diff --git a/en_US.ISO8859-1/books/ppp-primer/book.sgml b/en_US.ISO8859-1/books/ppp-primer/book.sgml new file mode 100644 index 0000000000..f824059981 --- /dev/null +++ b/en_US.ISO8859-1/books/ppp-primer/book.sgml @@ -0,0 +1,2340 @@ + + + + + +PPP - Pedantic PPP Primer + + + +Maintainer: Steve Sims <SimsS@IBM.NET> + + + +$FreeBSD: doc/en_US.ISO_8859-1/tutorials/ppp/ppp.sgml,v 1.8 1999/09/06 07:22:25 peter Exp $ + +This is a step-by-step guide for configuring FreeBSD systems to act as +a dial-up router/gateway in a Local Area Environment. All entries may +be assumed to be relevant to FreeBSD 2.2+, unless otherwise noted. + + + + + +Overview: + +The User-Mode PPP dialer in FreeBSD Version 2.2 (also known as: +"IIJ-PPP" ) now supports Packet Aliasing for dial up +connections to the Internet. This feature, also known as +"Masquerading", "IP Aliasing", or "Network Address +Translation", allows a FreeBSD system to act as a dial- on-demand +router between an Ethernet-based Local Area Network and an Internet +Service Provider. Systems on the LAN can use the FreeBSD system to +forward information between the Internet by means of a single +dial-connection. + + + +Purpose of this Guide. + +This guide explains how to: + + + +Configure the FreeBSD system to support dial-out connections, + + + +Share a dial-out connection with other systems in a network, + + + +Configure Windows platforms to use the FreeBSD system as a gateway to the Internet. + + + + + +While the focus of this guide is to assist in configuring IP Aliasing, +it also includes specific examples of the configuration steps necessary +to configure and install each individual component; each section stands +alone and may be used to assist in the configuration of various aspects +of FreeBSD internetworking. + + + + + +Building the Local Area Network + + While the ppp program can, and usually is, be configured to provide +services to only the local FreeBSD box it can also be used to serve as a +"Gateway" (or "router") between other LAN-connected resources and the Internet or +other Dial-Up service. + + + +Typical Network Topology + +This guide assumes a typical Local Area Network lashed together as +follows: + ++---------+ ----> Dial-Up Internet Connection +| FreeBSD | \ (i.e.: NetCom, AOL, AT&T, EarthLink, +etc) +| |-------- +| "Curly" | +| | ++----+----+ + | +|----+-------------+-------------+----| <-- Ethernet Network + | | | + | | | ++----+----+ +----+----+ +----+----+ +| | | | | | +| Win95 | | WFW | | WinNT | +| "Larry" | | "Moe" | | "Shemp" | +| | | | | | ++---------+ +---------+ +---------+ + + + + + +Assumptions about the Local Area Network + +Some specific assumptions about this sample network are: + +Three workstations and a Server are connected with Ethernet +cabling: + + + +a FreeBSD Server ("Curly") with an NE-2000 adapter configured as +'ed0' + + + +a Windows-95 workstation ("Larry") with Microsoft's "native" +32-bit TCP/IP drivers + + + +a Windows for Workgroups workstation ("Moe") with Microsoft's +16-bit TCP/IP extensions + + + +a Windows NT workstation ("Shemp") with Microsoft's "native" +32-bit TCP/IP drivers + + + + + +The IP Addresses on the Ethernet side of this sample LAN have been + +taken from the pool of "reserved" addresses proposed in RFC-1597. +IP addresses are assigned as follows: +Name IP Address +"Curly" 192.168.1.1 # The FreeBSD box +"Larry" 192.168.1.2 # The Win'95 box +"Moe" 192.168.1.3 # The WfW box +"Shemp" 192.168.1.4 # The Windows NT box + + +This guide assumes that the modem on the FreeBSD box is connected +to the first serial port ('/dev/cuaa0' or 'COM1:' in +DOS-terms). + +Finally, we'll also assume that your Internet Service Provider (ISP) +automatically provides the IP addresses of both your PPP/FreeBSD side +as well as the ISP's side. (i.e.: Dynamic IP Addresses on both ends +of the link.) Specific details for configuring the Dial-Out side of +PPP will be addressed in Section 2, "Configuring the FreeBSD System". + + + + + +FreeBSD System Configuration + +There are three basic pieces of information that must be known to +the FreeBSD box before you can proceed with integrating the sample +Local Area Network: + + + + + +The Host Name of the FreeBSD system; in our example it's "Curly", + + + +The Network configuration, + + + +The /etc/hosts file (which lists the names and IP addresses of +the other systems in your network) + + + + + +If you performed the installation of FreeBSD over a network +connection some of this information may already be configured into +your FreeBSD system. + +Even if you believe that the FreeBSD system was properly configured +when it was installed you should at least verify each of these bits of +information to prevent trouble in subsequent steps. + + + +Verifying the FreeBSD Host Name + +It's possible that the FreeBSD host name was specified and saved +when the system was initially installed. To verify that it was, enter +the following command at a prompt: + + + +# hostname + + + +The name of the host FreeBSD system will be displayed on a single +line. If the name looks correct (this is very subjective :-) skip +ahead to Section 3.2, "Verifying the Ethernet Interface +Configuration". + +For example, in our sample network, we would see 'curly.my.domain' +as a result of the `hostname` command if the name had been set +correctly during, or after, installation. (At this point, don't worry +too much about the ".my.domain" part, we'll sort this out later. The +important part is the name up to the first dot.) + +If a host name wasn't specified when FreeBSD was installed you'll +probably see 'myname.my.domain` as a response. You'll need to edit +/etc/rc.conf to set the name of the machine. + + + +Configuring the FreeBSD Host Name + +Reminder: You must be logged in as 'root' to edit the +system configuration files! + +CAUTION: If you mangle the system configuration files, +chances are your system WILL NOT BOOT correctly! Be careful! + +The configuration file that specifies the FreeBSD system's host +name when the system boots is in /etc/rc.conf. Use the +default text editor ('ee') to edit this file. + +Logged in as user 'root' load /etc/rc.conf into the +editor with the following command: + +# ee /etc/rc.conf + + + +Using the arrow keys, scroll down until you find the line that +specifies the host name of the FreeBSD system. By default, this +section says: + +--- +### Basic network options: ### +hostname="myname.my.domain" # Set this! +--- + + +Change this section to say (in our example): + +--- +### Basic network options: ### +hostname="curly.my.domain" # Set this! +--- + + + +Once the change to the host name has been made, press the 'Esc' key to +access the command menu. Select "leave editor" and make sure to +specify "save changes" when prompted. + + + + + +Verifying the Ethernet Interface Configuration + +To reiterate our basic assumption, this guide assumes that the +Ethernet Interface in the FreeBSD system is named 'ed0'. This is +the default for NE-1000, NE-2000, WD/SMC models 8003, 8013 and Elite +Ultra (8216) network adapters. + +Other models of network adapters may have different device names in +FreeBSD. Check the FAQ for specifics about your network adapter. If +you're not sure of the device name of your adapter, check the FreeBSD +FAQ to determine the device name for the card you have and substitute +that name (i.e.: 'de0', 'zp0', or similar) in the following +steps. + +As was the case with the host name, the configuration for the +FreeBSD system's Ethernet Interface may have been specified when the +system was installed. + +To display the configuration for the interfaces in your +FreeBSD system (Ethernet and others), enter the following command: + +# ifconfig -a + + +(In layman's terms: "Show me the InterFace CONFIGuration +for my network devices.") + +An example: + +# ifconfig -a + ed0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu +1500 + inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255 + ether 01:02:03:04:05:06 + lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500 + tun0: flags=8050<POINTOPOINT,RUNNING, MULTICAST> mtu 1500 + sl0: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 552 + ppp0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500 + lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 + inet 127.0.0.1 netmask 0xff000000 +# _ + + + +In this example, the following devices were displayed: + +ed0: The Ethernet Interface + +lp0: The Parallel Port Interface (ignored in this guide) + +tun0: The "tunnel" device; This is the one user-mode ppp uses! + +sl0: The SL/IP device (ignored in this guide) + +ppp0: Another PPP device (for kernel ppp; ignored in this guide) + +lo0: The "Loopback" device (ignored in this guide) + +In this example, the 'ed0' device is up and running. The key +indicators are: + + + +Its status is "UP", + + + +It has an Internet ("inet") address, (in this case, 192.168.1.1) + + + +It has a valid Subnet Mask ("netmask"; 0xffffff00 is the same as +255.255.255.0), and + + + +It has a valid broadcast address (in this case, 192.168.1.255). + + + + + +If the line for the Ethernet card had shown something similar to: + +ed0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500 + ether 01:02:03:04:05:06 + + +then the Ethernet card hasn't been configured yet. + +If the configuration for the Ethernet interface is correct you can +skip forward to Section 3.4, "Creating the list of other LAN hosts". +Otherwise, proceed with the next section. + + + +Configuring your Ethernet Interface + +Reminder: You must be logged in as 'root' to edit the +system configuration files! + +CAUTION: If you mangle the system configuration files, +chances are your system WILL NOT BOOT correctly! Be careful! + +The configuration file that specifies settings for the network +interfaces when the system boots is in /etc/rc.conf. Use +the default text editor ('ee') to edit this file. + +Logged in as user 'root' load /etc/rc.conf into the +editor with the following command: + + # ee /etc/rc.conf + +About 20 lines from the top of /etc/rc.conf is the section +that describes which network interfaces should be activated when the +system boots. In the default configuration file the specific line +that controls this is: + + + +network_interfaces="lo0" # List of network interfaces (lo0 is loopback). + + + +You'll need to amend this line to tell FreeBSD that you want to add +another device, namely the 'ed0' device. Change this line to +read: + + + +network_interfaces="lo0 ed0" # List of network interfaces (lo0 is loopback). + + + +(Note the space between the definition for the loopback device +("lo0") +and the Ethernet device ("ed0")! + + Reminder: If your Ethernet card isn't named 'ed0', specify +the correct device name here instead. + +If you performed the installation of FreeBSD over a network +connection then the 'network_interfaces=' line may already +include a reference to your Ethernet adapter. If it is, verify that +it is the correct device name. + +Specify the Interface Settings for the Ethernet device +('ed0'): + +Beneath the line that specifies which interfaces should be +activated are the lines that specify the actual settings for each +interface. In the default /etc/rc.conf file is a single +line that says: + + + +ifconfig_lo0="inet 127.0.0.1" # default loopback device configuration. + + + +You'll need to add another line after that to specify the settings +for your 'ed0' device. + +If you performed the installation of FreeBSD over a network +connection then there may already be an 'ifconfig_ed0=' line +after the loopback definition. If so, verify that it has the correct +values. + +For our sample configuration we'll insert a line immediately after +the loopback device definition that says: + + + +ifconfig_ed0="inet 192.168.1.1 netmask 255.255.255.0" + + + +When you've finished editing /etc/rc.conf to specify and +configure the network interfaces the section should look really close +to: + + + +--- +network_interfaces="ed1 lo0" # List of network interfaces (lo0 is loopback). +ifconfig_lo0="inet 127.0.0.1" # default loopback device configuration. +ifconfig_ed1="inet 192.168.1.1 netmask 255.255.255.0" +--- + + + +Once all of the necessary changes to /etc/rc.conf have +been made, press the 'Esc' key to invoke the control menu. Select +"leave editor" and be sure to select "save changes" when prompted. + + + + + +Enabling Packet Forwarding + +By default the FreeBSD system will not forward IP packets between +various network interfaces. In other words, routing functions (also +known as gateway functions) are disabled. + +If your intent is to use a FreeBSD system as stand-alone Internet +workstation and not as a gateway between LAN nodes and your ISP you +should skip forward to Section 3.4, "Creating the List of Other +LAN Hosts". + +If you intend for the PPP program to service the local FreeBSD box +as well as LAN workstations (as a router) you'll need to enable IP +forwarding. + +To enable IP Packet forwarding you'll need to edit the +/etc/rc.conf file. +Load this file into your editor with the following command: + +# ee /etc/rc.conf + + + +About 85 lines down from the top of the file will be the +configuration +section which controls IP forwarding, which will look like: + +===== +gateway_enable="NO" # Set to YES if this host will be a gateway. +===== + + + +Change this line to read: + +===== +gateway_enable="YES" # Set to YES if this host will be a gateway. +===== + + + +and exit the editor (saving the changes!). + +NOTE: This line may already be set to +'gateway_enable="YES"' if IP forwarding was enabled when the +FreeBSD system was installed. + + + + +Creating the List of other LAN Hosts(<filename>/etc/hosts</filename>) + +The final step in configuring the LAN side of the FreeBSD system is +to create a list of the names and TCP/IP addresses of the various +systems that are connected to the Local Area Network. This list is +stored in the '/etc/hosts' file. + +The default version of this file has only a single host name +listing in it: the name and address of the loopback device ('lo0'). +By networking convention, this device is always named "localhost" and +always has an IP address of 127.0.0.1. (See the interface +configuration example in Section 3.2.) + +To edit the /etc/hosts file enter the following command: + + # ee /etc/hosts + + + +Scroll all the way to the bottom of the file (paying attention to +the comments along the way; there's some good information there!) and +enter (assuming our sample network) the following IP addresses and +host names: + +192.168.1.1 curly curly.my.domain # FreeBSD System +192.168.1.2 larry larry.my.domain # Windows '95 System +192.168.1.3 moe moe.my.domain # Windows for Workgroups +System +192.168.1.4 shemp shemp.my.domain # Windows NT System + + + +(No changes are needed to the line for the '127.0.0.1 +localhost' entry.) + +Once