FreeBSD z ADSL kot domači router

Vem, da nek članek glede tega že obstaja, samo se mi zdi, da je potrebno par stvari dodat, tako da sem se odlocim da spisem tole.

Ok, najprej snemite FreeBSD (trenutno obstaja 5.3-RELEASE verzija, zato priporocam to). Seznam mirrorjev najdete tukaj. Če želite vleči iz slovenskega mirrorja, lahko greste kar semle in izberete najnovejso verzijo (trenutno 5.3). Instalacije ne mislim posebej komentirat, saj imate izčrpen vodič FreeBSD Handbook.

Ko spravite sistem v delovanje, morate za uspešno delovanje NAT-a in Firewalla recompileat kernel. To ni tako zakomplicirano kot se sliši.. Greste v direktorij "/usr/share/examples/cvsup/" in z text editorjem (recimo "ee") odprete datoteko "standard-supfile" in poiščete vrstico "*default host=CHANGE_THIS.FreeBSD.org". Spremenite v vaš mirror (slovenska sta dva: cvsup.si.FreeBSD.org in cvsup2.si.FreeBSD.org). Shranite in poženite "cvsup -g -L 2 standard-supfile". Pojdite na kavico da se zadeva konča. Zdaj imate izvorno kodo vsega potrebnega, da si naredite svoj kernel.

Najprej je treba narediti svoj config file z nastavitvami. Najprej si naredite svoj config. Tukaj postavim predpostavko da boste imenovali vaso skatlo ZAJCEK:
cd /usr/src/sys/i386/conf/
cp GENERIC ZAJCEK
Zdaj odprite to datoteko (ZAJCEK) in najprej preberite vse in si preuredite config tako da bo ustrezal vasim zeljam. Nujno pa morate spremeniti vrstico "ident GENERIC" v (v nasem primeru) "ident ZAJCEK". Ko ste nastavili vse opcije, za delovanje Firewalla in NAT-a na koncu dodajte se naslednje vrstice:
options IPFIREWALL
options IPDIVERT
options IPFIREWALL_VERBOSE
Če boste uporabljali tudi IPv6, dodajte še naslednje vrstice, saj je drugače IPv6 promet po defaultu blokiran:
options IPV6FIREWALL
options IPV6FIREWALL_VERBOSE
Zdaj config shranite. Up to date informacije o recompileanju kernela lahko najdete tukaj. Trenutno pa je postopek sledeč:
cd /usr/src
make -j4 buildworld
make buildkernel KERNCONF=ZAJCEK
make installkernel KERNCONF=ZAJCEK
reboot
Po restartu greste ponovno v direktorij /usr/src in napišete še:
make installworld
Če je šlo vse vredu, bi moral uname -a zdaj izpisati nekaj v stilu:
FreeBSD zajcek 5.3-RELEASE FreeBSD 5.3-RELEASE......

Ok, zdaj pa h konfiguraciji PPPoE za naš ADSL :)
Nastavitve so čisto preprost (v nasprotju z Linux OSji ;)):
Odprete datoteko /etc/ppp/ppp.conf in vpišete (spremenite uporabniško ime in geslo ter interface, na katerega je priklopljen ADSL - pri meni je to "rl1"):
default:
set log Phase tun command # po zelji lahko nastavite vecjo stopnjo logiranja
set ifaddr 10.0.0.1/0 10.0.0.2/0
disable ipv6cp # we are not connecting to any IPv6 dial-up provider
SIOL:
set device PPPoE:rl1
set authname username
set authkey password
set dial
set login
add default HISADDR

Če ne veste, na kateri interface je priklopljen ADSL napišite ifconfig -a. Izpisali se bojo vsi prepoznani interfacei. Ponavadi se ta, ki je za ADSL imenuje rl0, ed0 al xl0 (odvisno katera firma kartice je, in koliko kartic imate v škatli). lo0 ter plip0 sigurno nista prava, saj je prvi "local loopback", drugi pa za LPT kabelno povezavo dveh računalnikov.

