Pneumatic Antenna Launcher

I recently got a Pneumatic Antenna Launcher from Alan Biocca Engineering, the CSV17. Very well made, fires weighted tennis balls, and pumps up with bicycle pump.

Every other launcher I've seen fire lead weights which are asking for trouble, unless you're going over a tree with nothing of consequence behind it (e.g. an empty field).

I got a line over a Fir tree branch at 60ft on the first try with 50 psi (the 90 psi max will go 150+ ft), and with-in a couple hours in the rain I had my OCFD up where it clears the other trees around. At the previous height of 40ft I was always getting snagged in the Maple trees, and couldn't get one leg fully clear of one.

The OCFD has come to life on 80m and 40m, signals are noticeably stronger, and it's uncovered a layer of weaker signals previously lost in the noise. I've started to hear more DX on 20m too. On 6m the local repeaters are much stronger which suggests it might be useful here too.

The antenna launcher has already paid for it self in ease of getting a lines accurately over trees, and improved antenna performance as a result!

Report Linux IP, hostname & name servers

This script finds Linux hosts, and reports their IP address, FQDN hostname, name servers and outputs results in CSV format.

Details:

• nmap is used to scan IP ranges for hosts listing on port 22, then
• Remote ssh command is run to connect to each host, find FQDN (hostname -f) and configured name severs (resolv.conf)
• This assumes the user running the script has the privilege to login to each host via SSH
• The RSA key fingerprint prompt is auto accepted and the RSA key fingerprint is then discarded so that your ~/.ssh/known_hosts file is not filled up with hundreds or thousands of  RSA key fingerprints
• Results are output to CSV file.

https://github.com/lonney9/BashScripts/blob/master/Report-IP-DNS-FQDN-CSV.sh

Windows DNS Server Query Stats

Generate reports from Windows DNS servers showing client query statistics. This will simply show the IP/hostname of the client, and how many queries it has generated. We used this to track down what was talking to our Windows DNS servers as part of a network migration project.

Uses Windows DNS server debug logging and Microsoft Log Parser 2.2.

DNS servers output log to local storage, log directory is shared read-only.

An intermediate host is used to run a PowerShell script via Task Scheduler that reads the log over the network, parses it and outputs a CSV and HTML report for easy viewing. This removes the need for DCs / DNS hosts to run a script and users to login to them to retrieve the report.

The script is configured to only parse the log if has been X number of hours (e.g. 12) since the last report was generated and if the log file is over X (e.g. 50mb) size. The Windows DNS server debug log is cleared and started fresh when max log size is reached (this is by design). This way we can schedule the script to run every few minutes, and capture a reasonable amount of data a couple times a day, if nether condition is met, the script does nothing.

The scripts I assembled plus config info can be found at https://github.com/lonney9/WindowsDnsServerReporting 

Setup free Cloud VPN with Ad Blocking

Use Oracle Cloud always free tier, OpenVPN, Pi-Hole, and Quad9 DNS to setup your own ad, tracking, and malware blocking VPN!

Oracle Cloud offers an always free tier option which includes the ability to provision up-to two Linux VMs (from a choice of distributions) with 1 GB memory, 50 GB storage each, and public IP addresses. Ideal for this type of work, and considering these VMs are running on HA (high availability) hardware in a datacenter with redundant power and network links makes it hard to beat for the price!

Together with Pi-Hole and OpenVPN which has clients for Windows, macOS, Linux, iOS, and Android it's fairly easy to setup and get working.

Oracle Cloud VM

Go-to https://docs.cloud.oracle.com/en-us/iaas/Content/home.htm to learn about the services, how to get setup with the free account, and Launch a Linux instance guide which will walk you through getting a VM up and running with networking, which you can then SSH into.

When creating a VM the default image is Oracle Linux. I chose the Ubuntu 20.04 image (not the minimal one), as I'm most familiar with Debian/Ubuntu.

Once a VM is up and running, and logged in via SSH, update the system and reboot:

apt-get update

apt-get upgrade

reboot

Installing OpenVPN

Using the script from https://github.com/angristan/openvpn-install.

