VPN og FreeBSD

For å ivareta sikkerhet, samt å ha kontroll over det trådløse nettet har vi valgt å satse på VPN (Virtual Private Network) tjenester basert på PPTP (Point to Point Tunneling Protocol) for å ha kontroll med trafikken som går over det trådløse nettet.


*** How to get a FreeBSD-box on the UiB privnett online ***

This has only been tested for 5.1-RELEASE, but it should not be problematic 
to adapt the setup to earlier releases. I expect this setup to work without 
changes for 5.2-RELEASE. If you do not understand how to do the things 
written here, please consult the handbook at http://www.freebsd.no/handbook 
for answers and explanations.

1. Set up access to the privnett (10.10.X.Y) with relevant entries in 
/etc/rc.conf. 'ifconfig_xy0="DHCP"' can be a hint.

2. Install the mpd package. You probably need to download it on some 
machine with internet access and transfer it, for example on a floppy, to 
your FreeBSD box. All official FreeBSD ftp servers has this package. 
Remember to get the version corresponding to the release branch you are 
using (4 or 5). The latest package for the 5-branch you can find in the 
folder ftp://ftp.uio.no/bsd/unix/FreeBSD/ports/i386/packages-5-current/net/

3. Configure setup-files as indicated below. The spaces/tabs in the mpd 
setup files are absolutely necessary (that took me some time to discover!). 
Either use the setup with entries in /etc/rc.local, which disables any use 
of firewall, or implement the other setup, including the hack in 
/etc/rc.d/ipfw. With this last setup you only need 'gateway="YES"' in your 
/etc/rc.conf, before boxes connected to a second nic can connect to the 
internet through the FreeBSD machine.

4. The setup alternative that uses /etc/rc.local does not require any 
special kernel configuration, GENERIC will do fine. If you want to use the 
firewall-setup and natd, you need to customize the kernel before you can 
run natd. Have a look at the handbook for instructions.

Sometimes one of the vpn servers go down for mostly short periods of time 
(especially on mondays, for some reason). Change to a different one with 
the command 'mpd -kb uibX' where X can be , 2 or 3.

Have fun!

Written by Are-Harald Brenne 18.12.2003
Feel free to do whatever you want with this text.
You can reach me at ahb@ugagn.info

# cat /usr/local/etc/mpd/mpd.secret
@rasmus    ""
# chmod 0600 /usr/local/etc/mpd/mpd.secret

# cat /usr/local/etc/mpd/mpd.links
pptpuib:
         set link type pptp
         set pptp peer 10.0.0.2
         set pptp enable originate outcall
         set pptp disable incoming
pptpuib2:
         set link type pptp
         set pptp peer 10.2.1.1
         set pptp enable originate outcall
         set pppt disable incoming
pptpuib3:
         set link type pptp
         set pptp peer 10.0.0.3
         set pptp enable originate
         set pppt disable incoming

# cat /usr/local/etc/mpd/mpd.conf
default:
         load uib
uib:
         new -i ng0 uib pptpuib
         set iface route default
         set iface disable on-demand
         set iface mtu 1492
         set bundle authname secac@rasmus
         set ipcp ranges 0.0.0.0/0 0.0.0.0/0
         set ipcp yes vjcomp req-pri-dns req-sec-dns
         set link disable chap pap
         set link accept pap
         set link yes acfcomp protocomp
         set link keep-alive 10 60
         open iface
uib2:
         new -i ng0 uib2 pptpuib2
         set iface route default
         set iface disable on-demand
         set iface mtu 1492
         set bundle authname secac@rasmus
         set ipcp ranges 0.0.0.0/0 0.0.0.0/0
         set ipcp yes vjcomp req-pri-dns req-sec-dns
         set link no chap
         set link yes pap
         set link yes acfcomp protocomp
         set link keep-alive 10 60
         open iface
uib3:
         new -i ng0 uib3 pptpuib3
         set iface route default
         set iface disable on-demand
         set iface mtu 1492
         set bundle authname secac@rasmus
         set ipcp ranges 0.0.0.0/0 0.0.0.0/0
         set ipcp yes vjcomp req-pri-dns req-sec-dns
         set link disable chap pap
         set link accept pap
         set link yes acfcomp protocomp
         set link keep-alive 10 60
         open iface

