-1-5dbi-antenna.html .

This isn’t practical for business and Enterprise customers, but you should already be deploying a router which has these features anyway right? 🙂