I went with the defaults except it does not detect the public IP of the Oracle cloud instance, manually enter that. For the DNS servers, I prefer Quad9 which blocks known Malware domains and doesn't log. This selection doesn't matter too much because we're going to change it later to use the DNS server Pi-Hole installs, which I choose Quad9 for upstream DNS.

After installing the script prompts to setup a user and outputs a config file for the client.

• Port 1194 has to be enabled via the Oracle Cloud Console > Networking > Virtual Cloud Networks > [network name you created] > Public Subnet > Default Security List > add a rule for UDP port 1194 (stateful).
• Angristan's OpenVPN install script made the necessary changes to iptables and everything just worked.
• Note that the default iptables contains a number of rules for the iSCSI boot block volume, do not clear the iptables rules or modify these rules. More info in Oracle-Provided Images > Essential Firewall Rules.

After installing OpenVPN, I tested it with the defaults before moving on to installing Pi-Hole.

Note: This OpenVPN install script creates a pair a iptables scripts that are run when the OpenVPN service starts and stops. One adds rules, one removes them:

/etc/iptables/add-openvpn-rules.sh

/etc/iptables/rm-openvpn-rules.sh

Be aware these use the -I option to insert the rules at the top of their respective chains, if like me you have some geo whitelist and tor exit node block ipsets being inserted under the "related, established" connection tracking rule (usually 1st) 2nd and 3rd, then you may want to insert the INPUT rules further down by increasing the number after INPUT, e.g:

iptables -I INPUT 7 -i ens3 -p udp -m udp --dport 1194 -j ACCEPT

iptables -I INPUT 8 -i tun0 -j ACCEPT

There is also PiVPN (better to install it after PiHole if used) which will run on any Debian based system, not used or tested it yet, just making a note of it.

IPv6

The Oracle VM doesn't offer IPv6 (fine by me for now), however I found that on some operating systems if the local network assigned a valid routable IPv6 address it would prefer that and bypass the VPN.

To close that off, in the server config add:

push "block-ipv6"

DNS Servers

I also found that on Apple devices, if you push a private IP for primary DNS (like above with 10.8.0.1), and a public IP for secondary DNS - both are queries, and if the results dont match (because the private IP primary DNS is being filtered by Pi-Hole), then it will use the result from the public secondary!

This effectively bypasses the VPN for DNS, ads and junk will appear.

Only push one DNS server!

Installing Pi-Hole

Install methods are listed at https://github.com/pi-hole/pi-hole/#one-step-automated-install, I use the curl command.

The Pi-Hole script offers a list of upsteam DNS servers to use, I prefer Quad9 as they block known malware domains and don't log.

Configure Pi-Hole to listen on all interfaces, by default it picks an Ethernet interface, go-to http://10.8.0.1/admin > login > Settings > DNS > Listen on all interfaces.

Update OpenVPN server configuration to push the VPN tunnel IP for DNS, edit /etc/openvpn/server.conf Comment out the preset servers and add:

push "dhcp-option DNS 10.8.0.1"

# push "dhcp-option DNS 9.9.9.9"

# push "dhcp-option DNS 149.112.112.112"

Restart OpenVPN server:

systemctl restart openvpn@server

Logging

If logging is a concern, this can be disabled.

Per https://discourse.pi-hole.net/t/the-pihole-command-with-examples/738 > Enable/Disable Logging

sudo pihole logging off

In the Pi-Hole interface, Settings > Privacy > Anonymous mode

Per https://www.reddit.com/r/pihole/comments/9rxujj/delete_long_term_data/e8khbmo/

sudo service pihole-FTL stop

sudo rm /etc/pihole/pihole-FTL.db

sudo service pihole-FTL start

Clear out archived copies of /var/log/pihole.log with

sudo rm /var/log/pihole.log*

This will leave basic stats available on the dashboard, but wont log or display anything specific about clients or DNS queries.

I "think" that is all that is required, searching for info on how to turn off logging doesn't turn up info / explanations on how-to clearly and fully do this in one place.

Automatic Updates

The Oracle Ubuntu image appears to be partially setup for automatic updates, it was already installed and had a config file present.

