amos.shapira (Amos S)
User

Projects

Today

  • Clear sailing ahead.

Tomorrow

  • Clear sailing ahead.

Monday

  • Clear sailing ahead.

User Details

User Since
Jul 20 2016, 7:56 AM (70 w, 3 d)
Availability
Available

Recent Activity

Aug 2 2017

amos.shapira added Q105: Next Developer Meeting (Answer 147).
Aug 2 2017, 11:51 PM

Jul 26 2017

amos.shapira added a comment to T266: Create image of VyOS 1.2.0 for Amazon Web Services.

That's one way to get it done.
You can also support multiple regions by copying the uploaded AMI using aws ec2 copy-image if you like.
I left a comment suggesting improvement to by using awss own --query flag to extract the output instead of filtering through jq (thus reducing the need for yet another tool).
I gave instructions in the comment as much as I can without testing the specific command.

Jul 26 2017, 8:50 PM · AWS Support, VyOS 1.2.x

Jul 6 2017

amos.shapira added a comment to T266: Create image of VyOS 1.2.0 for Amazon Web Services.

Hi Julian,

Jul 6 2017, 2:02 AM · AWS Support, VyOS 1.2.x

Mar 7 2017

amos.shapira added a comment to T100: Create image for Google Compute Engine.
In T100#4801, @silverbp wrote:

I don't know enough to be able to do this in GCE without some help, not sure where to start. I was using the AWS packer image as an example but got stuck. If I have something to go off of, I can use that and work through it and/or ask questions as needed.

Mar 7 2017, 3:13 AM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support

Feb 18 2017

amos.shapira added a comment to T266: Create image of VyOS 1.2.0 for Amazon Web Services.

Just posting here in case someone can help me out -

Feb 18 2017, 6:58 AM · AWS Support, VyOS 1.2.x
amos.shapira added a comment to T100: Create image for Google Compute Engine.
In T100#4598, @mtz4718 wrote:

Is this en-devour dead? I really want to help but I wonder I'd be much use. If there's any dumb testing or boring tasks let me know.

Feb 18 2017, 2:13 AM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support

Feb 8 2017

amos.shapira added a comment to T266: Create image of VyOS 1.2.0 for Amazon Web Services.

I'm not building the VyOS from source but extract it from the nightly .iso file.
This works great for me with VyOS 1.1.7.
Debian Jessie doesn't have the kernel 3.18 which is required for OverlayFS.

Feb 8 2017, 1:55 AM · AWS Support, VyOS 1.2.x

Feb 7 2017

amos.shapira added a comment to T266: Create image of VyOS 1.2.0 for Amazon Web Services.

I'm building the VyOS disk image under another OS (latest test using Ubuntu 16.04 LTS) and was testing the extra configuration script under chroot. Your response would explain that the missing unionfs packages on the host OS could explain the error I get. I'll install them and try again.

Feb 7 2017, 7:24 PM · AWS Support, VyOS 1.2.x
amos.shapira added a comment to T266: Create image of VyOS 1.2.0 for Amazon Web Services.

I managed to get past the OverlayFS issue by adding:

Feb 7 2017, 12:02 PM · AWS Support, VyOS 1.2.x

Feb 6 2017

amos.shapira updated subscribers of T266: Create image of VyOS 1.2.0 for Amazon Web Services.

Question from @silverbp :>>! In T100#4449, @silverbp wrote:

Feb 6 2017, 11:53 PM · AWS Support, VyOS 1.2.x
amos.shapira created T266: Create image of VyOS 1.2.0 for Amazon Web Services.
Feb 6 2017, 11:43 PM · AWS Support, VyOS 1.2.x

Feb 4 2017

amos.shapira added a comment to T100: Create image for Google Compute Engine.

@syncer yes please split it off. Sorry for taking over the ticket.

Feb 4 2017, 9:07 PM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support
amos.shapira added a comment to T100: Create image for Google Compute Engine.

I got the VyOS 1.2 AMI built by Packer but it doesn't get the ssh key pulled from the metadata and stored in the configuration. With lots of manual testing I got to a stage where "/bin/cli-shell-api setupSession" fails with a core dump.

Feb 4 2017, 10:59 AM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support
amos.shapira added a comment to T100: Create image for Google Compute Engine.

I've updated https://github.com/amosshapira/thermal to let you specify VPC ID and subnet ID required to run Packer in AWS.

Feb 4 2017, 12:24 AM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support

Feb 2 2017

amos.shapira added a comment to T100: Create image for Google Compute Engine.

How do you get the code for 1.2 into your image? I use the ISO of 1.1.7 and started work for 1.2.0 and made some progress but stopped when I hit too many problems and realised that 1.2 isn't stable (that was a few months ago).

Feb 2 2017, 12:48 AM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support
amos.shapira added a comment to T100: Create image for Google Compute Engine.

I've just verified that the AMI gets built and runs correctly after making sure that the VPC ID and Subnet ID are set correctly in packer.json. I'll update my code when I get home. The issue to track this is https://github.com/amosshapira/thermal/issues/5

Feb 2 2017, 12:47 AM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support

Feb 1 2017

amos.shapira added a comment to T100: Create image for Google Compute Engine.

ami-72343365 is Ubuntu official public trusty AMI in us-east-1, name "ubuntu/images/hvm-ssd/ubuntu-trusty-14.04-amd64-server-20161205" owner id "099720109477"

Feb 1 2017, 11:10 PM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support
amos.shapira added a comment to T100: Create image for Google Compute Engine.

