In this document, we use the system configuration as follows. The network connecting terminals is called as lower-side network and the network having servers is called upper-side network.
upper-side network:192.168.0.0/24, 2001:1:2:3/64 Gateway to upper-side network:fxp1, 192.168.0.124, 2001:1:2:3::4 Gateway to lower-side network:fxp0, 192.168.1.1, 2001:5:6:7::1 lower-side network:192.168.1.0/24, 2001:5:6:7/64 |
Opengate recognizes the both addresses of IPv4 and IPv6, and controles the both firewalls. It can be used for IPv4 control only under the FreeBSD system that does not set up IPv6 environments.
Following is the proceddure of Opengate. The '*'mark means the mandatory items.
Choose distribution Developer(Full sources, binaries and doc), because we have to prepare a kernel.
Add next line to "/etc/rc.conf", because you enable the gateway function.
gateway_enable="YES" |
Prepare kernel having ipfw and ip6fw functions.
Copy kernel options file.
# cd /usr/src/sys/i386/conf # cp GENERIC MYKERNEL |
Add next lines to the kernel.
options IPDIVERT options IPFIREWALL options IPFIREWALL_FORWARD options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=100 options IPV6FIREWALL options IPV6FIREWALL_VERBOSE options IPV6FIREWALL_VERBOSE_LIMIT=100 options IPSEC options IPSEC_ESP options TCP_DROP_SYNFIN |
compile and install kernel having ipfw and ip6fw supports.
# config MYKERNEL # cd ../compile/MYKERNEL # make depend # make # make install |
In FreeBSD 6.x, "make clean" might be requested before "make depend".
Add next lines to "/etc/rc.conf". It you need not IPv6 function, do not add ipv6XXX.
firewall_enable="YES" firewall_script="/etc/rc.firewall" firewall_type="open" ipv6_firewall_enable="YES" ipv6_firewall_script="/etc/rc.firewall6" ipv6_firewall_type="open" natd_enable="YES" natd_interface="fxp1" |
Enable the ipfw and ip6fw. Be care to set the type 'OPEN' as to prevent mysteryous system behavior in installing procedure. For NAT, Enable natd and setup natd interface(Upper-side interface).
Connect PC to the lower-side network and check the IPv4 behavior.
As the DHCP does not setup yet, The PC must be setup manually.
If you need IPv4 only, this section can be skipped. Though explanation is omitted, many pareameters like the following sample might be set in /etc/rc.conf. You must study about IPv6 and setup carefully.
##ENABLE IPv6 ipv6_enable="YES" ipv6_network_interfaces="gif0 fxp0" ##TUNNELLING INTERFACE gif_interfaces="gif0" gifconfig_gif0="192.168.0.124 192.168.0.126" ##IPv6 ADDRESS ipv6_prefix_fxp0="2001:5:6:7" ipv6_ifconfig_fxp0="2001:5:6:7::1 prefixlen 64" ##ADVERTISE rtadvd_enable="YES" rtadvd_interfaces="fxp0" ##DEFAULT GATEWAY ipv6_default_interface="gif0" ipv6_defaultrouter="fe80::a:b:c:d%gif0" ##ROUTING(RIPv6) ipv6_gateway_enable="YES" ipv6_router_enable="YES" ipv6_router="/usr/sbin/route6d" ipv6_router_flags="-O 2001:5:6:7::/64,gif0" |
Connect a PC to the lower-side network and check the behavior of IPv6
In WindowsPC, a command "ipv6 install" might be needed to activate IPv6.
If the IPv6 function is used, Opengate needs a FQDN attached to both IPv4 and IPv6 addresses. It can be settled in existing DNS. If the IPv6 function is not used, you can ignore DNS setting and control with IP address base.
Installing BIND9 from ports is as follows.
# cd /usr/ports/dns/bind9/ # make clean # make install clean ; rehash |
The directory "/etc/namedb(/var/named/etc/namedb)" is made in the installation.
For security, BIND9 is controlled by rndc command.
Create the rndc key as follows.
# /usr/local/sbin/dnssec-keygen -a hmac-md5 -b 512 -n user rndc |
When error "out of entropy", try with next method.
