Opengate Install Procedureõ


A Outlineõ

A.1 System Configurationõ

In this document, we use the system configuration as follows. The network connecting terminals is called as lower-side network and the network having servers is called upper-side network.

upper-side network:192.168.0.0/24, 2001:1:2:3/64
Gateway to upper-side network:fxp1, 192.168.0.124, 2001:1:2:3::4
Gateway to lower-side network:fxp0, 192.168.1.1, 2001:5:6:7::1
lower-side network:192.168.1.0/24, 2001:5:6:7/64

Opengate recognizes the both addresses of IPv4 and IPv6, and controles the both firewalls. It can be used for IPv4 control only under the FreeBSD system that does not set up IPv6 environments.

A.2 Install Procedureõ

Following is the proceddure of Opengate. The '*'mark means the mandatory items.

back top

B FreeBSD Installõ

B.1 Basic Installõ

Choose distribution Developer(Full sources, binaries and doc), because we have to prepare a kernel.

Add next line to "/etc/rc.conf", because you enable the gateway function.

gateway_enable="YES"
back top

B.2 Addition of NAT and Firewallõ

Prepare kernel having ipfw and ip6fw functions.

Copy kernel options file.

# cd /usr/src/sys/i386/conf
# cp GENERIC MYKERNEL

Add next lines to the kernel.

options IPDIVERT

options IPFIREWALL
options IPFIREWALL_FORWARD
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100

options IPV6FIREWALL
options IPV6FIREWALL_VERBOSE
options IPV6FIREWALL_VERBOSE_LIMIT=100

options IPSEC
options IPSEC_ESP
options TCP_DROP_SYNFIN

compile and install kernel having ipfw and ip6fw supports.

# config MYKERNEL
# cd ../compile/MYKERNEL
# make depend
# make
# make install

In FreeBSD 6.x, "make clean" might be requested before "make depend".

Add next lines to "/etc/rc.conf". It you need not IPv6 function, do not add ipv6XXX.

firewall_enable="YES"
firewall_script="/etc/rc.firewall"
firewall_type="open"

ipv6_firewall_enable="YES"
ipv6_firewall_script="/etc/rc.firewall6"
ipv6_firewall_type="open"

natd_enable="YES"
natd_interface="fxp1"

Enable the ipfw and ip6fw. Be care to set the type 'OPEN' as to prevent mysteryous system behavior in installing procedure. For NAT, Enable natd and setup natd interface(Upper-side interface).

Connect PC to the lower-side network and check the IPv4 behavior.

As the DHCP does not setup yet, The PC must be setup manually.

back top

B.3 Setup of IPv6õ

If you need IPv4 only, this section can be skipped. Though explanation is omitted, many pareameters like the following sample might be set in /etc/rc.conf. You must study about IPv6 and setup carefully.

##ENABLE IPv6
ipv6_enable="YES"
ipv6_network_interfaces="gif0 fxp0"

##TUNNELLING INTERFACE
gif_interfaces="gif0"
gifconfig_gif0="192.168.0.124 192.168.0.126"

##IPv6 ADDRESS 
ipv6_prefix_fxp0="2001:5:6:7"
ipv6_ifconfig_fxp0="2001:5:6:7::1 prefixlen 64"

##ADVERTISE
rtadvd_enable="YES"
rtadvd_interfaces="fxp0"

##DEFAULT GATEWAY
ipv6_default_interface="gif0"
ipv6_defaultrouter="fe80::a:b:c:d%gif0"

##ROUTING(RIPv6)
ipv6_gateway_enable="YES"
ipv6_router_enable="YES"
ipv6_router="/usr/sbin/route6d"
ipv6_router_flags="-O 2001:5:6:7::/64,gif0"

Connect a PC to the lower-side network and check the behavior of IPv6

In WindowsPC, a command "ipv6 install" might be needed to activate IPv6.

back&freebsd0;top

C BIND9 Installõ

C.1 Ports Installõ

If the IPv6 function is used, Opengate needs a FQDN attached to both IPv4 and IPv6 addresses. It can be settled in existing DNS. If the IPv6 function is not used, you can ignore DNS setting and control with IP address base.

Installing BIND9 from ports is as follows.

# cd /usr/ports/dns/bind9/
# make clean
# make install clean ; rehash

The directory "/etc/namedb(/var/named/etc/namedb)" is made in the installation.

back top

C.2 Making RNDC keyõ

For security, BIND9 is controlled by rndc command.

