Guide to Building an OpenBSD PPPoE Gateway

From: Subject: Guide to Building an OpenBSD PPPoE Gateway Date: Fri, 16 Mar 2001 02:20:24 -0500 MIME-Version: 1.0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Content-Location: http://real.ath.cx/BSDinstall.html X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4133.2400 Guide to Building an OpenBSD PPPoE Gateway

A Step-by-Step Guide to Building an OpenBSD PPPoE Gateway

by Real Ouellet (hello@real.ath.cx)=20

Version 1.10=20 [2001-03-14]=20: DONT=20 call "do_ipcheck" from "ppp.linkup".=20; "ppp"=20 source code: replaced the convoluted CVS download method with a = simple, direct=20 URL.

Full = Changelog

Introduction

Why would one install his own personal gateway to the Internet? = Because one=20 can! And also because it simply is the most reliable, safest way to = connect=20 machines to a dedicated xDSL modem. Moreover, we can stash a whole bunch = of=20 useful features in such a little box. Here is a list:

PPPoE Gateway=20: PPPoE is a curious beast forced down our throats by some DSL = providers. On=20 one side, it does not really break anything, has low overhead and = allows you=20 to change IP adresses very easily & quickly. On the other side, it = sucks=20 big time because it does add overhead to the IP packets, is=20 proprietary, non-standard, forces you to change IP adresses = unpredictably, and=20 is unsupported in most operating systems. A good PPPoE gateway simply = hides=20 PPPoE from the machines on your internal network. It makes life much = easier=20 because you don't have to install any special "access manager" = software on=20 your windoze boxen. They will just work (provided you set their IP = address and=20 MTU correctly).
Firewall=20: A firewall is quite mandatory for any machine directly connected = to the=20 Big Bad Internet. We want an industrial-strength stateful inspection = firewall=20 and this is what we'll get.
NAT (Network Adress Translation)=20: The name seems complex, but it is really quite simple: this allows = the=20 gateway machine to act on the internet on behalf of all the machines = located=20 on the intranet (your internal home network). Even though you might = have two,=20 three or even ten computers on your local network, a NAT equipped = gateway will=20 hide them to outside observers. They will only see a single very = busy=20 machine, with a single IP address.
DNS (Domain Name Service) cache=20: Having your own DNS server will lower the latency of getting DNS=20 translations for all the machines on your intranet. This will not = really=20 decrease the traffic on your DSL modem by a large percentage, but it = will=20 improve the quality of the "internet experience" on your local = network.
Dynamic DNS tracker=20: Free dynamic DNS services are extremely useful to xDSL customers. = They=20 allow you to have your very own domain name, free of charge, which = will follow=20 in real-time your IP address changes. The catch is that the top-level = part of=20 your domain must be one of their supplied choices. They are not = that=20 bad, really... Personally, I use DYNDNS but any of the multiple = free dynamic=20 DNS providers out there will do just fine. Simply make sure they have = a client=20 "updater" which can compile and run under OpenBSD.
WEB server=20: Most ISP's only allow a few megabytes of disk for web service. = Moreover,=20 they never give you direct access to the web logs. Having your own web = server=20 allows you the luxury of using all the disk space you want, plus the = added=20 advantage of complete control over the web service (cgi-bin) and its = logs.=20 Moreover, OpenBSD comes with a crypto-enabled version of Apache and = all the=20 tools you need to create RSA-keyed certificates.
Mail server=20: Have you ever wanted to create a temporary email address just to = receive=20 some password? Or simply wanted addresses tailored for specific = domains of=20 interest? These are only a few of the many advantages of having your = own mail=20 server.
NTP server=20: The Network Time Protocol allow you to synchronize the gateway's = clock to=20 one of the numerous atomic time references available on the internet.=20 Moreover, the same program is also used as a local time server, so = that all=20 your intranet machines can themselves synchronize their clocks to the=20 gateway's clock. NTP synchronizations are made in tiers, like this, in = order=20 to lower the burden on the public time servers.

