Syed Jahanzaib Personal Blog to Share Knowledge !

February 14, 2019

Barracuda Email Security Gateway – Short Notes

Filed under: Emails - Antispam — Tags: , — Syed Jahanzaib / Pinochio~:) @ 12:58 PM

barracuda.jpg

We are running our own email server hosted locally using IBM Lotus Domino Server. Last year we acquired Barracuda Email Security Gateway hardware device (BSFI300a) to filter spam/junk emails. It came along with 1 Year Total Protection Plus & 1 Year IR (instant replacement). Hardware quality is enterprise grade & we haven’t encountered any failure so far.

 

Barracuda usage in our organization ~

For some reasons, we are using this device to filter incoming emails only. Outgoing emails are delivered to recipient/destination email server directly from our Domino server via main gateway router (bypassing barracuda for outgoing emails). This was done for better tracking of outgoing/sent emails as domino provides more detailed log as compared to barracuda. But IMO its better to use antispam device/app as centralized gateway to filter/control both incoming/outgoing email transactions.

 

Barracuda effectiveness in filtering Spam ~

If we talk in percentage basis, it is blocking spam upto 95-97 % effectively. We regularly review its message logs and report uncatched spam to Barracuda central spam & we never receive such email from that host further, so there monitoring team is reviewing the submission actively I suppose.

 

Past experience with Symantec SMSDOM ~

Before this we were using Symantec Mail security for domino base application  for about 10 years but it got discontinued & declared EOL. SMSDOM filtering was not much effective & was a constant headache for us.

Barracuda Hardware Specs for 300 Model

barracuda 300 user support

barracuda 300 user other specst


Some Snapshots …

barracuda 300 - dashboard part 1

barracuda 300 - dashboard part 2

 

barracuda 300 - dashboard part 3.PNG

 


Tip’s & Common Usage

Following are few short notes for reference purposes. First Login to Barracuda with admin account,

Device Web Management Port

  • 34000

View Messages LOG

Goto Basic > Message Log

SMTP Banner / Attachment Size Limit / SPF,Helo, Ehlo settings

Goto  ADVANCED > Email Protocol

Ping/Dig/Telnet Test / View LIVE Mail process Log

Goto  ADVANCED > Troubleshooting

Firmware Update

Goto ADVANCED > Firmware Update

IP + DNS configuration / Destination Mail Server / Barracuda Hostname Page

Goto Basic > IP Configuration

Password Change / Log Management / System Management like reset logs,restart,shutdown

Goto Basic > IP Configuration > Administration

Allow/Block Domain

Goto Basic > BASIC > BLOCK/ACCEPT > Sender Filters

Block specific extensions

Goto BASIC > BLOCK/ACCEPT > Attachment Filters

Check Queued emails

Goto Advanced > Queue Management

Device Backup/Restore/Scheduled

Goto Advanced > Backups

NTP configuration

Goto Advanced >Advanced Networking

Will keep adding more information as explored or requested.


General Tips for better email acceptance at internet

Following are general tips every email administrator must follow to avoid there email rejection at different internet hosts.

  • Make sure your ISP have reverse DNS entry against your email server IP, example if you have acquire public IP from the ISP, ask them to create reverse DNS / PTR record for this IP against your MAIL Server public ip
  • SMTP welcome banner should be your email server FQDN
  • Make sure you have valid SPF record to avoid spoofing your domain name by spammers, Gmail highly recommend it as well.
  • Adding DKIM/DMARC against your domain name is a good addition.
  • Try using your ISP SMTP as relay as first line,

Regard’s
Syed Jahanzaib

 

February 6, 2019

Unable to access Windows 2003 shared folder from Windows 10

Filed under: Microsoft Related — Tags: , , , — Syed Jahanzaib / Pinochio~:) @ 1:04 PM

smb1.png


We have some folders shared on old windows 2003 box, while trying to access them from windows 10 workstation, we are seeing following error …

w2003 error for w10.PNG

 

In Windows 10 Fall Creators Update and Windows Server, version 1709 (RS3) and later versions, the Server Message Block version 1 (SMBv1) network protocol is no longer installed by default. To enable it ,

Start powershell with privilege mode (on your windows 10 workstation) by >

Open CMD in privilege mode, and start powershell 

powershell

Now get status of ​SMB1Protocol

Get-WindowsOptionalFeature –Online –FeatureName SMB1Protocol

Probably it will be in Disabled State, change it to enable using following cmd,

Enable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol

Afterwards, it may ask you to reboot machine, Do it to restart so that changes can take effect.

Status after enabling SMB1Protocol

PS C:\> Get-WindowsOptionalFeature –Online –FeatureName SMB1Protocol

FeatureName : SMB1Protocol
DisplayName : SMB 1.0/CIFS File Sharing Support
Description : Support for the SMB 1.0/CIFS file sharing protocol, and the Computer Browser protocol.
RestartRequired : Possible
State : Enabled
CustomProperties :
ServerComponent\Description : Support for the SMB 1.0/CIFS file sharing protocol, and the Computer
Browser protocol.
ServerComponent\DisplayName : SMB 1.0/CIFS File Sharing Support
ServerComponent\Id : 487
ServerComponent\Type : Feature
ServerComponent\UniqueName : FS-SMB1
ServerComponent\Deploys\Update\Name : SMB1Protocol

Now try to access windows 2003 sharing folder & hopefully it will work fine.