Create the rndc key as follows.

# /usr/local/sbin/dnssec-keygen -a hmac-md5 -b 512 -n user rndc

When error "out of entropy", try with next method.

# /usr/local/sbin/dnssec-keygen -r /dev/urandom -a hmac-md5 -b 512 -n user rndc

By the command, following files are generated.

There is "/usr/local/etc/rndc.conf.sample" after BIND9 installation. Copy it to "rndc.conf".

Insert "key" directive in "Krndc.+xxxxxxxx.private into "key" directive in rndc.key.

options {
        default-server  localhost;
        default-key     "rndc_key";
};

server localhost {
        key     "rndc_key";
};

key "rndc_key" {
        algorithm       hmac-md5;
        secret "......................";
};
back top

C.3 Setup of named.confõ

There is "/etc/namedb/named.conf" after installation.

Edit "key" directive as like "key" directive of "rndc.conf"

key "rndc_key" {
        algorithm       hmac-md5;
        secret ".......................";
};

controls {
        inet ::1 allow {
                ::1;
        }
        keys {
                "rndc_key";
        };
        inet 127.0.0.1 allow {
                127.0.0.1;
        }
        keys {
                "rndc_key";
        };
};

For security, it is better to write the "key" directive in the other file, include it in "named.conf", and modify file permission.

Edit "options" directive.

options {
        directory "/etc/namedb";
        pid-file "/var/run/named/named.pid";
        auth-nxdomain yes;
        listen-on-v6 { any; };
};

Make the corresponding directory to put "named.pid".

back top

C.4 Setup of Zoneõ

Edit "view" and "zone" directive.

The "view" directive is implemented in BIND9. Replying to the inquiry from matched-clients, BIND9 sends the information described in the corresponding view.

view "og" {
        match-clients
        {
        192.168.1.0/24;
        };

        recursion yes;

        zone "." {
                type hint;
                file "named.root";
        };

        zone "og.saga-u.ac.jp" {
                type master;
                file "og.saga-u.ac.jp";
        };

        zone "0.0.127.IN-ADDR.ARPA" {
                type master;
                file "master/localhost.rev";
        };

        // RFC 3152
        zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\
              0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA" {
                type master;
                file "master/localhost-v6.rev";
        };

        // RFC 1886 -- deprecated
        zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\
              0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" {
                type master;
                file "master/localhost-v6.rev";
        };
};

Make a "zone" file for the domain as "og.saga-u.ac.jp".

$TTL    3600
$ORIGIN og.saga-u.ac.jp.

@       IN      SOA     ns.og.saga-u.ac.jp. postmaster (
                        2005051702 ;
                        3600
                        1200
                        2419200
                        86400 )
                IN      NS      ns.og.saga-u.ac.jp.
                IN      A       192.168.1.1
                IN      MX      10 opengate.og.saga-u.ac.jp.

ns              IN      A       192.168.1.1

opengate        IN      A       192.168.1.1
                        AAAA    2001:5:6:7::1
back top

C.5 Checking Behaviorõ

Confirm starting of "named" after setting was completed.

# /usr/local/sbin/named/ -u bind -c /etc/namedb/named.conf

If "named" starts without problems, Add next lines to "/etc/rc.conf" for auto start.

named_enable="YES"
named_program="/usr/local/sbin/named"
named_flags="-u bind -c /etc/namedb/named.conf"

Because management of a DNS server is too complicatedly, You need to read manual of BIND9 carefully, and refer other document.

back top

D isc-dhcp3 Installõ

D.1 Ports Installõ

Many client PCs are connected one after another. The DHCP might be a desireble solution for assginment of IP addresses to these clients.

Installing isc-dhcp3 from ports is as follows.

# cd /usr/ports/net/isc-dhcp3-server
# make clean
# make install clean ; rehash
back top

D.2 Setup of DHCPõ

There is a configuration file "/usr/local/etc/dhcpd.conf.sample" after instalation. Copy "dhcpd.conf.sample" to "dhcpd.conf" and edit the file. Following is a setting example.

option domain-name "og.saga-u.ac.jp";
option domain-name-servers 192.168.1.1;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.1.255;
option routers 192.168.1.1;

default-lease-time 600;
max-lease-time 7200;
ddns-update-style none;
log-facility local7;

subnet 192.168.55.0 netmask 255.255.255.0 {
  range 192.168.1.10 192.168.1.250;
}

Add next lines to "/etc/rc.conf" for auto start.

dhcpd_enable="YES"
dhcpd_ifaces="fxp0"
dhcpd_conf="/usr/local/etc/dhcpd.conf"

In this description, the value of "dhcpd_ifaces" is the interface for DHCP service(the lower-side network).

back top

E Apache2 Installõ

E.1 Ports Installõ

When using IPv6 function, Opengate needs Apache2 supporting IPv6. In default, Apache2 supports SSL which is desirable for secure authentication.

