Ersatz Internet

This is going to be a “work in progress” posting. I’m just going to be throwing things up here as they come to mind, rather than working out the details and making it a “decent posting”.

The reason is very simple: The Egyptian Government cut off of internet services shows that this can happen to anyone at any time and it would be good to be prepared. While I have no idea if this will help anyone, time is of the essence. For folks not in Egypt, having an idea what services and materials to get in advance and how to prepare can be of benefit.

Network Basics

For most countries, they have a major link connecting them to the rest of the world. They also have key “domain name services” they control. A network shutdown may involve both of those, and may also involve the smaller domains inside the country (local networks). Depending on which part is being shut off, you need to replace each of them.

THE most likely disruption is a shutdown of the “boundary routers” that connect the interior networks to the Rest Of World. If that is the case, you need a different “pipe” to the world. That’s the hardest part to fix in size, but in some ways the easiest to fix for a single person for small messages.

If you connect to your internet service and can see the local sites (like the government web site or the local department store advertizing) they have only shut off the boundary to the rest of the world. If you get nothing, or nearly nothing, they have shut down the whole thing. If it’s just the boundary, internal connectivity ‘group to group’ becomes easier, but routing a bit more complex for going out of the country). If you can ping a site, like google.com, via IP number directly ( I always keep a list of known numbers for testing…) then it is Domain Name Service that is being disrupted. Setting up your own DNS server can fix that (and a cacheing DNS server is good to have anyway…)

OK, how do you get past it?

Get off the freeway… take a minor side road. No, it can’t carry the whole freeway full of traffic, but it can carry you.

Personal Connectivity

Many laptops have a built in modem, typically unused. You need to turn it on and use it. As long as their is basic telephone service, you can place a phone call to an internet access point outside the country. I have 2 ISPs (Internet Service Providers) and both provide “dial up access” as a “backup” service. So from anywhere in the world I can call their USA phone numbers and be “on the internet”. For desktop machines, you can buy and attach a modem if you do not already have one. ( I recommend that everyone have one of these in inventory ‘just in case’ and use it from time to time. I do. I have one built in to my “internet router box” so if my main network is down, I can ‘bring up the dial-up”. This was standard procedure for decades in commercial network designs with ‘dial up links’ next to the “leased lines” for emergency use.

Once ONE person has internet access in this way, they can then let other folks “sign up” for a dial up account using their system to access the foreign ISP. It will take a credit card, but not much more. Yes, it is possible to monitor a phone system and detect modem signals on a line, and shut it down. Nobody is really set up to do that ‘en mass’. IFF the whole phone system is shut down, you have real problems and connectivity will be lowered.

OK, are there other options?

Satellite links. Many folks get ISP service from a satellite. If you have that, you are already working.

Company “leased lines”. Many companies will have a private wire that connects their remote offices to their main corporate office. If that is the case, the in-house IT support folks can route your local site through that leased line and get internet access from the office that is outside the country. So check connectivity at work, and from any remote company offices that your office can reach. You may find that you need to ‘remote login’ to a machine in the remote location, but your I.T. folks ought to be able to set up the connectivity. Frankly, in the systems I built, if one site lost internet access, it would often just automatically route to another ( you can set that ‘routing preference’ in the ‘routing tables’ of your ‘routers’ that do all this connecting…

Border Locations. AT the border, you may be able to pick up wireless access for an adjacent country. So if there is a Starbucks just over the boarder, see if you can wirelessly connect to it for internet. I have a minature ‘dish’ antenna for my laptop that can connect over about a 1 block range. Not a long ways, but it would be enough in some cases… Hawking makes it and it cost me about $60.

http://www.hawkingtech.com/products/productlist.php?CatID=32&FamID=60&ProdID=386

So, to recap: Modem, work leased line, satellite link, border location wireless.

Oh, and it is possible for one computer to talk to another private location over a modem too, so you could, if you wished, have your computer and modem call another individual (not an ISP) out of the country and connect directly to them.

There are some other ways, but those are the “big lumps”. (You can ‘tunnel’ a signal inside other allowed communications, but that’s a bit complicated for now).

Finally: “Never underestimate the bandwidth of a truck full of DVDs or Thumb Drives”. It will take a long time for data to get from one place to another, but with dedicated servers on your private network, you can swap updates back and forth via physical transport of media to sites outside that do have internet access.