Regard’s
Syed Jahanzaib

February 1, 2019

Forced routing of selective emails to ISP SMTP via Mikrotik Routing

Filed under: IBM Related, Mikrotik Related — Tags: , , — Syed Jahanzaib / Pinochio~:) @ 10:06 AM

isp.jpeg


Scenario:

We have a LAN environment with our own email server [IBM Lotus Domino] hosted locally. Mikrotik router is acting as our gateway router with /29 public pool & port forwarding from mikrotik public ip to email server is configured. Barracuda Antispam gateway is in place as well.

Problem & Challenges :

Sometimes there are few email servers on the internet that does not accept our emails, either they bounce back or silently drop our emails despite our public IP is not listed in any of blacklisting on the internet[It happens commonly with microsoft hosted email servers as they silently drop our emails without informing any reason]. If we use our ISP SMTP as relay in the DOMINO configuration, then the emails delivers to those particular servers without problem. But we cannot use ISP SMTP for all emails routing/relaying as they have per day sending limit, and we donot get proper reports for delivered or hold emails.

Another BIG problem is that sometimes ISP’s SMTP server IP gets ban/added in the spamhaus or likewise SPAM blacklist database & when this happens 80-90% emails bounces back.

So we needed a solution where we should not use ISP SMTP relay all the time but only particular destination email server’s mails should be routed to ISP smtp. & it should all be controlled by our Mikrotik RouterOS dynamically/centrally.


Solution:

First created a address list which should contain IP addresses of remote email servers [that donot accept our emails directly]

/ip firewall address-list
add address=smtp.remotemail.server.com comment="remote company mail server X IP" list=few_mails_routing_2_primary_ISP_smtp

Now using NAT rule, we will forcefully route all emails [port 25 traffic] going to above address list, will be routed to ISP SMTP , with below rule …

# 1.2.3.4 is the ISP SMTP IP

/ip firewall nat
add action=dst-nat chain=dstnat comment="Few Mails Routing 2 primary ISP smtp" dst-address-list=few_mails_routing_2_primary_ISP_smtp dst-port=25 protocol=tcp to-addresses=1.2.3.4 to-ports=25

It’s done.

BUT next challenge is to overcome issue when ISP changes it’s SMTP IP address for whatsoever reason, so we need to schedule a script that will keep checking the ISP SMTP IP by resolving it via google dns, and update the ISP SMTP IP in the NAT rule. [As per my knowledge we cannot put DNS name in TO-ADDRESS field, this is why putting IP is necessary, & update it dynamically is also essential to avoid bouncing email dueot blacklisting for ISP old SMTP IP]

the Script !

or workaround I suggest for very particular problem?

# Mikrotik routerOS script to resolve ISP SMTP, and add it to variables & in NAT rules
# Useful in scneario where ISP change its smtp IP frequently (to avoid SMTP Blacklisting)
# Script by Syed Jahanzaib / aacable at hotmail dot com / https : // aacable . wordpress . com
# 31-January-2019
# Find rule with following comments
:local COMMENT "few_mails_routing_2_primary_ISP_smtp";
# DNS Name of SMTP for resolving
:local ISP1SMTPDNSNAME "smtp.multi.net.pk";
# Which DNS server to be used for resolving
:local DNSSERVER "8.8.8.8";
# Below is Default IP of SMTP Server, so that if resolving cannot be done for what so ever reason, set this IP as DEFAULT SMTP
:local DEFAULTSMTP "202.141.224.89";
# Destination port that need to be redirected
:local DSTPORT "25";
# Dat time variables
:local i 0;
:local F 0;
:local date;
:local time;
:local sub1 ([/system identity get name])
:local sub2 ([/system clock get time])
:local sub3 ([/system clock get date])
:set date [/system clock get date];
:set time [/system clock get time];
# Set script last execution date time
:global SMTPLastCheckTime;
:set SMTPLastCheckTime ($time . " " . $date);

# Set global variables to store for ISP SMTP & its last resolved status
:global ISP1ACTIVEIP4SMTP;
:global ISP1SMTPLASTRESOLVERESULT;

# Check if resolving is doable, then act accordingly
:local RESOLVELIST {"$ISP1SMTPDNSNAME"}
:foreach addr in $RESOLVELIST do={
:do {:resolve server=$DNSSERVER $addr} on-error={
:set ISP1ACTIVEIP4SMTP "$DEFAULTSMTP";
:set ISP1SMTPLASTRESOLVERESULT "FAILED";
:log error "$ISP1SMTPDNSNAME resolved result: FAILED @ $date $time !";
/ip firewall nat set to-addresses=$DEFAULTSMTP to-ports=$DSTPORT [find comment="$COMMENT"] }}

