Bandwidth Traffic Monitoring on FREEBSD

 Ada banyak tool buat monitoring lalu-lintas trafik yg lewat router FreeBSD diantaranya :

systat -ifstat

tcpdump 

netstat 1

bmon

trafshow

trafshow3

iftop

vnstat

dll...

Semoga berguna :))

Continue

Create Loopback Interface FREEBSD

Interface loopback adalah interface internal dalam sebuah router, fungsinya sebagai pref-source untuk mendefinisikan atau mengidentifikasi router itu sendiri. Diantara manfaat penggunaan loopback ip public ini diantaranya :

• hemat ip public, karena point to point peer bgp bisa menggunakan ip private
• jika ada peer bgp yang multipath, dapat berganti ganti dengan tetap mengidentifikasi berdasarkan ip yang tertanam pada interface loopback tadi
• dapat digunakan untuk trobelshoting seperti ping / tracert dengan mencantumkan preference source
• dll.

root@BSDRouter:~ # ifconfig lo1
ifconfig: interface lo1 does not exist
root@BSDRouter:~ # ifconfig lo1 create
root@BSDRouter:~ # ifconfig lo1 up
root@BSDRouter:~ # service netif start lo1
Starting Network: lo1.
lo1: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
        options=680003<RXCSUM,TXCSUM,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
        inet 103.166.11.103 netmask 0xffffffff
        groups: lo
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

jangan lupa simpan biar permanen di /etc/rc.conf

ifconfig_lo1_alias1="inet 103.166.11.103/32"
ifconfig_lo1="up"

Continue

Catatan Bird Config (BIRD.CONF)

Berikut isi file /usr/local/etc/bird.conf 

# Configure logging
log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };
log stderr all;
#log "tmp" all;

# Override router ID
router id 10.60.60.2;
protocol kernel {

#       learn;                  # Learn all alien routes from the kernel
        persist;                # Don't remove routes on bird shutdown
        scan time 20;           # Scan kernel routing table every 20 seconds
#       import none;            # Default is import all
        export all;             # Default is export none
#       kernel table 5;         # Kernel table to synchronize with (default: main)
}

# This pseudo-protocol watches all interface up/down events.
protocol device {
        scan time 10;           # Scan interfaces every 10 seconds
}

# Static routes (again, there can be multiple instances, so that you
# can disable/enable various groups of static routes on the fly).
protocol static {
#       disabled;               # Disable by default
#       table testable;         # Connect to a non-default table
#       preference 1000;        # Default preference of routes
#       debug { states, routes, filters, interfaces, events, packets };
#       debug all;
#       route 0.0.0.0/0 via 198.51.100.13;
#       route 198.51.100.0/25 unreachable;
#       route 10.0.0.0/8 unreachable;
#       route 10.1.1.0:255.255.255.0 via 198.51.100.3;
#       route 10.1.2.0:255.255.255.0 via 198.51.100.3;
#       route 10.1.3.0:255.255.255.0 via 198.51.100.4;
#       route 10.2.0.0/24 via "arc0";
        route 103.166.141.0/32 via 10.60.60.1;
}

protocol bgp CCR1036 {
        #disabled;
        description "BGP Peer to CCR1036";
        local as 65530;
        neighbor 10.60.60.1 as 139967;
        import filter {
        ##jika no label maka kasih label 65000:5678
        # bgp_community = -empty-; bgp_community = add(bgp_community,(65000,5678));

        ##jika terima aspath 7717 maka kasih tag 50310:7717
        if bgp_path ~ [= * 7717 * =] then
                bgp_community = add(bgp_community,(50310,7717));
        if bgp_path ~ [= * 7597 * =] then
                bgp_community = add(bgp_community,(50310,7597));
        ##jika origin AS7713 maka kasih tag 50310:7713
        if bgp_path ~ [= * 7713 =] then
                bgp_community = add(bgp_community,(50310,7713));
        ##contoh reject AS20940
        #if bgp_path ~ [= * 20940 * =] then reject;
        ##contoh reject prefix 45.126.184.0/22 saja
        #if net ~ [ 45.126.184.0/22 ] then reject;
        ##contoh reject prefix 45.126.184.0/22 sampai prefix terkecil
        #if net ~ [ 45.126.184.0/22+ ] then reject;
        ##contoh reject prefix 45.126.184.0/22 sampai prefix terkecil (cara lain)
        #if net ~ 45.126.184.0/22 then reject;
        ##contoh reject prefix 36.90.0.0/16 sampai prefix terkecil
        #if net ~ 36.90.0.0/16 then reject;
        ##yg matching bgp community 50310:17451 ditambahkan tag 39967:17451
        if (50310,17451) ~ bgp_community then bgp_community.add((39967,17451));
        ##selain diatas maka accept
        accept;
        };
}