you've entered these lines, press the 'Esc' key to invoke the +control menu. Select "leave editor" and be sure to select "save +changes" when prompted. + + + + +Testing the FreeBSD system + +Congratulations! Once you've made it to this point, the FreeBSD +system is configured as a network-connected UNIX system! If you made +any changes to the /etc/rc.conf file you should probably +re-boot your FreeBSD system. This will accomplish two important +objectives: + + + +Allow the changes to the interface configurations to be applied, and + + + +Verify that the system restarts without any glaring configuration errors. + + + + + +Once the system has been rebooted you should test the network +interfaces. + + + +Verifying the operation of the loopback device + +To verify that the loopback device is configured correctly, log in as +'root' and enter: + +# ping localhost + + + +You should see: + +# ping localhost +PING localhost.my.domain. (127.0.0.1): 56 data bytes +64 bytes from 127.0.0.1: icmp_seq=0 ttl=255 time=0.219 ms +64 bytes from 127.0.0.1: icmp_seq=1 ttl=255 time=0.287 ms +64 bytes from 127.0.0.1: icmp_seq=2 ttl=255 time=0.214 m +[...] + + +messages scroll by until you hit Ctrl-C to stop the madness. + + + + +Verifying the operation of the Ethernet Device + +To verify that the Ethernet device is configured correctly, enter: + + + +# ping curly + + + +You should see: + +# ping curly +PING curly.my.domain. (192.168.1.1): 56 data bytes +64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=0.219 ms +64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=0.200 ms +64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=0.187 ms +[...] + + +messages. + +One important thing to look at in these two examples is that the +names (loopback and curly) correctly correlate to their IP addresses +(127.0.0.1 and 192.168.1.1). This verifies that the +/etc/hosts files is correct. + +If the IP address for "curly" isn't 192.168.1.1 or the address for +"localhost" isn't 127.0.0.1, return to Section 3.4 and review your +entries in '/etc/hosts'. + +If the names and addresses are indicated correctly in the result of +the ping command but there are errors displayed then something is +amiss with the interface configuration(s). Return to Section 3.1 and +verify everything again. + +If everything here checks out, proceed with the next section. + + + + + + +Configuring the PPP Dial-Out Connection + +There are two basic modes of operation of the ppp driver: +"Interactive" and "Automatic". + +In Interactive mode you: + + + + + +Manually establish a connection to your ISP, + + + +Browse, surf, transfer files and mail, etc..., + + + +Manually disconnect from your ISP. + + + + + +In Automatic mode, the PPP program silently watches what goes on +inside the FreeBSD system and automagically connects and disconnects +with your ISP as required to make the Internet a seamless element of +your network. + +In this section we'll address the configuration(s) for both modes +with emphasis on configuring your `ppp` environment to operate in +"Automatic" mode. + + + +Backing up the original PPP configuration files + +Before making any changes to the files which are used by PPP you +should make a copy of the default files that were created when the +FreeBSD system was installed. + +Log in as the 'root' user and perform the following steps: + +Change to the '/etc directory: + +# cd /etc + +Make a backup copy the original files in the 'ppp' directory: + +# cp -R ppp ppp.ORIGINAL + +You should now be able to see both a 'ppp' and a +'ppp.ORIGINAL' subdirectory +in the '/etc' directory. + + + + +Create your own PPP configuration files + +By default, the FreeBSD installation process creates a number of +sample configuration files in the /etc/ppp directory. Please take +some time to review these files; they were derived from working +systems and represent the features and capabilities of the PPP +program. + +I strongly encourage you to learn from these sample files and +apply them to your own configuration as necessary. + +For detailed information about the `ppp` program, read the ppp +manpage: + +# man ppp + + + +For detailed information about the `chat` scripting language used by +the PPP dialer, read the chat manpage: + +# man chat + + + +The remainder of this section describes the recommended contents of +the PPP configuration files. + + + +The '<filename>/etc/ppp/ppp.conf</filename>' file + +The '/etc/ppp/ppp.conf' file contains the information and +settings required to set up a dial-out PPP connection. More than one +configuration may be contained in this file. The FreeBSD handbook +(XXX URL? XXX) describes the contents and syntax of this file in +detail. + +This section will describe only the minimal configuration to get a +dial-out connection working. + +Below is the /etc/ppp/ppp.conf file that we'll be using to provide a +dial-out Internet gateway for our example LAN: + +################################################################ +# PPP Configuration File ('/etc/ppp/ppp.conf') +# +# Default settings; These are always executed always when PPP +# is invoked and apply to all system configurations. +################################################################ +default: +set device /dev/cuaa0 +set speed 57600 +disable pred1 +deny pred1 +disable lqr +deny lqr +set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0 +OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT" +set redial 3 10 +# +# +################################################################ +# +# For interactive mode use this configuration: +# +# Invoke with `ppp -alias interactive` +# +################################################################ +interactive: +set authname Your_User_ID_On_Remote_System +set authkey Your_Password_On_Remote_System +set phone 1-800-123-4567 +set timeout 300 +set openmode active +accept chap +# +################################################################ +# +# For demand-dial (automatic) mode we'll use this configuration: +# +# Invoke with: 'ppp -auto -alias demand' +# +################################################################ +demand: +set authname Your_User_ID_On_Remote_System +set authkey Your_Password_On_Remote_System +set phone 1-800-123-4567 +set timeout 300 +set openmode active +accept chap +set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0 +add 0 0 127.2.2.2 +################################################################ +# End of /etc/ppp/ppp.conf + + +This file, taken verbatim from a working system, has three relevant +configuration sections: + + + +The "<emphasis remap=tt>default</emphasis>" Section + +The 'default:' section contains the values and settings +used by every other section in the file. Essentially, this section is +implicitly added to the configuration lines to each other section. + +This is a good place to put "global defaults" applicable to all +dial-up sessions; especially modem settings and dialing prefixes which +typically don't change based on which destination system you're +connecting to. + +Following are the descriptions of each line in the "default" section +of the sample '/etc/ppp/ppp.conf' file: + +set device /dev/cuaa0 + + +This statement informs the PPP program that it should use the first +serial port. +Under FreeBSD the '/dev/cuaa0' device is the same port that's +known as "COM1:" under DOS, Windows, Windows 95, etc.... + +If your modem is on COM2: you should specify +'/dev/cua01; COM3: would be '/dev/cua02'. + + + +set speed 57600 + + + +This line sets the transmit and receive speed for the connection +between the serial port and the modem. While the modem used for this +configuration is only a 28.8 device, setting this value to 57600 lets +the serial link run at a higher rate to accommodate higher throughput +as a result of the data compression built into late-model modems. + +If you have trouble communicating with your modem, try setting this +value to 38400 or even as low as 19200. + + + +disable pred1 +deny pred1 + + + +These two lines disable the "CCP/Predictor type 1" compression +features of the PPP program. The current version of `ppp` supports +data compression in accordance with draft Internet standards. +Unfortunately many ISPs use equipment that does not support this +capability. Since most modems try to perform on-the-fly compression +anyway you're probably not losing much performance by disabling this +feature on the FreeBSD side and denying the remote side from forcing +it on you. + + + +disable lqr +deny lqr + + + +These two lines control the "Line Quality Reporting" functions which +are part of the complete Point-to-Point (PPP) protocol specification. +(See RFC-1989 for details.) + +The first line, "disable lqr", instructs the PPP program to not +attempt to report line quality status to the device on the remote end. + +The second line, "deny lqr", instructs the PPP program to deny any +attempts by the remote end to reports line quality. + +As most modern dial-up modems have automatic error correction and +detection and LQR reporting is not fully implemented in many vendor's +products it's generally a safe bet to include these two lines in the +default configuration. + + + +set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0 +OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT" + + + +NOTE: (This statement should appear on a single line; ignore any +line wrapping that may appear in this document.) + +This line instructs the PPP program how to dial the modem and +specifies some rudimentary guidelines for doing so: + + + +Attempts to dial should fail if the modem returns a "BUSY" result code, + + + +Attempts to dial should also fail if the modem returns a "NO CARRIER" result code, + + + +The PPP program should expect each of the following events to complete within a +5-second timeout period: + + + +The PPP program will initially expect nothing (specified above +by the \"\" portion of the statement) from the modem + + + +The program +will send the modem initialization string "ATE1Q0M0" to the modem and +await a response of "OK". If a response is not received, the program +should send an attention command to the modem ("AT") and look again +for a response of "OK", + + + +The program should delay for one second +(specified by the "\\d" part of the statement, and send the dialing +string to the modem. The "ATDT" portion of the statement is the +standard modem prefix to dial using tone-dialing; if you do not have +touch-tone service on your local phone line, replace the "ATDT" with +"ATDP". The "\\T" string is a placeholder for the actual phone number +(which will be automatically inserted as specified by the "set dial +123-4567"). + + + + + + + +Finally, before a (maximum) timeout of 40 seconds, the PPP +program should expect to see a "CONNECT" result code returned from the +modem. + + + + + +A failure at any point in this dialog will be interpreted as a dialing +failure and the PPP program will fail to connect. + +(For a detailed description of the mini-scripting language used by the +PPP dialer, refer to the "chat" manpage.) + + + +set redial 3 10 + + +This line specifies that if a dial connection cannot immediately be made +the PPP program should retry (up to 3 times if necessary) with a delay of 10 seconds +between redialing attempts. + + + + +The "<emphasis remap=tt>interactive</emphasis>" Section + +The 'interactive:' section contains the values and +settings used to set up an "interactive" PPP session with a specific +remote system. Settings in this section will have the lines included +in the "default" section included automatically. + +The example cited in this section of the guide presumes that you'll +be connecting to a remote system that understands how to authenticate +a user without any fancy scripting language. That is, this sample +uses the CHAP protocol to set up the connection. + +A good rule of thumb is that if the Windows '95 dialer can set up a +connection by just clicking the "Connect" button this sample +configuration should work OK. + +If, on the other hand, when you connect to your ISP using Microsoft +Windows '95 Dial-Up Networking you need to resort to using the "Dial +Up Scripting Tool" from the Microsoft Plus! pack or you have to select +"Bring up a terminal windows after dialing" in the Windows '95 +connection options then you'll need to look at the sample PPP +configuration files and the ppp manpage for examples of "expect / +response" scripting to make your ISP connection. The "set login" +command is used for this purpose. + +Or even better, find an ISP who knows how to provide PAP or CHAP +authentication! + +The configuration examples shown here have been successfully used to +connect to: + + + +Various Shiva LanRovers + + + +The IBM Network (http://www.ibm.net) + + + +AT&T WorldNet (http://att.com/worldnet) + + + +Erol's (http://www.erols.com) + + + + + +Following are descriptions for each line in the "interactive" section +of the sample '/etc/ppp/ppp.conf' file: + + + +set authname Your_User_ID_On_Remote_System + + +This line specifies the name you would use to log in to the remote +system. + + + +set authkey Your_Password_On_Remote_System + + +This is the password you'd use to log in to the remote system. + + + +set phone 1-800-123-4567 + + +This is the phone number of the remote system. If you're inside a PBX +you can +prepend '9, ' to the number here. + + + +set timeout 300 + + +This tells the PPP program that it should automatically hang up the +phone if no data has +be exchanged for 300 seconds (5 minutes). You may wish to tailor this +number to your +specific requirements. + + + +set openmode active + + +This tells the PPP program that once the modems are connected it +should immediately attempt to negotiate the connection. Some remote +sites do this automatically, some don't. This instructs your side of +the link to take the initiative and try to set up the connection. + + + +accept chap + + +This tells the PPP program to use the "Challenge-Handshake +Authentication Protocol" to authenticate you. The values exchanged +between the local and remote side for UserID and password are taken +from the 'authname' and 'authkey' entries above. + + + + +The "<emphasis remap=tt>demand</emphasis>" Section + +The "demand" section contains the values and settings used +to set up a "Dial-on-demand" PPP session with a specific remote +system. Settings in this section will also have the lines included in +the "default" section included automatically. + +Except for the last two lines in this section it is identical to +the configuration section which defines the "interactive" +configuration. + +As noted in Paragraph ???, the examples cited in this section of +the guide presume that you'll be connecting to a remote system that +understands how to use the CHAP protocol to set up the connection. + +Following are