Changes between Version 5 and Version 6 of FreeBSDXS4ALLFTTH

Timestamp:

06/14/17 20:41:46 (7 years ago)

Author:

Rick van der Zwet

Comment:

--

FreeBSDXS4ALLFTTH

@@ -1 +1 @@
 The Fritz!Box 7390 has issues with VAS and icmp forwarding, secondly I feel like the performance of the router is not meeting it's expections, yet no verification possible yet. Hence the switch to a FreeBSD based router/setup. First of all homework. Read [https://www.xs4all.nl/service/diensten/internet/installeren/modem-instellen/hoe-kan-ik-een-ander-modem-dan-fritzbox-instellen.htm the XS4ALL recommendations] and some good reading of Roel Traag [https://mijnglasvezelverbinding.nl/tv-internet-over-dezelfde-netwerkkabel/ part 1] and [https://mijnglasvezelverbinding.nl/tp-link-tl-sg3210-mac-vlan-configuratie/ part 2]. Cisco examples at [https://kpn.gebruikers.eu/forum/viewthread.php?thread_id=3899 KPN forum]. Improvements; use [https://bsdrp.net/documentation/examples/multicast_with_pim-sm PIM] to make to more clean.
+
+file:/etc/dhclient.conf
+{{{
+interface "re0vlan4" {
+        request routers,classless-routes;
+        send dhcp-class-identifier "IPTV_RG";
+}
+}}}
+
+
+file:/etc/rc.conf
+{{{
+hostname="routerZW.vanderzwet.net"
+sshd_enable="YES"
+
+gateway_enable="YES"
+ipv6_gateway_enable="YES"
+ipv6_cpe_wanif="ng0"
+
+
+ifconfig_re0="up -wol -arp"
+vlans_re0="re0vlan4 re0vlan6"
+create_args_re0vlan4="vlan 4"
+create_args_re0vlan6="vlan 6 -arp"
+
+# IPTV VLAN
+ifconfig_re0vlan4="DHCP"
+
+# Internet VLAN
+ifconfig_re0_ipv6="inet6 ifdisabled -nud -auto_linklocal -accept_rtadv"
+ifconfig_re0vlan6_ipv6="inet6 ifdisabled -nud -auto_linklocal -accept_rtadv"
+
+# Wireless Leiden
+ifconfig_re1="172.17.107.20/24"
+
+# Local Area Network
+ifconfig_re2="192.168.178.1/24"
+ifconfig_re2_alias0="80.127.152.25/29"
+ifconfig_re2_ipv6="inet6 2001:984:ac89:ffff::1"
+
+# Routing Wireless Leiden
+static_routes="wleiden"
+route_wleiden="-net 172.16.0.0/12 172.17.107.1"
+
+# PPPoE Tunnel for INET
+mpd_enable="YES"
+
+# DHCP for IPv6 (started via mpd5 - linkup script)
+dhcp6c_enable="NO"
+dhcp6c_interfaces="ng0"
+
+# IPv6 on LAN
+rtadvd_enable="YES"
+rtadvd_interfaces="re2"
+
+# IPv6 on WAN
+rtsold_enable="YES"
+
+# IPv4 on LAN
+dhcpd_enable="YES"
+dhcpd_ifaces="re2"
+
+# Firewall ACL
+firewall_type="open"
+firewall_enable="YES"
+firewall_script="/etc/firewall.sh"
+
+# NAT for LAN
+natd_enable="YES"
+natd_flags="-f /etc/natd.conf"
+
+# IPTV Multicast proxy
+igmpproxy_enable="YES"
+
+# Caching DNS Server
+unbound_enable="YES"
+}}}
+
+
+file:/boot/loader.conf
+{{{
+# Force output to run trough the comconsole, no exceptions
+console="comconsole"
+
+# PC Engines Alix APU board default serial settings cannot changed so 115200 it is. 
+comconsole_speed="115200"
+
+ip_mroute_load="YES"
+}}}
+
+file:/usr/local/etc/mpd5/linkup.sh
+{{{
+#!/bin/sh
+#
+
+test -z "$1" && exit 1
+
+if [ "$2" = "inet" ]
+then
+        /usr/bin/renice -n -5 $PPID
+fi
+
+if [ "$2" = "inet6" ]
+then
+        /sbin/ifconfig "$1" inet6 accept_rtadv -nud -no_radr
+        (sleep 3; /usr/local/etc/rc.d/dhcp6c onerestart) &
+
+
+fi
+
+exit 0
+}}}
+
+file:/usr/local/etc/mpd5/linkdown.sh
+{{{
+#!/bin/sh
+#
+
+test -z "$1" && exit 1
+
+if [ "$2" = "inet" ]
+then
+        /usr/bin/renice -n +5 $PPID
+fi
+
+if [ "$2" = "inet6" ]
+then
+        /usr/local/etc/rc.d/dhcp6c stop
+fi
+}}}
+
+file:/usr/local/etc/mpd5/mpd.conf
+{{{
+startup:
+        # configure mpd users
+        set user foo bar admin
+        set user foo1 bar1
+        # configure the console
+        set console self 127.0.0.1 5005
