Opengate Install Procedureõ


A Outlineõ

A.1 System Configurationõ

In this document, we use the system configuration as follows. The network connecting terminals is called as lower-side network and the network having servers is called upper-side network.

upper-side network:192.168.0.0/24, 2001:1:2:3/64
Gateway to upper-side network:fxp1, 192.168.0.124, 2001:1:2:3::4
Gateway to lower-side network:fxp0, 192.168.1.1, 2001:5:6:7::1
lower-side network:192.168.1.0/24, 2001:5:6:7/64

Opengate recognizes the both addresses of IPv4 and IPv6, and controles the both firewalls. It can be used for IPv4 control only under the FreeBSD system that does not set up IPv6 environments.

A.2 Install Procedureõ

Following is the proceddure of Opengate. The '*'mark means the mandatory items.

A.2 Support Pageõ

We prepare the Opengate support page as follows.
  http://www.cc.saga-u.ac.jp/opengate/index-e.html
back top

B FreeBSD Installõ

B.1 Basic Installõ

Use FreeBSD4.x or later. FreeBSD6.1 or later is desirable. Choose distribution Developer(Full sources, binaries and doc) or all, because we have to prepare a kernel.

Add next line to "/etc/rc.conf", because you enable the gateway function.

gateway_enable="YES"
back top

B.2 Addition of NAT and Firewallõ

Prepare kernel having ipfw and ip6fw functions.

Copy kernel options file.

# cd /usr/src/sys/i386/conf
# cp GENERIC MYKERNEL

Add next lines to the kernel.

(For FreeBSD6.0 or earlier)

options IPDIVERT

options IPFIREWALL
options IPFIREWALL_FORWARD
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100

options IPV6FIREWALL
options IPV6FIREWALL_VERBOSE
options IPV6FIREWALL_VERBOSE_LIMIT=100

options IPSEC
options IPSEC_ESP
options TCP_DROP_SYNFIN

(For FreeBSD6.1 or later)

options IPDIVERT

options IPFIREWALL
options IPFIREWALL_FORWARD
options IPFIREWALL_VERBOSE
options IPFIREWALL_VERBOSE_LIMIT=100

options IPSEC
device crypto

compile and install kernel having ipfw (and ip6fw) supports.

# config MYKERNEL
# cd ../compile/MYKERNEL
# make depend
# make
# make install

"make clean" might be requested before "make depend".

Add next lines to "/etc/rc.conf".

(For FreeBSD6.0 or earlier)

firewall_enable="YES"
firewall_script="/etc/rc.firewall"
firewall_type="open"

ipv6_firewall_enable="YES"
ipv6_firewall_script="/etc/rc.firewall6"
ipv6_firewall_type="open"

natd_enable="YES"
natd_interface="fxp1"

(For FreeBSD6.1 or later)

firewall_enable="YES"
firewall_script="/etc/rc.firewall"
firewall_type="open"

natd_enable="YES"
natd_interface="fxp1"

When setting the ipfw(and ip6fw) enable, be care to set the type 'OPEN' as to prevent mysteryous system behavior in installing procedure. For NAT, Enable natd and setup natd interface(Upper-side interface).

Connect PC to the lower-side network and check the IPv4 behavior.

As the DHCP does not setup yet, The PC network must be setup manually.

back top

B.3 Setup of IPv6õ

If you need IPv4 only, this section can be skipped. Though explanation is omitted, many pareameters like the following sample might be set in /etc/rc.conf. You must study about IPv6 and setup carefully.

##ENABLE IPv6
ipv6_enable="YES"
ipv6_network_interfaces="gif0 fxp0"

##TUNNELLING INTERFACE
gif_interfaces="gif0"
gifconfig_gif0="192.168.0.124 192.168.0.126"

##IPv6 ADDRESS 
ipv6_prefix_fxp0="2001:5:6:7"
ipv6_ifconfig_fxp0="2001:5:6:7::1 prefixlen 64"

##ADVERTISE
rtadvd_enable="YES"
rtadvd_interfaces="fxp0"

##DEFAULT GATEWAY
ipv6_default_interface="gif0"
ipv6_defaultrouter="fe80::a:b:c:d%gif0"

##ROUTING(RIPv6)
ipv6_gateway_enable="YES"
ipv6_router_enable="YES"
ipv6_router="/usr/sbin/route6d"
ipv6_router_flags="-O 2001:5:6:7::/64,gif0"

Connect a PC to the lower-side network and check the behavior of IPv6

In WindowsPC, a command "ipv6 install" might be needed to activate IPv6.

back top

C BIND9 Install(Optional)õ

C.1 Ports Installõ

You can ignore the DNS setting, if you control with IP address base or use existing DNS servers.