# /usr/local/sbin/dnssec-keygen -r /dev/urandom -a hmac-md5 -b 512 -n user rndc |
By the command, following files are generated.
Krndc.+157+60849.key
Krndc.+157+60849.private
There is "/usr/local/etc/rndc.conf.sample" after BIND9 installation. Copy it to "rndc.conf".
Insert "key" directive in "Krndc.+xxxxxxxx.private into "key" directive in rndc.key.
options { default-server localhost; default-key "rndc_key"; }; server localhost { key "rndc_key"; }; key "rndc_key" { algorithm hmac-md5; secret "......................"; }; |
There is "/etc/namedb/named.conf" after installation.
Edit "key" directive as like "key" directive of "rndc.conf"
key "rndc_key" { algorithm hmac-md5; secret "......................."; }; controls { inet ::1 allow { ::1; } keys { "rndc_key"; }; inet 127.0.0.1 allow { 127.0.0.1; } keys { "rndc_key"; }; }; |
For security, it is better to write the "key" directive in the other file, include it in "named.conf", and modify file permission.
Edit "options" directive.
options { directory "/etc/namedb"; pid-file "/var/run/named/named.pid"; auth-nxdomain yes; listen-on-v6 { any; }; }; |
Make the corresponding directory to put "named.pid".
Edit "view" and "zone" directive.
The "view" directive is implemented in BIND9. Replying to the inquiry from matched-clients, BIND9 sends the information described in the corresponding view.
view "og" { match-clients { 192.168.1.0/24; }; recursion yes; zone "." { type hint; file "named.root"; }; zone "og.saga-u.ac.jp" { type master; file "og.saga-u.ac.jp"; }; zone "0.0.127.IN-ADDR.ARPA" { type master; file "master/localhost.rev"; }; // RFC 3152 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA" { type master; file "master/localhost-v6.rev"; }; // RFC 1886 -- deprecated zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" { type master; file "master/localhost-v6.rev"; }; }; |
Make a "zone" file for the domain as "og.saga-u.ac.jp".
$TTL 3600 $ORIGIN og.saga-u.ac.jp. @ IN SOA ns.og.saga-u.ac.jp. postmaster ( 2005051702 ; 3600 1200 2419200 86400 ) IN NS ns.og.saga-u.ac.jp. IN A 192.168.1.1 IN MX 10 opengate.og.saga-u.ac.jp. ns IN A 192.168.1.1 opengate IN A 192.168.1.1 AAAA 2001:5:6:7::1 |
Confirm starting of "named" after setting was completed.
# /usr/local/sbin/named/ -u bind -c /etc/namedb/named.conf |
If "named" starts without problems, Add next lines to "/etc/rc.conf" for auto start.
named_enable="YES" named_program="/usr/local/sbin/named" named_flags="-u bind -c /etc/namedb/named.conf" |
Because management of a DNS server is too complicatedly, You need to read manual of BIND9 carefully, and refer other document.
Many client PCs are connected one after another. The DHCP might be a desireble solution for assginment of IP addresses to these clients.
Installing isc-dhcp3 from ports is as follows.
# cd /usr/ports/net/isc-dhcp3-server # make clean # make install clean ; rehash |
There is a configuration file "/usr/local/etc/dhcpd.conf.sample" after instalation. Copy "dhcpd.conf.sample" to "dhcpd.conf" and edit the file. Following is a setting example. The lease time must be greater than the maximum usage duration (Duration/Max in opengatesrv.conf) used at sellecting time watching mode.
option domain-name "og.saga-u.ac.jp"; option domain-name-servers 192.168.1.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.1.255; option routers 192.168.1.1; default-lease-time 86400; max-lease-time 604800; ddns-update-style none; log-facility local7; subnet 192.168.55.0 netmask 255.255.255.0 { range 192.168.1.10 192.168.1.250; } |
Add next lines to "/etc/rc.conf" for auto start.
dhcpd_enable="YES" dhcpd_ifaces="fxp0" dhcpd_conf="/usr/local/etc/dhcpd.conf" |
In this description, the value of "dhcpd_ifaces" is the interface for DHCP service(the lower-side network).