This page is for all those of you who have are lucky enough to enjoy = a=20 dedicated xDSL connection and would like to have a small firewall = installation.=20 In my search for the holy grail, i found the answer to most of my wishes = in the=20 OpenBSD package. This step-by-step guide is a collection of notes taken = while I=20 was installing the thing. They are intended to help my friends do their = own=20 setups very quickly and easily, without having to bug me too much ;) = They=20 should help you too.=20

Constructive comments can be sent there ... Have fun and GOOD LUCK!=20

Getting some hardware

The first thing to think about when one embarks on the firewalling = adventure=20 is to establish on what hardware you are going to install the thing. = This seems=20 unimportant at first, but don't forget that this box will be turned on = 24/7, so=20 the components you use must be reliable.=20

What are the minimum requirements? My system uses about 50% of its = CPU to=20 support Sympatico's ADSL rate (around 900 kbps). It is built with the = following=20 components:=20

An ancient 486 motherboard (with an ISA bus) given to me by a = friend=20 (thanks Christian!). It runs at 66 MHz.=20
32 MB of brand new RAM i bought for it.=20
A 200 MB hard disk, which was dying after about 1 year of faithful = use (it=20 came with the motherboard). This disk was recently replaced with the = cheapest=20 brand new drive i could find. I didn't know they still made those slow = 3600=20 RPM drives ;) Anyway, the old drive is kept as a kind of extreme = emergency=20 backup.=20
Two ISA-bus ethernet cards. I'll talk more about this later.=20
A CD-ROM drive. Very optional, but can make life easier.=20
A "home" grade hub & cat5 cabling. This is not strictly = necessary if=20 you'll have only one machine connected to your firewall: you can make = do with=20 a special "crossover= "=20 cat5 cable instead. The cable that comes with xDSL modems is = usually=20 (always?) a crossover cable. Anyway, for two or more machines, the hub = is=20 mandatory. Small hubs can be bought for a very reasonable price (~40$ = cdn).=20
or
Alternatively, many older ethernet cards come with a = BNC=20 female connector. This can be used to connect the machines on your = network=20 with coax cables, without any hub. However, be warned that a = 10base-2=20 network must follow certain rules if you want it to work flawlessly. = Follow th= em.=20

This gives a good approximation of what you need. The MOST important = part is=20 the RAM. Make absolutely sure that whatever RAM you use is reliable. Old = boxen=20 were usually setup to run Windoze, and it was not a big deal if the = machine had=20 flaky RAM because of the way Windoze works...=20

OpenBSD (like any real OS out there) is much less tolerant of flaky = RAM,=20 because it actually uses all of it. It will crash quite quickly = if your=20 RAM is marginal, probably within 5-10 minutes. You have been warned.=20

Finally, the OpenBSD hardware list is there. Try to make sure = that=20 whatever hardware you use in your gateway box figures on that list. It's = a long=20 list ;)=20

The ethernet cards

There is a boring thing of which we must talk about here. You see, = there are=20 many kinds of ethernet cards, and you must make sure you have the right = ones for=20 your machine. If you have a PCI-based machine, then all is well. = Whatever=20 ethernet card you put in there will probably be supported by OpenBSD. = However,=20 you must be a bit more careful if you have an ISA-based machine.=20

It is most likely that your box will not have any ethernet cards to = start=20 with since most people did not have networks at home in the pre-historic = era of=20 4 years ago. You need two cards. One will be connected to the DSL modem = (the=20 big, bad outerworld), while the other is connected to your internal = network hub=20 (your intranet). The gateway's job will be to pass (or block) packets = between=20 those two network cards. For security, its very important that the = outside world=20 packets cannot reach directly any of the intranet machines. This is the = reason=20 why we use two ethernet cards: complete logical and electrical = isolation.=20 Why so much isolation? For example, if someone(s) were launching a full=20 (distributed or not) denial of service attack on your gateway box, its=20 internet-connected ethernet card would be extremely busy, but your = intranet=20 would see nothing of this. While any communication with the outside = world would=20 probably fail, at least your intranet machines would still be able to = talk to=20 each other.=20

ISA cards use dedicated I/O ports and IRQ's in your machine. Those = must be=20 setup either with jumpers directly on the card, or with a special DOS = program if=20 the card is of the more recent "Plug & Play" type. This DOS program = is=20 always supplied with the card, when purchased brand new.=20

If your card is Plug&Play, you must disable the = Plug&Play, and=20 program specific I/O port and IRQ values with the setup software that = comes with=20 the card. Make sure that you program both cards with different sets of = I/O ports=20 and IRQs! Otherwise they will battle each other for cycles on the bus = and the=20 result will not be pretty. Once you have set the parameters on the card = it will=20 remember them and you don't have to reprogram anything later on, even if = the=20 computer is turned off.=20

