cd /usr/src/sys/i386/conf cp GENERIC MYKERNEL edit MYKERNEL insert following 3 lines options IPFIREWALL options IPFIREWALL_FORWARD options IPDIVERT config MYKERNEL cd ../compile/MYKERNEL make depend make make install
kern.ipc.somaxconn Maximum number of TCP connections(default=128). As Opengate server keeps TCP connection with each terminal, the number must be set larger than the number of terminals. kern.ipc.nmbclusters Maximum number of mbuf clusters (1cluster=2KB). It needs "send/recv buffer size(default=32KB)" x "number of connections". The usage statistics is shown by "netstat -m".For example, these values are set as follows. Be care about the memory size for mbuf (following setting needs 128MB).
Add two lines in the file "/etc/sysctl.conf". kern.ipc.somaxconn=4096 kern.ipc.nmbclusters=65536
Essential: Apache, ipfw Optional: NATD, DHCP, SSL, Perl etc* Check the installation carefully and be familiar with these softwares. Debugging is confused, if these softwares are incomplete.
gateway_enable="YES" <==If NATD is not used firewall_enable="YES" firewall_type="simple" natd_enable="YES" <==If NATD is used natd_interface="fxp0" <== ", the name must be matched to your interface.
Example description in /etc/rc.firewall.
Be care that rules matched to [simple] are distributed in the file.
Check the real setting by the command [ipfw list].
The sample setting is not the ideal.
Refer to the default rc.firewall and edit it properly.
[Ss][Ii][Mm][Pp][Ll][Ee]) # set these to your outside interface network and netmask and ip oif="fxp0" onet="133.49.20.0" omask="255.255.252.0" oip="133.49.22.5" # set these to your inside interface network and netmask and ip iif="fxp1" inet="192.168.0.0" imask="255.255.255.0" iip="192.168.0.1" # divert packet to NATD ################################ $fwcmd add 1 divert natd ip from any to any via ${oif} # Stop spoofing $fwcmd add deny all from ${inet}:${imask} to any in via ${oif} $fwcmd add deny all from ${onet}:${omask} to any in via ${iif} # Allow from / to myself $fwcmd add pass all from ${iip} to any via ${iif} $fwcmd add pass all from ${oip} to any via ${oif} $fwcmd add pass all from any to ${iip} via ${iif} $fwcmd add pass all from any to ${oip} via ${oif} # Allow DNS queries out in the world # (if DNS is on localhost, delete passDNS) $fwcmd add pass udp from any 53 to any $fwcmd add pass udp from any to any 53 # Forwarding http connection from unauth client ############### $fwcmd add 60000 fwd localhost tcp from ${inet}:${imask} to any http # Allow TCP through if setup succeeded ######################## $fwcmd add 60100 pass tcp from any to any establishedCaution
The file [conf/opengatefw.conf] is the script describing the above rules. You can edit and use this script instead of rc.firewall.
ipfw add 10000 allow ip from xx.xx.xx.xx to any <===Open outgoing ipfw add 10000 allow ip from any to xx.xx.xx.xx <===Open incoming ipfw del 10000 <===CloseBe falimiar with ipfw command. Opengate is a software to send out the ipfw command like above one.
Web access control
order deny,allow deny from all allow from 133.49.0.0/255.255.0.0 (Example, need to change address) allow from 192.168.0.0/255.255.0.0CGI enable
#ScriptAlias /cgi-bin/ "/usr/local/www/cgi-bin/" | V ScriptAlias /cgi-bin/ "/usr/local/www/cgi-bin/"Jump to Top at Page NotFound
#ErrorDocument 404 /missing.html | V ErrorDocument 404 /index.html
local1.* /var/log/opengate.log --Separated by TAB key
touch /var/log/opengate.log
tar zxvf opengatexxx.tar.gz (where xxx is the version. Use latest one)Then, the following directorys are created. Check the files. Change the setting if you want(Most setting can be modified after installation).
doc: Documentations conf: configuration file sample, firewall control perl script sample javahtml: Client Java Programs and HTML files. opengatesrv: Server CGI program
javac Opengate.java jar cvf Opengate.jar *.class
cd opengatesrv : Move to opengatesrv directory edit Makefile : Modify Makefile (parameters are described below) **HOSTADDR must be changed to IP address of your machine's client side interface.** edit opengatesrv.h : Modify header file(parameters are described below) make : Compile su : Change to Root make install : Install
ID:address=hostname|hostaddr:[port=portno:]protocol=ftp|pop3|pop3s: ID:protocol=radius:[conffile=filepath:] ID:protocol=pam:[servicename=name:]where each term indicates following.