Installing BIND9 from ports is as follows. The "sysinstall" command can also be used for installation.

# cd /usr/ports/dns/bind9/
# make clean
# make install clean ; rehash

The directory "/etc/namedb(/var/named/etc/namedb)" is made in the installation.

back top

C.2 Making RNDC keyõ

For security, BIND9 is controlled by rndc command.

Create the rndc key as follows.

# cd /etc/namebd/
# rndc-confgen -b 512 > rndc.conf

By the command, following "rndc.conf" file is generated.

# Start of rndc.conf
key "rndc-key" {
	algorithm hmac-md5;
	secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA==";
};

options {
	default-key "rndc-key";
	default-server 127.0.0.1;
	default-port 953;
};
# End of rndc.conf

# Use with the following in named.conf, adjusting the allow list as needed:
# key "rndc-key" {
# 	algorithm hmac-md5;
# 	secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA==";
# };
# 
# controls {
# 	inet 127.0.0.1 port 953
# 		allow { 127.0.0.1; } keys { "rndc-key"; };
# };
# End of named.conf
back top

C.3 Setup of named.confõ

There is "/etc/namedb/named.conf" after installation.

Copy later half of "rndc.conf" file, remove comment, and add IPv6 configuration(if required).

# Use with the following in named.conf, adjusting the allow list as needed:
key "rndc-key" {
	algorithm hmac-md5;
	secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA==";
};

controls {
	inet ::1 port 953 allow { ::1; } keys { "rndc-key"; };
	inet 127.0.0.1 port 953	allow { 127.0.0.1; } keys { "rndc-key"; };
};
# End of named.conf

For security, it is better to write the "key" directive in the other file.

Edit "options" directive in "named.conf".

options {
        directory "/etc/namedb";
        pid-file "/var/run/named/pid";
        auth-nxdomain yes;
        listen-on-v6 { any; };
};

Make the corresponding directory to put "pid".

back top

C.4 Setup of Zoneõ

Edit "view" and "zone" directive in "named.conf".

The "view" directive is implemented in BIND9. Replying to the inquiry from matched-clients, BIND9 sends the information described in the corresponding view.

view "og" {
        match-clients
        {
        192.168.1.0/24;
        };

        recursion yes;

        zone "." {
                type hint;
                file "named.root";
        };

        zone "og.saga-u.ac.jp" {
                type master;
                file "og.saga-u.ac.jp";
        };

        zone "0.0.127.IN-ADDR.ARPA" {
                type master;
                file "master/localhost.rev";
        };

        // RFC 3152
        zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\
              0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA" {
                type master;
                file "master/localhost-v6.rev";
        };

        // RFC 1886 -- deprecated
        zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\
              0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" {
                type master;
                file "master/localhost-v6.rev";
        };
};

Make a "zone" file for the domain as "og.saga-u.ac.jp". The domain name and IPv4/6 addresses should be modified properly. If you don't need IPv6, the line "AAAA ...." should be removed.

$TTL    3600
$ORIGIN og.saga-u.ac.jp.

@       IN      SOA     ns.og.saga-u.ac.jp. postmaster (
                        2005051702 ;
                        3600
                        1200
                        2419200
                        86400 )
                IN      NS      ns.og.saga-u.ac.jp.
                IN      A       192.168.1.1
                IN      MX      10 opengate.og.saga-u.ac.jp.

ns              IN      A       192.168.1.1

opengate        IN      A       192.168.1.1
                        AAAA    2001:5:6:7::1
back top

C.5 Checking Behaviorõ

Confirm starting of "named" after setting was completed.