It is good at this point to know a few magic numbers:=20

Card Type I/O #1 IRQ #1 Mem #1 I/O #2 IRQ #2 Mem #2
NE2000 (ne) 0x240 9 -- 0x300 10 --

SMC WD-8003 (we) 0x280 9 0xd0000 0x300 10 0xcc000

Card Type	I/O #1	IRQ #1	Mem #1	I/O #2	IRQ #2	Mem #2
NE2000 (ne)	0x240	9	--	0x300	10	--
SMC WD-8003 (we)	0x280	9	0xd0000	0x300	10	0xcc000

For example, i use two cards made by AOpen: the model ALN-101. They = are=20 Plug&Play and use the NE2000 chip. The first one is setup at I/O = port 0x240,=20 IRQ 9. It is known as "ne0" in the GENERIC openBSD kernel. The second = one is set=20 at I/O port 0x300, IRQ 10. It is known as "ne1". If the cards were = programmed=20 differently, the GENERIC kernel would not recognize them "out of the = box" and=20 you would have to re-configure the kernel. It can be done, but its much = easier=20 to setup the hardware once than re-configure the kernel every time it = gets=20 upgraded.=20

One more thing: some cards can be used in the so-called "full-duplex" = mode.=20 Be aware that if you want to use an ethernet card in full-duplex, your=20 hub must also be full-duplex, as well as the other ethernet cards = in the=20 system. A full-duplex hub is much more expensive and not necessary at = all.=20 Unless you know what you are doing, program your ethernet cards to use = the=20 half-duplex mode, otherwise it won't play nice with the other = components=20 in your local network, including the xDSL modem ;)=20

The hard disk

The most secure storage medium is one which can't be erased. Some = firewalls=20 actually use setups like this (with CD-ROMS) but we'll build our = firewall with a=20 classic, writeable hard drive because:=20

We don't need "Absolute Security", do we? We can't have it anyway = ;)=20
We want to use an "out-of-the-box" OpenBSD distro. This will make = security=20 maintenance much easier.

Almost any hard disk out there will work OK, since 200 MB is a safe = minimum=20 size. The only thing you must remember is that this disk will run 24/7, = so if=20 you use an old drive, it will likely die relatively soon. The = venerable=20 drive my friend gave me lasted 6 months before i had to change it, YMMV. =

No keyboard?

Of course you'll need a keyboard... and a monitor too, but just for = the=20 installation. After the firewall is successfully installed, you will be = able to=20 talk to it through encrypted ssh connections over your internal = network,=20 so a keyboard & monitor will not be really useful at that point.=20

Getting the software

We will be using OpenBSD.=20 Why? Because it is the most secure freely available operating system out = there.=20 It could also be the most secure operating system, but i don't want to = go into=20 that... All the source code included in the mainstream distribution CD's = has=20 been audited for years by the OpenBSD team, which is why = sometimes an=20 exploit published on BugTraq is found not to work on OpenBSD simply = because the=20 faulty code was already fixed months ago.=20

I strongly suggest you buy their CD-ROM kit as it comes with a set of = very=20 cool stickers... You can also download their stuff for free, of course, = but you=20 won't have the stickers then ;)=20

This FAQ was initially written with OpenBSD version 2.7, but since = then i got=20 and installed release 2.8 on my system and all is well.=20

The easiest way to install the software is to use a CD-ROM drive on = your=20 firewall box. If you don't have that, you can do a network install with = the=20 "ftp" protocol, either directly to an outside OpenBSD mirror, or to one of = your own=20 internal machines equipped with an ftp server. Be aware that if your DSL = provider forces you to use PPPoE (boooo!), then of course your link to = the=20 outside world will not be functional yet at installation time, which is = one more=20 reason to use the CD-ROM. If your machine can boot a CD-ROM, great! It = will=20 gladly boot the OpenBSD disc. Otherwise, simply create a boot diskette = according=20 to the README and boot that. This diskette is also your rescue disk, so = don't=20 lose it.=20

