BSDRP 1.52に家庭用ブロードバンドルータ的な設定をする

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# 追加
# sysrc mpd_enable=YES
mpd_enable:  -> YES
# 変更
# sysrc mpd_enable=NO
mpd_enable: YES -> NO
# 確認
# sysrc mpd_enable
mpd_enable: NO
# 削除
# sysrc -x mpd_enable
# 変更されている設定を全部表示
# sysrc -a
# デフォルトの設定を含め全部表示
# sysrc -A

1
2
3
4
5
6
7
8

# grep "ssh" /etc/defaults/rc.conf
sshd_enable="NO"                # Enable sshd
sshd_program="/usr/sbin/sshd"   # path to sshd, if you want a different one.
sshd_flags=""                   # Additional flags for sshd.
# sysrc -A | grep "ssh"
sshd_enable: NO
sshd_flags:
sshd_program: /usr/sbin/sshd

1
2
3

# sysrc ifconfig_em1="inet 192.168.0.1 netmask 255.255.255.0"
# sysrc ifconfig_em1_ipv6="inet6 2001:db8::1 prefixlen 64"
# service netif restart

1
2

# sysrc sshd_enable="YES"
# service sshd start

1
2

# vi /etc/ssh/sshd_config
PermitRootLogin without-password

1
2

# vi /etc/ssh/sshd_config
PermitRootLogin no

1

# passwd

1
2
3
4
5

# sysrc hostname="router1.example.com"
# echo "nameserver 192.168.0.53" >> /etc/resolv.conf
# echo "search example.com" >> /etc/resolv.conf
# tzsetup
# adduser -D

1
2

# service quagga stop
# sysrc quagga_enable="NO"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

# netstat -an -p tcp -p udp
Active Internet connections (including servers)
Proto Recv-Q Send-Q Local Address          Foreign Address        (state)
udp4       0      0 *.514                  *.*
udp6       0      0 *.514                  *.*
# sockstat
USER     COMMAND    PID   FD PROTO  LOCAL ADDRESS         FOREIGN ADDRESS
root     login      1200  3  dgram  -> /var/run/logpriv
root     syslogd    972   4  dgram  /var/run/log
root     syslogd    972   5  dgram  /var/run/logpriv
root     syslogd    972   6  udp6   *:514                 *:*
root     syslogd    972   7  udp4   *:514                 *:*
root     devd       917   4  stream /var/run/devd.pipe

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

# vi /usr/local/etc/mpd5/mpd5.conf
startup:
    set user admin admin admin
    set console self 127.0.0.1 5005
    set console open
    set web self 127.0.0.1 5006
    set web open

default:
    load pppoe_isp

pppoe_isp:
    create bundle static B1
    set iface route default
    set iface enable tcpmssfix
    set ipcp ranges 0.0.0.0/0 0.0.0.0/0
    create link static L1 pppoe
    set link action bundle B1
    set link max-redial 0
    set link mtu 1454
    set link mru 1454
    set link disable pap chap
    set link accept chap
    set auth authname your-username@isp.example.com
    set auth password your-password
    set pppoe iface em0
    open
# sysrc mpd5_enable="YES"
# service mpd5 start

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

# vi /etc/pf.conf
#--- Interface
ext_if        = "ng0"
int_if        = "em1"

#--- Address
int_subnet    = "192.168.0.0/24"
dns_server    = "192.168.0.53"
www_server    = "192.168.0.80"
dns_server_v6 = "2001:db8::53"
www_server_v6 = "2001:db8::80"

#--- Service
tcp_port      = "{22,53,80,443}"
udp_port      = "{53}"
dns_service   = "{53}"
www_service   = "{80,443}"

#--- Options
set skip on lo0

#--- Normalization
scrub in all
scrub in on $ext_if all fragment reassemble

#--- NAPT
nat on $ext_if from $int_subnet to any -> ($ext_if)

#--- Redirect
rdr pass on $ext_if inet proto {tcp, udp} from any to ($ext_if) port $dns_service -> $www_server
rdr pass on $ext_if inet proto tcp from any to ($ext_if) port $www_service -> $www_server

#--- Hairpin NAT
rdr pass on $int_if proto {tcp, udp} from $int_subnet to ($ext_if) port $dns_service -> $dns_server
rdr pass on $int_if proto tcp from $int_subnet to ($ext_if) port $www_service -> $www_server
nat pass on $int_if proto {tcp, udp} from $int_subnet to $dns_server port $dns_service -> ($ext_if)
nat pass on $int_if proto tcp from $int_subnet to $www_server port $www_service -> ($ext_if)