# /usr/local/sbin/named -u bind -c /etc/namedb/named.conf

If "named" starts without problems, Add next lines to "/etc/rc.conf" for auto start.

named_enable="YES"
named_program="/usr/local/sbin/named"
named_flags="-u bind -c /etc/namedb/named.conf"

Because the management of a DNS server is complicated, You need to read manual of BIND9 carefully, and refer other document.

back top

D isc-dhcp3 Install(Optional)õ

D.1 Ports Installõ

Many client PCs are connected. Thus the DHCP might be a desireble solution for assginment of IP addresses to these clients.

Installing isc-dhcp3 from ports is as follows. The "sysinstall" command can also be used for intallation.

# cd /usr/ports/net/isc-dhcp3-server
# make clean
# make install clean ; rehash
back top

D.2 Setup of DHCPõ

There is a configuration file "/usr/local/etc/dhcpd.conf.sample" after instalation. Copy "dhcpd.conf.sample" to "dhcpd.conf" and edit the file. Following is an example setup. The lease time must be greater than the maximum usage duration (Duration/Max in opengatesrv.conf).

The domain name and IP addresses should be modified.

option domain-name "og.saga-u.ac.jp";
option domain-name-servers 192.168.1.1;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.1.255;
option routers 192.168.1.1;

default-lease-time 86400;
max-lease-time 604800;
ddns-update-style none;
log-facility local7;

subnet 192.168.55.0 netmask 255.255.255.0 {
  range 192.168.1.10 192.168.1.250;
}

Add next lines to "/etc/rc.conf" for auto start.

dhcpd_enable="YES"
dhcpd_ifaces="fxp0"
dhcpd_conf="/usr/local/etc/dhcpd.conf"

In this description, the value of "dhcpd_ifaces" is the interface for DHCP service(the lower-side network).

back top

E Apache2 Installõ

E.1 Ports Installõ

When using IPv6 function, Opengate needs Apache2 supporting IPv6. In default, Apache2 supports SSL which is desirable for secure authentication.

Installing Apache2 from ports is as follows. The "sysinstall" command can also be used for installation.

# cd /usr/ports/www/apache22
# make clean
# make install clean ; rehash
back top

E.2 Making Certificateõ

It is better to obtain a formal key from some CA. But we shows the procedure to make a self-signed private key and certificate.

Make a private key as follows.

# cd /usr/local/etc/apache22
# mkdir ssl.key ssl.crt
# chmod 700 ssl.key ssl.crt

# /usr/bin/openssl genrsa -out /usr/local/etc/apache22/server.key 1024

Make a certificate from the key as follows.

# /usr/bin/openssl req -new -x509 -days 365 \
    -key /usr/local/etc/apache22/server.key \
    -out /usr/local/etc/apache22/server.crt

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Saga
Locality Name (eg, city) []:Saga-city
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Saga-university
Organizational Unit Name (eg, subsection) []:Opengate Management
Common Name (eg, YOUR name) []:opengate.og.saga-u.ac.jp
Email Address []:administrator@opengate.og.saga-u.ac.jp

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

back top

E.4  Setup of SSLõ

Edit "/usr/local/etc/apache22/extra/httpd-ssl.conf" like the following example.

ssl.conf
<VirtualHost _default_:443>
    DocumentRoot "/usr/local/www/apache22/data"
    ServerName opengate.og.saga-u.ac.jp:443
    ServerAdmin administrator@opengate.og.saga-u.ac.jp
    ErrorLog "|/usr/bin/logger -p local6.info"
    CustomLog "|/usr/bin/logger -p local5.info" combined

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile /usr/local/etc/apache22/server.crt
    SSLCertificateKeyFile /usr/local/etc/apache22/server.key
</VirtualHost>

As Apache2 has many settings, be familiar with Apache2 configuration for adequate control.

back top

E.5 Other Setting and Checkingõ

Edit "/usr/local/etc/apache22/httpd.conf" as follows.

Opengate send back the authentication page for any kind of HTTP request. To do so, add next line to httpd.conf. This means that the top page is sent back at HTTP_ERROR 404(file not found) error.

ErrorDocument 404 /

Add ExecCGI to execute CGI program in cgi-bin directory.