descriptions for each line in the "demand" section of +the sample '/etc/ppp/ppp.conf' file: + + + +set authname Your_User_ID_On_Remote_System + + +This line specifies the name you would use to log in to the remote +system. + + + +set authkey Your_Password_On_Remote_System + + +This is the password you'd use to log in to the remote system. + + + +set phone 1-800-123-4567 + + +This is the phone number of the remote system. + + + +set timeout 300 + + + +This tells the PPP program that it should automatically hang up the +phone if no data has be exchanged for 300 seconds (5 minutes). You +may wish to tailor this number to your specific requirements. + + + +set openmode active + + + +This tells the PPP program that once the modems are connected it +should immediately attempt to negotiate the connection. Some remote +sites do this automatically, some don't. This instructs your side of +the link to take the initiative and try to set up the connection. + + + +accept chap + + + +This tells the PPP program to use the "Challenge-Handshake +Authentication Protocol" to authenticate you. The values exchanged +between the local and remote side for UserID and password are taken +from the 'authname' and 'authkey' entries above. + + + +set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0 + + + +This command sets up a pair of "fake" IP addresses for the local and +remote sides of the PPP link. It instructs the PPP program to create +an IP address of 127.1.1.1 for the local side of the 'tun0' +(tunnel) device (refer back to section ?? for a description of this +device) and 127.2.2.2 for the remote side. Appending '/0' to +each address tells the PPP program that zero of the bits that make up +these addresses are significant and can (in fact, must!) be negotiated +between the local and remote systems when the link is established. +The 255.255.255.0 string tells the PPP program what Subnet mask to +apply to these pseudo-interfaces. + +Remember, we've assumed that your ISP provides the IP addresses for +both ends of the link! If your ISP assigned you a specific IP address +that you should use on your side when configuring your system, enter +that IP address here instead of 127.1.1.1. + +Conversly, if your ISP gave you a specific IP address that he uses on +his end you should enter that IP address here instead of +127.2.2.2. + +In both cases, it's probably a good idea to leave the '/0' on +the end of each address. This gives the PPP program the opportunity +to change the address(es) of the link if it has to. + + + +add 0 0 127.2.2.2 + + + +This last line tells the PPP program that it should add a default +route for IP traffic that points to the (fake) IP address of the ISP's +system. + +Note: If you used an ISP-specified address instead of +127.2.2.2 on the preceeding line, use the same number here +instead of 127.2.2.2. + +By adding this "fake" route for IP traffic, the PPP program can, +while idle: + + + +Accept packets that FreeBSD doesn't already know how to forward, + + + +Establish a connection to the ISP "on-the-fly", + + + +Reconfigure the IP addresses of the local and remote side of the link, + + + +Forward packets between your workstation and the ISP. + + + + +automatically! + +Once the number of seconds specified by the timeout value in the +"default" section have elapsed without any TCP/IP traffic the PPP +program will automatically close the dial-up connection and the +process will begin again. + + + + + +The '<filename>/etc/ppp/ppp.linkup</filename>' file + +The other file needed to complete the PPP configuration is found in +'/etc/ppp/ppp.linkup'. This file contains instructions for +the PPP program on what actions to take after a dial-up link is +established. + +In the case of dial-on-demand configurations the PPP program will need +to delete the default route that was created to the fake IP address of +the remote side (127.2.2.2 in our example in the previous section) and +install a new default route that points the actual IP address of the +remote end (discovered during the dial-up connection setup). + +A representative '/etc/ppp/ppp.linkup' file: + +#########################################################################= + +# PPP Link Up File ('/etc/ppp/ppp.linkup') +# +# This file is checked after PPP establishes a network connection. +# +# This file is searched in the following order. +# +# 1) First, the IP address assigned to us is searched and +# the associated command(s) are executed. +# +# 2) If the IP Address is not found, then the label name specified at + +# PPP startup time is searched and the associated command(s) +# are executed. +# +# 3) If neither of the above are found then commands under the label +# 'MYADDR:' are executed. +# +#########################################################################= + +# +# This section is used for the "demand" configuration in +# /etc/ppp/ppp.conf: +demand: + delete ALL + add 0 0 HISADDR +# +# All other configurations in /etc/ppp/ppp.conf use this: +# +MYADDR: + add 0 0 HISADDR +######################################################################## +# End of /etc/ppp/ppp.linkup + + +Notice that there is a section in this file named "demand:", identical +to the configuration name used in the '/etc/ppp/ppp.conf' +file. This section instructs the PPP program that once a link is +established using this configuration, it must: + + + +Remove any IP routing information that the PPP program has created + + + +Add a default route the remote end's actual address. + + + + + +It's critical that those configurations in +'/etc/ppp/ppp.conf' which include the 'set ifaddr' and +'add 0 0' statements (i.e.: those configurations used for +Dial-on-Demand configurations) execute the "delete ALL" and "add 0 0 +HISADDR" commands in /etc/ppp/ppp.linkup. + +This is the mechanism that controls the actual on-demand +configuration of the link. + +All configurations not explicitly named in +/etc/ppp/ppp.linkup will use whatever commands are in the +"MYADDR:" section of the file. This is where non-Demand-Dial +configurations (such as our "interactive:" sample) will fall through +to. This section simply adds a default route to the ISP's IP address +(at the remote end). + + + + + +IP Aliasing + +All of the configuration steps described thus far are relevant to +any FreeBSD system which will be used to connect to an ISP via dial-up +connection. + +If your sole objective in reading this guide is to connect your +FreeBSD box to the Internet using dial-out ppp you can proceed to +Section 6, "Testing the Network". + +One very attractive feature of the PPP program in on-demand mode is +its ability to route IP traffic between other systems on the Local +Area Network automatically. This feature is known by various names, +"IP Aliasing", "Network Address Translation", "Address +Masquerading" or "Transparent Proxying". + +Regardless of the terminology used, this mode is not, however, +automatic. If the PPP program is started normally then the program +will not forward packets between LAN interface(s) and the dial-out +connection. In effect, only the FreeBSD system is connected to the +ISP; other workstations cannot "share" the same connection. + +For example, if the program is started with either of the following +command lines: + +# ppp interactive (Interactive mode) + + or + +# ppp -auto demand (Dial-on-Demand mode) + +then the system will function as an Internet-connected workstation +only for the +FreeBSD box. + +To start the PPP program as a gateway between LAN resources and the +Internet, one of the following command lines would be used instead: + +# ppp -alias interactive (Interactive mode) + + or + +# ppp -auto -alias demand (Dial-on-Demand mode) + +You can alternatively use the command ``alias enable yes'' +in your ppp configuration file (refer to the man page for details). + +Keep this in mind if you intend to proceed with Section 5, +"Configuring Windows Systems". + + + + + +Configuring Windows Systems + +As indicated in Section 1, our example network consists of a +FreeBSD system ("Curly") which acts as a gateway (or router) between a +Local Area Network consisting of two different flavors of Windows +Workstations. In order for the LAN nodes to use Curly as a router +they need to be properly configured. Note that this section does not +explain how to configure the Windows workstations for Dial-Up +networking. If you need a good explanation of that procedure, I +recommend http://www.aladdin.co.uk/techweb. + + + + Configuring Windows 95 + +Configuring Windows 95 to act as an attached resource on your LAN +is relatively simple. The Windows 95 network configuration must be +slightly modified to use the FreeBSD system as the default gateway to +the ISP. Perform the following steps: + +Create the Windows 95 "hosts" file: + +In order to connect to the other TCP/IP systems on the LAN you'll +need to create an identical copy of the "hosts" file that you +installed on the FreeBSD system in Section 3.4. + + + +Click the "Start" button; select "Run..."; enter "notepad +\WINDOWS\HOSTS" (without the quotes) and click "OK" + + + +In the editor, enter the addresses and system names from the hosts +file shown in Section 3.4. + + + +When finished editing, close the notepad application (making sure +that you save the file!). + + + + + +Configure the Windows 95 TCP/IP Network Configuation +settings: + + + +Click the "Start" button on the taskbar; select "Settings" and +"Control Panel". + + + +Double-click the "Network" icon to open it. + + +The settings for all Network Elements are displayed. + + + +With the "Configuration" tab selected, scroll down the list of +installed components and highlight the "TCP/IP->YourInterfaceType" line +(where "YourInterfaceType" is the name or type of Ethernet adapter in your system). + + +If TCP/IP is not listed in the list of installed network +components, click the "Add" button and install it before proceeding. + +(Hint: "Add | Protocol | Microsoft | TCP/IP | OK") + + + +Click on the "Properties" button to display a list of the +settings associated with the TCP component. + + + + + +Configure the IP Address Information: + + + +Click the "IP Address" tab + + + +Click the "Specify an IP address" radio button. + + +(In our example LAN the Windows 95 system is the one we've called "Larry".) + + + +In the "IP Address" field enter "192.168.1.2". + + + +Enter 255.255.255.0 in the "Subnet Mask" field. + + + + + +Configure the Gateway information: + + + +Click on the "Gateway" tab + + +For our example network the FreeBSD box will be acting as our +gateway to the Internet (routing packets between the Ethernet LAN and +the PPP dial-up connection. Enter the IP address of the FreeBSD +Ethernet interface, 192.168.1.1, in the "New gateway" field and click +the "Add" button. If any other gateways are defined in the "Installed +gateways" list you may wish to consider removing them. + + + + + +Configure the DNS Information: + +This guide assumes that your Internet Service Provider has given +you a list of Domain Name Servers (or "DNS Servers") that you should +use. If you wish to run a DNS server on your local FreeBSD system, +refer to Section 6, "Exercise for the Interested Student" for tips on +setting up DNS on your FreeBSD system. + + + + + +Click the "DNS Configuration" tab + + + +Make sure that the "Enable DNS" radio button is selected. + + +(If this button is not selected only the entries that +we put in the host file(s) will be available and your Net-Surfing +will not work as you expect!) + + + +In the "Host" field enter the name of the Windows 95 box, in this +case: "Larry". + + + +In the "Domain" field enter the name of our local network, in this +case: "my.domain" + + + +In the "DNS Server Search Order" section, enter the IP address +of the DNS server(s) that your ISP provided, clicking the "Add" button +after every address is entered. Repeat this step as many times as +necessary to add all of the addresses that your ISP provided. + + + + + +Other Windows 95 TCP/IP options: + +For our purposes the settings under the "Advanced", "WINS +Configuration" and "Bindings" tabs are not necessary. + +If you wish to use the Windows Internet Naming Service ("WINS") +your attention is invited to http://www.localnet.org for +more information about WINS settings, specifically regarding sharing +files transparently across the Internet. + +Mopping up: + + + +Click on the "OK" button to close the TCP/IP Properties window. + + + +Click on the "OK" button to close the Network Control Panel. + + + +Reboot your computer if prompted to do so. + + + + + + That's it! + + + + +Configuring Windows NT + +Configuring Windows NT to act as a LAN resource is also relatively +straightforward. The procedures for configuring Windows NT are +similar to Windows 95 with minor exceptions in the user interface. + +The steps shown here are appropriate for a Windows NT 4.0 +Workstation, but the principles are the same for NT 3.5x. You may +wish to refer to the "Configuring Windows for Workgroups" section if +you're configuring Windows NT 3.5x, since the user interface is +the same for NT 3.5 and WfW. + +Perform the following steps: + +Create the Windows NT "hosts" file: + +In order to connect to the other TCP/IP systems on the LAN you'll +need to create an identical copy of the "hosts" file that you +installed on the FreeBSD system in Section 3.4 + + + +Click the "Start" button; select "Run..."; enter "notepad +\WINDOWS\SYSTEM\DRIVERS\ETC\HOSTS" (without the quotes) and click +"OK" + + + +In the editor, enter the addresses and system names from Section +3.4. + + + +When finished editing, close the notepad application (making sure +that you save the file!). + + + + + +Configure the Windows NT TCP/IP Network Configuation +settings: + + + +Click the "Start" button on the taskbar; select "Settings" and +"Control Panel". + + + +Double-click the "Network" icon to open it. + + + +With the "Identification" tab selected, verify the "Computer Name" +and "Workgroup" fields. In this example we'll use "Shemp" for the name +and "Stooges" for the workgroup. Click the "Change" button and amend +these entries as necessary. + + + +Select the "Protocols" tab. + + + +The installed Network Protocols will be displayed. There may be a +number of protocols listed but the one of interest to this guide is +the "TCP/IP Protocol". If "TCP/IP Protocol" is not listed, click the +"Add" button to load it. + +(Hint: "Add | TCP/IP Protocol | OK") + + + +Highlight "TCP/IP +Protocol" and click the "Properties" button. + + +Tabs for specifying various settings for TCP/IP will be displayed. + + + + + +Configuring the IP Address: + +Make sure that the Ethernet Interface is shown in the "Adapter" +box; if not, scroll through the list of adapters until the correct +interface is shown. + + + +Click the "Specify an IP address" radio button