Berikut CheatSet untuk trobelshoting masalah routing bgp

root@BSDRouter:~ # birdc
BIRD 1.6.8 ready.
bird> show protocols
name     proto    table    state  since       info
kernel1  Kernel   master   up     23:07:34
device1  Device   master   up     23:07:34
static1  Static   master   up     23:07:34
CCR1036  BGP      master   up     04:44:52    Established
bird>

bird> show protocols all CCR1036
name     proto    table    state  since       info
CCR1036  BGP      master   up     04:44:52    Established
  Description:    BGP Peer to CCR1036
  Preference:     100
  Input filter:   (unnamed)
  Output filter:  REJECT
  Routes:         20994 imported, 0 exported, 20994 preferred
  Route change stats:     received   rejected   filtered    ignored   accepted
    Import updates:         231033          0         18     206404      24611
    Import withdraws:         1430          0        ---       1408         40
    Export updates:          24612      24611          1        ---          0
    Export withdraws:           40        ---        ---        ---          0
  BGP state:          Established
    Neighbor address: 10.60.60.1
    Neighbor AS:      139967
    Neighbor ID:      103.146.185.254
    Neighbor caps:    refresh AS4
    Session:          external AS4
    Source address:   10.60.60.2
    Hold timer:       138/180
    Keepalive timer:  3/60

bird> show route where net ~ 45.126.184.0/22 all

45.126.185.0/24    via 10.60.60.1 on vlan605 [CCR1036 05:24:46] * (100) [AS17451i]
        Type: BGP unicast univ
        BGP.origin: IGP
        BGP.as_path: 139967 17451
        BGP.next_hop: 10.60.60.1
        BGP.local_pref: 100
        BGP.community: (0,32934) (17451,7033) (50310,17451) (39967,17451)
45.126.184.0/24    via 10.60.60.1 on vlan605 [CCR1036 05:24:45] * (100) [AS17451i]
        Type: BGP unicast univ
        BGP.origin: IGP
        BGP.as_path: 139967 17451
        BGP.next_hop: 10.60.60.1
        BGP.local_pref: 100
        BGP.community: (0,32934) (50310,17451) (39967,17451)
45.126.184.0/22    via 10.60.60.1 on vlan605 [CCR1036 05:24:46] * (100) [AS17451?]
        Type: BGP unicast univ
        BGP.origin: Incomplete
        BGP.as_path: 139967 17451
        BGP.next_hop: 10.60.60.1
        BGP.local_pref: 100
        BGP.atomic_aggr:
        BGP.aggregator: 182.253.99.245 AS17451
        BGP.community: (0,32934) (50310,17451) (39967,17451)

bonus aspath delete :

##bgp cut aspath 139967
if (bgp_path ~ [= 139967 * =]) && (bgp_path.last != 139967) then
bgp_path.delete(139967);

##bgp cut aspath 139967 dan 7717
if (bgp_path ~ [= 7717 * =]) then
bgp_path.delete(7717);

Semoga berguna :))

Continue

Create Delete VLAN FreeBSD 12.3-Stable

Sebelumnya, load dulu kernel buat vlan
vi /boot/loader.conf

if_vlan_load=YES

Setelah itu reboot. Sebelum create vlan, perhatikan root interface/ethernet nya apa, di sini saya kasih contoh mlxen0 (Mellanox ConectX-3) 2 Port 40Gbps, ini port manteb bgt buat deploy router. Oh iya, cara load driver nya begini :

kldload mlx4en

Itu hanya bersifat sementara, kalau mau permanen, tambahkan script di /boot/loader.conf lalu reboot

mlx4en_load="YES"

Sekarang tips buat vlan interface. Untuk freebsd versi terbaru, crate vlan lebih mudah, contoh :

root@BSDRouter:~ # ifconfig vlan605 create

root@BSDRouter:~ # ifconfig vlan605 vlan 605 vlandev mlxen0

root@BSDRouter:~ # ifconfig vlan605 inet 10.70.70.2 netmask 255.255.255.252

root@BSDRouter:~ # ifconfig vlan605

vlan605: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500

        options=680703<RXCSUM,TXCSUM,TSO4,TSO6,LRO,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>