# If resolving is ok from above results then set resolved address as default SMTP ip
:if ($SP1SMTPLASTRESOLVERESULT !="FAILED") do={
:log warning "$ISP1SMTPDNSNAME resolved result: SUCCESS @ $date $time !";
:set ISP1ACTIVEIP4SMTP [:resolve "$ISP1SMTPDNSNAME"];
:set ISP1SMTPLASTRESOLVERESULT "SUCCESS";
/ip firewall nat set to-addresses=$ISP1ACTIVEIP4SMTP to-ports=$DSTPORT [find comment="$COMMENT"]
}

We can add dynamic names in the ISP SMTP address list.


Regard’s
SYED JAHANZAIB

 

 

 

January 16, 2019

BASH script to monitor Cisco Switch Port Status

Filed under: Cisco Related, Linux Related — Tags: , , , , , , — Syed Jahanzaib / Pinochio~:) @ 10:55 AM

portmonitor

2019-01-17 10.05.47.jpg

Following script was designed for an OP who wanted to monitor his cisco switch ports status via linux base bash script.

  • Created: February, 2016
  • Revision: January, 2019

 

OP Requirements:

  • We need a bash script that can acquire ports status of Cisco switch using SNMP query & act accordingly based on the results, example send sms/email etc,
  • The script should first check target device network connectivity by ping, if PING NOT responding, Exit,
  • If ping OK, then check SNMP status, if SNMP NOT responding, then error report, & Exit,
  • If Ping / SNMP responds OK, then check the port status, if port status is NOT UP , then send email/sms alert 1 time until next status change.

Hardware / Software Used in this post:

  • Cisco 3750 24 Gigabit Ports Switch
  • Ubuntu 12.4 Server Edition
  • Bash Script
  • SNMP support enabled on Cisco switch to query port status using MIB names

Solution:

I made following script which checks PING/SNMP status, and then Port Status of Cisco 3750 Switch. This is just an example. You can use your own techniques to acquire the same result. This is fully tested and working script. There are many other ways to do the same like using any NMS app like Nagios, or DUDE which have good GUI control so no need to do coding in the dark : )

Surely this contains too much junk or some unwanted sections, so you may want to trim it according to your taste and requirements.

Regard’s
Syed Jahanzaib


  1. Install SNMP MIBS

First we need to make sure that MIB are installed, Do so by

sudo apt-get install -y snmp
apt-get install -y snmp-mibs-downloader
sudo download-mibs

After this , Add SNMP Mibs entry in

/etc/snmp/snmp.conf

by adding this line

mibs +ALL

Save & Exit

Now query your switch by following command to see if snmpwalk is working …

root@Radius:/temp# snmpwalk -v1 -c wl 10.0.0.1 IF-MIB::ifOperStatus

& you should see something line below if SNMP is working …

IF-MIB::ifOperStatus.1 = INTEGER: up(1)
IF-MIB::ifOperStatus.17 = INTEGER: up(1)
IF-MIB::ifOperStatus.5182 = INTEGER: down(2)
IF-MIB::ifOperStatus.5183 = INTEGER: down(2)
IF-MIB::ifOperStatus.5184 = INTEGER: down(2)
IF-MIB::ifOperStatus.10601 = INTEGER: up(1)
IF-MIB::ifOperStatus.10602 = INTEGER: down(2)
IF-MIB::ifOperStatus.10603 = INTEGER: down(2)
IF-MIB::ifOperStatus.10604 = INTEGER: down(2)
IF-MIB::ifOperStatus.10605 = INTEGER: up(1)
IF-MIB::ifOperStatus.10606 = INTEGER: up(1)
IF-MIB::ifOperStatus.10607 = INTEGER: up(1)
IF-MIB::ifOperStatus.10608 = INTEGER: up(1)
IF-MIB::ifOperStatus.10609 = INTEGER: up(1)
IF-MIB::ifOperStatus.10610 = INTEGER: up(1)
IF-MIB::ifOperStatus.10611 = INTEGER: up(1)
IF-MIB::ifOperStatus.10612 = INTEGER: up(1)
IF-MIB::ifOperStatus.10613 = INTEGER: up(1)
IF-MIB::ifOperStatus.10614 = INTEGER: up(1)
IF-MIB::ifOperStatus.10615 = INTEGER: up(1)
IF-MIB::ifOperStatus.10616 = INTEGER: up(1)
IF-MIB::ifOperStatus.10617 = INTEGER: up(1)
IF-MIB::ifOperStatus.10618 = INTEGER: up(1)
IF-MIB::ifOperStatus.10619 = INTEGER: up(1)
IF-MIB::ifOperStatus.10620 = INTEGER: up(1)
IF-MIB::ifOperStatus.10621 = INTEGER: up(1)
IF-MIB::ifOperStatus.10622 = INTEGER: up(1)
IF-MIB::ifOperStatus.10623 = INTEGER: up(1)
IF-MIB::ifOperStatus.10624 = INTEGER: up(1)
IF-MIB::ifOperStatus.10625 = INTEGER: down(2)
IF-MIB::ifOperStatus.10626 = INTEGER: down(2)
IF-MIB::ifOperStatus.10627 = INTEGER: down(2)
IF-MIB::ifOperStatus.10628 = INTEGER: down(2)
IF-MIB::ifOperStatus.14501 = INTEGER: up(1)

OR getting UP/DOWN result for particular port (port 10)

snmpwalk -v1 -c wl 10.0.0.1 IF-MIB::ifOperStatus.10610 -Oqv

Output Result:

up

 

 


the Script!

