send host-name "cp10682-a"

Where «cp10682-a» is the «hostname» the ISP assigned to you. It is probably printed on some form you received.

More coming soon!

In The Netherlands there are now, as far as I know, two different ways in which ADSL users have to configure their machines. One is without hassles (good!) and one is with hassles (bad!).

The without-hassle method below is valid for people connecting to Demon in The Netherlands. Please inform me of other ISPs implementing this method.

The with-hassle method below is valid for Alcatel ADSL modems as provided by the Dutch ISPPlanet Internet. People with an ADSL connection from the Austrian ISP Inode should encounter no problems, but they may not be (entirely) correct for Other ISP’s, in The Netherlands or abroad.

ADSL without hassles

Say you have an external interface called rl0. While installing OpenBSD, configure the interfacerl0 by typing «dhcp» when asked for an IP address. If you’ve already a running install, you can edit /etc/hostname.rl0. That file should exist of only one line reading «dhcp».

This is pretty much it. If you’re editing /etc/hostname.rl0 after you installed OpenBSD, you should either reboot or run route flush && sh -x /etc/netstart.

OpenBSD asks via the DHCP protocol your ISP to provide your machine with an IP address, gateway, DNS servers, etc. You might not like everything you receive from the remote DHCP daemon, so you might have to edit /etc/dhclient.conf in order to override some of the options the DHCP daemon whispers in your DHCP client’s ear:

supersede host-name "aurora";
supersede domain-name "intranet.hezeldrama.net";
prepend domain-name-servers 127.0.0.1;

Above three lines tell the DHCP client to use «aurora» as the hostname of the machine, «intranet.hezeldrama.net» as its domain name and to setup /etc/resolv.conf in such a way that the first nameserver line reads «127.0.0.1″. The last option is required only if you’d like to run your own caching DNS server on the localhost (= 127.0.0.1).

ADSL with hassles

1. Reconfigure and recompile your kernel if you run the GENERIC OpenBSD kernel or a custom one, built with GRE (Generic Route Encapsulation) support. GRE eats the packets that are actually meant for the PPTP daemon software we’re about to use, resulting in a not working ADSL connection and the following error: LCP: timeout sending Config-Requests.So search for the line pseudo-device gre 1 in your kernel configuration file and disable it by putting a hash-sign (#) in front of that line. See the section updating for more information on recompiling your kernel.

   Doing sysctl -w net.inet.gre.allow=0 does not work. Reconfigure & Recompile(tm).

2. Now you configure the network interface connected to your modem. Create or edit for this/etc/hostname.<if>, where if is the devicename of the interface: inet 10.0.0.150 255.0.0.0 NONE
3. Download PPTP software from packetst0rm. Extract the source, runmake and copy pptp and pptp_callmgr to /usr/sbin.
4. Edit /etc/ppp/options to read the following: name "LOGINNAME"
noauth
noipdefault
defaultroute
debug

   Replace LOGINNAME with the loginname/username/user-id that you need to dial-in to your ISP.
5. Edit /etc/ppp/pap-secrets to read the following: LOGINNAME 10.0.0.138 PASSWORD

   Replace LOGINNAME with the loginname/username/user-id that you need to dial-in to your ISP. The same goes for PASSWORD.

6. If you do not run your own (caching) nameserver, you may like to edit/etc/resolv.conf to use the nameservers of your ISP: search speed.planet.nl
nameserver 195.121.1.34
nameserver 195.121.1.66

7. Run pptp 10.0.0.138 to login to your ISP. The ADSL internet link should now be up.
8. Credits:
   Michael Kummer for his OpenBSD ADSL howto
   Lukas Ertl for his FreeBSD ADSL howto

ADSL with hassles: Afterwards

1. For OpenBSD versions below 3.0:If you’d like to use NAT over your ADSL connection, disable the ipnat in your/etc/rc.conf, since ppp0 is not a valid configured interface at the time when/etc/netstart is run. Though ipfilter should be enabled.

   ipfilter=YES
ipnat=NO

   Only when your ADSL connection is running and ppp0 is configured you should run:

   /sbin/ipnat -CF -f /etc/ipnat.conf

   For OpenBSD versions above 2.9:

   You’re probably running PF and not IPFilter. I’m not sure if you need to do special things in order to have NAT work automatically when connected to the internet via de ADSL line. I’ll ask around.

2. You could optionally download this ADSL reconnect script from packetst0rm and run it from crontab to reestablish a broken connection. But that’s not a usable script.Don’t panic! I wrote one myself. Though it is very brutal, it does reconnect in all possible situations as far as I know. Packetst0rm’s script didn’t.

   - View adsl_reconnect.sh
   - Download adsl_reconnect.sh (gzipped)

   The only thing you should configure is the REMOTE_IP variable, which is the IP address of the remote end of your PPTP tunnel. This IP can be found easily when ADSL is running:

   $ ifconfig ppp0
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
inet 62.131.xx.yyy --> 195.190.aaa.bbb netmask 0xff000000

   Here, the «195.190.aaa.bbb» is the value you should assign to the REMOTE_IP variable.
   Note: some ISPs drop/block ping packets directed to the remote end of the PPTP tunnel or most if not all of their other servers. So it is advised to check if the IP you’d like to use is returning ping packets before using it in the reconnect script.

   To have that reconnection script executed every five minutes you could edit root’s crontaband insert the following somewhere:

   # Check ADSL connection
*/5 * * * * /root/bin/adsl_reconnect.sh > /dev/null


Normally, the pflog file used is /var/log/pflog. It’s in tcpdump readable format. It is synced every minute with the pflog0 interface.

To view the pflog file:

tcpdump -n -e -ttt -r /var/log/pflog

To view packets being logged in realtime:

tcpdump -n -e -ttt pflog0

To enable NAT you should enable ipfilter and ipnat in /etc/rc.conf and edit/etc/ipnat.rules to reflect your needs.

An example. rl0 is the external interface, connected with the internet.

Proxy outgoing FTP connections from the intranet:

map rl0 192.168.0.0/24 -> rl0/32 proxy port ftp ftp/tcp

Do some redirection from the outside to an internal host:

rdr rl0 0.0.0.0/0 port 8022 -> 192.168.0.8 port 22
rdr rl0 0.0.0.0/0 port 8080 -> 192.168.0.8 port 80

Two NAT rules to let the intranet transparently talk with the internet:

map rl0 192.168.0.0/24 -> rl0/32 portmap tcp/udp 10000:20000
map rl0 192.168.0.0/24 -> rl0/32

More coming soon.

You can also download it:
- pf.conf (plaintext)
- pf.conf.gz (gzipped)

My /etc/pf.conf:

# $OpenBSD: pf.conf,v 1.21 2003/09/02 20:38:44 david Exp $
#
# See pf.conf(5) and /usr/share/pf for syntax and examples.
# Required order: options, normalization, queueing, translation, filtering.
# Macros and tables may be defined and used anywhere.
# Note that translation rules are first match while filter rules are last match.
#

# <bof>

# <eof>
]]> http://purebsd.com/setting-up-firewall.html/feed 0