Installing Apache2 from ports is as follows.

# cd /usr/ports/www/apache2
# make clean
# make install clean ; rehash

Add next lines to "/etc/rc.conf" for auto start.

apache2_enable="YES"
apache2ssl_enable="YES"
back top

E.2 Making Certificateõ

It is better to obtain a formal key from some CA. But we shows the proceddure to make a self-signed private key and certificate.

Make a private key as follows.

# cd /usr/local/etc/apache2
# mkdir ssl.key ssl.crt
# chmod 700 ssl.key ssl.crt

# /usr/bin/openssl genrsa -out /usr/local/etc/apache2/ssl.key/server.key 1024

Make a certificate from the key as follows.

# /usr/bin/openssl req -new -x509 -days 365 \
    -key /usr/local/etc/apache2/ssl.key/server.key \
    -out /usr/local/etc/apache2/ssl.crt/server.crt

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Saga
Locality Name (eg, city) []:Saga-city
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Saga-university
Organizational Unit Name (eg, subsection) []:Opengate Management
Common Name (eg, YOUR name) []:opengate.og.saga-u.ac.jp
Email Address []:administrator@opengate.og.saga-u.ac.jp

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

back top

E.4  Setup of SSLõ

Edit "ssl.conf" like the following example.

ssl.conf
<VirtualHost _default_:443>
    DocumentRoot "/usr/local/www/data"
    ServerName opengate.og.saga-u.ac.jp:443
    ServerAdmin administrator@opengate.og.saga-u.ac.jp
    ErrorLog "|/usr/bin/logger -p local6.info"
    CustomLog "|/usr/bin/logger -p local5.info" combined

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /usr/local/etc/apache2/ssl.crt/server.crt
    SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/server.key
</VirtualHost>

As Apache2 has many settings, be familiar with Apache2 configuration for adequate control.

back top

E.5 Other Setting and Checkingõ

Edit "/usr/local/etc/httpd.conf" as follows.

Opengate send back the authentication page for any kind of HTTP request. To do so, add next line to httpd.conf. This means the sending back top page at HTTP_ERROR 404(file not found) error.

ErrorDocument 404 /

Add ExecCGI to execute CGI program in cgi-bin directory.

<Directory "/usr/local/www/cgi-bin">
    ...
    Options ExecCGI
    ...
</Directory>

Check the behavior of Apache2 by various access.

back top

F Opengate Installõ

F.1 Opengate Packageõ

Unfold the package of Opengate. It have following directorys.

doc: Documentations
conf: Configuration file and firewall control perl script sample
javahtml: Client Java Programs and  HTML files
opengatesrv: Server CGI programs
tools: Some related tools
ezxml: XML parser (Copyright Aaron Voisine)
back top

F.2 Installõ

Check setting in opengatesrv/Makefile as follows. If web directory is changed, modify it. If you modify the setting, modify the same setting in config file described below.

HTMLTOP = /usr/local/www/data
DOCPATH = /usr/local/www/data/opengate
CGIPATH = /usr/local/www/cgi-bin/opengate
CONFIGPATH = /etc/opengate

Compile and Install as follows.

# make clean
# make install
back top

F.3 Setup of Config Fileõ

Copy sample config file '/etc/opengate/opengatesrv.conf.sample' to '/etc/opengate/opengatesrv.conf' and modify. Following settings must be changed.

	<OpengateServerName>opengate.og.saga-u.ac.jp</OpengateServerName>

	<AuthServer>
		<Address>192.168.0.2</Address>
		<Protocol>pop3s</Protocol>
	</AuthServer>

In <OpengateServerName>, set HOSTNAME(FQDN) or IP address of opengate gateway server. If you want to use IPv6 function, you need to set FQDN corresponding to IPv4 and IPv6 both addresses.

In <AuthServer>, set the information of authentication server. Though Opengate support various protocol, see the config file for details. To separate the problem between auth server and opengate server, try the following setting firstly.