  • mkdir /temp
  • cd /temp
  • touch monitor_sw_port.sh
  • chmod +x monitor_sw_port.sh
  • nano monitor_sw_port.sh

and paste following, make sure to edit all info accordingly…

#!/bin/bash
#set -x
# Script to check Cisco Switch Port Status and send alert accordingly
# It will first check PING, then SNMP Status, then PORT status & act accordingly
# Email: aacable at hotmail dot com / http : // aacable . wordpress . com
# 15-Jan-2019
HOST="$1"
PORT="$2"
SNMP="public"
DEVNAME="ZAIB_Main_Switch"
HOSTNAME=`hostname`
TEMP="temp"
COMPANY="ZAIB (Pvt) Ltd."
DATE=`date`
# GMAIL DETAILS
GMAILID="MYGMAIL@gmail.com"
GMAILPASS="GMAIL_PASS"
ADMINMAIL1="aacableAThotmail.com"
SENDMAIL="/temp/sendEmail-v1.56/sendEmail"
# SMS RELATED and KANNEL INFO
# KANNEL SMS Gateway Info
KANNELURL="127.0.0.1:13013"
KANNELID="kannel"
KANNELPASS="KANNEL_PASS"
CELL1="03333021909"
PING_ATTEMPTS="2"
HOST_PING_STATUS="/$TEMP/$HOST.$PORT.ping"
HOST_PORT_STATUS="/$TEMP/$HOST.$PORT.port"
LAST_DOWNTIME_HOLDER="/$TEMP/$HOST.$PORT.last_down.status.txt"
touch $HOST_PING_STATUS
touch $HOST_PORT_STATUS
touch $LAST_DOWNTIME_HOLDER
# If ip parameters are missing, then inform & exit
if [ -z "$HOST" ];then
echo "Error: IP missing, Please use this,
./monitor_sw_port.sh 10.0.0.1 10601"
exit 1
fi
# If port parameters are missing, then inform & exit
if [ -z "$PORT" ];then
echo "Error: PORT number missing, Please use this,
./monitor_sw_port.sh 10.0.0.1 10601"
exit 1
fi
# Test PING to device
count=$(ping -c $PING_ATTEMPTS $HOST | awk -F, '/received/{print $2*1}')
if [ $count -eq 0 ]; then
echo "$HOST $DEVNAME is not responding to PING Attempts, cannot continue without , por disable ping check] !"
exit 1
else
echo "- PING Result : OK"
fi
# Test SNMP Result of device
snmpwalk -v1 -c $SNMP $HOST SNMPv2-MIB::sysDescr.0 > /tmp/$HOST.$PORT.snmp.status.txt
if [ ! -f "/tmp/$HOST.$PORT.snmp.status.txt" ]; then
echo "- ALERT: ..... $HOST $DEVNAME is not responding to SNMP Request, Cannot continue without it ... Exit"
exit 1
else
echo "- SNMP Result : OK"
fi
# If all OK, then pull Port Description
PORT_DERSCRIPTION=`snmpwalk -v1 -c $SNMP $HOST IF-MIB::ifDescr.$PORT -Oqv`
# Check if folder exists, if not create one and continue
if [ ! -d "/$TEMP" ]; then
echo
echo
echo "/$TEMP folder not found, Creating it so all ping results should be saved there . . ."
mkdir /$TEMP
fi
### START ACTION
################################
### CHECK PORT STATUS - for UP #
################################
CHKPORT=`snmpwalk -v1 -c $SNMP $HOST IF-MIB::ifOperStatus.$PORT -Oqv`
#CHKPORT="up"
# If Port number does not exists, then inform and exit
if [ -z "$CHKPORT" ]; then
echo "ALERT: .... Port number $PORT NOT found on $HOST $DEVNAME , Please check Port Number, Exiting ..."
exit 1
fi
#########################################
# SMS/EMAIL Messages for PORT UP / DOWN #
#########################################
# Temporary file holder for PORT DOWN/UP storing sms/email
PORT_DOWN_MSG_HOLDER="/$TEMP/$HOST.$PORT.down.msg"
PORT_UP_MSG_HOLDER="/$TEMP/$HOST.$PORT.up.msg"
echo "ALERT:
$DEVNAME $HOST port $PORT $PORT_DESCRIPTION is DOWN @ $DATE
$COMPANY" > $PORT_DOWN_MSG_HOLDER
echo "INFO:
$DEVNAME $HOST port $PORT $PORT_DESCRIPTION is OK @ $DATE!
$COMPANY" > $PORT_UP_MSG_HOLDER