Ko ste shranili ppp.conf lahko poizkusite, če se lahko povežete:
ppp -ddial SIOL
Če je povezava uspešna potem gremo lahko naprej. Odprite /etc/rc.conf in dodajte naslednje vrstice:
# Internet basic conf
ppp_enable="YES"
ppp_mode="ddial"
ppp_nat="NO" # pri adsl lahko povzroca tezave
ppp_profile="SIOL"
# Internet - NAT & firewall
gateway_enable="YES"
natd_enable="YES"
natd_flags="-f /etc/natd.conf"
firewall_enable="YES"
firewall_script="/etc/ipfw.rules"
firewall_type="OPEN"
firewall_quiet="YES"
firewall_logging="YES"

Za IPv6 dodamo še:
# Internet - IPv6
ipv6_enable="YES"
ipv6_firewall_enable="YES"
ipv6_firewall_script="/etc/rc.firewall6"
ipv6_firewall_type="OPEN"
ipv6_firewall_quiet="YES"

Najprej glede /etc/natd.conf datoteke. Sem vpišete vse "port redirectione" ter osnovne nastavitve za NATD:
interface tun0 # tun0 je navadno tunnel interface za ADSL
use_sockets yes
same_ports yes
unregistered_only yes
dynamic yes
# Don't forget to add rules to ipfw.rules for every forwarded port!
redirect_port tcp 192.168.0.5:4662 4662 # eMule
redirect_port udp 192.168.0.5:4675 4675 # eMule
#redirect_port tcp 192.168.0.5:6000-6500 6000-6500 # primer za cel range portov

Ker hočemo malo varnosti spremenimo še datoteko /etc/ipfw.rules... Na koncu bom dodal se skripto z osnovnimi pravili za firewall, ki jih lahko prilagodite tako, da bodo ustrezali vašim željam. Bodite pozorni na pravila za NAT, saj lahko hitro kaj "zajebemo" in nat ne bo deloval ;)

Preberite si še moj drugi članek glede ADSL povezave ob zagonu. Problem je v tem, da sshd in drugi daemoni ne morajo odpret določenega porta na IPju od ADSLja, ker ADSL pri zagonu ponavadi še ni povezan, zato sem naredil to skripto ki pred zagonom daemonov in serverjev najprej počaka, da se ADSL poveže. Članek je tule

/etc/ipfw.rules:
# Set these to your outside interface network and netmask and ip.
oif="tun0"
onet="193.11.111.0"
omask="255.255.255.0"
oip="193.11.111.205"

# Set these to your inside interface network and netmask and ip.
iif="rl0"
inet="192.168.2.0"
imask="255.255.255.0"
iip="192.168.0.1"

fwcmd="/sbin/ipfw -q"

# Flush
${fwcmd} -f flush

${fwcmd} add allow all from any to any via lo0 # allow all localhost

# NAT things
${fwcmd} add divert natd all from any to any via ${oif}
${fwcmd} add check-state

# Allow forwarded ports
${fwcmd} add allow udp from any to 192.168.0.5 4675 via ${oif}
${fwcmd} add allow tcp from any to 192.168.0.5 4662 via ${oif}

# Allow anything on the internal net
${fwcmd} add allow all from any to any via ${iif} keep-state
# keep-state is important for natd to work. do not use ppp_nat!

# End NAT things

# Stop spoofing
#${fwcmd} add deny log all from ${inet}:${imask} to any in via ${oif}
#${fwcmd} add deny log all from ${onet}:${omask} to any in via ${iif}

# Stop RFC1918 nets on the outside interface
${fwcmd} add deny log all from any to 10.0.0.0/8 via ${oif}
${fwcmd} add deny log all from any to 172.16.0.0/12 via ${oif}
${fwcmd} add deny log all from any to 192.168.0.0/16 via ${oif}

# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny log all from any to 0.0.0.0/8 via ${oif}
${fwcmd} add deny log all from any to 169.254.0.0/16 via ${oif}
${fwcmd} add deny log all from any to 192.0.2.0/24 via ${oif}
${fwcmd} add deny log all from any to 224.0.0.0/4 via ${oif}
${fwcmd} add deny log all from any to 240.0.0.0/4 via ${oif}

#${fwcmd} add divert natd all from any to any via ${oif}

# Stop RFC1918 nets on the outside interface
${fwcmd} add deny log all from 10.0.0.0/8 to any via ${oif}
${fwcmd} add deny log all from 172.16.0.0/12 to any via ${oif}
${fwcmd} add deny log all from 192.168.0.0/16 to any via ${oif}

# Stop draft-manning-dsua-03.txt (1 May 2000) nets (includes RESERVED-1,
# DHCP auto-configuration, NET-TEST, MULTICAST (class D), and class E)
# on the outside interface
${fwcmd} add deny log all from 0.0.0.0/8 to any via ${oif}
${fwcmd} add deny log all from 169.254.0.0/16 to any via ${oif}
${fwcmd} add deny log all from 192.0.2.0/24 to any via ${oif}
${fwcmd} add deny log all from 224.0.0.0/4 to any via ${oif}
${fwcmd} add deny log all from 240.0.0.0/4 to any via ${oif}