 ****Do not use this setting in real service****
	<AuthServer>
		<Protocol>accept</Protocol> 
	<AuthServer>

Opengate switchs plural auth servers and other settings by ID attached to userid (userid@ID). See the config file for details. By this function, you can divide the authentication servers for many sections or guests.

About parameters that can be modified in the config file, see the config file for details.

Caution: As the IPv6 function is activated only when IPv6 access is detected, do not delete the IPv6 related setting in config file. The IPv6 access is executed when the FQDN for IPv6 is prepared.

back top

F.4 Setup of ipfwõ

Write ipfw rules for for Opengate. This is example "rc.firewall".

From FreeBSD6.1, IPFW supports IPv6. The IPFW rule used in Opengate is affected by this change. See

Rule number for [forward] Command(60000) must be larger than the rule numbers used by opengate(10000-40000). Rule number for [divert to natd] must be smaller than most rules.

The above script is installed as /etc/opengate/rc.firewall.sample. Copy it to /etc/opengate/rc.firewall and modify. To use this script, edit firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.

firewall_script="/etc/opengate/rc.firewall"

Be familiar with the ipfw command. Opengate is a software to send out ipfw add/delete command.

back top

F.5 Setup of ip6fwõ

Write ipfw rules for for Opengate. This is example "rc.firewall6".

From FreeBSD6.1, IPFW supports IPv6. The IPFW rule used in Opengate is affected by this change. See

ip6fw dose not have [forward] function. Therefore IPv6 HTTP request is denied. And retried access with IPv4 is catched by ipfw [forward] fuction.

When use FreeBSD 5.2 or later, ip6fw has TCP reset function. Because of the reset response, client needs no waiting time until timeout.

The above script is installed as /etc/opengate/rc.firewall6.sample. Copy it to /etc/opengate/rc.firewall6 and modify. To use this script, edit firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.

ipv6_firewall_script="/etc/opengate/rc.firewall6"

Be familiar with ip6fw command too.

back top

F.6 Setup of syslogõ

Edit /etc/syslog.conf to save log file for Opengate.

local1.*   /var/log/opengate.log
         | Separeted by TAB code

Make the corresponding file as follows. Be care to control the size of this log file.

# touch /var/log/opengate.log
back top

F.7 Checking Behaviorõ

Connect a PC to the lower-side network and access to a site in the upper-side network. If it does not work properly, refer doc/progflow.html and doc/protocol.txt to understand the procedure. And see the log file for Opengate, httpd, system and others at first. To dump more information from Opengate, set the <Debug> switch 1 in opengatesrv.conf. Check also the functions of related software. The error checking document(errcheck.html) and Q and A document (qa.html) might be used for problem solving.

back top

G MRTG Install

G.1 Ports Install

This is optional. You can use MRTG to watch a state of Opengate. If you do not want to watch the state of Opengate, you do not need to install MRTG.

MRTG(Multi Router Traffic Grapher) is system to watch network traffic. MRTG makes graphic images and HTML files.

You can install MRTG to gateway server or another server. If you must watch plural Opengate, you had better install MRTG to another server.

# cd /usr/ports/net-mgmt/mrtg/
# make clean
# make install clean ; rehash
back top

G.2 Setup of MRTG

There is "/usr/local/etc/mrtg/mrtg.cfg.sample" as configuration file after instalation. Copy mrtg.cfg.sample to opengate.cfg and edit configuration file.

##################################################
#  opengate user counter

WorkDir: /usr/home/user/public_html/mrtg/opengate/

##### Options
Options[^]: growright,gauge,nopercent,integer

Target[opengate]:`/usr/home/user/bin/input.sh`
Title[opengate]: Opengate user counter

PageTop[opengate]: <h1>Opengate user counter</h1>
 <p>Show the number of people using Opengate</p>

# Max Number
MaxBytes[opengate]: 200

# Title of Y axis
YLegend[opengate]: Opengate User
# unit
ShortLegend[opengate]: s
# Title of graph LegendI: first line LegendO: second line
LegendI[opengate]: IPv6 Users
LegendO[opengate]: Total Users

make a directory which you appointed in "WorkDir". MRTG makes graphic images and HTML files in WorkDir.

"Target[opengate]" is path to program to hand data to MRTG. explain below th details.

G.2.1 Case of gateway server

Put this shellscript as "/usr/home/user/bin/input.sh".