When using IPv6 function, Opengate needs Apache2 supporting IPv6. In default, Apache2 supports SSL which is desirable for secure authentication.
Installing Apache2 from ports is as follows.
# cd /usr/ports/www/apache2 # make clean # make install clean ; rehash |
Add next lines to "/etc/rc.conf" for auto start.
apache2_enable="YES" apache2ssl_enable="YES" |
It is better to obtain a formal key from some CA. But we shows the proceddure to make a self-signed private key and certificate.
Make a private key as follows.
# cd /usr/local/etc/apache2 # mkdir ssl.key ssl.crt # chmod 700 ssl.key ssl.crt # /usr/bin/openssl genrsa -out /usr/local/etc/apache2/ssl.key/server.key 1024 |
Make a certificate from the key as follows.
# /usr/bin/openssl req -new -x509 -days 365 \ -key /usr/local/etc/apache2/ssl.key/server.key \ -out /usr/local/etc/apache2/ssl.crt/server.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]:Saga Locality Name (eg, city) []:Saga-city Organization Name (eg, company) [Internet Widgits Pty Ltd]:Saga-university Organizational Unit Name (eg, subsection) []:Opengate Management Common Name (eg, YOUR name) []:opengate.og.saga-u.ac.jp Email Address []:administrator@opengate.og.saga-u.ac.jp Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: |
Edit "ssl.conf" like the following example.
ssl.conf |
<VirtualHost _default_:443> DocumentRoot "/usr/local/www/data" ServerName opengate.og.saga-u.ac.jp:443 ServerAdmin administrator@opengate.og.saga-u.ac.jp ErrorLog "|/usr/bin/logger -p local6.info" CustomLog "|/usr/bin/logger -p local5.info" combined SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateFile /usr/local/etc/apache2/ssl.crt/server.crt SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/server.key </VirtualHost> |
As Apache2 has many settings, be familiar with Apache2 configuration for adequate control.
Edit "/usr/local/etc/httpd.conf" as follows.
Opengate send back the authentication page for any kind of HTTP request. To do so, add next line to httpd.conf. This means the sending back top page at HTTP_ERROR 404(file not found) error.
ErrorDocument 404 / |
Add ExecCGI to execute CGI program in cgi-bin directory.
<Directory "/usr/local/www/cgi-bin"> ... Options ExecCGI ... </Directory> |
Remove the comment mark to enable the following setting
AddHandler type-map .var |
Check the behavior of Apache2 by various access.
Unfold the package of Opengate. It have following directorys.
doc: Documentations conf: Configuration file and firewall control perl script sample javahtml: Client Java Programs and HTML files opengatesrv: Server CGI programs tools: Some related tools ezxml: XML parser (Copyright Aaron Voisine) |
Check setting in opengatesrv/Makefile as follows. If web directory is changed, modify it. If you modify the setting, modify the same setting in config file described below.
HTMLTOP = /usr/local/www/data DOCPATH = /usr/local/www/data/opengate CGIPATH = /usr/local/www/cgi-bin/opengate CONFIGPATH = /etc/opengate |
Compile and Install as follows.
# make clean # make install |
Copy sample config file '/etc/opengate/opengatesrv.conf.sample' to '/etc/opengate/opengatesrv.conf' and modify. Following settings must be changed.
<OpengateServerName>opengate.og.saga-u.ac.jp</OpengateServerName> <AuthServer> <Address>192.168.0.2</Address> <Protocol>pop3s</Protocol> </AuthServer> |
In <OpengateServerName>, set HOSTNAME(FQDN) or IP address of opengate gateway server. If you want to use IPv6 function, you need to set FQDN corresponding to IPv4 and IPv6 both addresses.
In <AuthServer>, set the information of authentication server. Though Opengate support various protocol, see the config file for details. To separate the problem between auth server and opengate server, try the following setting firstly.
****Do not use this setting in real service**** <AuthServer> <Protocol>accept</Protocol> <AuthServer> |
Opengate switchs plural auth servers and other settings by ID attached to userid (userid@ID). See the config file for details. By this function, you can divide the authentication servers for many sections or guests.
