92 replies to this topic

[littlesat]

10.x.x.x is private address space... But not included

[Pr2]

Please also add:   172.16.0.0/12  which is also a private IP range (or if you prefer: from  172.16.0.0 to 172.31.255.255).

[WanWizard]

https://tools.ietf.org/html/rfc1918

 

There are quite a few private ranges. I personally NEVER use 192.168.x.x, which most use by default.

 

Another possible problem with this: if you have VPN connections to other internal networks, they will have automatic access when you need to enable VPN for yourself. In the end, the STB is not a security device, and these workarounds don't make it one. If it needs to be a security device, a good firewall needs to be added, processes need to be chrooted, and they need to run outside the current root context.

[SpaceRat]

The check "is it a VPN?" is already performed using python-ipaddress' "is_private" function, NOT comparison against 192.168.x.y

The regexp you might find in the code containing 192.168.x.y is for allowing user "root" from LAN even if root access is disabled (Too many E2 tools not able to handle different logins for Web, telnet and ftp).
Actually it should be rewritten to use the "is in subnet" functionality of py-ipaddress now that we have it.

And I want to add: Too many E2 tools not being able to just use f@cking ssh with key auth for everything instead of direct access for HTTP, ftp AND Telnet.
These crappy tools are probably one of the main reason for all those open OWIFs and ftps and telnets on E2 boxes ...

[WanWizard]

Agreed. And "is in subnet" is definitely a better solution, for all those users (including me ) that don't use 192.168.x.x.

[SpaceRat]

I'll rewrite that part when 1.1-DEV becomes master.

[WanWizard]

Thanks. I plan to do the same with the rubbish network code in Enigma, once 5 is released.

[Erik Slagter]

169.254.0.0/16   

[SpaceRat]

That's the IPv4 zeroconf fallback, isn't it?

[WanWizard]

Yes. I sure hope nobody is relying on that range to get his network operational...

[SpaceRat]

Even if: Where is the problem?

[WanWizard]

With using zeroconf? Not every device supports it, and the broadcast domain is huge. There are some other issues as well, but perhaps that is "Déformation professionnelle".

[SpaceRat]

Well, I don't care much about legacy IPv4 anymore, that's why I needed to ask

My whole home network talks IP(v6) and two E2 boxes are running IP(v6)-only already.

[littlesat]

Still most people have IPv4 stuff.....

[SpaceRat]

I know

The sick shit is that ATM E2 is hardcoded for or restricted to legacy IPv4 in that many places, that it will become a show-stopper by the time when people really want to get rid of IPv4, given the current development speed.
That much to do ...

[WanWizard]

It is the same with a lot of networked equipment.

 

It is really shocking that even today a lot of ISP's aren't even thinking about it. Even a company like OVH, publicly very vocal about IPv6, can't offer IPv6 to their corporate customers, their vRack infrastructure is IPv4 only. Took quite a bit of trickery to make it work, so sites like this are IPv6 accessable.

 

E2 is on my todo list, health and time permitting I'll start on it after we've released 5.

[SpaceRat]

Hm, I've got IPv6 on my OVH server.

[WanWizard]

On the public interface of a standalone server, yes.

 

But not if your internet access is routing through a vRack to non-public servers on VLAN's. And you need the vRack if you want to build clusters, as layer-2 connectivity on the public interface is blocked by OVH, even if you have multiple servers in the same rack.

 

We have a 10G vRack to which our firewall cluster is connected, and internet traffic is routed to it. All other servers have internal vRack connectivity only, no public interfaces.

[rytec]

It's new that you also need to set password if you want to use webif outside your LAN. 

->

This does even not really work... I connect with box via open VPN and it blocks the 10.x.x.x ip address reange....

 

It would also be nice when the OWIF does not show the hidden number markers... now we see a channel with a - (dash)

Has this been solved now? or is it possible to change these settings through a Telnet session? If yes, what file do you need to edit to be able to access the open webif through a VPN connection?

Or do you first need to configurate something in the menu on the TV screen?

 

Thank you

[SpaceRat]

Through GUI:


Change the setting "Enable access from VPNs", "Auch Zugriff aus VPNs erlauben" or whatever it translates to in your language to "Yes", "Ja", "Oui", "Si", whatever.


Through telnet/ssh:

init 4
cat /etc/enigma2/settings | grep -v config.OpenWebif.vpn_access > /tmp/settings
echo config.OpenWebif.vpn_access=true >> /tmp/settings
mv /tmp/settings /etc/enigma2/settings
init 3