• The Great IPv6 Experiment

    So during the last week I decided it was about time I rebuilt my firewall, if for no other reason than to upgrade to the latest version of m0n0wall, as the version I was running dated back to 2006. Of course, naturally enough, during the course of my initial experimentation, my old firewall hardware kicked the bucket (it was an old 150Mhz P-II… I’m surprised it hadn’t died sooner), so I suddenly found myself in need of a new firewall PC. “Lucky for my, I ditched my old MythTV motherboard”, I thought to myself… what a fool I was.

    As a bit of background, I’ve been running an open wireless access point for years and years now, and to achieve reasonable security, the network topology was something like the following:

    Topology graph "Topology" { rankdir = LR; node [shape = rectangle]; WiFirewall Firewall; node [shape = circle]; Wireless -- WiFirewall; WiFirewall -- LAN; LAN -- Firewall; Firewall -- WAN; } Topology WiFirewall WiFirewall LAN LAN WiFirewall--LAN Firewall Firewall WAN WAN Firewall--WAN Wireless Wireless Wireless--WiFirewall LAN--Firewall

    Where both the WiFirewall and Firewall perform network address translation. Unfortunately, this means:

    1. The wireless network is double-NATed, which makes forwarding ports back from the firewall to the wireless network a heck of a lot more cumbersome.
    2. I have to maintain two separate sets of firewall rules.

    Plus, the WAP I have doesn’t support IPv6, so if I wanted to deploy IPv6 internally, I couldn’t do so for the wireless pool.

    Well, this screamed for a solution, hence me building a new firewall. My vision was the following:

    Topology graph "Topology" { node [shape = rectangle]; Firewall; node [shape = circle]; WAN -- Firewall; Firewall -- LAN; Firewall -- Wireless; } Topology Firewall Firewall LAN LAN Firewall--LAN Wireless Wireless Firewall--Wireless WAN WAN WAN--Firewall

    In this sort of arrangement, the firewall acts as a single NAT for both subnets, and also allows me to control access from the wireless pool to the LAN and vice versa all in one place. Plus, because both subnets are directly connected to the firewall, which supports IPv6, I can deploy v6 across my network.

    Of course, this scenario requires three NICs in the firewall, one for the WAN, one for the wireless subnet, and one for the LAN subnet. So I took my spare machine, threw three NICs in it, fired up the newest version of m0n0wall, and got… “watchdog timeout: dc0”, followed by hard locks.

    sigh

    Many hours later, after running up and down the stairs a couple dozen times, my conclusion was IRQ conflicts between one of the NICs and the USB controller on the board. Yes, that’s right, in 2010, I was fighting with IRQ conflicts. Seriously, what the heck?

    The next day, I relented and decided to try out another motherboard I had lying around (yes, that’s right, I had two spare motherboards just lying around. Go figure.) Luckily, this one seems to work beautifully, and I now have a brand new firewall set up as described above. I even configured m0n0wall’s traffic shaping such that bittorrent traffic is de-prioritized versus other traffic, so I no longer need to perform upstream throttling in rtorrent, as the firewall takes care of everything (and it works beautifully… rtorrent can now saturate my upstream, while web browsing, etc, continue to work flawlessly).

    Furthermore, I figured, hey, why not deploy IPv6 for kicks? So I went and allocated a tunnel from Hurricane Electric. They provide free IPv6 tunnels plus a free routable /48 if you want it (yes, that’s right, an 80-bit address space for nothing). You just need a router/firewall that supports it. Well, as you might imagine, m0n0wall does. Additionally, Hurricane Electric has a deal with Google such that, if you use HE’s nameservers, then all of Google’s services will be accessible over IPv6. So now anyone connected to my WAP will be able to browse the IPv6 internet, and access Google’s services over v6. Neat!

    And, as if that weren’t enough, I registered a new domain name: “b-ark.ca”. I then plan to use afraid.org, which is a free DNS hosting service which provides support for IPv4, both static and dynamic, and IPv6, both forward and reverse. Of course, I’ll need to find a way to cleanly migrate away from “frodo.dyn.gno.org”, but once I do, that address will be disappearing, and this place will be reachable at “b-ark.ca”.

  • A Long Overdue Knitting Post

    Here I am, part of the Men Who Knit webring, and I honestly can’t remember the last time I posted about knitting. “Who cares, no one reads this anyway,” you say? Okay, yeah, you’re right. But who isn’t up for a little linguistic masturbation from time to time, eh? If anything, at least it keeps my writing (read: rambling) skills bright and shiny. And, hey, at least Lenore probably reads this thing occasionally. Right?

    Anyway, where was I? Oh, right, knitting. So, yeah, I haven’t posted about knitting in a while, but I figured I’d share a little project I whipped up recently. It’s a hat. Yeah, fine big deal, a hat. But it’s a special hat. Wanna see it? Of course you do! You wouldn’t be reading this if you didn’t, right? Okay, here it is:

    Pacman Beanie

    Pretty cool, eh? Cooler yet, I actually designed this thing myself! Though, admittedly, I didn’t actually go through the effort of grabbing the graphics out of the game… a little search for “pacman ghosts” turned up this link, and voila! I was off to the races (oddly, that link is to a website called Sprite Stitch, a, quote, “Video game inspired craft weblog”… apparently I’m not the only one who had this idea). Once I had the graphics, it was a simple matter of charting out the pattern on graph paper, finding some yarn with the colours I needed, and then whipping the thing up.

    Of course, charting the pattern did take a bit of effort. The trickiest thing when translating an image into a knitting pattern is altering the images to match your row/stitch gauge. You see, my knit stitches aren’t perfectly square. In fact, they’re a little wider than they are tall. But the images in your average video game are designed to be presented on a display with square pixels. The result is that, if you convert the images directly to a pattern, they come out distorted. So you have to either alter the images to stretch/squish them as necessary, or alter your row/stitch gauge. I opted to alter the images, squishing them horizontally, which was actually a bit challenging, as they’re already very low resolution. But I think the result is pretty nice.

    But the question now, is, what next? I’m thinking another classic video game of some kind. One of the Mario Bros. characters, maybe? Or maybe something a little more obscure… Opa Opa, anyone?