The SeattleWireless operators have recently settled on using RIPv2 for a routing protocol. RIP is by no means a perfect routing protocol -- as a matter of fact it is the oldest and probably the most limited protocol available. But it seems to work well for our needs at the moment. It is fairly easy to configure and there is a Free implementation available.
Please note that I (TomMarshall@zebra.com) am not a "router person". My entire experience with routing protocols has been with SeattleWireless over the course of the past week. If you find any technical errors in this document or have anything to add, please do.
_Big Disclaimer_ RIP is limited to 15 hops. While it does work for us right now, we are going to be reviewing other routing solutions. So don't go baking your write-once firmwares quite yet, ok? --EricJohanson
What software should I use?
We are using the GNU Zebra implementation. As noted above, it is easy to configure and it is Free. Zebra provides implementations of several routing protocols in addition to RIP.
I also found GateD but it is a commercial product. Apparently, the company used to provide "public code" for it, but their website says it has been retired.
How do I configure Zebra and RIPv2?
Zebra uses several configuration files. It uses one config file for the basic Zebra options, and one config file per routing protocol. We will be concerned with zebra.conf and ripd.conf. The config files will typically be found in /usr/local/etc for a manually compiled and installed version. If you installed zebra from a "package" or it came with your OS, the config files will typically be found in /etc or /etc/zebra.
The zebra config files are plain text and easy to read. A leading ! (bang) indicates a comment line. Note that at least some options in some files appear to be sensitive to ordering -- that is, changing the order of the lines may change or break the config.
zebra.conf
This file seems to be useful mostly for storing your static routes. Here are some config entries that may be useful:
hostname Router |
Not sure where this is used besides the command prompt |
password ****** |
This is the password to the command interface on port 2601 |
enable password ****** |
If set, this is required to use the "enable" command |
interface <name or net> |
This begins a config block pertaining to an interface |
multicast |
Designates the interface as multicast capable |
ip route <net/mask> |
Defines a static route |
log file <pathname> |
The log file to use |
Here is my zebra.conf:
hostname Router password ****** enable password ****** interface 10.18.129.14 description wlan0: Eric no multicast # Direct connections ip route 10.18.128.0/24 10.18.129.13 # Links ip route 10.18.130.0/24 10.18.129.13 interface 10.18.4.14 description wlan0: Chuck no multicast ! Direct connections ip route 10.18.128.0/24 10.18.4.13 ! Links ip route 10.18.130.0/24 10.18.4.13 log file /var/log/zebra/zebra.log
ripd.conf
hostname Router |
Not sure where this is used besides the command prompt |
password ****** |
This is the password to the command interface on port 2601 |
enable password ****** |
If set, this is required to use the "enable" command |
router rip |
This enables RIP routing |
network <interface or net> |
This entables RIP for an interface or network |
neighbor |
Designates a "neighbor" router to send updates directly (in addition to multicast) |
redistribute connected |
Send notification of connected routes. |
redistribute static |
Send notification of static routes |
distribute-list <name> <in/out> <iface> |
Add inbound/outbound traffic via an interface to the named distribution list |
access-list <name> <permit/deny> <net/mask> |
Specify access rules for the named list |
log file <pathname> |
The log file to use |
Here is my ripd.conf:
hostname ripd password ****** enable password ****** router rip network wlan0 neighbor 10.18.4.13 neighbor 10.18.129.13 redistribute static redistribute connected distribute-list swn in wlan0 distribute-list swn out wlan0 access-list swn permit 10.0.0.0/8 access-list swn deny any log file /var/log/zebra/ripd.log
And EricJohanson's ripd.conf:
debug rip events ! debug rip packet ! router rip network gif0 network sf1 network gif4 ! this neighbor line is required for talking with an AirportLinux box, as they can't do multicast. neighbor 10.18.129.10 redistribute static redistribute connected distribute-list private in gif0 distribute-list private out gif0 distribute-list private in sf1 distribute-list private out sf1 distribute-list private in gif4 distribute-list private out gif4 access-list private permit 10.0.0.0/8 access-list private deny any log file /var/log/ripd.log
Types of routes
There are several types of routes that Zebra can act upon. The ones we are concerned with are:
- Connected routers. These are the routes that are directly "connected" to your router
via ethernet or wireless. Computers on the connected network are directly accessible and traffic to them does not pass through a gateway. Connected routes are typically added automatically by the "ifconfig" command when you enable an interface.
- Static routes. These are the routes that you wish to add to the network. If you run
a CxNode, you will probably have at least one /24 network that you wish to connect with the rest of the SeattleWireless network. This is an example of a static route.
- Kernel routes. These are the routing entries from your kernel. They can typically
be seen with the command "route -n" on Linux systems or "netstat -r" on BSD systems. We do not want to redistribute kernel routes. One reason is because the kernel will typically have a default route to your internet connection and you probably don't want all of SeattleWireless sharing it. 
How do I find and correct problems?
- Use port 2601 and port 2602.
- Use tcpdump (try this: tcpdump -n -s 1500 "udp port 520").
What about security?
- Change the default password!
- Set an enable password.
- Make the config files mode 0600 if the machine is multiuser.
- We will look at MD5 authentication in the near future.
- RIP is datagram based and easily spoofed.
- Filtering by MAC address provides a layer of security but it is easily spoofed.
- Close off external access to ports 2601 and 2602 if you wish.
Where can I find out more?
Official Zebra website.
Some good documentation (but a bit terse).