Installing OpenBSD

The installation of OpenBSD is very easy, once you have the right = hardware,=20 and the right answers to some of the questions. In the following steps, = i'll=20 assume you can follow the instructions of the install program and focus = only on=20 the tricky little things you should know to make your life easier.=20

fdisk & disklabel

Stuff that is not essential, but useful to know about

Using "mtree" to check on files

As suggested by Camiel Dobbelaar on = the=20 openbsd list.=20

The idea here is to create a unique fingerprint of each of your = files at a=20 point in time. Later on, when you suspect someone might have modified = one of=20 your files in a malicious way, you re-compute the fingerprints and = compare=20 with your previously stored set of fingerprints. Obviously you must be = careful=20 to encrypt the original set of fingerprints, or store them someplace = safe.=20

The way to create the fingerprints is like this:=20

mtree -c -Ksha1digest -p / > = fingerprint=20

Later=20 on, to check your files against the fingerprint file, you simply do:=20

mtree -f fingerprint -p /=20

Of course, many files will be different (e.g. the log files, = etc...). You will have to use your judgement in how to interpret the = results.=20 One thing is for sure: none of the basic operating system binary = utilities=20 should have changed, unless you did it yourself.=20

Using application proxies to help gard agains trojans

If you want to increase even more the security of your firewall, = you might=20 want to install application proxies. This subject is rather = complicated, but=20 if you want to know more about it, just go there. Source code included... ;)=20

Seting up the MTU in Windows

This is not needed anymore with the new version of ppp!=20

In order to use your shiny new PPPoE gateway with windoze machines = on your=20 intranet, you must specify the maximum MTU in each windows machine. = This is=20 very well explained there.=20

Another "Firewall Building" page

Matthew Patton, a nice guy who works for netsec.net has put = together a=20 good presentation on firewall building, available there. You will = also find=20 there info about how to build a firewall on a floppy. Very cool stuff. =

Version 1.10=20 [2001-03-14]=20: DONT=20 call "do_ipcheck" from "ppp.linkup".=20; "ppp"=20 source code: replaced the convoluted CVS download method with a = simple, direct=20 URL.
Version 1.09=20 [2001-03-12]=20: New=20 method for automatic dyndns updates=20; Better=20 usage of the "ppp.linkup" facility=20; Usage=20 of "-ddial" instead of "-background" with ppp
Version 1.08=20 [2001-02-22]=20: Added a "ipnat" rule to allow maping of ICMP = requests from=20 the intranet
Version 1.07=20 [2001-02-21]=20: Updated PPP/PPPoE procedure=20; Improved firewall (ipf) rules (again...)
Version 1.06=20 [2001-02-04]=20: Slightly improved firewall (ipf) rules
Version 1.05=20 [2001-01-31]=20: Time zone recommendation changed from GMT to UTC = (thanks=20 Thierry!)
Version 1.04=20 [2001-01-24]=20: Added info about how to specify the physical = ethernet=20 interface to pppoe=20; Added info about how to set the MTU in Windoze =
Version 1.03=20 [2001-01-15]=20: Added info about how to use "mtree" as an alternative to the tripwire = utility=20; Added info about "fwtk.org"
Version 1.02=20 [2001-01-04]=20: Modified the "test_ddns"=20 script=20; Minor changes for release 2.8
Version 1.01=20 [2000-11-11]=20: Modified the "test_hse"=20 script=20; Added improvements suggested by outside = readers
Version 1.0=20 [2000-11-07]=20: Modified the "test_hse"=20 script
Draft = [2000-11-05]=20: Draft

Back to=20 TOP

Active FTP

Don't forget SSL!

UTC time zone

First Boot

Kernel extra configuration

Sys control files

PPP & PPPoE

Second Boot

The afterboot phase

Firewall and NAT rule sets

Adding stuff to /etc/rc.local

The NTP daemon

The Dynamic DNS

Keeping your xDSL link alive 24/7

Method 1 (The one I use, now)

Method 2 (Deprecated, i'm not doing this = anymore even=20 if it worked reliably)

Apache

Sendmail

The mail popper

The installed packages

The Secure Shell

The log files

Apply the security patches!

Reboot and enjoy!

A Step-by-Step Guide to Building an OpenBSD PPPoE Gateway

Introduction

Getting some hardware

The ethernet cards

The hard disk

No keyboard?

Getting the software

Installing OpenBSD

fdisk & disklabel

Stuff that is not essential, but useful to know about

Using "mtree" to check on files

Using application proxies to help gard agains trojans

Seting up the MTU in Windows

Another "Firewall Building" page