        ether 00:02:c9:a3:0d:21

        inet 10.70.70.2 netmask 0xfffffffc broadcast 10.70.70.3

        groups: vlan

        vlan: 605 vlanpcp: 0 parent interface: mlxen0

        media: Ethernet autoselect (40Gbase-CR4 <full-duplex,rxpause,txpause>)

        status: active

        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

Lalu, kalau ingin destroy cukup ketikkan begini:

ifconfig vlan605 destroy

Kalau ingi disable vlan, ketikkan gini :

ifconfig vlan605 down

ok, itu hanya bersifat temporary. Kalau pengen kesimpen dan di load saat booting, pasang script di /etc/rc.conf

cloned_interfaces="vlan605"
ifconfig_vlan605="inet 10.60.60.2 netmask 255.255.255.252 vlan 605 vlandev mlxen0"
ifconfig_mlxen0="up"

setelah itu save, kemudian eksekusi :

service netif restart

Semoga Berguna :-)

Continue

 [cara enlarge]

# lvextend -r -l +100%FREE /dev/mapper/centos-root

Continue

cara membuat https librenms

Sebelum masuk ke tutorial, berikut cara mount image librenms berbentuk ova yang akan di add disk ke vm proxmox.

pertama-tama, download di proxmox, path bebas

axel https://github.com/librenms/packer-builds/releases/download/21.2.0/librenms-ubuntu-20.04-amd64.ova

kemudian estrak isinya

tar -xvf librenms-ubuntu-20.04-amd64.ova

kemudian convert menjadi qcow2

qemu-img convert -f vmdk librenms-ubuntu-20.04-amd64-disk001.vmdk -O qcow2 disk-librenms.qcow2

setelah itu silahkan bikin VM seperti biasa, disk bebas, kecil aja toh nanti juga didelete. Setelah itu silahkan di delete disk nya. kemudian lakukan add-disk dari file disk-librenms.qcow2 yang abis diconvert tadi

qm importdisk 104 disk-librenms.qcow2 TAMMUZ

sebagai catatan, di sini saya bikin VM dengan ID 104 dan dengan nama LVM TAMMUZ

setelah itu, sesuai arahan dari situs ini : https://docs.librenms.org/Installation/Images/
ganti passwordnya, config netplan sbb :

network:

   version: 2

   ethernets:

      ens18:

         addresses:

            - 103.146.xxx.xxx/29

         gateway4: 103.146.xxx.xxx

         nameservers:

            addresses: [ 103.146.xxx.xxx ]

kemudian

netplan apply

coba login web, trus ganti passwordnya jangan lupa.
pointing IN A biar lebih mudah diakses lewat domain anda.

sekarang langkah membuat certbot
pertama tama install snapd

apt install snapd -y

abis itu 

root@librenms:~# snap install core

core 16-2.51.1 from Canonical✓ installed

trus buat mastiini ada update ngga, caranya snap refresh core abis itu, install certbot caranya :

root@librenms:~# snap install --classic certbot
snap "certbot" is already installed, see 'snap help refresh'

buat symlink

ln -s /snap/bin/certbot /usr/bin/certbot

kemudian buat virtualhost, edit file /etc/nginx/sites-available/default
Tambahkan isinya di paling bawah sbb :

server {

 listen              443 ssl http2;

 listen              [::]:443 ssl http2;

 server_name nms1.ispanda.net.id;

# access_log  /opt/librenms/logs/access_log;

# error_log   /opt/librenms/logs/error_log;

 root        /opt/librenms/html;

 index       index.php;

 charset utf-8;

 gzip on;

 gzip_types text/css application/javascript text/javascript application/x-javascript image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon;

 location / {

  try_files $uri $uri/ /index.php?$query_string;

 }

 location ~ [^/]\.php(/|$) {

  fastcgi_pass unix:/run/php-fpm-librenms.sock;

  fastcgi_split_path_info ^(.+\.php)(/.+)$;

  include fastcgi.conf;

 }

 location ~ /\.(?!well-known).* {

  deny all;

 }

    ssl_certificate /etc/letsencrypt/live/nms1.ispanda.net.id/fullchain.pem; # managed by Certbot

    ssl_certificate_key /etc/letsencrypt/live/nms1.ispanda.net.id/privkey.pem; # managed by Certbot

}

lalu restart nginx

root@librenms:~# /etc/init.d/nginx restart

Restarting nginx (via systemctl): nginx.service.

kemudian buat certbot

certbot --nginx

ikuti petunjuknya hingga selesai.

lalu restart nginx

root@librenms:~# /etc/init.d/nginx restart

Restarting nginx (via systemctl): nginx.service.

kemudian akses https://nms.domainanda.com

 

Continue