#!/bin/sh

#######################################
##
## shwo opengate status for MRTG
##
##   1 line : IPv6 Users
##   2 line : Total Users
##   3 line : uptime
##   4 line : comment for data
##
#######################################

LANG=C
COLUMNS=256

export LANG
export COLUMNS

### IPv6 prefix
prefix="2001:2f8:22:801:"
###opengateprocessname
process="opengatesrv.cgi" 

###tmp file  name
tmp_all="/tmp/og_count_all.tmp"
tmp_6="/tmp/og_count_6.tmp"

######################################################
psax | grep $process > $tmp_all
COUNT = `wc-l $tmp_all | awk '{print $1}'` 
grep $prefix $tmp_all >  $tmp_6
COUNT6=`wc -l $tmp_6 | awk '{print $1}'`
UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"`

rm $tmp_all
rm $tmp_6

echo "$COUNT6"
echo "$COUNT"
echo "$UPTIME"
echo "Opengate User Counter"

carry out this shell script alone and confirm that you can acquire the following data.

5
48
10days
Opengate User Counter
G.2.2 Case of another server

Put this shellscript as "/usr/home/user/bin/input.sh" on another server.

#!/bin/sh

#######################################
##
## input data for MRTG
##
##   1 line : IPv6 Users
##   2 line : Total Users
##   3 line : uptime
##   4 line : comment for data
##
#######################################

# tmp file name
file="/tmp/opengate.tmp"

# URL of output.sh at opengate
url="http://opengate.saga-u.ac.jp/cgi-bin/output.sh"

fetch -o $file $url &> /dev/null

more $file

Put this shell script as "/usr/local/apache2/cgi-bin/output.sh" on Opengate server. And set this URL to $url in script explained by the above.

#!/bin/sh

#######################################
##
## shwo opengate status for MRTG
##
##   1 line : IPv6 Users
##   2 line : Total Users
##   3 line : uptime
##   4 line : comment for data
##
#######################################

LANG=C
COLUMNS=256

export LANG
export COLUMNS

### IPv6 prefix
prefix="2001:2f8:22:801:"
###opengateprocessname
process="opengatesrv.cgi" 

###tmp file name
tmp_all="/tmp/og_count_all.tmp"
tmp_6="/tmp/og_count_6.tmp"

######################################################
psax | grep $process > $tmp_all 
COUNT = `wc-l $tmp_all | awk '{print $1}'` 
grep $prefix $tmp_all >  $tmp_6
COUNT6=`wc -l $tmp_6 | awk '{print $1}'`
UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"`
rm $tmp_all
rm $tmp_6

echo "Content-type: text/plain; charset=iso-8859-1"
echo

echo "$COUNT6"
echo "$COUNT"
echo "$UPTIME"
echo "Opengate User Counter"

carry out "input.sh" shell script on another server and confirm that you can acquire the following data.

5
48
10days
Opengate User Counter
back top

G.3 Start confirmation

Confirm after setting was completed.

# /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg

Various WARNING is output the first and second time.

There is some files in "WorkDir".

> ls -l
-rw-r--r--  1 root  wheel    538 12 14 04:40 mrtg-l.png
-rw-r--r--  1 root  wheel    414 12 14 04:40 mrtg-m.png
-rw-r--r--  1 root  wheel   1759 12 14 04:40 mrtg-r.png
-rw-r--r--  1 root  wheel   2941 12 20 15:15 opengate-day.png
-rw-r--r--  1 root  wheel   2146 12 20 14:35 opengate-month.png
-rw-r--r--  1 root  wheel   2867 12 20 14:55 opengate-week.png
-rw-r--r--  1 root  wheel   1897 12 20 05:00 opengate-year.png
-rw-r--r--  1 root  wheel   5961 12 20 15:15 opengate.html
-rw-r--r--  1 root  wheel  48786 12 20 15:15 opengate.log
-rw-r--r--  1 root  wheel  48784 12 20 15:10 opengate.old
back top

G.4 Setup crontab

Add next line to "/etc/crontab".

*/5 * * * * root /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg
back top

H rulechk Install

This is optional. At the abnormal termination of Opengate process, superfluous rule might be left bihind. Though it is very rare, a script dealing with the case is prepared in tools/rulechk. This script is compatible with Opengate Ver1.3.1 or later. This script compares the Opengate process list and the firewall rule list, and deletes the superfluous rules.

back top