PORT_DERSCRIPTION=`snmpwalk -v1 -c $SNMP $HOST IF-MIB::ifDescr.$PORT -Oqv`
HOST_PORT_DOWN_ALERTONSCREEN="ALERT: .... $HOST $DEVNAME port nummber $PORT $PORT_DERSCRIPTION is DOWN @ $DATE"
HOST_PORT_UP_ALERTONSCREEN="INFO: .... $HOST $DEVNAME port nummber $PORT $PORT_DERSCRIPTION is OK @ $DATE"
# Check if port is UP
if [ "$CHKPORT" = "up" ]; then
echo -e "$HOST_PORT_UP_ALERTONSCREEN"
# Check if port isUP and its previous state was DOWN, then send UP sms/email
if [ $(grep -c "$HOST" "$HOST_PORT_STATUS") -eq 1 ]; then
echo "INFO: This port was previosuly DOWN, and now its UP ,Sending UP SMS 1 time only"
# Sending PORT DOWN ALERT via EMAIL
$SENDMAIL -u "$HOST_PORT_UP_ALERTONSCREEN" -o tls=yes -s smtp.gmail.com:587 -t $ADMINMAIL1 -xu $GMAILID -xp $GMAILPASS -f $GMAILID -o message-file=$PORT_UP_MSG_HOLDER -o message-content-type=text
# Sending PORT DOWN ALERT via SMS using KANNEL SMS Gateway
cat $PORT_UP_MSG_HOLDER | curl "http://$KANNELURL/cgi-bin/sendsms?username=$KANNELID&password=$KANNELPASS&to=$CELL1" -G --data-urlencode text@-
sed -i "/$HOST/d" "$HOST_PORT_STATUS"
fi
fi
##################################
### CHECK PORT STATUS - for DOWN #
##################################
if [ "$CHKPORT" = "down" ]; then
echo "$HOST_PORT_DOWN_ALERTONSCREEN"
#check if port staus was previosly UP, then act
if [ $(grep -c "$HOST" "$HOST_PORT_STATUS") -eq 1 ]; then
echo "ALERT: ..... $HOST $DEVNAME port $PORT $PORT_DERSCRIPTION is DOWN. SMS have already been sent."
fi
if [ $(grep -c "$HOST" "$HOST_PORT_STATUS") -eq 0 ]; then
echo "ALERT: ..... $HOST $DEVNAME port $PORT $PORT_DERSCRIPTION is now down! - SENDING PORT DOWN SMS ..."
echo "$HOST" > $HOST_PORT_STATUS
echo "SMS Sent FOR $HOST $DEVNAME port $PORT $PORT_DERSCRIPTION DOWN have been sent only 1 time until next status change ..."
# Sending PORT DOWN ALERT via EMAIL
$SENDMAIL -u "$HOST_PORT_DOWN_ALERTONSCREEN" -o tls=yes -s smtp.gmail.com:587 -t $ADMINMAIL1 -xu $GMAILID -xp $GMAILPASS -f $GMAILID -o message-file=$PORT_DOWN_MSG_HOLDER -o message-content-type=text
# Sending PORT UP ALERT via SMS
cat $PORT_DOWN_MSG_HOLDER | curl "http://$KANNELURL/cgi-bin/sendsms?username=$KANNELID&password=$KANNELPASS&to=$CELL1" -G --data-urlencode text@-
fi
fi
####################
# SCRIPT ENDS HERE #
# SYED JAHANZAIB #
####################

Usage:

change the IP and port number.

  • /temp/monitor_sw_port.sh 10.0.0.1 10610

You can add entry in cron like this

# Check for Service remote host port status
*/5 * * * * /temp/portmon.sh 10.0.0.1 10610

RESULT:

SMS result:
2019-01-17 10.05.47.jpgEmail Result:

email alert on port down vlan.PNG

# Monitoring Port # 10 , when port is DOWN ...

root@Radius:/temp# ./monitor_sw_port.sh 10.0.0.1 10610
- PING Result : OK
- SNMP Result : OK
ALERT: .... 10.0.0.1 WL_Main_Switch port nummber 10610 GigabitEthernet2/0/10 is DOWN @ Tue Jan 15 12:44:45 PKT 2019
ALERT: ..... 10.0.0.1 WL_Main_Switch port 10610 GigabitEthernet2/0/10 is DOWN. SMS have already been sent.

root@Radius:/temp# ./monitor_sw_port.sh 10.0.0.1 10610
- PING Result : OK
- SNMP Result : OK
ALERT: .... 10.0.0.1 WL_Main_Switch port nummber 10610 GigabitEthernet2/0/10 is DOWN @ Tue Jan 15 12:44:51 PKT 2019
ALERT: ..... 10.0.0.1 WL_Main_Switch port 10610 GigabitEthernet2/0/10 is DOWN. SMS have already been sent.