# Allow anything outbound from this net.
${fwcmd} add pass all from ${onet}:${omask} to any out via ${oif}

# Deny anything outbound from other nets.
${fwcmd} add deny log all from any to any out via ${oif}

# Allow TCP through if setup succeeded.
${fwcmd} add pass tcp from any to any established

# Allow IP fragments to pass through.
${fwcmd} add pass all from any to any frag

# Allow all IPv6 packets through - they are handled by the separate
# ipv6 firewall rules in rc.firewall6.
${fwcmd} add pass ipv6 from any to any

# Allow inbound ftp, ssh, email, tcp-dns, http, https, pop3, pop3s.
#${fwcmd} add pass tcp from any to ${oip} 21 setup in via ${oif}
#${fwcmd} add pass tcp from any to ${oip} 22 setup in via ${oif}
#${fwcmd} add pass tcp from any to ${oip} 25 setup in via ${oif}
#${fwcmd} add pass tcp from any to ${oip} 53 setup in via ${oif}
#${fwcmd} add pass tcp from any to ${oip} 80 setup in via ${oif}
#${fwcmd} add pass tcp from any to ${oip} 443 setup in via ${oif}
#${fwcmd} add pass tcp from any to ${oip} 110 setup in via ${oif}
#${fwcmd} add pass tcp from any to ${oip} 995 setup in via ${oif}

# Deny inbound auth, netbios, and ldap without logging.
${fwcmd} add deny tcp from any to ${oip} 113 setup in via ${oif}
${fwcmd} add deny tcp from any to ${oip} 139 setup in via ${oif}
${fwcmd} add deny tcp from any to ${oip} 389 setup in via ${oif}

# Deny some chatty UDP broadcast protocols without logging.
${fwcmd} add deny udp from any 137 to any in via ${oif}
${fwcmd} add deny udp from any to any 137 in via ${oif}
${fwcmd} add deny udp from any 138 to any in via ${oif}
${fwcmd} add deny udp from any 513 to any in via ${oif}
${fwcmd} add deny udp from any 525 to any in via ${oif}

# Allow inbound DNS and NTP replies. This is somewhat of a hole,
# since we're looking at the incoming port number, which can be
# faked, but that's just the way DNS and NTP work.
${fwcmd} add pass udp from any 53 to ${oip} in via ${oif}
${fwcmd} add pass udp from any 123 to ${oip} in via ${oif}

# Allow inbound DNS queries.
#${fwcmd} add pass udp from any to ${oip} 53 in via ${oif}

# Deny inbound NTP queries without logging.
${fwcmd} add deny udp from any to ${oip} 123 in via ${oif}

# Allow traceroute to function, but not to get in.
${fwcmd} add unreach port udp from any to ${oip} 33435-33524 in via ${oif}

# Allow some inbound icmps - echo reply, dest unreach, source quench,
# echo, ttl exceeded.
${fwcmd} add pass icmp from any to any in via ${oif} icmptypes 0,3,4,8,11

# Broadcasts are denied and not logged.
${fwcmd} add deny all from any to 255.255.255.255

# Everything else is denied and logged.
${fwcmd} add deny log all from any to any

moj_nick: em ne, ker je un post z razlogom ločen, ker dost ljudi že ima poštiman adsl z freebsdjem, samo tega z bootom pa ne vejo.. zato je post ločen, ker je tisto veliko bolj specifična zadeva..
tko da se ne strinjam s tem da bi se tist post nekam premikal drugam kot v svojo temo.

Če boš imel kake težave (pisal sem iz glave, tko da možno da sem kej zaj*), čimprej napiši sem.. Mam da mi pošlje email ko kdo replya tko da bom lahko odpisal med 16.00-zvečer :) upam da ne bo težav vseeno.. Čene je pa tudi handbook zakon ;) Če boš sam opazil da kaj manjka, vseeno napiši, da popravim.

lp

glede na to da si moderator bom reku da kar naredi kot se tebi zdi najboljse, ker imas vec iskusenj s tem tko da brezveze da kaj tupim :)

morda bi lahko dal FreeBSD in ADSL namig kot sticky, ali pa ce das link v prvi post na tisti already-sticky temi, ker se mi zdi kar *pomembna* zadeva (ker ce nimas lokalnega dostopa do masine in ti ssh ne dela ob bootu, imas lahko kdaj kar problemcke ;))

thx in lp