Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[aesmith]

Hi,

A company I contract for has offered to supply and pay for Starlink for our house. I think he's impatient with flakiness on video conferencing calls. Anyway I need to work out (a) where to install it and (b) how to integrate into our network.

For installation most sources say it needs an uninterrupted view of the entire sky,  others say it should face N 8  the Northern hemisphere, and this web site that I found suggests it will actually choose satellites to the S. Between SE and SW
https://satellitemap.space/?constellation=starlink#

For networking we have a Mikrotik router as main core. 4G and ADSL each have dedicated routers each doing their own NAT and firewall. But connecting Starlink that was will introduce an addressing conflict, and I believe the Starlink subnet etc can't be changed. So the other option would be pass-thru with NAT and firewall on the Mikrotik interface.

Any comments welcome.  Or any other aspects and gotchas I might have missed.

Thank,

[IMgoRt]

The direction you point in is based on where you're located in the UK, the app will advise during install (you can lie it on the floor before install to get an idea)
I ran mine 50% covered without any throughput issue

You put the SL router in bypass mode and it then doesn't create any conflicts

[meritez]

If you do not have the SL router, the Dishy app will not work, as it requires the router, but yes as above just put it in bypass/bridge mode.

[aesmith]

Cheers, regarding Bypass Mode I saw somewhere that you need a manual route pointed to the Starlink, in order to still get management access. Does that ring a bell?

[Alex Atkin UK]

That's generally how bridge/modem mode works on most devices in my experience.

[aesmith]

Sorry, maybe not clear. Basic Internet access would be by creating a route 0.0.0.0/0 pointing to the DHCP address dished out by the Starlink.  With Mikrotik that's part of the DHCP client configuration applied to the interface. As you say that's business as usual.

What I was referring to was comments about needing to also add manual routes to 192.168.1.100 or 192.168.100.1 (or both) via the Starlink interface, required for management to still work while in bypass.

[Alex Atkin UK]

I understood what you meant, Virgin Media routers worked the same way the last time I had a play with one.

[aesmith]

I've received the gear, not yet worked all the details yet for physical installation, but I've tested the networking. I may not need the management route as even with the router in bypass you can still get statistics and diagnostics from the Starlink account.

In bypass mode my router gets a CGNAT address and next hop from the Starlink. I assume that's subject to change but is it known whether the next hop is always the same? 

If it is, that gives me a Mikrotik challenge. For failover I've been using their "remote gateway" function. Similar to Cisco's Object Tracking. I don't think that can be configured if the next hop is unknown.

[dee.jay]

Cheers, regarding Bypass Mode I saw somewhere that you need a manual route pointed to the Starlink, in order to still get management access. Does that ring a bell?

Yes, I used mine with opnSense - what I needed to do was to create a Virtual IP that was in the 192.168.100.0/24 range because this is the range that the Starlink dish uses - then outbound NAT that address as a source from my LAN, then I could reach the dishy pages on 192.168.100.1.

[aesmith]

Adding a secondary address on 192.168.100.0/24 on the Starlink interface I can access 192.168.100.1, but all it gives me is a black page with "Starlink" written in the middle, that doesn't seem much help. On the other hand via the account it seems like I can access most of the useful information, like alignment and obstructions. So maybe it's not really needed.

Regarding routing I am given an address from 100.64.0.0/10 with next hop of 100.64.0.1. Does anyone know if that next hop is always the same?

[aesmith]

Just discovered a bit of a gotcha. If you enable the power saving "sleep" schedule, the Starlink router still stays up, but gives a different IP address like 217.x.x.x. Because the interface is up and dishing out IP address and gateway, my main router keeps that route up and doesn't failover to my backup so we loose Internet altogether. In addition the sleep schedule is GMT, not local time so it happens an hour earlier than expected.

[Alex Atkin UK]

What router?  Can you specify an Internet IP address as its monitoring address (ideally one you don't care about as it would need to be a static route to work for this) so it would detect the gateway as down when traffic is not reaching the Internet?  That's certainly how I'd do it on OPNsense/pfSense.

Although failover in general is a pain, as it doesn't handle an unreliable connection well and just constantly restarts the firewall breaking connectivity.

[aesmith]

Cheers. It's Mikrotik. It was configured as you describe for LTE, for failover to DSL. Mikrotik call it "recursive routing" but functionally is similar to cutdown precanned version of Cisco object tracking.

It does rely on the next hop being known and fixed. At the moment I haven't found confirmation that it will always be 100.64.0.1, but I've set up the remote gateways on that assumption for the moment. If that turns out not to be the case I'll need to look at a script triggered by the DHCP client to re-write the remote gateway routes. I'm hoping that won't be needed.

[aesmith]

Just found myself blocked from a consumer advice website, IP address blacklisted. I remember similar when I used Smarty, is this just something you have to put up with on CGNAT?

[Alex Atkin UK]

It does rely on the next hop being known and fixed. At the moment I haven't found confirmation that it will always be 100.64.0.1, but I've set up the remote gateways on that assumption for the moment. If that turns out not to be the case I'll need to look at a script triggered by the DHCP client to re-write the remote gateway routes. I'm hoping that won't be needed.

Yeah I got around that by monitoring a known fixed IP further out on the Internet that it wouldn't matter if traffic to that IP always went over the backup WAN.  For example if one of the Starlink core/peer routers responds to ping you could use that.

Just found myself blocked from a consumer advice website, IP address blacklisted. I remember similar when I used Smarty, is this just something you have to put up with on CGNAT?

You could use AAISP L2TP or rent a VPS and connect over a VPN to it.