# Monitoring Port # 10 , when port is UP now ...
root@Radius:/temp# ./monitor_sw_port.sh 10.0.0.1 10610
- PING Result : OK
- SNMP Result : OK
INFO: .... 10.0.0.1 WL_Main_Switch port nummber 10610 GigabitEthernet2/0/10 is OK @ Tue Jan 15 12:45:01 PKT 2019
INFO: This port was previosuly DOWN, and now its UP ,Sending UP SMS 1 time only
Jan 15 12:45:11 radius sendEmail[18700]: Email was sent successfully!
0: Accepted for delivery

# Monitoring Port # 10 , when port is working UP ...
root@Radius:/temp# ./monitor_sw_port.sh 10.0.0.1 10610
- PING Result : OK
- SNMP Result : OK
INFO: .... 10.0.0.1 WL_Main_Switch port nummber 10610 GigabitEthernet2/0/10 is OK @ Tue Jan 15 12:45:12 PKT 2019

November 19, 2018

Mikrotik Remote Access via Multiple WAN Links

Filed under: Mikrotik Related — Syed Jahanzaib / Pinochio~:) @ 1:47 PM

how-to-mark-trails-like-a-pro-pin

I wrote about this topic few years back, but forgot where it is now, So adding it again as Note to Self! This solution applies for following particular scenario.


Scenario:

We have 2 wan links configured with policy base routing. As we know that Mikrotik or any device can have only one default route active at a time. So if we will try to access mikrotik via wan2 link it will not work, because when request will arrive on wan2 link, and tries to return to its original requester, it will always route via WAN-1 link dueto default route. At this point remote client will receive packets with a source IP it didn’t initiate traffic with, so it reject that response.

Fair enough !

To sort we need to mark there connections, and make sure every packets should return via same route via which it came IN.

# Mirkotik IP Firewall Mangle Section
/ ip firewall mangle
# Mark traffic coming via WAN-1 link
add chain=input in-interface=WAN1 action=mark-connection new-connection-mark=WAN1_incoming_conn
# Mark traffic coming via WAN-2 link
add chain=input in-interface=WAN2 action=mark-connection new-connection-mark=WAN2_incoming_conn

# Mark traffic routing mark for above marked connection for WAN-1 , so that mikrotik will return traffic via same interface it came in
add chain=output connection-mark=WAN1_incoming_conn action=mark-routing new-routing-mark=to_WAN1
# Mark traffic routing mark for above marked connection for WAN-2, so that mikrotik will return traffic via same interface it came in
add chain=output connection-mark=WAN2_incoming_conn action=mark-routing new-routing-mark=to_WAN2

# Finally Add appropriate routes in ROUTE section
/ ip route
add dst-address=0.0.0.0/0 gateway=1.1.1.2 routing-mark=to_WAN1 check-gateway=ping
add dst-address=0.0.0.0/0 gateway=2.2.2.2 routing-mark=to_WAN2 check-gateway=ping

For other scenario’s, you may want to look into prerouting !

Regard’s
Syed Jahanzaib

 

October 24, 2018

ASCI Fun with Mikrotik Terminal Banner

Filed under: Mikrotik Related — Tags: , — Syed Jahanzaib / Pinochio~:) @ 3:46 PM

bat banner

To edit Mikrotik Terminal Welcome Banner, Open Terminal & Issue following command,

/system note edit note

Now Design your graphics / or add texts of your choice, or paste your already copied data in this terminal window.

After Done, Press CTRL+O , & it will save/exit.

Now open Terminal again, and this time you will see your MOTD/Banner smiling 🙂

mikrotik temrinal motd banner

More Info here

October 8, 2018

PAKRAD – Reseller,Dealer & Sub-Dealer base ISP Billing System

Filed under: freeradius — Tags: , , — Syed Jahanzaib / Pinochio~:) @ 9:08 AM

pakrad

PAK~Radius” is a customized billing system designed for mid-large scale ISP’s. It’s powered by Linux (Ubuntu) using Freeradius v 2.x.x & Dynamic & responsive GUI panel coded in PHP 7.x . It’s developed to cater local desi market requirements.

It’s built on concept where ISP have Super Admin > Admin / Reseller / Dealer & Sub-Dealer base clientele. This system is continuously under development & new features / enhancements and improvements are begin made on a regular basis.


Workflow ….

workflow.jpg

  • It’s a cash base system, (cards options not available)
  • on TOP, ISP have the Super Admin account , this account assign services with desired rates to the ADMIN account
  • ADMIN account cannot create users directly, Admin first creates reseller , assign him some services with desired rates, & transfer desired amount in the reseller wallet/account,
  • Reseller cannot create users directly, Reseller first creates Dealer, assign him some services with desired rates, & transfer some amount in the dealer wallet/account,
  • Dealer can create his users upto the limit of his wallet/account, Dealer can also create his sub dealer and assign him required services and assign there rates to his sub-dealer.