<Directory "/usr/local/www/cgi-bin">
    ...
    Options ExecCGI
    ...
</Directory>

Remove the comment mark to enable the following setting
AddHandler cgi-script .cgi
AddHandler type-map .var

Add "index.html.var" into DirectoryIndex.
DirectoryIndex index.html.var index.html

Include ssl conf file.
Include etc/apache22/extra/httpd-ssl.conf

Set Server name.
ServerName opengate.og.saga-u.ac.jp

Start Apache2 with "apachectl start" and check the normal action. Then add next lines to "/etc/rc.conf" for auto start.

apache22_enable="YES"
apache22ssl_enable="YES"

If the system shows "Failed to enable the 'httpready' Accept Filter", add following into /boot/loader.conf
accf_http_load="YES"

back top

F Opengate Installõ

F.1 Opengate Packageõ

Unfold the package of Opengate.

# tar xzvf opengatexxxx.tar.gz

It have following directorys.

doc: Documentations
conf: Configuration file and firewall control perl script sample
javahtml: Client Java Programs and  HTML files
opengatesrv: Server CGI programs
tools: Some related tools
ezxml: XML parser (Copyright Aaron Voisine)
back top

F.2 Installõ

Check setting in "opengatesrv/Makefile" and modify properly.

HTMLTOP = /usr/local/www/apache22
DOCDIR = /data
CGIDIR = /cgi-bin
OPENGATEDIR = /opengate
CONFIGPATH = /etc/opengate

Compile and Install.

# make clean
# make install
back top

F.3 Setup of Config Fileõ

Copy sample config file "/etc/opengate/opengatesrv.conf.sample" to "/etc/opengate/opengatesrv.conf" and modify. Following settings must be changed.

	<OpengateServerName>opengate.og.saga-u.ac.jp</OpengateServerName>

	<AuthServer>
		<Protocol>pop3s</Protocol>
		<Address>192.168.0.2</Address>
	</AuthServer>

In <OpengateServerName>, set HOSTNAME(FQDN) or IP address of opengate gateway server. If you want to use IPv6 function, you need to set FQDN corresponding to IPv4 and IPv6 both addresses.

In <AuthServer>, set the information of authentication server. Opengate support various auth protocols. See the config file for details. To separate the problem between auth server and opengate server, try the following setting firstly. This means that any userid and password are accepted.

 ****Do not use this setting in real service****
	<AuthServer>
		<Protocol>accept</Protocol> 
	<AuthServer>

The config file is XML form. The # mark in the file does not mean the start of a comment. Use XML-formed comment as <!-- Comment String --> to disable description.

Opengate can switch auth setting with "userid@extid" pattern. See the config file for details. By this function, you can divide the authentication servers for many sections or guests.

When default auth server is not replied, Opengate can re-request to other auth servers. See the config file for details.

Caution: Do not delete the IPv6 related setting in config file. The IPv6 access is executed when the FQDN for IPv6 is prepared.

back top

F.4 Setup of ipfwõ

Write ipfw rules for Opengate.

(For FreeBSD6.0 or earlier)

IPv4 packets are controlled by ipfw, and IPv6 packets by ip6fw.

Sample setup scripts for both commands are prepared as "/etc/opengate/rc.firewall4.sample" and "/etc/opengate/rc.firewall6.sample"

Copy these script and modify properly.

# cd /etc/opengate
# cp rc.firewall4.sample rc.firewall4
# cp rc.firewall6.sample rc.firewall6
# vi rc.firewall4
# vi rc.firewall6

Modify firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.

firewall_enable="YES"
firewall_script="/etc/opengate/rc.firewall4"

ipv6_firewall_enable="YES"
ipv6_firewall_script="/etc/opengate/rc.firewall6"

Then modify "/etc/opengatesrv.conf" from <Ip6fwPath>/sbin/ipfw</Ip6fwPath> to <Ip6fwPath>/sbin/ip6fw</Ip6fwPath>

(For FreeBSD6.1 or later)

Both of IPv4 and IPv6 packets are controlled by ipfw.

Sample setup scripts for the system are prepared as "/etc/opengate/rc.firewall.sample"

Copy the script and modify properly. If you don't know IPv6, set IPv6 addresses as localhost(*net6="0", *ip6="::1").

# cd /etc/opengate
# cp rc.firewall.sample rc.firewall
# vi rc.virewall

Modify firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.

firewall_enable="YES"
firewall_script="/etc/opengate/rc.firewall"

Be familiar with the ipfw command. Opengate is a software to send out ipfw add/delete command.

back top

F.5 Setup of syslogõ

Edit /etc/syslog.conf to save log file for Opengate.

         | Separeted by TAB code
         V
local1.*   /var/log/opengate.log

Make the log file as follows. Be care to control the size of this log file.