+        set console open
+        # configure the web server
+        set web self 0.0.0.0 5006
+        set web open
+
+#
+# Default configuration is "dialup"
+
+default:
+        load pppoe_client
+
+pppoe_client:
+#
+# PPPoE client: only outgoing calls, auto reconnect,
+# ipcp-negotiated address, one-sided authentication,
+# default route points on ISP's end
+#
+
+        create bundle static B1
+        set iface   up-script /usr/local/etc/mpd5/linkup.sh
+        set iface down-script /usr/local/etc/mpd5/linkdown.sh
+        set ipcp ranges 0.0.0.0/0 0.0.0.0/0
+        set bundle enable ipv6cp
+        set iface route default
+        load nat
+
+
+        create link static P1 pppoe
+        set link action bundle B1
+        set link latency 1200
+        set link bandwidth 100000000
+        set link max-redial 0
+        set link keep-alive 10 60
+        #set link mtu 1492
+        #set ppooe max-payload 1500
+
+        set auth authname FB7490@xs4all.nl
+        set auth password FB7490
+
+        set pppoe iface re0vlan6
+        set pppoe service ""
+        open
+}}}
+
+file:/etc/rtadvd.conf
+{{{
+re2:\
+        :addr="2001:984:ac89:ffff::":prefixlen#64:\
+        :rdnss="2001:984:ac89:ffff::1":\
+        :dnssl="vanderzwet.net":
+}}}
+
+file:/usr/local/etc/dhcpd.conf
+{{{
+default-lease-time 600;
+max-lease-time 7200;
+
+authoritative;
+
+log-facility local7;
+
+subnet 192.168.178.0 netmask 255.255.255.0 {
+  range 192.168.178.50 192.168.178.200;
+  option routers 192.168.178.1;
+  option domain-name "thuis.vanderzwet.net";
+  option domain-name-servers 192.168.178.1;
+  option vendor-class-identifier "IPTV_RG";
+  option broadcast-address 192.168.178.255;
+}
+}}}
+
+file:/usr/local/etc/unbound.conf
+{{{
+
+server:
+
+        verbosity: 1
+
+        interface: 127.0.0.1
+        interface: ::1
+        interface: 192.168.178.1
+        interface: 2001:984:ac89:ffff::1
+        interface: 172.17.107.20
+
+        access-control: 192.168.178.0/24 allow
+        access-control: 172.16.0.0/12 allow
+        access-control: 2001:984:ac89::/48 allow
+
+        
+
+python:
+
+remote-control:
+
+include: /usr/local/etc/unbound/forward.conf
+include: /usr/local/etc/unbound/lan-zones.conf
+
+}}}
+
+file:/etc/resolv.conf
+{{{
+search vanderzwet.net
+nameserver 127.0.0.1
+
+nameserver 194.109.6.66
+nameserver 194.109.9.99
+nameserver 194.109.104.104
+nameserver 2001:888:0:6::66
+nameserver 2001:888:0:9::99
+}}}
+
+file:/etc/firewall.sh
+{{{
+case ${firewall_type} in
+[Oo][Pp][Ee][Nn]|[Cc][Ll][Ii][Ee][Nn][Tt])
+        case ${natd_enable} in
+        [Yy][Ee][Ss])
+                ${fwcmd} add 50 divert natd ip4 from not 80.127.152.25/29 to not 80.127.152.25/29 via ng0
+
+                ${fwcmd} add 51 divert 8669 ip4 from 10.201.184.0/22 to me via re0vlan4
+                ${fwcmd} add 51 divert 8669 ip4 from 192.168.178.0/24 to 10.201.184.0/22 via re0vlan4
+
+                ${fwcmd} add 51 divert 8669 ip4 from 192.168.178.0/24 to 213.75.112.0/21 via re0vlan4
+                ${fwcmd} add 51 divert 8669 ip4 from 213.75.112.0/21 to me via re0vlan4
+
+                ${fwcmd} add 52 divert 8670 ip4 from 192.168.178.0/24 to 172.16.0.0/12 out via re1
+                ${fwcmd} add 52 divert 8670 ip4 from 172.16.0.0/12 to me in via re1
+
+                ;;
+        esac
+
+        # Allow DHCPv6
+        ${fwcmd} add pass udp from fe80::/10 to me 546
+
+        # Allow TCP through if setup succeeded
+        ${fwcmd} add pass tcp from any to any established
+        ${fwcmd} add pass ipv6 from any to any established