About parameters that can be modified in the config file, see the config file for details.
Caution: As the IPv6 function is activated only when IPv6 access is detected, do not delete the IPv6 related setting in config file. The IPv6 access is executed when the FQDN for IPv6 is prepared.
Write ipfw rules for for Opengate. This is example "rc.firewall".
From FreeBSD6.1, IPFW supports IPv6. The IPFW rule used in Opengate is affected by this change. See
Rule number for [forward] Command(60000) must be larger than the rule numbers used by opengate(10000-40000). Rule number for [divert to natd] must be smaller than most rules. The above script is installed as /etc/opengate/rc.firewall.sample. Copy it to /etc/opengate/rc.firewall and modify. To use this script, edit firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.
firewall_script="/etc/opengate/rc.firewall" |
Be familiar with the ipfw command. Opengate is a software to send out ipfw add/delete command.
Write ipfw rules for for Opengate. This is example "rc.firewall6".
From FreeBSD6.1, IPFW supports IPv6. The IPFW rule used in Opengate is affected by this change. See
ip6fw dose not have [forward] function. Therefore IPv6 HTTP request is denied. And retried access with IPv4 is catched by ipfw [forward] fuction. When use FreeBSD 5.2 or later, ip6fw has TCP reset function. Because of the reset response, client needs no waiting time until timeout. The above script is installed as /etc/opengate/rc.firewall6.sample. Copy it to /etc/opengate/rc.firewall6 and modify. To use this script, edit firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.
ipv6_firewall_script="/etc/opengate/rc.firewall6" |
Be familiar with ip6fw command too.
Edit /etc/syslog.conf to save log file for Opengate.
local1.* /var/log/opengate.log | Separeted by TAB code |
Make the corresponding file as follows. Be care to control the size of this log file.
# touch /var/log/opengate.log |
Connect a PC to the lower-side network and access to a site in the upper-side network. If it does not work properly, refer doc/progflow.html and doc/protocol.txt to understand the procedure. And see the log file for Opengate, httpd, system and others at first. To dump more information from Opengate, set the <Debug> switch 1 in opengatesrv.conf. Check also the functions of related software. The error checking document(errcheck.html) and Q and A document (qa.html) might be used for problem solving.
If you want to modify the contents of web pages, edit the html files in Opengate directories. The relative path cannot use in httpkeep.html. Use the URL of full description. The descriptions such as %%XXX%% are variables replaced with some proper values in CGI.
This is optional. You can use MRTG to watch a state of Opengate. If you do not want to watch the state of Opengate, you do not need to install MRTG.
MRTG(Multi Router Traffic Grapher) is system to watch network traffic. MRTG makes graphic images and HTML files.
You can install MRTG to gateway server or another server. If you must watch plural Opengate, you had better install MRTG to another server.
# cd /usr/ports/net-mgmt/mrtg/ # make clean # make install clean ; rehash |
There is "/usr/local/etc/mrtg/mrtg.cfg.sample" as configuration file after instalation. Copy mrtg.cfg.sample to opengate.cfg and edit configuration file.
################################################## # opengate user counter WorkDir: /usr/home/user/public_html/mrtg/opengate/ ##### Options Options[^]: growright,gauge,nopercent,integer Target[opengate]:`/usr/home/user/bin/input.sh` Title[opengate]: Opengate user counter PageTop[opengate]: <h1>Opengate user counter</h1> <p>Show the number of people using Opengate</p> # Max Number MaxBytes[opengate]: 200 # Title of Y axis YLegend[opengate]: Opengate User # unit ShortLegend[opengate]: s # Title of graph LegendI: first line LegendO: second line LegendI[opengate]: IPv6 Users LegendO[opengate]: Total Users |
make a directory which you appointed in "WorkDir". MRTG makes graphic images and HTML files in WorkDir.
"Target[opengate]" is path to program to hand data to MRTG. explain below th details.
Put this shellscript as "/usr/home/user/bin/input.sh".