Simple setup, without natd-possibility and firewall:
# cat /etc/rc.local
route add 10.0.0.0/8 fantoft-gw
route delete default
/usr/local/sbin/mpd -b uib
sleep 10


With natd-functionality and firewall. Only relevant parts of /etc/rc.conf 
are shown here. In this case cut out the above from /etc/rc.local.
# cat /etc/rc.conf
[...]
natd_enable="YES"
natd_interface="ng0"           # ng0 is the vpn interface.
natd_flags="-unregistered_only -dynamic -use_sockets -same_ports" # 
'-dynamic' is essential!
firewall_enable="YES"
firewall_script="/etc/rc.firewall"
firewall_type="OPEN"            # Firewall type. 'OPEN' means no firewall. 
See /etc/rc.firewall.

You also need to hack /etc/rc.d/ipfw. This will only work on 5.1 and later 
releases on the 5-branch. You need to add the four lines marked with # ***. 
The point is to get the tunnel up before the firewall and nat-daemon are 
configured. There are, of course, many different ways this can be done. 
Remember this hack when running mergemaster, if you upgrade to a new 
release in the future.
# cat /etc/rc.d/ipfw
#!/bin/sh
#
# $FreeBSD: src/etc/rc.d/ipfw,v 1.4 2003/03/30 15:52:18 mtm Exp $
#

# PROVIDE: ipfw
# REQUIRE: ppp-user
# BEFORE: NETWORKING
# KEYWORD: FreeBSD

. /etc/rc.subr

name="ipfw"
rcvar="firewall_enable"
start_cmd="ipfw_start"
start_precmd="ipfw_precmd"
stop_cmd="ipfw_stop"

ipfw_precmd()
{
         if ! ${SYSCTL} net.inet.ip.fw.enable > /dev/null 2>&1; then
                 if ! kldload ipfw; then
                         warn unable to load firewall module.
                         return 1
                 fi
         fi

         return 0
}

ipfw_start()
{

route add 10.0.0.0/8 10.10.64.1 # ***
route delete default            # ***
/usr/local/sbin/mpd -b uib      # ***
sleep 10                        # ***

         # set the firewall rules script if none was specified
         [ -z "${firewall_script}" ] && firewall_script=/etc/rc.firewall

         if [ -r "${firewall_script}" ]; then
                 . "${firewall_script}"
                 echo -n 'Firewall rules loaded, starting divert daemons:'

                 # Network Address Translation daemon
                 #
                 if checkyesno natd_enable; then
                         if [ -n "${natd_interface}" ]; then
                                 if echo ${natd_interface} | \
                                 grep -q -E '^[0-9]+(\.[0-9]+){0,3}$'; then
                                         natd_flags="$natd_flags -a 
${natd_interface}"
                                 else
                                         natd_flags="$natd_flags -n 
${natd_interface}"
                                 fi
                         fi
                         echo -n ' natd'
                         ${natd_program:-/sbin/natd} ${natd_flags} 
${natd_ifarg}
                 fi
         elif [ "`ipfw l 65535`" = "65535 deny ip from any to any" ]; then
                 echo 'Warning: kernel has firewall functionality, but' \
                     ' firewall rules are not enabled.'
                 echo '           All ip services are disabled.'
         fi
         echo '.'

         # Firewall logging
         #
         if checkyesno firewall_logging; then
                 echo 'Firewall logging enabled'
                 sysctl net.inet.ip.fw.verbose=1 >/dev/null
         fi

         # Enable the firewall
         #
         ${SYSCTL_W} net.inet.ip.fw.enable=1
}

ipfw_stop()
{
         # Disable the firewall
         #
         ${SYSCTL_W} net.inet.ip.fw.enable=0
}

load_rc_config $name
run_rc_command "$1"

Interesante linker:

http://www.microsoft.com/ntserver/commserv/deployment/moreinfo/pptpfaq.asp
ftp://ftp.ietf.org/rfc/rfc2637.txt