ID:Identification keyword for the authentication server. address: IP address(or domain name) of the authentication server. protocol: protocol for authentication, At present, ftp,pop3,pop3s,radius,pam are available. port: port number for authentication. If ignored, follows to /etc/services. conffile: path to config file at RADIUS. default is "/etc/radius.conf". servicename: service name at PAM. default is "opengate".Examples of opengatesrv.conf
*This is a simple example.
In this case, the user is checked by FTP accessing to the address xx.xx.xx.xx.
At first, check the basic installation by the setting like this.
default:tc=as as:address=xx.xx.xx.xx:protocol=ftp: (FTP access to address xx.xx.xx.xx must be checked in advance)*Following example sets four authentication servers.
default:tc=cs cs:address=noah.cs.is.saga-u.ac.jp:protocol=pop3: cc:address=himiko.cc.saga-u.ac.jp:protocol=ftp:port=21: pam:protocol=pam: rad:protocol=radius:*If protocol=pam is defined, you must setup [/etc/pam.conf] or [/etc/pam.d/opengate]. Opengate checks auth and account.
opengate auth required pam_radius.so opengate account required pam_permit.soFollowing is an example of /etc/pam.d/opengate
auth required pam_radius.so account required pam_permit.so
*If protocol=radius is defined, you must setup [/etc/radius.conf]. Following is an example of radius.conf.
auth radius1.foo.bar "password1" 5 6 auth radius2.foo.bar "password2" 5 6
topindex.html : first html which describe the auto-jump to Authentication page. index.html : Authentication page deny.html : page sent at authentication denyed. accept.html,accept2.html : pages sent at authntication accepted. Don't remove mark "**OpengateAppletHere**", where Java Applet description is inserted. %%HOSTADDR%% is replaced with address at installation. %%OPENGATEDIR%% is replaced with install directory.
If USEFWSCRIPT=0, CGI execs ipfw command directly. In this case, the all packets from/to the authenticated client is allowed. If 1, perl script controls the ipfw command. By editting opengatefw.pl, flexible control can be done. Be care to maintain it simple for better performance and security. The script runs under exclusive mode. Insertion of time comsuming logics may result in less performance.
If you want to control firewall state with some user property in a database, edit the skeleton routine comm-userdb.c to send property to this script.
HOSTADDR = IP address of gateway interfaced to client network. HTMLTOP1 = Web top directory HTMLTOP2 = Web top directort (for SSL) OPENGATEDIR = Opengate install directory (from Web top) CGIPATH = CGI directory CGIPROG = CGi program name CONFIGFILE = Configuration file name USEFWSCRIPT= Enable(1) or disable(0) Perl script to control firewall open FWSCRIPT = Firewall control Perl script name FWSCRIPTPATH = Perl script path LOCKFILE= Lock file for exclusive execution HTMLDOCS= HTML files listing DENYDOC = HTML file sent at denying ACCEPTDOC = HTML file sent at accepting HTMLLANGS= Languages of HTML files ARPPATH= Path to arp command IPFWPATH= Path to ipfw command
DEBUG : If set to 1, function call trace log is put out to syslog. DURATIONDEFAULT : Default time duration to wait for Java Applet connect.(second) If no connection in the duration, the network is closed. The duration can be changed in auth page by the user. DURATIONMAX : Maximum duration to wait for Java Applet connect. (second) Under this value, the Applet waiting duration (= duration of network open without Java Applet) can be specified by the user on the authentication page. If user specified duration is not agreeable, set it the same value as DURATIONDEFAULT and remove the field in auth page. ACTIVECHECKINTERVAL : Time interval of checking the terminal.(second) In no java mode, check by MAC address and packet count for the terminal's IP address. In java mode, check by HELLO exchange and packet count. COMMWAITTIMEOUT : Server waiting time for communication reply.(second) NOREPLYMAX : Permitted count of no reply to HELLO. If the client does not send back HELLO more than NOREPLYMAX times, then the network is closed. NOPACKETINTERVAL : If no packet is passed for this time interval, then the network is closed.(second) LOCKTIMEOUT : Maximum locking time for exclusive ipfw action.(second) IPFWMIN : Minimum ipfw rule number used by opengate. IPFWMAX : Maximum ipfw rule number used by opengate. IPFWINTERVAL : Rule number interval used by opengate. The maximum terminals/processes can be controled by these value. PORTMIN : minimum port value used by opengate. PORTMAX : maximum port value used by opengate. Set unused port range. FACILITY : syslog facility PAMSERVICENAME : default service name at PAM. RADIUSCONF : default path to radius.conf.