to enable the three +text boxes. + + +In our example LAN the Windows NT system is the one we've called +"Shemp" + + + +In the "IP Address" field enter "192.168.1.4". + + + +Enter 255.255.255.0 in the "Subnet Mask" field. + + + + + +Configure the Gateway information: + +For our example network the FreeBSD box will be acting as our gateway +to the Internet (routing packets between the Ethernet LAN and the PPP dial-up +connection. + + + +Enter the IP address of the FreeBSD Ethernet interface, +192.168.1.1, in the "New gateway" field and click the "Add" button. + + +If any other gateways are defined in the "Installed gateways" list +you may wish to consider removing them. + + + + + +Configuring DNS: + +Again, this guide assumes that your Internet Service Provider has +given you a list of Domain Name Servers (or "DNS Servers") that you +should use. + +If you wish to run a DNS server on your local FreeBSD system, refer to +Section 6, "Exercise for the Interested Student" for tips on setting +up DNS on your FreeBSD system. + + + +Click the "DNS" tab + + + +In the "Host Name" field enter the name of the Windows NT box, in +this case: "Shemp". + + + +In the "Domain" field enter the name of our local network, in this +case: "my.domain" + + + +In the "DNS Server Search Order" section, enter the IP address of +the DNS server that your ISP provided, clicking the "Add" button after +every address is entered. Repeat this step as many times as necessary +to add all of the addresses that your ISP provided. + + + + + +Other Windows NT TCP/IP options: + +For our purposes the settings under the "WINS Address" and +"Routing" tabs are not used. + +If you wish to use the Windows Internet Naming Service ("WINS") +your attention is invited to http://www.localnet.org for +more information about WINS settings, specifically regarding sharing +files transparently across the Internet. + +Mopping up: + + + +Click on the "OK" button to close the TCP/IP Properties section. + + + + +Click on the "Close" button to close the Network Control Panel. + + + + +Restart your computer if prompted to do so. + + + + + +That's it! + + + + +Configuring Windows for Workgroups + +Configuring Windows for Workgroups to act as a network client +requires that the Microsoft TCP/IP-32 driver diskette has been +installed on the workstation. The TCP/IP drivers are not included +with the WfW CD or diskettes; if you need a copy they're available at +ftp://ftp.microsoft.com:/peropsys/windows/public/tcpip. + +Once the TCP/IP drivers have been loaded, perform the following +steps: + +Create the Windows for Workgroups "hosts" file: + +In order to connect to the other TCP/IP systems on the LAN you'll +need to create an identical copy of the "hosts" file that you +installed on the FreeBSD system in Section 3.4. + + + +In Program Manager, click the "File" button; select "Run"; and +enter: "notepad \WINDOWS\HOSTS" (without the quotes) and click "OK" + + + +In the editor, enter the addresses and system names from the hosts +file shown in Section 3.4. + + + +When finished editing, close the notepad application (making sure +that you save the file!). + + + + + +Configure the Windows 95 TCP/IP Network Configuation +settings + + + +In the main window of Program Manager, open the "Network" group by +double-clicking the icon. + + + +Double click on the "Network Setup" icon. + + + +In the "Network Drivers Box" double-click the "Microsoft +TCP/IP-32" entry. + + + + + +Configure the Windows for Workgroups IP Address: + +Ensure +the correct Ethernet Interface is selected in the "Adapter" list. If +not, scroll down until it is displayed and select it by clicking on +it. + + + +Ensure that the "Enable Automatic DHCP Configuration" check box is +blank. If it is checked, click it to remove the "X". + + + +In our example LAN the Windows for Workgroups system is the one +we've called "Moe"; in the "IP Address" field enter "192.168.1.3". + + + +Enter 255.255.255.0 in the "Subnet Mask" field. + + + + + +Configure the Gateway information: + +For our example network the FreeBSD box will be acting as our +gateway to the Internet (routing packets between the Ethernet LAN and +the PPP dial-up connection). + + + +Enter the IP address of the FreeBSD system, 192.168.1.1, in the +"Default Gateway" field. + + + + + +Configuring DNS: + +Again, this guide assumes that your Internet Service Provider has +given you a list of Domain Name Servers (or "DNS Servers") that you +should use. If you wish to run a DNS server on your local FreeBSD +system, refer to Section 6, "Exercise for the Interested Student" for +tips on setting up DNS on your FreeBSD system. + + + +Click the "DNS" button. + + + +In the "Host Name" field enter the name of the Windows for +Workgroups box, in this case: "Moe". + + + +In the "Domain" field enter the name of our local network, in this +case: "my.domain" + + + +In the "Domain Name Service (DNS) Search Order" section, enter the +IP address of the DNS server that your ISP provided, clicking the "Add" +button after each address is entered. Repeat this step as many times as +necessary to add all of the addresses that your ISP provided. + + + +Click on the "OK" button to close the DNS Configuration window. + + + + + + +Mopping up: + + + +Click on the "OK" button to close the TCP/IP Configuration window. + + + + +Click on the "OK" button to close the Network Setup window. + + + +Reboot your computer if prompted. + + + + + +That's it! + + + + + +Testing the Network + + Once you've completed that appropriate tasks above you should have +a functioning PPP gateway to the Internet. + + + +Testing the Dial-Up link: + + The first thing to test is that the connection is being made +between your modem and the ISP. + + + + +Testing the Ethernet LAN + + *** TBD *** + + + + + +Exercises for the Interested Student + + + +Creating a mini-DNS system + +While managing a Domain Name Service (DNS) hierarchy can be a black +art, it is possible to set up a Mini-DNS server on the FreeBSD system +that also acts as your gateway to your ISP. + +Building on the files in /etc/namedb when the FreeBSD +system was installed it's possible to create a name server that is +both authoritative for the example network shown here as well as a +front-door to the Internet DNS architecture. + +In this minimal DNS configuration, only three files are necessary: + +/etc/namedb/named.boot +/etc/namedb/named.root +/etc/namedb/mydomain.db + + + +The /etc/namedb/named.root file is automatically installed +as part of the FreeBSD base installation; the other two files must be +created manually. + + + +The <filename>/etc/namedb/named.boot</filename> file + +The /etc/namedb/named.boot file controls the startup +settings of the DNS server. +Esentially, it tells the Name Server: + + + +Where to find configuration files, + + + +What "domain names" it's responsible for, and + + + +Where to find other DNS servers. + + + + + +Using the 'ee' editor, create a +/etc/namedb/named.boot with the following contents: + +; boot file for mini-name server + +directory /etc/namedb + +; type domain source host/file backup file + +cache . named.root +primary my.domain. mydomain.db + + + +Lines that begin with a semi-colon are comments. The significant +lines in this file are: + + + +directory /etc/namedb + + +Tells the Name Server where to find the configuration files +referenced in the remaining sections of the +'/etc/namedb/named.boot' file. + + + +cache . named.root + + +Tells the Name Server that the list of "Top-Level" DNS servers for +the Internet can be found in a file called 'named.root'. +(This file is included in the base installation and its +contents are not described in this document.) + + + +primary my.domain. mydomain.db + + +Tells the Name Server that it will be "authoritative" for a DNS +domain called "my.domain" and that a list of names and IP addresses +for the systems in "my.domain" (the local network) +can be found in a file named 'mydomain.db'. + + + + + +Once the /etc/namedb/named.boot file has been created and +saved, proceed to the next section to create the +/etc/namedb/mydomain.db file. + + + + +The <filename>/etc/namedb/mydomain.db</filename> file + +The /etc/namedb/mydomain.db file lists the names and IP +addresses of every system in the Local Area Network. + +For a detailed description of the statements used in this file, +refer to the named manpage. + +The /etc/namedb/mydomain.db file for our minimal DNS +server has the following contents: + +@ IN SOA my.domain. root.my.domain. ( + 961230 ; Serial + 3600 ; Refresh + 300 ; Retry + 3600000 ; Expire + 3600 ) ; Minimum + IN NS curly.my.domain. + +curly.my.domain. IN A 192.168.1.1 # The FreeBSD box +larry.my.domain. IN A 192.168.1.2 # The Win'95 box +moe.my.domain. IN A 192.168.1.3 # The WfW box +shemp.my.domain. IN A 192.168.1.4 # The Windows NT box + +$ORIGIN 1.168.192.IN-ADDR.ARPA + IN NS curly.my.domain. +1 IN PTR curly.my.domain. +2 IN PTR larry.my.domain. +3 IN PTR moe.my.domain. +4 IN PTR shemp.my.domain. + +$ORIGIN 0.0.127.IN-ADDR.ARPA + IN NS curly.my.domain. +1 IN PTR localhost.my.domain. + + + +In simple terms, this file declares that the local DNS server is: + + + +The Start of Authority for ("SOA") for a domain called +'my.domain', + + + +The Name Server ("NS") for 'my.domain', + + + +Responsible for the reverse-mapping for all IP addresses that +start with '192.168.1.' and +'127.0.0.' ("$ORIGIN ...") + + + + + +To add workstation entries to this file you'll need to add two +lines for each system; one in the top section where the name(s) are +mapped into Internet Addresses ("IN A"), and another line that maps +the addresses back into names in the $ORIGIN +1.168.192.IN-ADDR.ARPA section. + + + + +Starting the DNS Server + +By default the DNS server ('/usr/sbin/named') is not +started when the system boots. You can modify this behavior by +changing a single line in '/etc/rc.conf' as follows: + + Using the 'ee' editor, load /etc/rc.conf. Scroll +down approximately 40 lines until you come to the section that says: + +--- +named_enable="NO" # Run named, the DNS server (or NO). +named_flags="-b /etc/namedb/named.boot" # Flags to named (if enabled). +--- + + +Change this section to read: + +--- +named_enable="YES" # Run named, the DNS server (or NO). +named_flags="-b /etc/namedb/named.boot" # Flags to named (if enabled). +--- + + +Save the file and reboot. + +Alternatively, start the Name Server daemon by entering the following +command: + +# named -b /etc/namedb/named.boot + + + +Whenever you modify any of the files in /etc/namedb you'll +need to kick-start the Name Server process to make it pick up the +modifications. This is performed with the following system command: + +# kill -HUP `cat /var/run/named.pid` + + + + + + + +Playing with PPP filters + +The PPP program has the ability to apply selected filtering rules +to the traffic it routes. While this is not nearly as secure as a +formal firewall it does provide some access control as to how the link +is used. + +('man ipfw' for information on setting up a more secure +FreeBSD system.) + +The complete documentation for the various filters and rules under +PPP are availabe in the PPP manpage. + +There are four distinct classes of rules which may be applied to +the PPP program: + + + +afilter - Access Counter (or "Keep Alive") filters + + +These control which events are ignored by the set timeout= +statement in the configuration file. + + + +dfilter - Dialing filters + + +These filtering rules control which events are ignored by the +demand-dial mode of PPP. + + + +ifilter - Input filters + + +Control whether incoming packets should be discarded or passed into +the system. + + + +ofilter - Output filters + + +Control whether outgoing packets should be discarded or passed into +the system. + + + + + +What follows is a snippet from an operating system which provides a +good foundation for "normal" Internet operations while preventing PPP +from pumping all data over the dial-up connection. Comments +briefly describe the logic of each rule set: + +# +# KeepAlive filters +# Don't keep Alive with ICMP,DNS and RIP packet +# + set afilter 0 deny icmp + set afilter 1 deny udp src eq 53 + set afilter 2 deny udp dst eq 53 + set afilter 3 deny udp src eq 520 + set afilter 4 deny udp dst eq 520 + set afilter 5 permit 0/0 0/0 +# +# Dial Filters: +# Note: ICMP will trigger a dial-out in this configuration! +# + set dfilter 0 permit 0/0 0/0 +# +# Allow ident packet pass through +# + set ifilter 0 permit tcp dst eq 113 + set ofilter 0 permit tcp src eq 113 +# +# Allow telnet connection to the Internet +# + set ifilter 1 permit tcp src eq 23 estab + set ofilter 1 permit tcp dst eq 23 +# +# Allow ftp access to the Internet +# + set ifilter 2 permit tcp src eq 21 estab + set ofilter 2 permit tcp dst eq 21 + set ifilter 3 permit tcp src eq 20 dst gt 1023 + set ofilter 3 permit tcp dst eq 20 +# +# Allow access to DNS lookups +# + set ifilter 4 permit udp src eq 53 + set ofilter 4 permit udp dst eq 53 +# +# Allow DNS Zone Transfers +# + set ifilter 5 permit tcp src eq 53 + set ofilter 5 permit tcp dst eq 53 +# +# Allow access from/to local network +# + set ifilter 6 permit 0/0 192.168.1.0/24 + set ofilter 6 permit 192.168.1.0/24 0/0 +# +# Allow ping and traceroute response +# + set ifilter 7 permit icmp + set ofilter 7 permit icmp + set ifilter 8 permit udp dst gt 33433 + set ofilter 9 permit udp dst gt 33433 +# +# Allow cvsup +# + set ifilter 9 permit tcp src eq 5998 + set ofilter 9 permit tcp dst eq 5998 + set ifilter 10 permit tcp src eq 5999 + set ofilter 10 permit tcp dst eq 5999 +# +# Allow NTP for Time Synchronization +# + set ifilter 11 permit tcp src eq 123 dst eq 123 + set ofilter 11 permit tcp src eq 123 dst eq 123 + set ifilter 12 permit udp src eq 123 dst eq 123 + set ofilter 12 permit udp src eq 123 dst eq 123 +# +# SMTP'd be a good idea! +# + set ifilter 13 permit tcp src eq 25 + set ofilter 13 permit tcp dst eq 25 +# +# +# We use a lot of `whois`, let's pass that +# + set ifilter 14 permit tcp src eq 43 + set ofilter 14 permit tcp dst eq 43 + set ifilter 15 permit udp src eq 43 + set ofilter 15 permit udp dst eq 43 +# +# If none of above rules matches, then packet is blocked. +#------- + + + +Up to 20 distinct filtering rules can be applied to each class of +filter. Rules in each class are number sequentially from 0 to 20 +but none of the rules for a particular filter class take affect +until ruleset '0' is defined! + +If you choose not to use Filtering Rules in the PPP +configuration then ALL traffic will be permitted both into and +out of your system while it's connected to your ISP. + +If you decide that you want to implement filtering rules, add the +above lines to your /etc/ppp/ppp.conf file in either the +"default:", "demand:", or "interactive:" section (or all of them - the +choice is yours). + + + + diff --git a/en_US.ISO_8859-1/books/ppp-primer/book.sgml b/en_US.ISO_8859-1/books/ppp-primer/book.sgml new file mode 100644 index 0000000000..f824059981 --- /dev/null +++ b/en_US.ISO_8859-1/books/ppp-primer/book.sgml @@ -0,0 +1,2340 @@ + + + + + +PPP - Pedantic PPP Primer + + + +Maintainer: Steve Sims <SimsS@IBM.NET> + + + +$FreeBSD: doc/en_US.ISO_8859-1/tutorials/ppp/ppp.sgml,v 1.8 1999/09/06 07:22:25 peter Exp $ + +This is a step-by-step guide for configuring FreeBSD systems to act as +a dial-up router/gateway in a Local Area Environment. All entries may +be assumed to be relevant to FreeBSD 2.2+, unless otherwise noted. + + + + + +Overview: + +The User-Mode PPP dialer in FreeBSD Version 2.2 (also known as: +"IIJ-PPP" ) now supports Packet Aliasing for dial up +connections to the Internet. This feature, also known as +"Masquerading", "IP Aliasing", or "Network Address +Translation", allows a FreeBSD system to act as a dial- on-demand +router between an Ethernet-based Local Area Network and an Internet +Service Provider. Systems on the LAN can use the FreeBSD system to +forward information between the Internet by means of a single +dial-connection. + + + +Purpose of this Guide. + +This guide explains how to: + + + +Configure the FreeBSD system to support dial-out connections, + + + +Share a dial-out connection with other systems in a network, + + + +Configure Windows platforms to use the FreeBSD system as a gateway to the Internet. + + + + + +While the focus of this guide is to assist in configuring IP Aliasing, +it also includes specific examples of the configuration steps necessary +to configure and install each individual component; each section stands +alone and may be used to assist in the configuration of various aspects +of FreeBSD internetworking. + + + + + +Building the Local Area Network + + While the ppp program can, and usually is, be configured to provide +services to only the local FreeBSD box it can also be used to serve as a +"Gateway" (or "router") between other LAN-connected resources and the Internet or +other Dial-Up service. + + + +Typical Network Topology + +This guide assumes a typical Local Area Network lashed together as +follows: + ++---------+ ----> Dial-Up Internet Connection +| FreeBSD | \ (i.e.: NetCom, AOL, AT&T, EarthLink, +etc) +| |-------- +| "Curly" | +| | ++----+----+ + | +|----+-------------+-------------+----| <-- Ethernet Network + | | | + | | | ++----+----+ +----+----+ +----+----+ +| | | | | | +| Win95 | | WFW | | WinNT | +| "Larry" | | "Moe" | | "Shemp" | +| | | | | | ++---------+ +---------+ +---------+ + + + + + +Assumptions about the Local Area Network + +Some specific assumptions about this sample network are: + +Three workstations and a Server are connected with Ethernet +cabling: + + + +a FreeBSD Server ("Curly") with an NE-2000 adapter configured as +'ed0' + + + +a Windows-95 workstation ("Larry") with Microsoft's "native" +32-bit TCP/IP drivers + + + +a Windows for Workgroups workstation ("Moe") with Microsoft's +16-bit TCP/IP extensions + + + +a Windows NT workstation ("Shemp") with Microsoft's "native" +32-bit TCP/IP drivers + + + + + +The IP Addresses on the Ethernet side of this sample LAN have been + +taken from the pool of "reserved" addresses proposed in RFC-1597. +IP addresses are assigned as follows: +Name IP Address +"Curly" 192.168.1.1 # The FreeBSD box +"Larry" 192.168.1.2 # The Win'95 box +"Moe" 192.168.1.3 # The WfW box +"Shemp" 192.168.1.4 # The Windows NT box + + +This guide assumes that the modem on the FreeBSD box is connected +to the first serial port ('/dev/cuaa0' or 'COM1:' in +DOS-terms). + +Finally, we'll also assume that your Internet Service Provider (ISP) +automatically provides the IP addresses of both your PPP/FreeBSD side +as well as the ISP's side. (i.e.: Dynamic IP Addresses on both ends +of the link.) Specific details for configuring the Dial-Out side of +PPP will be addressed in Section 2, "Configuring the FreeBSD System". + + + + + +FreeBSD System Configuration + +There are three basic pieces of information that must be known to +the FreeBSD box before you can proceed with integrating the sample +Local Area Network: + + + + + +The Host Name of the FreeBSD system; in our example it's "Curly", + + + +The Network configuration, + + + +The /etc/hosts file (which lists the names and IP addresses of +the other systems in your network) + + + + + +If you performed the installation of FreeBSD over a network +connection some of this information may already be configured into +your FreeBSD system. + +Even if you believe that the FreeBSD system was properly configured +when it was installed you should at least verify each of these bits of +information to prevent trouble in subsequent steps. + + + +Verifying the FreeBSD Host Name + +It's possible that the FreeBSD host name was specified and saved +when the system was initially installed. To verify that it was, enter +the following command at a prompt: + + + +# hostname + + + +The name of the host FreeBSD system will be displayed on a single +line. If the name looks correct (this is very subjective :-) skip +ahead to Section 3.2, "Verifying the Ethernet Interface +Configuration". + +For example, in our sample network, we would see 'curly.my.domain' +as a result of the `hostname` command if the name had been set +correctly during, or after, installation. (At this point, don't worry +too much about the ".my.domain" part, we'll sort this out later. The +important part is the name up to the first dot.) + +If a host name wasn't specified when FreeBSD was installed you'll +probably see 'myname.my.domain` as a response. You'll need to edit +/etc/rc.conf to set the name of the machine. + + + +Configuring the FreeBSD Host Name + +Reminder: You must be logged in as 'root' to edit the +system configuration files! + +CAUTION: If you mangle the system configuration files, +chances are your system WILL NOT BOOT correctly! Be careful! + +The configuration file that specifies the FreeBSD system's host +name when the system boots is in /etc/rc.conf. Use the +default text editor ('ee') to edit this file. + +Logged in as user 'root' load /etc/rc.conf into the +editor with the following command: + +# ee /etc/rc.conf + + + +Using the arrow keys, scroll down until you find the line that +specifies the host name of the FreeBSD system. By default, this +section says: + +--- +### Basic network options: ### +hostname="myname.my.domain" # Set this! +--- + + +Change this section to say (in our example): + +--- +### Basic network options: ### +hostname="curly.my.domain" # Set this! +--- + + + +Once the change to the host name has been made, press the 'Esc' key to +access the command menu. Select "leave editor" and make sure to +specify "save changes" when prompted. + + + + + +Verifying the Ethernet Interface Configuration + +To reiterate our basic assumption, this guide assumes that the +Ethernet Interface in the FreeBSD system is named 'ed0'. This is +the default for NE-1000, NE-2000, WD/SMC models 8003, 8013 and Elite +Ultra (8216) network adapters. + +Other models of network adapters may have different device names in +FreeBSD. Check the FAQ for specifics about your network adapter. If +you're not sure of the device name of your adapter, check the FreeBSD +FAQ to determine the device name for the card you have and substitute +that name (i.e.: 'de0', 'zp0', or similar) in the following +steps. + +As was the case with the host name, the configuration for the +FreeBSD system's Ethernet Interface may have been specified when the +system was installed. + +To display the configuration for the interfaces in your +FreeBSD system (Ethernet and others), enter the following command: + +# ifconfig -a + + +(In layman's terms: "Show me the InterFace CONFIGuration +for my network devices.") + +An example: + +# ifconfig -a + ed0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu +1500 + inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255 + ether 01:02:03:04:05:06 + lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500 + tun0: flags=8050<POINTOPOINT,RUNNING, MULTICAST> mtu 1500 + sl0: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 552 + ppp0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500 + lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 + inet 127.0.0.1 netmask 0xff000000 +# _ + + + +In this example, the following devices were displayed: + +ed0: The Ethernet Interface + +lp0: The Parallel Port Interface (ignored in this guide) + +tun0: The "tunnel" device; This is the one user-mode ppp uses! + +sl0: The SL/IP device (ignored in this guide) + +ppp0: Another PPP device (for kernel ppp; ignored in this guide) + +lo0: The "Loopback" device (ignored in this guide) + +In this example, the 'ed0' device is up and running. The key +indicators are: + + + +Its status is "UP", + + + +It has an Internet ("inet") address, (in this case, 192.168.1.1) + + + +It has a valid Subnet Mask ("netmask"; 0xffffff00 is the same as +255.255.255.0), and + + + +It has a valid broadcast address (in this case, 192.168.1.255). + + + + + +If the line for the Ethernet card had shown something similar to: + +ed0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500 + ether 01:02:03:04:05:06 + + +then the Ethernet card hasn't been configured yet. + +If the configuration for the Ethernet interface is correct you can +skip forward to Section 3.4, "Creating the list of other LAN hosts". +Otherwise, proceed with the next section. + + + +Configuring your Ethernet Interface + +Reminder: You must be logged in as 'root' to edit the +system configuration files! + +CAUTION: If you mangle the system configuration files, +chances are your system WILL NOT BOOT correctly! Be careful! + +The configuration file that specifies settings for the network +interfaces when the system boots is in /etc/rc.conf. Use +the default text editor ('ee') to edit this file. + +Logged in as user 'root' load /etc/rc.conf into the +editor with the following command: + + # ee /etc/rc.conf + +About 20 lines from the top of /etc/rc.conf is the section +that describes which network interfaces should be activated when the +system boots. In the default configuration file the specific line +that controls this is: + + + +network_interfaces="lo0" # List of network interfaces (lo0 is loopback). + + + +You'll need to amend this line to tell FreeBSD that you want to add +another device, namely the 'ed0' device. Change this line to +read: + + + +network_interfaces="lo0 ed0" # List of network interfaces (lo0 is loopback). + + + +(Note the space between the definition for the loopback device +("lo0") +and the Ethernet device ("ed0")! + + Reminder: If your Ethernet card isn't named 'ed0', specify +the correct device name here instead. + +If you performed the installation of FreeBSD over a network +connection then the 'network_interfaces=' line may already +include a reference to your Ethernet adapter. If it is, verify that +it is the correct device name. + +Specify the Interface Settings for the Ethernet device +('ed0'): + +Beneath the line that specifies which interfaces should be +activated are the lines that specify the actual settings for each +interface. In the default /etc/rc.conf file is a single +line that says: + + + +ifconfig_lo0="inet 127.0.0.1" # default loopback device configuration. + + + +You'll need to add another line after that to specify the settings +for your 'ed0' device. + +If you performed the installation of FreeBSD over a network +connection then there may already be an 'ifconfig_ed0=' line +after the loopback definition. If so, verify that it has the correct +values. + +For our sample configuration we'll insert a line immediately after +the loopback device definition that says: + + + +ifconfig_ed0="inet 192.168.1.1 netmask 255.255.255.0" + + + +When you've finished editing /etc/rc.conf to specify and +configure the network interfaces the section should look really close +to: + + + +--- +network_interfaces="ed1 lo0" # List of network interfaces (lo0 is loopback). +ifconfig_lo0="inet 127.0.0.1" # default loopback device configuration. +ifconfig_ed1="inet 192.168.1.1 netmask 255.255.255.0" +--- + + + +Once all of the necessary changes to /etc/rc.conf have +been made, press the 'Esc' key to invoke the control menu. Select +"leave editor" and be sure to select "save changes" when prompted. + + + + + +Enabling Packet Forwarding + +By default the FreeBSD system will not forward IP packets between +various network interfaces. In other words, routing functions (also +known as gateway functions) are disabled. + +If your intent is to use a FreeBSD system as stand-alone Internet +workstation and not as a gateway between LAN nodes and your ISP you +should skip forward to Section 3.4, "Creating the List of Other +LAN Hosts". + +If you intend for the PPP program to service the local FreeBSD box +as well as LAN workstations (as a router) you'll need to enable IP +forwarding. + +To enable IP Packet forwarding you'll need to edit the +/etc/rc.conf file. +Load this file into your editor with the following command: + +# ee /etc/rc.conf + + + +About 85 lines down from the top of the file will be the +configuration +section which controls IP forwarding, which will look like: + +===== +gateway_enable="NO" # Set to YES if this host will be a gateway. +===== + + + +Change this line to read: + +===== +gateway_enable="YES" # Set to YES if this host will be a gateway. +===== + + + +and exit the editor (saving the changes!). + +NOTE: This line may already be set to +'gateway_enable="YES"' if IP forwarding was enabled when the +FreeBSD system was installed. + + + + +Creating the List of other LAN Hosts(<filename>/etc/hosts</filename>) + +The final step in configuring the LAN side of the FreeBSD system is +to create a list of the names and TCP/IP addresses of the various +systems that are connected to the Local Area Network. This list is +stored in the '/etc/hosts' file. + +The default version of this file has only a single host name +listing in it: the name and address of the loopback device ('lo0'). +By networking convention, this device is always named "localhost" and +always has an IP address of 127.0.0.1. (See the interface +configuration example in Section 3.2.) + +To edit the /etc/hosts file enter the following command: + + # ee /etc/hosts + + + +Scroll all the way to the bottom of the file (paying attention to +the comments along the way; there's some good information there!) and +enter (assuming our sample network) the following IP addresses and +host names: + +192.168.1.1 curly curly.my.domain # FreeBSD System +192.168.1.2 larry larry.my.domain # Windows '95 System +192.168.1.3 moe moe.my.domain # Windows for Workgroups +System +192.168.1.4 shemp shemp.my.domain # Windows NT System + + + +(No changes are needed to the line for the '127.0.0.1 +localhost' entry.) + +Once you've entered these lines, press the 'Esc' key to invoke the +control menu. Select "leave editor" and be sure to select "save +changes" when prompted. + + + + +Testing the FreeBSD system + +Congratulations! Once you've made it to this point, the FreeBSD +system is configured as a network-connected UNIX system! If you made +any changes to the /etc/rc.conf file you should probably +re-boot your FreeBSD system. This will accomplish two important +objectives: + + + +Allow the changes to the interface configurations to be applied, and + + + +Verify that the system restarts without any glaring configuration errors. + + + + + +Once the system has been rebooted you should test the network +interfaces. + + + +Verifying the operation of the loopback device + +To verify that the loopback device is configured correctly, log in as +'root' and enter: + +# ping localhost + + + +You should see: + +# ping localhost +PING localhost.my.domain. (127.0.0.1): 56 data bytes +64 bytes from 127.0.0.1: icmp_seq=0 ttl=255 time=0.219 ms +64 bytes from 127.0.0.1: icmp_seq=1 ttl=255 time=0.287 ms +64 bytes from 127.0.0.1: icmp_seq=2 ttl=255 time=0.214 m +[...] + + +messages scroll by until you hit Ctrl-C to stop the madness. + + + + +Verifying the operation of the Ethernet Device + +To verify that the Ethernet device is configured correctly, enter: + + + +# ping curly + + + +You should see: + +# ping curly +PING curly.my.domain. (192.168.1.1): 56 data bytes +64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=0.219 ms +64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=0.200 ms +64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=0.187 ms +[...] + + +messages. + +One important thing to look at in these two examples is that the +names (loopback and curly) correctly correlate to their IP addresses +(127.0.0.1 and 192.168.1.1). This verifies that the +/etc/hosts files is correct. + +If the IP address for "curly" isn't 192.168.1.1 or the address for +"localhost" isn't 127.0.0.1, return to Section 3.4 and review your +entries in '/etc/hosts'. + +If the names and addresses are indicated correctly in the result of +the ping command but there are errors displayed then something is +amiss with the interface configuration(s). Return to Section 3.1 and +verify everything again. + +If everything here checks out, proceed with the next section. + + + + + + +Configuring the PPP Dial-Out Connection + +There are two basic modes of operation of the ppp driver: +"Interactive" and "Automatic". + +In Interactive mode you: + + + + + +Manually establish a connection to your ISP, + + + +Browse, surf, transfer files and mail, etc..., + + + +Manually disconnect from your ISP. + + + + + +In Automatic mode, the PPP program silently watches what goes on +inside the FreeBSD system and automagically connects and disconnects +with your ISP as required to make the Internet a seamless element of +your network. + +In this section we'll address the configuration(s) for both modes +with emphasis on configuring your `ppp` environment to operate in +"Automatic" mode. + + + +Backing up the original PPP configuration files + +Before making any changes to the files which are used by PPP you +should make a copy of the default files that were created when the +FreeBSD system was installed. + +Log in as the 'root' user and perform the following steps: + +Change to the '/etc directory: + +# cd /etc + +Make a backup copy the original files in the 'ppp' directory: + +# cp -R ppp ppp.ORIGINAL + +You should now be able to see both a 'ppp' and a +'ppp.ORIGINAL' subdirectory +in the '/etc' directory. + + + + +Create your own PPP configuration files + +By default, the FreeBSD installation process creates a number of +sample configuration files in the /etc/ppp directory. Please take +some time to review these files; they were derived from working +systems and represent the features and capabilities of the PPP +program. + +I strongly encourage you to learn from these sample files and +apply them to your own configuration as necessary. + +For detailed information about the `ppp` program, read the ppp +manpage: + +# man ppp + + + +For detailed information about the `chat` scripting language used by +the PPP dialer, read the chat manpage: + +# man chat + + + +The remainder of this section describes the recommended contents of +the PPP configuration files. + + + +The '<filename>/etc/ppp/ppp.conf</filename>' file + +The '/etc/ppp/ppp.conf' file contains the information and +settings required to set up a dial-out PPP connection. More than one +configuration may be contained in this file. The FreeBSD handbook +(XXX URL? XXX) describes the contents and syntax of this file in +detail. + +This section will describe only the minimal configuration to get a +dial-out connection working. + +Below is the /etc/ppp/ppp.conf file that we'll be using to provide a +dial-out Internet gateway for our example LAN: + +################################################################ +# PPP Configuration File ('/etc/ppp/ppp.conf') +# +# Default settings; These are always executed always when PPP +# is invoked and apply to all system configurations. +################################################################ +default: +set device /dev/cuaa0 +set speed 57600 +disable pred1 +deny pred1 +disable lqr +deny lqr +set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0 +OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT" +set redial 3 10 +# +# +################################################################ +# +# For interactive mode use this configuration: +# +# Invoke with `ppp -alias interactive` +# +################################################################ +interactive: +set authname Your_User_ID_On_Remote_System +set authkey Your_Password_On_Remote_System +set phone 1-800-123-4567 +set timeout 300 +set openmode active +accept chap +# +################################################################ +# +# For demand-dial (automatic) mode we'll use this configuration: +# +# Invoke with: 'ppp -auto -alias demand' +# +################################################################ +demand: +set authname Your_User_ID_On_Remote_System +set authkey Your_Password_On_Remote_System +set phone 1-800-123-4567 +set timeout 300 +set openmode active +accept chap +set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0 +add 0 0 127.2.2.2 +################################################################ +# End of /etc/ppp/ppp.conf + + +This file, taken verbatim from a working system, has three relevant +configuration sections: + + + +The "<emphasis remap=tt>default</emphasis>" Section + +The 'default:' section contains the values and settings +used by every other section in the file. Essentially, this section is +implicitly added to the configuration lines to each other section. + +This is a good place to put "global defaults" applicable to all +dial-up sessions; especially modem settings and dialing prefixes which +typically don't change based on which destination system you're +connecting to. + +Following are the descriptions of each line in the "default" section +of the sample '/etc/ppp/ppp.conf' file: + +set device /dev/cuaa0 + + +This statement informs the PPP program that it should use the first +serial port. +Under FreeBSD the '/dev/cuaa0' device is the same port that's +known as "COM1:" under DOS, Windows, Windows 95, etc.... + +If your modem is on COM2: you should specify +'/dev/cua01; COM3: would be '/dev/cua02'. + + + +set speed 57600 + + + +This line sets the transmit and receive speed for the connection +between the serial port and the modem. While the modem used for this +configuration is only a 28.8 device, setting this value to 57600 lets +the serial link run at a higher rate to accommodate higher throughput +as a result of the data compression built into late-model modems. + +If you have trouble communicating with your modem, try setting this +value to 38400 or even as low as 19200. + + + +disable pred1 +deny pred1 + + + +These two lines disable the "CCP/Predictor type 1" compression +features of the PPP program. The current version of `ppp` supports +data compression in accordance with draft Internet standards. +Unfortunately many ISPs use equipment that does not support this +capability. Since most modems try to perform on-the-fly compression +anyway you're probably not losing much performance by disabling this +feature on the FreeBSD side and denying the remote side from forcing +it on you. + + + +disable lqr +deny lqr + + + +These two lines control the "Line Quality Reporting" functions which +are part of the complete Point-to-Point (PPP) protocol specification. +(See RFC-1989 for details.) + +The first line, "disable lqr", instructs the PPP program to not +attempt to report line quality status to the device on the remote end. + +The second line, "deny lqr", instructs the PPP program to deny any +attempts by the remote end to reports line quality. + +As most modern dial-up modems have automatic error correction and +detection and LQR reporting is not fully implemented in many vendor's +products it's generally a safe bet to include these two lines in the +default configuration. + + + +set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0 +OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT" + + + +NOTE: (This statement should appear on a single line; ignore any +line wrapping that may appear in this document.) + +This line instructs the PPP program how to dial the modem and +specifies some rudimentary guidelines for doing so: + + + +Attempts to dial should fail if the modem returns a "BUSY" result code, + + + +Attempts to dial should also fail if the modem returns a "NO CARRIER" result code, + + + +The PPP program should expect each of the following events to complete within a +5-second timeout period: + + + +The PPP program will initially expect nothing (specified above +by the \"\" portion of the statement) from the modem + + + +The program +will send the modem initialization string "ATE1Q0M0" to the modem and +await a response of "OK". If a response is not received, the program +should send an attention command to the modem ("AT") and look again +for a response of "OK", + + + +The program should delay for one second +(specified by the "\\d" part of the statement, and send the dialing +string to the modem. The "ATDT" portion of the statement is the +standard modem prefix to dial using tone-dialing; if you do not have +touch-tone service on your local phone line, replace the "ATDT" with +"ATDP". The "\\T" string is a placeholder for the actual phone number +(which will be automatically inserted as specified by the "set dial +123-4567"). + + + + + + + +Finally, before a (maximum) timeout of 40 seconds, the PPP +program should expect to see a "CONNECT" result code returned from the +modem. + + + + + +A failure at any point in this dialog will be interpreted as a dialing +failure and the PPP program will fail to connect. + +(For a detailed description of the mini-scripting language used by the +PPP dialer, refer to the "chat" manpage.) + + + +set redial 3 10 + + +This line specifies that if a dial connection cannot immediately be made +the PPP program should retry (up to 3 times if necessary) with a delay of 10 seconds +between redialing attempts. + + + + +The "<emphasis remap=tt>interactive</emphasis>" Section + +The 'interactive:' section contains the values and +settings used to set up an "interactive" PPP session with a specific +remote system. Settings in this section will have the lines included +in the "default" section included automatically. + +The example cited in this section of the guide presumes that you'll +be connecting to a remote system that understands how to authenticate +a user without any fancy scripting language. That is, this sample +uses the CHAP protocol to set up the connection. + +A good rule of thumb is that if the Windows '95 dialer can set up a +connection by just clicking the "Connect" button this sample +configuration should work OK. + +If, on the other hand, when you connect to your ISP using Microsoft +Windows '95 Dial-Up Networking you need to resort to using the "Dial +Up Scripting Tool" from the Microsoft Plus! pack or you have to select +"Bring up a terminal windows after dialing" in the Windows '95 +connection options then you'll need to look at the sample PPP +configuration files and the ppp manpage for examples of "expect / +response" scripting to make your ISP connection. The "set login" +command is used for this purpose. + +Or even better, find an ISP who knows how to provide PAP or CHAP +authentication! + +The configuration examples shown here have been successfully used to +connect to: + + + +Various Shiva LanRovers + + + +The IBM Network (http://www.ibm.net) + + + +AT&T WorldNet (http://att.com/worldnet) + + + +Erol's (http://www.erols.com) + + + + + +Following are descriptions for each line in the "interactive" section +of the sample '/etc/ppp/ppp.conf' file: + + + +set authname Your_User_ID_On_Remote_System + + +This line specifies the name you would use to log in to the remote +system. + + + +set authkey Your_Password_On_Remote_System + + +This is the password you'd use to log in to the remote system. + + + +set phone 1-800-123-4567 + + +This is the phone number of the remote system. If you're inside a PBX +you can +prepend '9, ' to the number here. + + + +set timeout 300 + + +This tells the PPP program that it should automatically hang up the +phone if no data has +be exchanged for 300 seconds (5 minutes). You may wish to tailor this +number to your +specific requirements. + + + +set openmode active + + +This tells the PPP program that once the modems are connected it +should immediately attempt to negotiate the connection. Some remote +sites do this automatically, some don't. This instructs your side of +the link to take the initiative and try to set up the connection. + + + +accept chap + + +This tells the PPP program to use the "Challenge-Handshake +Authentication Protocol" to authenticate you. The values exchanged +between the local and remote side for UserID and password are taken +from the 'authname' and 'authkey' entries above. + + + + +The "<emphasis remap=tt>demand</emphasis>" Section + +The "demand" section contains the values and settings used +to set up a "Dial-on-demand" PPP session with a specific remote +system. Settings in this section will also have the lines included in +the "default" section included automatically. + +Except for the last two lines in this section it is identical to +the configuration section which defines the "interactive" +configuration. + +As noted in Paragraph ???, the examples cited in this section of +the guide presume that you'll be connecting to a remote system that +understands how to use the CHAP protocol to set up the connection. + +Following are