@silverbp have you considered using Packer? I got Packer building AMI's of VyOS on AWS here: https://github.com/amosshapira/thermal/tree/master/vyos-image, perhaps you can use it as a basis for a GCE image. Let me know if you need help with understanding the code there (it uses a trick to work around Packer's lack of support for creating the final image from a "side-mounted" volume by switching volumes and rebooting).

Feb 1 2017, 4:43 AM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support

Nov 10 2016

amos.shapira added a comment to T190: two factor authentication for OpenVPN remote VPN tunnels.

This is different but might be a little related - FoxPass publishes a one-line tweak to VyOS 1.0 to let them support two-factor authentication for IPSec VPN at https://foxpass.readme.io/docs/vyatta-vyos-ubiquity-vpn-clients
It would be nice to have this change possible via an option.

Nov 10 2016, 11:26 AM · VyOS 1.2.x

Sep 30 2016

amos.shapira added a comment to T164: Create image for MicroSoft Azure.

I'm not sure how much this will help, but I have a branch on a fork of vyos-build to build AMI's from ISO files: https://github.com/amosshapira/vyos-build/tree/make-ami

Sep 30 2016, 10:22 PM · VyOS 1.2.x, Hyper-V/Azure Support

Sep 17 2016

amos.shapira created T157: Remove "install system" command.
Sep 17 2016, 2:49 AM · VyOS 1.2.x

Sep 9 2016

amos.shapira added a comment to T100: Create image for Google Compute Engine.

I think the usual short name for Google Cloud is "GCE" (Google Cloud Engine).

Sep 9 2016, 7:44 PM · VyOS 2.0.x, VyOS 1.2.x, Google Cloud Platform Support

Sep 7 2016

amos.shapira added a watcher for VyOS 1.1.x: amos.shapira.
Sep 7 2016, 10:27 PM
amos.shapira added a watcher for AWS Support: amos.shapira.
Sep 7 2016, 10:26 PM
amos.shapira added a comment to T138: Cloud Auto VPN feature.

I have a python script which will read a VPN Connection configuration from a Virtual Gateway and emit VyOS commands to configure it as a client to that VPN connection.

Sep 7 2016, 10:16 PM · VyOS 1.2.x, Hyper-V/Azure Support, Google Cloud Platform Support , AWS Support
amos.shapira added a comment to Q39: How to force source address over IPsec site-to-site VPN? (Answer 79).

The 169.254/16 is a special link-local subnet which by definition can't be routed outside the immediate link (as far as I follow it). See https://tools.ietf.org/html/rfc3927 for authoritative definition.

Sep 7 2016, 9:57 PM

Aug 31 2016

amos.shapira added a comment to T135: Any need to respond to the encryption weakness described in sweet32.io?.

Thanks for the update.
Where can I get 1.2 to help testing?

Aug 31 2016, 10:01 PM

Aug 27 2016

amos.shapira added a comment to T135: Any need to respond to the encryption weakness described in sweet32.io?.

Thanks. I'll try to find how to follow this advice.

Aug 27 2016, 11:45 PM

Aug 25 2016

amos.shapira created T135: Any need to respond to the encryption weakness described in sweet32.io?.
Aug 25 2016, 1:06 AM

Aug 17 2016

amos.shapira added a comment to Q39: How to force source address over IPsec site-to-site VPN? (Answer 74).

Thanks for your research and findings.

Aug 17 2016, 9:27 PM

Aug 16 2016

amos.shapira added a comment to Q39: How to force source address over IPsec site-to-site VPN?.

@jeffbearer how about policy routing and telling Linux that traffic should only use local 169.254/16 source address if its destination is also on 169.254?

Aug 16 2016, 10:01 PM · VyOS 1.1.x
amos.shapira added a comment to Q39: How to force source address over IPsec site-to-site VPN? (Answer 72).

That (using iptables to munge the DNS traffic) sounds like a great work-around. I like it because if it works then I can set it as part of the VyOS standard configuration.

Aug 16 2016, 9:57 PM
amos.shapira added a comment to Q39: How to force source address over IPsec site-to-site VPN? (Answer 72).

I have BGP tunnel up over the IPSec tunnel between the VyOS and the AWS Virtual GW.

Aug 16 2016, 10:02 AM

Aug 12 2016

amos.shapira added a comment to Q39: How to force source address over IPsec site-to-site VPN?.

I'm not an expert but my understanding of the definition of 169.254/16 is that it's a "link local" address and shouldn't be used for "real traffic", e.g. AWS uses it to pass EC2 metadata through 169.254.169.254, or see https://tools.ietf.org/html/rfc3927 for how this network is defined.
So I think that the solution should more in the direction of somehow telling VyOS to prefer the local interface address over the 169.254 address.

Aug 12 2016, 10:09 PM · VyOS 1.1.x

Aug 6 2016

amos.shapira added a comment to Q39: How to force source address over IPsec site-to-site VPN?.

Thanks but I can't use GRE or OVPN since the other side is AWS virtual gateway (more specifically, I use it as a Virtual CloudHub connecting offices and multiple VPC's).

Aug 6 2016, 11:18 AM · VyOS 1.1.x

Jul 20 2016

amos.shapira updated Q39: How to force source address over IPsec site-to-site VPN? from to How to force source address over IPsec site-to-site VPN?.
Jul 20 2016, 8:13 AM · VyOS 1.1.x