Some screenshots …

pakrad1

dashboard view.png

free user

dealer panel view 2

dealer panel view my billing

dealer panel view

user usage history.PNG


 


Some major Features …

Exclusive.jpg

billing dept.png

  • Dynamic , responsive & appealing web design (advance responsive PHP designing)
  • Just one time license cost & you get Lifetime license (PHP code is encrypted)
  • Unlimited number of users / NAS support
  • Generalized information on front panel for each manager, a glance window 
  • Specially customized designed for local Internet Cable Services providers , with TO THE POINT options only, no hankies pankies
  • Purely Designed as a Reseller base system, Example – Admin > Reseller > Dealer / Sub-dealer 
  • Profit calculation for view purposes
  • Free ID’s assignment for dealer for there Test purposes  *under process*
  • Different services rates assignment for different re-sellers / dealers / sub-dealers
  • Each Manager can view there dealer/sub-dealer billing easily. Good Financial modules for tracking all sort of transactions for dealer / sub-dealers
  • Cash base system for reseller/dealer/sub-dealer charging
  • `Get Back Cash` System to pull back cash sent to the managers
  • Dynamic day & night bandwidth configuration available , compatible with all version of mikrotik routers
  • Quota base packages configuration available *under process*
  • Prevention of user DELETE action to prevent any misuse, user can be disabled only!
  • Users unsuccessful dialing attempts for each manager
  • Users connecting devices information recorded in user table , example tplink/tenda etc
  • Reports for Package wise consumption
  • Good reporting section for Users usage reports / / User charges reports (User usage Graphs base option *under process*)
  • Record last login information
  • Email/SMS Alerts for various actions & multiple users email/sms alert example expiry / renewal / general notification sending to active users etc [currently its being done via bash scripts, but soon they will be added in GUI]
  • Strong Bug Free Back-end design, capable of connecting thousands of users in just few seconds ! 

~ Years of experiences compiled in one single package ~

Many other features added based on local operators feedback to suite local market requirements !


Demo link: 

demo.png

  • http://pakrad.galaxy.net.pk:8181
    Credentials  ….
  • superadmin/superadmin
  • admin/admin
  • reseller/reseller
  • reseller2/reseller2
  • dealer/dealer
  • dealer2/dealer2
  • subdealer/subdealer

Regard’s
Syed Jahanzaib 

October 2, 2018

September 27, 2018

DNSMASQ Short Notes to self

Filed under: Linux Related — Tags: , , , , — Syed Jahanzaib / Pinochio~:) @ 10:15 AM

dnsmasq.jpg

Dnsmasq is a lightweight, easy to configure DNS forwarder, designed to provide DNS (and optionally DHCP and TFTP) services to a small-scale network.

As compared to `​BIND`​, which is a bit complex to configure for beginners, `DNSMASQ` is very easy and requires minimum configuration. This post is just a reference guide for myself.


Install DNSMASQ in Ubuntu !

sudo apt-get install dnsmasq

After this edit /etc/dnsmasq.conf file ,  For Shorter version, I am pasting required important options only, (by removing all lines & using these one only …)

domain-needed
#IF you want to listen on multiple interface, add them (by duplicating following line)
interface=enp6s0
bogus-priv
strict-order
expand-hosts
cache-size=10000

After every change in the config, make sure to restart DNSMASQ service.

service dnsmasq restart


Forwarding Queries to Upstream DNS

By default, DNSMASQ forwards all requests which are not able to be resolved in /etc/hosts to the upstream DNS servers defined in /etc/resolve.conf like below

cat /etc/resolv.conf

nameserver 127.0.0.1
nameserver 8.8.8.8

Make Sure to setup 127.0.0.1 in your network adapter as well example

dns-nameservers 127.0.0.1 8.8.8.8



Add DNS Records (static dns entries if required for local servers like media sharing etc)

Adding customized domain entries, dns spoofing i guess. Add the records in /etc/hosts file

cat /etc/hosts

127.0.0.1 localhost
1.2.3.4 zaib.com

 


Restart DNSMASQ Service

After every change in the config, make sure to restart dnsmasq service.

service dnsmasq restart

Monitor DNS traffic

DSNTOP is your best friend. for full details read

http://dns.measurement-factory.com/tools/dnstop/dnstop.8.html


# ACL / Secure you DNS from open relay / flooding

To allow only specific ip series to query your dns server, you can use following bash script.