+
+        # Allow IP fragments to pass through
+        ${fwcmd} add pass all from any to any frag
+
+        # Wireless Leiden Special
+        ${fwcmd} add pass tcp from any to 80.127.152.27/32 dst-port 9000-9100 in via ng0 setup
+
+        # Allow setup of incoming TCP stuff to VAS
+        for i in 25 53 80 443 465 993 1022; do 
+                ${fwcmd} add pass tcp from any to 80.127.152.24/29 dst-port ${i} in via ng0 setup
+                ${fwcmd} add pass ip6 from any to 2001:984:ac89::/48 dst-port ${i} in via ng0 setup proto tcp
+        done
+        # Allow setup of incoming UDP stuff to VAS
+        for i in 53 123; do 
+                ${fwcmd} add pass udp from any to 80.127.152.24/29 dst-port ${i} in via ng0
+                ${fwcmd} add pass ip6 from any to 2001:984:ac89::/48 dst-port ${i} in via ng0 proto udp
+        done
+
+        # TCP Access to Router
+        for i in 1022; do
+                ${fwcmd} add pass tcp from any to me dst-port ${i} in via ng0 setup
+                ${fwcmd} add pass ip6 from any to me dst-port ${i} in via ng0 setup proto tcp
+        done
+
+        # Allow UDP on VAS
+        ${fwcmd} add check-state
+        ${fwcmd} add pass udp from 80.127.152.24/29 to any out via ng0 proto udp keep-state
+        ${fwcmd} add pass ip6 from 2001:984:ac89::/48 to any out via ng0 proto udp keep-state
+
+        # Allow UDP on Router
+        ${fwcmd} add pass udp from me to any out via ng0 proto udp keep-state
+        ${fwcmd} add pass ip6 from me to any out via ng0 proto udp keep-state
+
+        # Reject&Log all setup of incoming connections from the outside
+        ${fwcmd} add deny log ip4 from any to 80.127.152.24/29 in via ng0 setup proto tcp
+        ${fwcmd} add deny log ip4 from any to 80.127.152.24/29 in via ng0 proto udp
+        ${fwcmd} add deny log ip6 from any to 2001:984:ac89::/48 in via ng0 setup proto tcp
+        ${fwcmd} add deny log ip6 from any to 2001:984:ac89::/48 in via ng0 proto udp
+
+        # Access limit to Router
+        ${fwcmd} add deny log ip4 from any to me in via ng0 setup proto tcp
+        ${fwcmd} add deny log ip4 from any to me in via ng0 proto udp
+        ${fwcmd} add deny log ip6 from any to me in via ng0 setup proto tcp
+        ${fwcmd} add deny log ip6 from any to me in via ng0 proto udp
+
+        # Allow setup of any other TCP connection
+        ${fwcmd} add pass tcp from any to any setup
+
+        # Allow DNS queries out in the world
+        #${fwcmd} add pass udp from me to any 53 keep-state
+
+        # Allow NTP queries out in the world
+        #${fwcmd} add pass udp from me to any 123 keep-state
+
+        # Everything else is denied by default, unless the
+        # IPFIREWALL_DEFAULT_TO_ACCEPT option is set in your kernel
+        # config file.
+        case ${firewall_nat_enable} in
+        [Yy][Ee][Ss])
+                if [ -n "${firewall_nat_interface}" ]; then
+                        if echo "${firewall_nat_interface}" | \
+                                grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
+                                firewall_nat_flags="ip ${firewall_nat_interface} ${firewall_nat_flags}"
+                        else
+                                firewall_nat_flags="if ${firewall_nat_interface} ${firewall_nat_flags}"
+                        fi
+                        ${fwcmd} nat 123 config log ${firewall_nat_flags}
+                        ${fwcmd} add 50 nat 123 ip4 from any to any via ${firewall_nat_interface}
+                fi
+                ;;
+        esac
+esac
+}}}