#!/bin/sh ####################################### ## ## show opengate status for MRTG ## ## 1 line : IPv6 Users ## 2 line : Total Users ## 3 line : uptime ## 4 line : comment for data ## ####################################### LANG=C COLUMNS=256 export LANG export COLUMNS ### IPv6 prefix prefix="2001:2f8:22:801:" ###opengateprocessname process="opengatesrv.cgi" ###tmp file name tmp_all="/tmp/og_count_all.tmp" tmp_6="/tmp/og_count_6.tmp" ###################################################### psax | grep $process > $tmp_all COUNT = `wc-l $tmp_all | awk '{print $1}'` grep $prefix $tmp_all > $tmp_6 COUNT6=`wc -l $tmp_6 | awk '{print $1}'` UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` rm $tmp_all rm $tmp_6 echo "$COUNT6" echo "$COUNT" echo "$UPTIME" echo "Opengate User Counter" |
carry out this shell script alone and confirm that you can acquire the following data.
5 48 10days Opengate User Counter |
Put this shellscript as "/usr/home/user/bin/input.sh" on another server.
#!/bin/sh ####################################### ## ## input data for MRTG ## ## 1 line : IPv6 Users ## 2 line : Total Users ## 3 line : uptime ## 4 line : comment for data ## ####################################### # tmp file name file="/tmp/opengate.tmp" # URL of output.sh at opengate url="http://opengate.saga-u.ac.jp/cgi-bin/output.sh" fetch -o $file $url &> /dev/null more $file |
Put this shell script as "/usr/local/apache2/cgi-bin/output.sh" on Opengate server. And set this URL to $url in script explained by the above.
#!/bin/sh ####################################### ## ## shwo opengate status for MRTG ## ## 1 line : IPv6 Users ## 2 line : Total Users ## 3 line : uptime ## 4 line : comment for data ## ####################################### LANG=C COLUMNS=256 export LANG export COLUMNS ### IPv6 prefix prefix="2001:2f8:22:801:" ###opengateprocessname process="opengatesrv.cgi" ###tmp file name tmp_all="/tmp/og_count_all.tmp" tmp_6="/tmp/og_count_6.tmp" ###################################################### psax | grep $process > $tmp_all COUNT = `wc-l $tmp_all | awk '{print $1}'` grep $prefix $tmp_all > $tmp_6 COUNT6=`wc -l $tmp_6 | awk '{print $1}'` UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` rm $tmp_all rm $tmp_6 echo "Content-type: text/plain; charset=iso-8859-1" echo echo "$COUNT6" echo "$COUNT" echo "$UPTIME" echo "Opengate User Counter" |
carry out "input.sh" shell script on another server and confirm that you can acquire the following data.
5 48 10days Opengate User Counter |
Confirm after setting was completed.
# /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg |
Various WARNING is output the first and second time.
There is some files in "WorkDir".
> ls -l -rw-r--r-- 1 root wheel 538 12 14 04:40 mrtg-l.png -rw-r--r-- 1 root wheel 414 12 14 04:40 mrtg-m.png -rw-r--r-- 1 root wheel 1759 12 14 04:40 mrtg-r.png -rw-r--r-- 1 root wheel 2941 12 20 15:15 opengate-day.png -rw-r--r-- 1 root wheel 2146 12 20 14:35 opengate-month.png -rw-r--r-- 1 root wheel 2867 12 20 14:55 opengate-week.png -rw-r--r-- 1 root wheel 1897 12 20 05:00 opengate-year.png -rw-r--r-- 1 root wheel 5961 12 20 15:15 opengate.html -rw-r--r-- 1 root wheel 48786 12 20 15:15 opengate.log -rw-r--r-- 1 root wheel 48784 12 20 15:10 opengate.old |
Add next line to "/etc/crontab".
*/5 * * * * root /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg |
This is optional. At the abnormal termination of Opengate process, superfluous rule might be left bihind. Though it is very rare, a script dealing with the case is prepared in tools/rulechk. This script is compatible with Opengate Ver1.3.1 or later. This script compares the Opengate process list and the firewall rule list, and deletes the superfluous rules.