We have multiple ip pools, and we have made a small text file , we can small bash script to read from the file and add iptables rules accordingly

Sample of /temp/localips.txt

10.0.0.0/8
172.16.0.0/16
192.168.0.0/16

Now you can execute the bash script manually or add it in /etc/rc.local file to execute on every reboot.

cat /etc/fw.sh

#!/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# Very Basic Level of Firewall to allow DNS only for some ip range
# Script by Syed Jahanzaib
# 26-SEP-2018
#set -x

# Setting various Variables

#Local IP files which contains ip/ranges
IPFILE="/temp/localip.txt"

#Destination Port we want to restrict
DPORT="53"

#Destination Port type we want to restrict
DPORT_TYPE1="udp"
DPORT_TYPE2="tcp"

# Flush all previous iptables Rules
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X

# Allow localhost access to query DNS service
iptables -A INPUT -s 127.0.0.1 -p $DPORT_TYPE1 --dport $DPORT -j ACCEPT
iptables -A INPUT -s 127.0.0.1 -p $DPORT_TYPE2 --dport $DPORT -j ACCEPT

# LOOP - Read from localip.txt file , and apply iptables rules
for IP in $(cat $IPFILE); do echo "Allowing $IP for $DPORT_TYPE1 $DPORT Server queries access ..."; iptables -A INPUT -s $IP -p $DPORT_TYPE1 --dport $DPORT -j ACCEPT; done
for IP in $(cat $IPFILE); do echo "Allowing $IP for $DPORT_TYPE2 $DPORT Server queries access ..."; iptables -A INPUT -s $IP -p $DPORT_TYPE2 --dport $DPORT -j ACCEPT; done

# DROP all other requests going to DNS service
iptables -A INPUT -p $DPORT_TYPE1 --dport $DPORT -j DROP
iptables -A INPUT -p $DPORT_TYPE1 --dport $DPORT -j DROP

# Script ends here
# Syed Jahanzaib

add this in /etc/rc.local so that it can run on every reboot!

Also note that if you have large ip pool, its better to use IPSET which is more efficient

SIMPLE QUEUE for traffic going to/from DNS Server

/queue simple
add max-limit=10M/10M name="NS1 DNS Traffic 10mb limit" target=X.X.X.X/32

NSLOOKUP with details on Windows BOX

nslookup -all - 8.8.8.8

Regard’s
Syed Jahanzaib

September 24, 2018

FREERADIUS WITH MIKROTIK – Part #20 – Enforcement of lowercase in username

Filed under: freeradius — Tags: , , , — Syed Jahanzaib / Pinochio~:) @ 9:43 AM

uppwer lower logo

FREERADIUS WITH MIKROTIK – Part #1 – General Tip’s Click here to read more on FR tutorials …


Disclaimer! This is important!

Every Network is different , so one solution cannot be applied to all. Therefore try to understand logic & create your own solution as per your network scenario. Just dont follow copy paste.

If anybody here thinks I am an expert on this stuff, I am NOT certified in anything Mikrotik/Cisco/Linux or Windows. However I have worked with some core networks and I read , research & try stuff all of the time. So I am not speaking/posting about stuff I am formerly trained in, I pretty much go with experience and what I have learned on my own. And , If I don’t know something then I read & learn all about it.

So , please don’t hold me/my-postings to be always 100 percent correct. I make mistakes just like everybody else. However – I do my best, learn from my mistakes and always try to help others.

Regard’s
Syed Jahanzaib~


Scenario:

  • We have a generic FreeRADIUS Version 2.2.8 as a billing system in Ubuntu 16.04.3 LTS Server.
  • Freeradius is installed by apt-get default repository.
  • Mikrotik ver 6.43.x is being used as NAS.

Problem:

By default freeradius allows upper/lowercase in username, so If user configures  username in upper/lower mix case in his dialer/router then it will be logged same in RADACCT table. This is not a problem by design, but since we are using some external bash scripts to perform various operations like sending COA for bandwidth change on the fly/disconnection etc & the script is picking usernames from our user able which has all lowercase , the NAS does not recognize it for user who have uppercase defined.

Task:

We would like to restrict that all usernames must be entered in lowercase at user side , if not then reject the authentication to enforce our policy forcefully.

Solution:

Edit dialup.conf

nano /etc/freeradius/sql/mysql/dialup.conf

& search following … Comment below lines, this code allows upper/lower case in user names …

# The default queries are case insensitive. (for compatibility with
# older versions of FreeRADIUS)
authorize_check_query = "SELECT id, username, attribute, value, op \
FROM ${authcheck_table} \
WHERE username = '%{SQL-User-Name}' \
ORDER BY id"
authorize_reply_query = "SELECT id, username, attribute, value, op \
FROM ${authreply_table} \
WHERE username = '%{SQL-User-Name}' \
ORDER BY id"

Now UN-COMMENT following …

# Use these for case sensitive usernames.
authorize_check_query = "SELECT id, username, attribute, value, op \
FROM ${authcheck_table} \
WHERE username = BINARY '%{SQL-User-Name}' \
ORDER BY id"
authorize_reply_query = "SELECT id, username, attribute, value, op \
FROM ${authreply_table} \
WHERE username = BINARY '%{SQL-User-Name}' \
ORDER BY id"

So after editing it would be something like …

case sensitive.PNG

Now restart freeradius service one time

service freeradius restart

After this all users authentication with uppercase will be rejected by freeradius. Use it with caution !

This is all done by default in v3…
Alan DeKok.


 

Older Posts »

%d bloggers like this: