Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cope bad peering of ISP Deutsche Telekom

    Scheduled Pinned Locked Moved General pfSense Questions
    16 Posts 5 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DaddyGoD
      DaddyGo @Bob.Dig
      last edited by

      @bob-dig said in Cope bad peering of ISP Deutsche Telekom:

      So guys, what to do in practice?

      this will be hard to circumvent with NAT and things like that...

      as I understood the German articles on the theme...

      Deutsche Telekom is misbehaving with large network traffic suppliers "players" such as Hurrican Electric, AWS, etc.

      open a ticket with measurements evidence and if they can't help you will have a reason to get rid of it

      https://www.peeringdb.com/net/196

      Cats bury it so they can't see it!
      (You know what I mean if you have a cat)

      Bob.DigB 1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @DaddyGo
        last edited by Bob.Dig

        @daddygo said in Cope bad peering of ISP Deutsche Telekom:

        this will be hard to circumvent with NAT and things like that...

        Couldn't I use pfBlocker to create an alias for AWS and then selectively route this through a vpn (on WAN though) or create a static route for that somehow?

        stephenw10S DaddyGoD 2 Replies Last reply Reply Quote 0
        • JKnottJ
          JKnott @Bob.Dig
          last edited by

          @bob-dig

          What do you mean by "peering". That's where carriers and ISPs meet to exchange data. For example, my ISP peers at the Toronto Internet Exchange. You mention AWS, but unless they have a point of presence at the same location as your ISP, they're not peering.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          Bob.DigB 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator @Bob.Dig
            last edited by

            You can try to do that. If you can make an alias of all of AWS you can static route it via a VPN gateway. That will apply all traffic including any client traffic not policy routed.

            Steve

            Bob.DigB 1 Reply Last reply Reply Quote 0
            • DaddyGoD
              DaddyGo @Bob.Dig
              last edited by DaddyGo

              @bob-dig said in Cope bad peering of ISP Deutsche Telekom:

              Couldn't I use pfBlocker to create an alias for AWS

              but yes, you only have to do this with all the intermediate network players ๐Ÿ˜‰

              it would be a horror job and you donโ€™t know when your packages will travel and which route

              f.e.:
              in the EU travels a lot of package on the HE network

              BTW:
              Telekom is also in a bad relationship with them

              +++edit:
              like you said you don't just notice this problem towards AWS....(?!)

              Cats bury it so they can't see it!
              (You know what I mean if you have a cat)

              1 Reply Last reply Reply Quote 0
              • Bob.DigB
                Bob.Dig LAYER 8 @stephenw10
                last edited by Bob.Dig

                @stephenw10 said in Cope bad peering of ISP Deutsche Telekom:

                You can try to do that. If you can make an alias of all of AWS you can static route it via a VPN gateway. That will apply all traffic including any client traffic not policy routed.

                Steve

                Thanks steve, but where to "put" it. It should be used at least by Suricata and pfBlocker.

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Add is as a static route in Sys > Routing > Static Routes.

                  It might get ugly with an alias that tries to include all of AWS as that will be huge. Your routing table will end up.... large!

                  There is no way to policy route traffic from the firewall itself so it will apply to all traffic that isn't otherwise policy routed.

                  Steve

                  Bob.DigB 1 Reply Last reply Reply Quote 1
                  • Bob.DigB
                    Bob.Dig LAYER 8 @stephenw10
                    last edited by Bob.Dig

                    @stephenw10 I checked with a rule on lan, worked flawlessly with the snort rules download.

                    Capturexyz.PNG

                    That table I created has 2,055 records though...

                    How could I do that or at least test it on "wan"? Is it doable in the gui?
                    I can't load these pfBlocker Aliases under System/Routing/Static Routes.

                    @DaddyGo To be clear, I want to get rid of them asap, but I signed a two year contract...

                    Bob.DigB 1 Reply Last reply Reply Quote 0
                    • Bob.DigB
                      Bob.Dig LAYER 8 @Bob.Dig
                      last edited by Bob.Dig

                      @bob-dig said in Cope bad peering of ISP Deutsche Telekom:

                      How could I do that or at least test it on "wan"? Is it doable in the gui?
                      I can't load these pfBlocker Aliases under System/Routing/Static Routes.

                      For the lols I guess, I tried this, but also wasn't working:

                      Captureabba.PNG

                      I do have a VPS though and routing it there seems to be a viable solution. But I have configured it to connect to me and not the other way around and I am somewhat noobish when it comes to my own OVPN-installations, so the firewall itself will be the last to have internet. ๐Ÿ™„

                      1 Reply Last reply Reply Quote 0
                      • Bob.DigB
                        Bob.Dig LAYER 8 @JKnott
                        last edited by

                        @jknott said in Cope bad peering of ISP Deutsche Telekom:

                        You mention AWS, but unless they have a point of presence at the same location as your ISP, they're not peering.

                        Ok, then I meant routing because of bad peering or just bad routing in general. ๐Ÿ˜‰

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          Yeah, it would need to actually route to it using a static route. Outbound NAT does not route traffic.

                          You're right though, you can't use a URL alias in a static route. Which is reasonable since adding 2055 routes to the table would be.... ugly at best!

                          Steve

                          1 Reply Last reply Reply Quote 1
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.