descriptions for each line in the "demand" section of +the sample '/etc/ppp/ppp.conf' file: + + + +set authname Your_User_ID_On_Remote_System + + +This line specifies the name you would use to log in to the remote +system. + + + +set authkey Your_Password_On_Remote_System + + +This is the password you'd use to log in to the remote system. + + + +set phone 1-800-123-4567 + + +This is the phone number of the remote system. + + + +set timeout 300 + + + +This tells the PPP program that it should automatically hang up the +phone if no data has be exchanged for 300 seconds (5 minutes). You +may wish to tailor this number to your specific requirements. + + + +set openmode active + + + +This tells the PPP program that once the modems are connected it +should immediately attempt to negotiate the connection. Some remote +sites do this automatically, some don't. This instructs your side of +the link to take the initiative and try to set up the connection. + + + +accept chap + + + +This tells the PPP program to use the "Challenge-Handshake +Authentication Protocol" to authenticate you. The values exchanged +between the local and remote side for UserID and password are taken +from the 'authname' and 'authkey' entries above. + + + +set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0 + + + +This command sets up a pair of "fake" IP addresses for the local and +remote sides of the PPP link. It instructs the PPP program to create +an IP address of 127.1.1.1 for the local side of the 'tun0' +(tunnel) device (refer back to section ?? for a description of this +device) and 127.2.2.2 for the remote side. Appending '/0' to +each address tells the PPP program that zero of the bits that make up +these addresses are significant and can (in fact, must!) be negotiated +between the local and remote systems when the link is established. +The 255.255.255.0 string tells the PPP program what Subnet mask to +apply to these pseudo-interfaces. + +Remember, we've assumed that your ISP provides the IP addresses for +both ends of the link! If your ISP assigned you a specific IP address +that you should use on your side when configuring your system, enter +that IP address here instead of 127.1.1.1. + +Conversly, if your ISP gave you a specific IP address that he uses on +his end you should enter that IP address here instead of +127.2.2.2. + +In both cases, it's probably a good idea to leave the '/0' on +the end of each address. This gives the PPP program the opportunity +to change the address(es) of the link if it has to. + + + +add 0 0 127.2.2.2 + + + +This last line tells the PPP program that it should add a default +route for IP traffic that points to the (fake) IP address of the ISP's +system. + +Note: If you used an ISP-specified address instead of +127.2.2.2 on the preceeding line, use the same number here +instead of 127.2.2.2. + +By adding this "fake" route for IP traffic, the PPP program can, +while idle: + + + +Accept packets that FreeBSD doesn't already know how to forward, + + + +Establish a connection to the ISP "on-the-fly", + + + +Reconfigure the IP addresses of the local and remote side of the link, + + + +Forward packets between your workstation and the ISP. + + + + +automatically! + +Once the number of seconds specified by the timeout value in the +"default" section have elapsed without any TCP/IP traffic the PPP +program will automatically close the dial-up connection and the +process will begin again. + + + + + +The '<filename>/etc/ppp/ppp.linkup</filename>' file + +The other file needed to complete the PPP configuration is found in +'/etc/ppp/ppp.linkup'. This file contains instructions for +the PPP program on what actions to take after a dial-up link is +established. + +In the case of dial-on-demand configurations the PPP program will need +to delete the default route that was created to the fake IP address of +the remote side (127.2.2.2 in our example in the previous section) and +install a new default route that points the actual IP address of the +remote end (discovered during the dial-up connection setup). + +A representative '/etc/ppp/ppp.linkup' file: + +#########################################################################= + +# PPP Link Up File ('/etc/ppp/ppp.linkup') +# +# This file is checked after PPP establishes a network connection. +# +# This file is searched in the following order. +# +# 1) First, the IP address assigned to us is searched and +# the associated command(s) are executed. +# +# 2) If the IP Address is not found, then the label name specified at + +# PPP startup time is searched and the associated command(s) +# are executed. +# +# 3) If neither of the above are found then commands under the label +# 'MYADDR:' are executed. +# +#########################################################################= + +# +# This section is used for the "demand" configuration in +# /etc/ppp/ppp.conf: +demand: + delete ALL + add 0 0 HISADDR +# +# All other configurations in /etc/ppp/ppp.conf use this: +# +MYADDR: + add 0 0 HISADDR +######################################################################## +# End of /etc/ppp/ppp.linkup + + +Notice that there is a section in this file named "demand:", identical +to the configuration name used in the '/etc/ppp/ppp.conf' +file. This section instructs the PPP program that once a link is +established using this configuration, it must: + + + +Remove any IP routing information that the PPP program has created + + + +Add a default route the remote end's actual address. + + + + + +It's critical that those configurations in +'/etc/ppp/ppp.conf' which include the 'set ifaddr' and +'add 0 0' statements (i.e.: those configurations used for +Dial-on-Demand configurations) execute the "delete ALL" and "add 0 0 +HISADDR" commands in /etc/ppp/ppp.linkup. + +This is the mechanism that controls the actual on-demand +configuration of the link. + +All configurations not explicitly named in +/etc/ppp/ppp.linkup will use whatever commands are in the +"MYADDR:" section of the file. This is where non-Demand-Dial +configurations (such as our "interactive:" sample) will fall through +to. This section simply adds a default route to the ISP's IP address +(at the remote end). + + + + + +IP Aliasing + +All of the configuration steps described thus far are relevant to +any FreeBSD system which will be used to connect to an ISP via dial-up +connection. + +If your sole objective in reading this guide is to connect your +FreeBSD box to the Internet using dial-out ppp you can proceed to +Section 6, "Testing the Network". + +One very attractive feature of the PPP program in on-demand mode is +its ability to route IP traffic between other systems on the Local +Area Network automatically. This feature is known by various names, +"IP Aliasing", "Network Address Translation", "Address +Masquerading" or "Transparent Proxying". + +Regardless of the terminology used, this mode is not, however, +automatic. If the PPP program is started normally then the program +will not forward packets between LAN interface(s) and the dial-out +connection. In effect, only the FreeBSD system is connected to the +ISP; other workstations cannot "share" the same connection. + +For example, if the program is started with either of the following +command lines: + +# ppp interactive (Interactive mode) + + or + +# ppp -auto demand (Dial-on-Demand mode) + +then the system will function as an Internet-connected workstation +only for the +FreeBSD box. + +To start the PPP program as a gateway between LAN resources and the +Internet, one of the following command lines would be used instead: + +# ppp -alias interactive (Interactive mode) + + or + +# ppp -auto -alias demand (Dial-on-Demand mode) + +You can alternatively use the command ``alias enable yes'' +in your ppp configuration file (refer to the man page for details). + +Keep this in mind if you intend to proceed with Section 5, +"Configuring Windows Systems". + + + + + +Configuring Windows Systems + +As indicated in Section 1, our example network consists of a +FreeBSD system ("Curly") which acts as a gateway (or router) between a +Local Area Network consisting of two different flavors of Windows +Workstations. In order for the LAN nodes to use Curly as a router +they need to be properly configured. Note that this section does not +explain how to configure the Windows workstations for Dial-Up +networking. If you need a good explanation of that procedure, I +recommend http://www.aladdin.co.uk/techweb. + + + + Configuring Windows 95 + +Configuring Windows 95 to act as an attached resource on your LAN +is relatively simple. The Windows 95 network configuration must be +slightly modified to use the FreeBSD system as the default gateway to +the ISP. Perform the following steps: + +Create the Windows 95 "hosts" file: + +In order to connect to the other TCP/IP systems on the LAN you'll +need to create an identical copy of the "hosts" file that you +installed on the FreeBSD system in Section 3.4. + + + +Click the "Start" button; select "Run..."; enter "notepad +\WINDOWS\HOSTS" (without the quotes) and click "OK" + + + +In the editor, enter the addresses and system names from the hosts +file shown in Section 3.4. + + + +When finished editing, close the notepad application (making sure +that you save the file!). + + + + + +Configure the Windows 95 TCP/IP Network Configuation +settings: + + + +Click the "Start" button on the taskbar; select "Settings" and +"Control Panel". + + + +Double-click the "Network" icon to open it. + + +The settings for all Network Elements are displayed. + + + +With the "Configuration" tab selected, scroll down the list of +installed components and highlight the "TCP/IP->YourInterfaceType" line +(where "YourInterfaceType" is the name or type of Ethernet adapter in your system). + + +If TCP/IP is not listed in the list of installed network +components, click the "Add" button and install it before proceeding. + +(Hint: "Add | Protocol | Microsoft | TCP/IP | OK") + + + +Click on the "Properties" button to display a list of the +settings associated with the TCP component. + + + + + +Configure the IP Address Information: + + + +Click the "IP Address" tab + + + +Click the "Specify an IP address" radio button. + + +(In our example LAN the Windows 95 system is the one we've called "Larry".) + + + +In the "IP Address" field enter "192.168.1.2". + + + +Enter 255.255.255.0 in the "Subnet Mask" field. + + + + + +Configure the Gateway information: + + + +Click on the "Gateway" tab + + +For our example network the FreeBSD box will be acting as our +gateway to the Internet (routing packets between the Ethernet LAN and +the PPP dial-up connection. Enter the IP address of the FreeBSD +Ethernet interface, 192.168.1.1, in the "New gateway" field and click +the "Add" button. If any other gateways are defined in the "Installed +gateways" list you may wish to consider removing them. + + + + + +Configure the DNS Information: + +This guide assumes that your Internet Service Provider has given +you a list of Domain Name Servers (or "DNS Servers") that you should +use. If you wish to run a DNS server on your local FreeBSD system, +refer to Section 6, "Exercise for the Interested Student" for tips on +setting up DNS on your FreeBSD system. + + + + + +Click the "DNS Configuration" tab + + + +Make sure that the "Enable DNS" radio button is selected. + + +(If this button is not selected only the entries that +we put in the host file(s) will be available and your Net-Surfing +will not work as you expect!) + + + +In the "Host" field enter the name of the Windows 95 box, in this +case: "Larry". + + + +In the "Domain" field enter the name of our local network, in this +case: "my.domain" + + + +In the "DNS Server Search Order" section, enter the IP address +of the DNS server(s) that your ISP provided, clicking the "Add" button +after every address is entered. Repeat this step as many times as +necessary to add all of the addresses that your ISP provided. + + + + + +Other Windows 95 TCP/IP options: + +For our purposes the settings under the "Advanced", "WINS +Configuration" and "Bindings" tabs are not necessary. + +If you wish to use the Windows Internet Naming Service ("WINS") +your attention is invited to http://www.localnet.org for +more information about WINS settings, specifically regarding sharing +files transparently across the Internet. + +Mopping up: + + + +Click on the "OK" button to close the TCP/IP Properties window. + + + +Click on the "OK" button to close the Network Control Panel. + + + +Reboot your computer if prompted to do so. + + + + + + That's it! + + + + +Configuring Windows NT + +Configuring Windows NT to act as a LAN resource is also relatively +straightforward. The procedures for configuring Windows NT are +similar to Windows 95 with minor exceptions in the user interface. + +The steps shown here are appropriate for a Windows NT 4.0 +Workstation, but the principles are the same for NT 3.5x. You may +wish to refer to the "Configuring Windows for Workgroups" section if +you're configuring Windows NT 3.5x, since the user interface is +the same for NT 3.5 and WfW. + +Perform the following steps: + +Create the Windows NT "hosts" file: + +In order to connect to the other TCP/IP systems on the LAN you'll +need to create an identical copy of the "hosts" file that you +installed on the FreeBSD system in Section 3.4 + + + +Click the "Start" button; select "Run..."; enter "notepad +\WINDOWS\SYSTEM\DRIVERS\ETC\HOSTS" (without the quotes) and click +"OK" + + + +In the editor, enter the addresses and system names from Section +3.4. + + + +When finished editing, close the notepad application (making sure +that you save the file!). + + + + + +Configure the Windows NT TCP/IP Network Configuation +settings: + + + +Click the "Start" button on the taskbar; select "Settings" and +"Control Panel". + + + +Double-click the "Network" icon to open it. + + + +With the "Identification" tab selected, verify the "Computer Name" +and "Workgroup" fields. In this example we'll use "Shemp" for the name +and "Stooges" for the workgroup. Click the "Change" button and amend +these entries as necessary. + + + +Select the "Protocols" tab. + + + +The installed Network Protocols will be displayed. There may be a +number of protocols listed but the one of interest to this guide is +the "TCP/IP Protocol". If "TCP/IP Protocol" is not listed, click the +"Add" button to load it. + +(Hint: "Add | TCP/IP Protocol | OK") + + + +Highlight "TCP/IP +Protocol" and click the "Properties" button. + + +Tabs for specifying various settings for TCP/IP will be displayed. + + + + + +Configuring the IP Address: + +Make sure that the Ethernet Interface is shown in the "Adapter" +box; if not, scroll through the list of adapters until the correct +interface is shown. + + + +Click the "Specify an IP address" radio