The options I configured in /etc/apt/apt.conf.d/50unattended-upgrades were:

// Automatically reboot *WITHOUT CONFIRMATION* if

//  the file /var/run/reboot-required is found after the upgrade

Unattended-Upgrade::Automatic-Reboot "true";

// Automatically reboot even if there are users currently logged in

// when Unattended-Upgrade::Automatic-Reboot is set to true

Unattended-Upgrade::Automatic-Reboot-WithUsers "true";

// If automatic reboot is enabled and needed, reboot at the specific

// time instead of immediately

//  Default: "now"

Unattended-Upgrade::Automatic-Reboot-Time "10:00";

Note the time is in UTC (assuming it's the default timezone in Oracle Cloud VMs). 10am UTC is 2am Pacific Time in my case.

Incidentally I found when trying to get automatic-updates working on my Raspberry Pi that it doesn't work, the config file needs to be edited - https://raspberrypi.stackexchange.com/a/102350

Some more info on automatic-updates

https://linuxiac.com/how-to-set-up-automatic-updates-on-debian/

https://bipulkkuri.medium.com/auto-update-upgrade-raspberry-pi-b5b7b43ced64

Pi-Hole Updates

Running pihole -up manually will update the Pi-Hole software.

To automate it, sudo -i to switch to root, crontab -e to edit the crontab, and enter:

# Pi-Hole weekly update

0 11 * * 0 /usr/local/bin/pihole -up > /var/log/pihole-up.log

Minutes, Hours, Days of month, Months of year, Day of week, Command, What to do with the output.

This will run the update at 11:00 am once a week on Sunday (day zero of the week) in the timezone of the machine, since mine is UTC and I'm Pacific time -8 hours this is 3am every Sunday morning. Output the results to /var/log/pihole-up.log. Plenty of crontab generators online.

Speedtest

Speedtest-cli is a command line speed test tool (requires Python). From the VM it reports 420 to 490 mbps in both directions. Over the VPN tunnel I get up-to 100 mbps.

Additional Block Lists

Additional block lists can be added via Group Management > Adlists

These don't seem to be an exact science, DYOR.

See:

• https://firebog.net
• https://github.com/jacklul/pihole-updatelists
• https://github.com/blocklistproject/Lists
• https://tsmith.co/2018/setting-up-additional-pi-hole-blocklists-forwarding-for-homelab
• https://codeberg.org/spootle/blocklist/ - no longer updated.

Enable client to client communication

In /etc/openvpn/server.conf add an entry/line with: client-to-client

Add an iptables forwarding rule to enable traffic to pass out of and back into the tun0 interface:

iptables -A FORWARD -i tun0 -o tun0 -j ACCEPT

I later found I didn't need this rule, maybe a system reboot after the addition of client-to-client to server.conf works on its own?

Restart OpenVPN server and check status: 

systemctl restart openvpn

systemctl status openvpn

Multiple Instances for both UDP and TCP

(Rough notes)

By default OpenVPN is setup to listen on UDP port 1194, UDP is preferred as its more efficient and any TCP traffic being tunneled will handle dropped packet retries.

Some networks may block outgoing UDP traffic and/or limit traffic to web browsing only on TCP ports 80 and 443.

A work around is to enable multiple instances of OpenVPN server, one listening on UDP and one on TCP port 443 which is least likely to be restricted.

Copy /etc/openvpn/server.conf to /etc/openvpn/server2.conf

Edit the original server.conf change dev tun to dev tun0.

Edit server2.conf:

• Change dev tun to dev tun1, 
• port to 443 and proto to TCP
• Change the server line to use a new subnet e.g server 10.9.0.0 255.255.255.0
• If clients are assigned static IPs configs in the ccd directory and ipp.txt, duplicate directory and files and update addresses with server configs referencing each one.

Start the new server: systemctl start openvpn@server2.service
Check the new server status: systemctl status openvpn@server2.service
Enable autostart with: systemctl -f enable openvpn@server2.service

Update the iptables rules in /etc/iptables/add-openvpn-rules.sh or /etc/iptables/rules.v4 to enable incoming connections on TCP 443 (depending on where this rule is added), and duplicate any rules related for the new OpenVPN subnet and new tun1 interface. (Need to add details).