Group Connectivity

It is also possible that you don’t really care so much about reaching CNN New York and are more interested in contacting folks in your area. For that, you can set up ‘group intranets.

So a typical home or work wireless access node can be locked down, or opened up to other folks. If I left mine open, my neighbor can connect to it, and then we two can swap information. (At that point, we will want to have a shared Domain Name Servier or DNS server, or we will need to do things by calling each other by “IP Number” or Internet Protocol Number. Linux easily provides DNS services as does some releases of Microsoft Windows. Consult the manual pages for DNS if needed.) So, for example, I have a Linux box. I can “telnet” to my Linux box from my Windows machine by opening a ‘terminal window’ and typing “Telnet 192.168.1.22” (or whatever the IP number is that my machine has got). So if my neighbor gets on MY wireless node, then he can do the same. We can share file systems (with various remote file sharing protocols) and we can even set up things like individual email and “FTP” servers.

IFF I’ve got a ‘dial up’ internet access to outside the country running, I can turn on ‘internet sharing’ and my neighbor will get that access as well. It will be slow (as we are sharing one phone line) but it will exist.

Now is where it gets fun.

That neighbor can turn on his wireless router and internet sharing and let HIS neighbor get access through him.

You could do this to some depth, but after about 20 “hops” it is going to be pretty slow and a bit failure prone. Still, it WILL be “up” and with restraint (i.e. not watching videos) folks can get a lot of news and mail distributed. This, BTW, is how the Internet started but using modems instead of wireless links.

Inside each Linux and Unix box are the ‘primitive’ programs that made this go. All you need to do is turn them on again and learn out to configure your routing and your DNS. Then turn on a “web server” such as Apache and a mail server (there are several). So imagine a group of “20 deep” hops. Each home with 4 neighbors. That’s 4^20 total people… It doesn’t take long to connect a neighborhood. At about a half dozen users, your dial up will start to be a painfully slow, so things like “DNS Lookups” will be better from a local Linux server and information exchange would be better routed through a Linux “News” and “Mail” server as primarily text. I’ve had 4000 person companies run OK on a single dial up line for such basic services (prior to the “multi media’ age).

But once you have a few hundred folks up, they ought to be rapidly getting their own “dial up” accounts and / or finding a connection through a work site (or over a border fence …)

Router Tuning

Each route has a “hop count” and weighting. So I could configure my router (if a smart one, and Linux / Unix know how to be smart routers) to take my modem to the internet if it’s available, or try the one in the next home over if mine is off… and the one 2 homes over if that one is down too. In this way, a neighborhood becomes a ‘tapestry’ of connections with data flowing to wherever their is connectivity. One home gets taken out, the data just flows around that break to the ones that are still up.

This is a bit ‘esoteric’ so I’m not going to go into it just yet, but just ‘be advised’ that you want to find an I.T. guy to set up a routing plan for larger groups.

OK, so you have your “neighborhood” and it has some limited and sporadic connectivity to the internet. How do you connect to the next “block” over? Well, anyone on an edge could just toss a network cable over their fence and connect the two domains (with proper routing turned on at the edge between them).

For example, my “wireless box” has some plug in wired connections. An ethernet cable plugged in their, and over the fence, connects just as well as the wireless connection. Similiarly, my Linux box has 2 NICS or “Network Interface Cards” in it. I could plug one into my network, the other into their network, route between them, and everyone on MY network can now talk to everyone on THEIR network. Someone would need to act as ‘network guy’ and make sure the numbering didn’t collide and that the DNS servers knew about each other (but this is a normal IT function that a lot of folks ought to already know how to do). So my DNS server can be informed that 10.2.2.xxx is “serviced by Bob’s DNS at 10.2.2.129 so just ask him” and we’re ‘good to go’.

In this way, each neighborhood domain can link up with other domains and create one large “Intranet”. Folks wanting to coordinate inside that group need not go to the intERnet do do so. This, btw, is the type of structure used inside most companies. Your “inside” stuff is on your company “intRAnet” and only the outside stuff is on the internet. Similarly, when two companies partner on things, a DMZ or “Demilatarized Zone” or sometimes even a “partner network” is set up between them. Someplace they can both reach through their routers, but where they don’t get complete acess inside the other guys home network.