#--- Filter rule
block all
pass quick on $int_if all
pass out all keep state
#pass in on $ext_if proto icmp from any to any
#pass in on $ext_if proto tcp from any to any port $tcp_port flags S/SA
#pass in on $ext_if proto udp from any to any port $udp_port

# sysrc pf_enable="YES"
# service pf start

1
2

# sysrc ntpd_enable="YES"
# service ntpd start

1
2
3

# sysrc ntpdate_enable="YES"
# sysrc ntpdate_hosts="192.168.0.123"
# service ntpdate start

1
2

# echo "*.* @192.168.0.14" >> /etc/syslog.conf
# service syslogd restart

1
2

# sysrc syslogd_flags="-s -b 127.0.0.1"
# service syslogd restart

1
2

# sysrc syslogd_flags="-s -b [::1]"
# service syslogd restart

1
2

# sysrc bsnmpd_enable=YES
# service bsnmpd start

1
2
3
4
5
6
7
8
9

# bsnmpget ifOutOctets.1
ifOutOctets[1] = 1568
# bsnmpwalk 1.3.6.1.2.1.2.2.1.16
ifOutOctets[1] = 1568
ifOutOctets[2] = 322162
ifOutOctets[3] = 0
ifOutOctets[4] = 0
ifOutOctets[5] = 0
ifOutOctets[6] = 143128

1
2

# sockstat | grep 161
root     bsnmpd     2941  8  udp4   *:161                 *:*

1
2
3
4
5

# grep "begemotSnmpdPortStatus" /etc/snmpd.config
#begemotSnmpdPortStatus.0.0.0.0.161 = 1
begemotSnmpdPortStatus.192.168.0.1.161 = 1
# sockstat | grep 161
root     bsnmpd     2978  8  udp4   192.168.0.1:161    *:*

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# config
BSD Router Project configuration tool
Usage: /usr/local/sbin/config option
  - diff [quiet|factory]    : Show diff between current and saved config
  - save     : Save current config
  - apply    : Apply current config
  - rollback : Revert to previous config
  - put      : Put the saved config to a remote server
  - get      : Get config from remote server
  - factory  : Return to default configuration
  - help (h) [option]  : Display this help message.
                        If [option] given, display more detail about the option

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# config diff
Looking for differences between running and saved configuration files...
host.conf
hostid
opiekeys
rc.conf
# config save
Archiving previous configuration files...
Saving configuration...
Done.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# config put scp root@10.0.0.1:/tmp
Send saved configuration by SCP to root@10.0.0.1:/tmp
Password for root@router.bsdrp.net:
router.bsdrp.net.tar.xz                       100%  844     0.8KB/s   00:00
# config get scp root@10.0.0.1:/tmp/router.bsdrp.net.tar.xz
Get configuration archive SCP from root@10.0.0.1:/tmp/router.bsdrp.net.tar.xz
Password for root@router.bsdrp.net:
router.bsdrp.net.tar.xz                       100%  844     0.8KB/s   00:00
Configuration restored
Don't forget confirming your restoration by a 'config save'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

# tail -2 /etc/rc.conf
ifconfig_em1="inet 192.168.0.1 netmask 255.255.255.0"
ifconfig_em1_ipv6="inet6 2001:db8::1 prefixlen 64"
# config factory
Clear all saved configuration...Done
For confirming this action: Reboot and answer 'no' to the question about saving configuration
For canceling this action: Simply save the running configuration with 'config save'
# tail -2 /etc/rc.conf
ifconfig_em1="inet 192.168.0.1 netmask 255.255.255.0"
ifconfig_em1_ipv6="inet6 2001:db8::1 prefixlen 64"
# reboot
Checking if configuration is saved...
Warning: Unsaved changes detected !
Looking for differences between running and saved configuration files...
host.conf
hostid
opiekeys
rc.conf
Do you want to save the configuration before to continue or abort ? (y/n/a): n
Rebooting...
Shutdown NOW!
# tail -2 /etc/rc.conf
quagga_daemons="zebra ripd ripngd ospfd ospf6d bgpd isisd"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# config save
Archiving previous configuration files...
Saving configuration...
Done.
# system stop
Checking if configuration is saved...
Power halting...
Shutdown NOW!
shutdown: [pid 5173]

*** FINAL System shutdown message from root@router.bsdrp.net ***