Inter client communication (if needed) between each instance needs a pair of iptables rules to forward traffic between tun0 and tun1, e.g:

iptables -I FORWARD -i tun0 -o tun1 -j ACCEPT
iptables -I FORWARD -i tun1 -o tun0 -j ACCEPT

Edit or remove/add a new VPN client profile to duplicate it, edit the duplicated file and change proto to tcp and the port number on the remote entry, we have one profile for UDP, and one for TCP when needed. It may be possible to include several remote lines in one profile such as https://openvpn.net/faq/how-do-i-set-up-my-profile-for-server-failover/. (Need to test this and see if it'll work reliably).

Renew Expired Server Certificate

These will expire after 3 years (I found this out the hard way)!

https://github.com/angristan/openvpn-install/issues/1002#issuecomment-1229525488

Running those commands worked, no changed needed to clients - macOS or iPhone at least.

A later comment on that issue suggested using easyrsa renew, but I couldn't figure out what version of easyrsa I had.

Privacy Badger (EFF)

Adds and additional layer to the browser

https://privacybadger.org/

40m Half-Square

Next on the antenna project list is a half square for 40m.

The half square is a simple antenna design thats been around for a longtime:

• Offers good low angle gain with out the need for radials.
• Little more than 1/4 wave high (40ft at 40m).
• Current nodes/maximums are up high, compared to verticals this should have less interaction with near by structures on the ground and reduce noise pickup.
• 80 degree beam-width, can be fed directly with coax at a corner, or voltage fed at the bottom of one leg. I coax fed mine and put a 1M (million) ohm 5W metal film resister across the feed-point to bleed off any static buildup.
• Only down side is the bandwidth is a bit narrow in the model, but in practice it was more forgiving.

More reading by people smarter than me:

• Part 4: The Open-Ended Cousins - Cebik
• Using the Half-Square Antenna For Low-Band DXing - N6LF
• Bob Tails and Half Squares - K3KY

EZNEC Model: 40m Half Square.

 

   

Locations of available trees dictate running the antenna near north/south, the broadside will be near east/west. Plotting the bi-directional 80 degree beam-width on an Azimuth map from my location reveals some useful coverage, a good portion of the Pacific, Australia and Alaska, to the east it'll cover pretty much all of the lower 48, Canada, South America and South Africa:

I've had the antenna up for a few days, on JS8Call where I'm most familiar with what I can hear, this antenna has shown it's DX potential on 40m overnight, with more stations spotted across the Pacific than with the OCFD. Down side is performance (as expected) with closer in stations (~1000 miles) are weaker.

The SWR bandwidth is broader than the model, it's quite usable across 40m with it centered around 7.160 MHz.



Noise pickup is negligibly different compared to the OCFD, a stark contrast to the ground mounted 43ft vertical I had up a while back which was very noisy on receive in my city location.

If I had the room for more than one wire antenna I'd keep this one up, however it's a single bander. The OCFD is back up for now..

---

The half square can be taken a step further for some real gain (~6dBi at 20 degrees) on the low bands by adding a second one as a reflector, VA7ST built one - A cheap 40m DX machine: the twin half square array, a copy of the defunct Cebik link referenced can be found at https://antenna2.github.io/cebik/content/ao/ao11.html. 

Phasing them is also a possibility - Phased Arrays - 40m Twin Half Square.

Unfortunately I don't have the room for one of these on 40m.

---

Models are good starting point, and a way to investigate and better understand antenna systems. These tools can also help guide us to and validate the final result, if a good correlation is observed in the real world then we can have confidence the patterns and other information are accurate.

The models I have created and made available may contain errors, or overlook something someone more experienced can see. I don't claim to be an expert or authority on the subject of antenna modeling or phased arrays. I simply want to further my own knowledge and understanding of antennas which I find fascinating. Comments, suggestions, discussion are welcome - lonney@gmail.com.

This post is one of several on Phased Arrays.