At this point, you have your neighborhood network, some limited Internet via modems and anyone with a satellite connection, and you have some connections to similar other groups around the margin. IF any of them gets a line to a corporate “Leased line” or can get a wireless link over the boarder, you all get more access and more data can flow (with updates to DNS and router tables…)

Honorable Mention

Ham Radio operators originated the cell phone (called ‘packet radio’) technology. They can still send data over radio links. If any of the folks in the intranet has this setup, they can provide that connectivity to the group.

Dialup can happen ‘house to house’. You con’t need to have a modem to an ISP, nor a wireless to your neighbor, nor a wire tossed over the fence. You could have a modem on your computer call a modem on another person’s private machine elsewhere (in another city or even another country) in what is called a ‘peer to peer’ connection. So even if all the ISP dial up numbers get “blocked” at the telephone company, unless they want to block ALL outgoing phone calls, you can call a friend at their home on their modem, then hop onto the internet out thier connection. Yes, this takes some ‘setting up’ of the modem and of their computer to ‘share’ the interent access. Of particular fun here is that a FAX modem uses different tones than a DATA modem, yet most modems can talk both. So if the country blocks DATA but lets FAX flow (I’m not sure how they could do that, but if they did…) you could configure your modem and your friends modem to both ‘talk FAX’ and ship data… and get out on a “FAX” line…

Mirror Servers. Some key servers can be replicated inside the intranet. Take a ‘thumb drive’ or a long weekend download for the first image, then set the system to ‘mirror’ changes. Now only the ‘difference’ has to travel over that internet connection, most folks inside can use the mirror copy. Having a mirror server on a modem link to another outside server is a very good way to keep line use low while providing a lot more service fast internally.

In Review

It’s very helpful to have a couple of modems and an ISP account with global access.

Set up your own internal servers for DNS ( “caching DNS server”), email, and FTP (File Transfer Protocol).

Set up your own internal network with a private IP number (such as 10.x.x.x. or 192.168.x.x) and then extend it toward the edges. When you encounter another group, put in a boundary router between you. (Possiblly using “NAT” or Network Address Translation to cure any numbering conflicts).

Exploit any other existing connection options (satellite, wireless over borders, packet radio, wire over a fence, heck I even sent 9600 baud through my old Startac cell phone telephone with a special cable…) to add redundant connections.

Get a good book on Linux and a good book on network routing (or a good friend who’s good at it…)

Learn to configure and use Linux (or if you really must, a lot of this can be done with Windows if you have a relase with the tools in it, like the ‘server’ editions).

What we are doing here is basically ‘building an intranet” and a google search on that term will yield many useful guides. Then we’re gluing on any ersatz ISP connection we can get via whatever connectivity still exists, be it modem or wireless or whatever. An example of google results would be these clase notes:

http://www.dhark.com/intranet.html

There are even “for dummies” books on how to do it:

http://www.amazon.com/Building-Intranet-Dummies-John-Fronckowiak/dp/076450276X

So the basic approach is to build a neighborhood network, bring up some ‘intranet’ services for internal usage, connect to the ‘outside’ by any wires or wireless available, and then use caching servers / mirrors to reduce total network traffic to the outside world.

What if basic connectivity works, but sites are blocked?

This is a simple censorship issue. (Ususally done via DNS and IP blocking). For that you need your own DNS server (updated from ‘outside’) and it is useful to have a ‘proxy server’ you can reach ‘outside’. If need be, you can set up a private encrypted “tunnel” to an outside helper / friend who then provides you a non-filtered access to the interent. That is a bit outside the scope of this posting as it stands now, but here are some links to look at. The general technique is either to use a proxy server or set up a private encrypted tunnel. There is GNU software to do this, and the technology / protocol (called “IPSEC” or Internet Protocal Security) is built in to many routers.

http://www.stunnel.org/

There is even a wiki on it ;-)

http://en.wikipedia.org/wiki/Stunnel

So if you DO have basic connectivity, it’s just a disruption of what you can see, then there are easy ways to flow around that. If you do NOT have basic connectivity, you need to establish that (and DNS) first. Then you can layer on other levels of security and ‘tunneling’.

Some of these are semi-randomly chosen, so I don’t know how trusted any software they might offer would be…

A google search can even turn up some folks doing this as a commercial service. A reminder, these are the result of a random google search on a key phrase such as “vpn tunnel” and I have no idea if these are reputable examples or not:

http://www.personalvpn.org/

http://www.vpnaccounts.com/

And pointers to proxy servers:

http://webupon.com/services/bypassing-internet-censorship/

Subscribe to feed