Setting up OpenBSD as a Gateway/Firewall

Today I setup and tested my first OpenBSD firewall/gateway. I was really fun. Before today I had completed bits and pieces of the setup but not the entire process.
These where the steps I took:

# 1. Install:

Partitions =
Filesystem Size Mounted on
/dev/wd0a 150.1M /
/dev/wd0b 383.9M swap
/dev/wd0d 511.9M /tmp
/dev/wd0e 99.9M /var
/dev/wd0f 5120.2M /usr
/dev/wd0g 2048.0M /home

Sets =
bsd - This is the Kernel. Required
base40.tgz - Contains the base OpenBSD system
etc40.tgz - Contains all the files in /etc

# 2. Filtering and Firewalling OpenBSD:

First I Prepared pf: by starting it in rc.conf.local. (I will need to reboot for this to take effect)
# echo "#Start PF" >> /etc/rc.conf.local
# echo pf=YES >> /etc/rc.conf.local
Now I need to configure pf.conf:
# vi /etc/pf.conf

If you need help creating a pf ruleset please have a look at the following: PF User's Guide, pf(4), pfctl(8), pf.conf(5), pf.os(5), pflog(4), pfsync(4), altq(9).

# 3. Setting up your OpenBSD box as a Gateway
Allow IP forwarding by adding this line to /etc/sysctl.conf configuration file:
# echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf

Now modify the routes on the other hosts on both sides.
Routes can be controlled with routed(8) or OpenBGPD, in the base OpenBSD install.

# 4. DHCP Server

# Configuring the DHCP server, dhcpd
# echo "#Start dhcpd" >> /etc/rc.conf.local
# echo 'dhcpd_flags=""' >> /etc/rc.conf.local
# Put the interfaces that you want dhcpd to listen on in /etc/dhcpd.interfaces:
# echo rl1 > /etc/dhcpd.interfaces
# Then, edit /etc/dhcpd.conf
# vi /etc/dhcpd.conf

# 5. Configuration:

Su'd to root, create /etc/profile and add the content below.
# Configuring profiles:
# echo "alias su='su -l'" > /etc/profile
# echo "alias rm='rm -P'" >> /etc/profile
# echo 'if [ "$USER" = root ]; then' >> /etc/profile
# echo 'PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin' >> /etc/profile
# echo 'PS1="\`hostname -s\`:\`pwd\`# "' >> /etc/profile
# echo 'else' >> /etc/profile
# echo 'PATH=/bin:/usr/bin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin:/usr/games:.' >> /etc/profile
# echo 'PS1="\`hostname -s\`:\`pwd\`$ "' >> /etc/profile
# echo 'fi' >> /etc/profile

Then I rebooted the system, so that all of the above could take effect. I attached a couple of nodes to the switch, which worked perfectly.
Now I am testing the setup. So far everything is working well :)

I'm not sure how I went, I think I did ok for a first try. If anyone has any suggestions I would be more than willing to hear them. Thank you!

OpenBSD LiveCD Firewall

Over the past couple of weeks all of my research and experimentation has been leading towards a project. I have been learning how to create my own livecd firewall. Currently I am preparing an environment to create this livecd in.

First I installed a basic version of OpenBSD 4.0. Then I Downloaded the source code using cvsup:
# export PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/4.0/packages/i386/
# pkg_add -v cvsup-16.1h-no_x11.tgz
# vi /root/.configs/cvsup-file
added:

# Defaults that apply to all the collections
*default release=cvs
*default delete use-rel-suffix
*default umask=002
*default host=cvsup.jp.OpenBSD.org
*default base=/usr
*default prefix=/usr
*default tag=OPENBSD_4_0
# If your network link is a T1 or faster, comment out the following line.
*default compress
#OpenBSD-ports
#OpenBSD-all
OpenBSD-src
#OpenBSD-www
#OpenBSD-x11
#OpenBSD-xf4

# cvsup -g -L 2 cvsup-file

Once I had done that I made a partition in which to create the livecd in. First I edited the disklabel, then formatted the new partition:
# disklabel -e wd0
# newfs /dev/wd0h

Now create the directory to mount on the new partition:
# mkdir /bootcd
then edit /etc/fstab so that the partition would be mounted at boot time:
# vi /etc/fstab
added:

/dev/wd0h /bootcd ffs rw 1 2

then rebooted

Once the system had rebooted and everything was OK I cd into /bootcd and downloaded base40.tgz and etc40.tgz and unpacked them into /bootcd:
# cd /bootcd
# tar -xZf base40.tgz
# tar -xZf etc40.tgz

At the moment I am waiting for my new kernel to compile with my needed options:
# cd /usr/src/sys/arch/i386/conf/
# cp RAMDISK_CD BOOTCD
# vi BOOTCD
commented out this line:

#config bsd root on rd0a swap on rd0b and wd0b and sd0b

added this line:

config bsd root on cd0a

# config BOOTCD
# cd ../compile/BOOTCD/
# make clean && make depend && make

I can't wait to see how it works. This is so exciting. I am such a geek...

Learning Networking, OpenBSD style

I have only been learning OpenBSD for the past couple of weeks, so I am still eagerly learning how the Networking side of things works.
Until today I have never looked much into pf. I have used IPFW2 and IPF many times, and iptables a bit, but never pf. I started out with the information in the OpenBSD FAQ. I always find that this is a good place to start. Then the man pages available on the subject

Reading: I started out with the OpenBSD FAQ Networking section:
http://openbsd.org/faq/faq6.html
As well as investigating the following pages:
lo(4);
The loop interface is a software loopback mechanism which may be used for performance analysis, software testing, and/or local communication.
pflog(4);
The pflog interface is a pseudo-device which makes visible all packets logged by the packet filter, pf(4). Logged packets can easily be monitored in real time by invoking tcpdump(8) on the pflog interface, or stored to disk using pflogd(8).
sl(4);
The sl interface allows serial lines to be used as network interfaces using the slip protocol
ppp(4);
The ppp interface allows serial lines to be used as network interfaces using the Point-to-Point Protocol (PPP).
tun(4);
The tun driver provides a network interface pseudo-device. Packets sent to this interface can be read by a userland process and processed as desired.
enc(4);
The enc interface is a software loopback mechanism that allows hosts or firewalls to filter ipsec(4) traffic using pf(4).
bridge(4);
The bridge device creates a logical link between two or more Ethernet interfaces or encapsulation interfaces
vlan(4);
The vlan Ethernet interface allows construction of virtual LANs when used in conjunction with IEEE 802.1Q-compliant Ethernet devices.
gre(4);
The gre network interface allows tunnel construction using the Cisco GRE or the Mobile-IP (RFC 2004) encapsulation protocols.
gif(4);
The gif interface is a generic tunnelling pseudo-device for IPv4 and IPv6.
carp(4);
The carp interface is a pseudo-device which implements and controls the CARP protocol. carp allows multiple hosts on the same local network to share a set of IP addresses.
tcpdump(8);
tcpdump prints out the headers of packets on a network interface that match the boolean expression.
pflogd(8);
pflogd is a background daemon which reads packets logged by pf(4) to a pflog(4) interface, normally pflog0, and writes the packets to a logfile (normally /var/log/pflog) in tcpdump(8) binary format.
pf(4);
Packet filtering takes place in the kernel. A pseudo-device, /dev/pf, allows userland processes to control the behaviour of the packet filter through an ioctl(2) interface.
ioctl(2);
The ioctl() function manipulates the underlying device parameters of special files. In particular, many operating characteristics of character special files (e.g., terminals) may be controlled with ioctl() requests.
pf.conf(5);
The pf(4) packet filter modifies, drops or passes packets according to rules or definitions specified in pf.conf.
altp(9);
altq - kernel interfaces for manipulating output queues on network interfaces

OpenBSD Firewall links

I have been working hard today one getting information and requirements I need to redesign and build my home network. Mostly I have been investigating the Firewall, and I have come across some handy links:

• OpenBSD wiki
• OpenBSD Wiki::Howto Router and Firewall/Gateway OpenBSD
• OpenBSD Wiki::LiveCD
• Using your firewall to transparently proxy protocols
• Build your own gateway firewall
• OpenBSD 101 Tutorials
• OpenBSD Admin Guide

I hope you find these helpful.