button to enable the three +text boxes. + + +In our example LAN the Windows NT system is the one we've called +"Shemp" + + + +In the "IP Address" field enter "192.168.1.4". + + + +Enter 255.255.255.0 in the "Subnet Mask" field. + + + + + +Configure the Gateway information: + +For our example network the FreeBSD box will be acting as our gateway +to the Internet (routing packets between the Ethernet LAN and the PPP dial-up +connection. + + + +Enter the IP address of the FreeBSD Ethernet interface, +192.168.1.1, in the "New gateway" field and click the "Add" button. + + +If any other gateways are defined in the "Installed gateways" list +you may wish to consider removing them. + + + + + +Configuring DNS: + +Again, this guide assumes that your Internet Service Provider has +given you a list of Domain Name Servers (or "DNS Servers") that you +should use. + +If you wish to run a DNS server on your local FreeBSD system, refer to +Section 6, "Exercise for the Interested Student" for tips on setting +up DNS on your FreeBSD system. + + + +Click the "DNS" tab + + + +In the "Host Name" field enter the name of the Windows NT box, in +this case: "Shemp". + + + +In the "Domain" field enter the name of our local network, in this +case: "my.domain" + + + +In the "DNS Server Search Order" section, enter the IP address of +the DNS server that your ISP provided, clicking the "Add" button after +every address is entered. Repeat this step as many times as necessary +to add all of the addresses that your ISP provided. + + + + + +Other Windows NT TCP/IP options: + +For our purposes the settings under the "WINS Address" and +"Routing" tabs are not used. + +If you wish to use the Windows Internet Naming Service ("WINS") +your attention is invited to http://www.localnet.org for +more information about WINS settings, specifically regarding sharing +files transparently across the Internet. + +Mopping up: + + + +Click on the "OK" button to close the TCP/IP Properties section. + + + + +Click on the "Close" button to close the Network Control Panel. + + + + +Restart your computer if prompted to do so. + + + + + +That's it! + + + + +Configuring Windows for Workgroups + +Configuring Windows for Workgroups to act as a network client +requires that the Microsoft TCP/IP-32 driver diskette has been +installed on the workstation. The TCP/IP drivers are not included +with the WfW CD or diskettes; if you need a copy they're available at +ftp://ftp.microsoft.com:/peropsys/windows/public/tcpip. + +Once the TCP/IP drivers have been loaded, perform the following +steps: + +Create the Windows for Workgroups "hosts" file: + +In order to connect to the other TCP/IP systems on the LAN you'll +need to create an identical copy of the "hosts" file that you +installed on the FreeBSD system in Section 3.4. + + + +In Program Manager, click the "File" button; select "Run"; and +enter: "notepad \WINDOWS\HOSTS" (without the quotes) and click "OK" + + + +In the editor, enter the addresses and system names from the hosts +file shown in Section 3.4. + + + +When finished editing, close the notepad application (making sure +that you save the file!). + + + + + +Configure the Windows 95 TCP/IP Network Configuation +settings + + + +In the main window of Program Manager, open the "Network" group by +double-clicking the icon. + + + +Double click on the "Network Setup" icon. + + + +In the "Network Drivers Box" double-click the "Microsoft +TCP/IP-32" entry. + + + + + +Configure the Windows for Workgroups IP Address: + +Ensure +the correct Ethernet Interface is selected in the "Adapter" list. If +not, scroll down until it is displayed and select it by clicking on +it. + + + +Ensure that the "Enable Automatic DHCP Configuration" check box is +blank. If it is checked, click it to remove the "X". + + + +In our example LAN the Windows for Workgroups system is the one +we've called "Moe"; in the "IP Address" field enter "192.168.1.3". + + + +Enter 255.255.255.0 in the "Subnet Mask" field. + + + + + +Configure the Gateway information: + +For our example network the FreeBSD box will be acting as our +gateway to the Internet (routing packets between the Ethernet LAN and +the PPP dial-up connection). + + + +Enter the IP address of the FreeBSD system, 192.168.1.1, in the +"Default Gateway" field. + + + + + +Configuring DNS: + +Again, this guide assumes that your Internet Service Provider has +given you a list of Domain Name Servers (or "DNS Servers") that you +should use. If you wish to run a DNS server on your local FreeBSD +system, refer to Section 6, "Exercise for the Interested Student" for +tips on setting up DNS on your FreeBSD system. + + + +Click the "DNS" button. + + + +In the "Host Name" field enter the name of the Windows for +Workgroups box, in this case: "Moe". + + + +In the "Domain" field enter the name of our local network, in this +case: "my.domain" + + + +In the "Domain Name Service (DNS) Search Order" section, enter the +IP address of the DNS server that your ISP provided, clicking the "Add" +button after each address is entered. Repeat this step as many times as +necessary to add all of the addresses that your ISP provided. + + + +Click on the "OK" button to close the DNS Configuration window. + + + + + + +Mopping up: + + + +Click on the "OK" button to close the TCP/IP Configuration window. + + + + +Click on the "OK" button to close the Network Setup window. + + + +Reboot your computer if prompted. + + + + + +That's it! + + + + + +Testing the Network + + Once you've completed that appropriate tasks above you should have +a functioning PPP gateway to the Internet. + + + +Testing the Dial-Up link: + + The first thing to test is that the connection is being made +between your modem and the ISP. + + + + +Testing the Ethernet LAN + + *** TBD *** + + + + + +Exercises for the Interested Student + + + +Creating a mini-DNS system + +While managing a Domain Name Service (DNS) hierarchy can be a black +art, it is possible to set up a Mini-DNS server on the FreeBSD system +that also acts as your gateway to your ISP. + +Building on the files in /etc/namedb when the FreeBSD +system was installed it's possible to create a name server that is +both authoritative for the example network shown here as well as a +front-door to the Internet DNS architecture. + +In this minimal DNS configuration, only three files are necessary: + +/etc/namedb/named.boot +/etc/namedb/named.root +/etc/namedb/mydomain.db + + + +The /etc/namedb/named.root file is automatically installed +as part of the FreeBSD base installation; the other two files must be +created manually. + + + +The <filename>/etc/namedb/named.boot</filename> file + +The /etc/namedb/named.boot file controls the startup +settings of the DNS server. +Esentially, it tells the Name Server: + + + +Where to find configuration files, + + + +What "domain names" it's responsible for, and + + + +Where to find other DNS servers. + + + + + +Using the 'ee' editor, create a +/etc/namedb/named.boot with the following contents: + +; boot file for mini-name server + +directory /etc/namedb + +; type domain source host/file backup file + +cache . named.root +primary my.domain. mydomain.db + + + +Lines that begin with a semi-colon are comments. The significant +lines in this file are: + + + +directory /etc/namedb + + +Tells the Name Server where to find the configuration files +referenced in the remaining sections of the +'/etc/namedb/named.boot' file. + + + +cache . named.root + + +Tells the Name Server that the list of "Top-Level" DNS servers for +the Internet can be found in a file called 'named.root'. +(This file is included in the base installation and its +contents are not described in this document.) + + + +primary my.domain. mydomain.db + + +Tells the Name Server that it will be "authoritative" for a DNS +domain called "my.domain" and that a list of names and IP addresses +for the systems in "my.domain" (the local network) +can be found in a file named 'mydomain.db'. + + + + + +Once the /etc/namedb/named.boot file has been created and +saved, proceed to the next section to create the +/etc/namedb/mydomain.db file. + + + + +The <filename>/etc/namedb/mydomain.db</filename> file + +The /etc/namedb/mydomain.db file lists the names and IP +addresses of every system in the Local Area Network. + +For a detailed description of the statements used in this file, +refer to the named manpage. + +The /etc/namedb/mydomain.db file for our minimal DNS +server has the following contents: + +@ IN SOA my.domain. root.my.domain. ( + 961230 ; Serial + 3600 ; Refresh + 300 ; Retry + 3600000 ; Expire + 3600 ) ; Minimum + IN NS curly.my.domain. + +curly.my.domain. IN A 192.168.1.1 # The FreeBSD box +larry.my.domain. IN A 192.168.1.2 # The Win'95 box +moe.my.domain. IN A 192.168.1.3 # The WfW box +shemp.my.domain. IN A 192.168.1.4 # The Windows NT box + +$ORIGIN 1.168.192.IN-ADDR.ARPA + IN NS curly.my.domain. +1 IN PTR curly.my.domain. +2 IN PTR larry.my.domain. +3 IN PTR moe.my.domain. +4 IN PTR shemp.my.domain. + +$ORIGIN 0.0.127.IN-ADDR.ARPA + IN NS curly.my.domain. +1 IN PTR localhost.my.domain. + + + +In simple terms, this file declares that the local DNS server is: + + + +The Start of Authority for ("SOA") for a domain called +'my.domain', + + + +The Name Server ("NS") for 'my.domain', + + + +Responsible for the reverse-mapping for all IP addresses that +start with '192.168.1.' and +'127.0.0.' ("$ORIGIN ...") + + + + + +To add workstation entries to this file you'll need to add two +lines for each system; one in the top section where the name(s) are +mapped into Internet Addresses ("IN A"), and another line that maps +the addresses back into names in the $ORIGIN +1.168.192.IN-ADDR.ARPA section. + + + + +Starting the DNS Server + +By default the DNS server ('/usr/sbin/named') is not +started when the system boots. You can modify this behavior by +changing a single line in '/etc/rc.conf' as follows: + + Using the 'ee' editor, load /etc/rc.conf. Scroll +down approximately 40 lines until you come to the section that says: + +--- +named_enable="NO" # Run named, the DNS server (or NO). +named_flags="-b /etc/namedb/named.boot" # Flags to named (if enabled). +--- + + +Change this section to read: + +--- +named_enable="YES" # Run named, the DNS server (or NO). +named_flags="-b /etc/namedb/named.boot" # Flags to named (if enabled). +--- + + +Save the file and reboot. + +Alternatively, start the Name Server daemon by entering the following +command: + +# named -b /etc/namedb/named.boot + + + +Whenever you modify any of the files in /etc/namedb you'll +need to kick-start the Name Server process to make it pick up the +modifications. This is performed with the following system command: + +# kill -HUP `cat /var/run/named.pid` + + + + + + + +Playing with PPP filters + +The PPP program has the ability to apply selected filtering rules +to the traffic it routes. While this is not nearly as secure as a +formal firewall it does provide some access control as to how the link +is used. + +('man ipfw' for information on setting up a more secure +FreeBSD system.) + +The complete documentation for the various filters and rules under +PPP are availabe in the PPP manpage. + +There are four distinct classes of rules which may be applied to +the PPP program: + + + +afilter - Access Counter (or "Keep Alive") filters + + +These control which events are ignored by the set timeout= +statement in the configuration file. + + + +dfilter - Dialing filters + + +These filtering rules control which events are ignored by the +demand-dial mode of PPP. + + + +ifilter - Input filters + + +Control whether incoming packets should be discarded or passed into +the system. + + + +ofilter - Output filters + + +Control whether outgoing packets should be discarded or passed into +the system. + + + + + +What follows is a snippet from an operating system which provides a +good foundation for "normal" Internet operations while preventing PPP +from pumping all data over the dial-up connection. Comments +briefly describe the logic of each rule set: + +# +# KeepAlive filters +# Don't keep Alive with ICMP,DNS and RIP packet +# + set afilter 0 deny icmp + set afilter 1 deny udp src eq 53 + set afilter 2 deny udp dst eq 53 + set afilter 3 deny udp src eq 520 + set afilter 4 deny udp dst eq 520 + set afilter 5 permit 0/0 0/0 +# +# Dial Filters: +# Note: ICMP will trigger a dial-out in this configuration! +# + set dfilter 0 permit 0/0 0/0 +# +# Allow ident packet pass through +# + set ifilter 0 permit tcp dst eq 113 + set ofilter 0 permit tcp src eq 113 +# +# Allow telnet connection to the Internet +# + set ifilter 1 permit tcp src eq 23 estab + set ofilter 1 permit tcp dst eq 23 +# +# Allow ftp access to the Internet +# + set ifilter 2 permit tcp src eq 21 estab + set ofilter 2 permit tcp dst eq 21 + set ifilter 3 permit tcp src eq 20 dst gt 1023 + set ofilter 3 permit tcp dst eq 20 +# +# Allow access to DNS lookups +# + set ifilter 4 permit udp src eq 53 + set ofilter 4 permit udp dst eq 53 +# +# Allow DNS Zone Transfers +# + set ifilter 5 permit tcp src eq 53 + set ofilter 5 permit tcp dst eq 53 +# +# Allow access from/to local network +# + set ifilter 6 permit 0/0 192.168.1.0/24 + set ofilter 6 permit 192.168.1.0/24 0/0 +# +# Allow ping and traceroute response +# + set ifilter 7 permit icmp + set ofilter 7 permit icmp + set ifilter 8 permit udp dst gt 33433 + set ofilter 9 permit udp dst gt 33433 +# +# Allow cvsup +# + set ifilter 9 permit tcp src eq 5998 + set ofilter 9 permit tcp dst eq 5998 + set ifilter 10 permit tcp src eq 5999 + set ofilter 10 permit tcp dst eq 5999 +# +# Allow NTP for Time Synchronization +# + set ifilter 11 permit tcp src eq 123 dst eq 123 + set ofilter 11 permit tcp src eq 123 dst eq 123 + set ifilter 12 permit udp src eq 123 dst eq 123 + set ofilter 12 permit udp src eq 123 dst eq 123 +# +# SMTP'd be a good idea! +# + set ifilter 13 permit tcp src eq 25 + set ofilter 13 permit tcp dst eq 25 +# +# +# We use a lot of `whois`, let's pass that +# + set ifilter 14 permit tcp src eq 43 + set ofilter 14 permit tcp dst eq 43 + set ifilter 15 permit udp src eq 43 + set ofilter 15 permit udp dst eq 43 +# +# If none of above rules matches, then packet is blocked. +#------- + + + +Up to 20 distinct filtering rules can be applied to each class of +filter. Rules in each class are number sequentially from 0 to 20 +but none of the rules for a particular filter class take affect +until ruleset '0' is defined! + +If you choose not to use Filtering Rules in the PPP +configuration then ALL traffic will be permitted both into and +out of your system while it's connected to your ISP. + +If you decide that you want to implement filtering rules, add the +above lines to your /etc/ppp/ppp.conf file in either the +"default:", "demand:", or "interactive:" section (or all of them - the +choice is yours). + + + +