Fork 0

3.2 KiB

LTE Backup

We have a network backup via vultr. As it's difficult to convey its architecture via netbox, we document it slightly more here.


The Device (oob1.waw)

oob1.waw is a WDR3600 running OpenWRT, present in dcr01. It has a USB modem plugged in for LTE uplink.

See netbox for L1 connectivity diagrams.

The Bridge (

There is an L2 subnet/bridge that spans three boxes: edge01.waw, oob1.waw and edge01.fra. This network is dieectly available on one of oob1.waw's ports, and edge01.waw connects to it (for information on ports, see netbox). - address of oob1.waw on bridge, set on br-bgpvpn on OpenWRT - address of edge01.waw on bridge, set on physical interface on edge - address of edge01.fra on bridge, set on OpenVPN tap

This subnet is announced by edge01.waw to its main upstreams and through a huge prepend on edge01.fra. When edge01.waw's main uplink goes down, traffic gets routed through edge01.fra, as with the rest of the current production subnet ( However, if edge01.waw is dead, the subnet will stop being announced at all. You will then have to manually jump through edge01.fra.bgp.wtf. (oob1.waw) is not publicly routed, as oob1 has its main routing table default gw via LTE. There is a runbook below on how to access this box.

The OpenVPN tunnel

There is an OpenVPN tunnel set between oob1.waw and edge01.fra. edge01.fra is the server, listening on its publically routed internet adress. oob1 is the client. On oob1, the resulting tap interface is part of the br-bgpvpn bridge.

oob1.waw has a USB modem plugged in with a Play SIM card. The modem exposes a RFC1918 network that it NATs itself (or passes over to a CGNAT at Play?), oob1 has a DHCP address in this subnet.

The BGP session

This entire setup lets us establish a non-multihop iBGP session between and, and that's what we do.

Access to

oob1 sits in this network at .2, and is plugged into the management switch in dcr01. All LAN (yellow) ports on oob1 are also part of this subnet.

Access runbook

oob1.waw, if edge01.waw is up:

$ ssh -J root@edge01.waw.bgp.wtf root@

oob1.waw, if edge01.fra is up and the LTE tunnel is up (but edge01.waw is dead):

$ ssh -J root@edge01.fra.bgp.wtf root@

LTE modem interface

$ sudo ip a add dev lo
$ sudo ssh -J root@edge01.waw.bgp.wtf root@ -L
$ # now you can visit on your local web browser


oob1 and edge01.fra are currently fully manually managed. q3k has access.

SIM Card Plan

See: netbox for phone number and latest validity information.

To manage the SIM plan, you'll have to access the modem web interface as above. From there, you can bootstrap yourself access to Play24. Generally topping up gives you tons of data, so you can do that if seemingly the link is down. Then, you can try logging into Play24 and buying a year-long subscription package for 50PLN.