# touch /var/log/opengate.log
back top

F.6 Checking Behaviorõ

Connect a PC to the lower-side network and access to a site in the upper-side network. If it does not work properly, refer doc/progflow.html and doc/protocol.txt to understand the procedure. And see the log file for Opengate, httpd, system and others. To dump more information from Opengate, set the <Debug> switch "2" in opengatesrv.conf. Check also the functions of related software. The error checking document(errcheck.html) and Q and A document (qa.html, recentqa.html in web) might be used for problem solving.

back top

F.7 Modification of Pagesõ

If you want to modify the contents of web pages, edit the html files in Opengate directories. The relative path cannot use in httpkeep.html. Use the URL of full description. The descriptions such as %%XXX%% are variables replaced with some proper values in CGI.

back top

G MRTG Install(Optional)

G.1 Ports Install

This is optional. When you want to watch the state of Opengate, MRTG can be used but is not required usually.

MRTG(Multi Router Traffic Grapher) is system to watch network traffic. MRTG makes graphic images and HTML files.

You can install MRTG to gateway server or another server. If you must watch plural Opengate, you had better install MRTG to another server.

# cd /usr/ports/net-mgmt/mrtg/
# make clean
# make install clean ; rehash
back top

G.2 Setup of MRTG

There is "/usr/local/etc/mrtg/mrtg.cfg.sample" as configuration file after instalation. Copy mrtg.cfg.sample to opengate.cfg and edit configuration file.

##################################################
#  opengate user counter

WorkDir: /usr/home/user/public_html/mrtg/opengate/

##### Options
Options[^]: growright,gauge,nopercent,integer

Target[opengate]:`/usr/home/user/bin/input.sh`
Title[opengate]: Opengate user counter

PageTop[opengate]: <h1>Opengate user counter</h1>
 <p>Show the number of people using Opengate</p>

# Max Number
MaxBytes[opengate]: 200

# Title of Y axis
YLegend[opengate]: Opengate User
# unit
ShortLegend[opengate]: s
# Title of graph LegendI: first line LegendO: second line
LegendI[opengate]: IPv6 Users
LegendO[opengate]: Total Users

make a directory which you appointed in "WorkDir". MRTG makes graphic images and HTML files in WorkDir.

"Target[opengate]" is path to program to hand data to MRTG. explain below th details.

G.2.1 Case of gateway server

Put this shellscript as "/usr/home/user/bin/input.sh".

#!/bin/sh

#######################################
##
## show opengate status for MRTG
##
##   1 line : IPv6 Users
##   2 line : Total Users
##   3 line : uptime
##   4 line : comment for data
##
#######################################

LANG=C
COLUMNS=256

export LANG
export COLUMNS

### IPv6 prefix
prefix="2001:2f8:22:801:"
###opengateprocessname
process="opengatesrv.cgi" 

###tmp file  name
tmp_all="/tmp/og_count_all.tmp"
tmp_6="/tmp/og_count_6.tmp"

######################################################
psax | grep $process > $tmp_all
COUNT = `wc-l $tmp_all | awk '{print $1}'` 
grep $prefix $tmp_all >  $tmp_6
COUNT6=`wc -l $tmp_6 | awk '{print $1}'`
UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"`

rm $tmp_all
rm $tmp_6

echo "$COUNT6"
echo "$COUNT"
echo "$UPTIME"
echo "Opengate User Counter"

carry out this shell script alone and confirm that you can acquire the following data.

5
48
10days
Opengate User Counter
G.2.2 Case of another server

Put this shellscript as "/usr/home/user/bin/input.sh" on another server.

#!/bin/sh

#######################################
##
## input data for MRTG
##
##   1 line : IPv6 Users
##   2 line : Total Users
##   3 line : uptime
##   4 line : comment for data
##
#######################################

# tmp file name
file="/tmp/opengate.tmp"

# URL of output.sh at opengate
url="http://opengate.saga-u.ac.jp/cgi-bin/output.sh"

fetch -o $file $url &> /dev/null

more $file

Put this shell script as "/usr/local/apache2/cgi-bin/output.sh" on Opengate server. And set this URL to $url in script explained by the above.

#!/bin/sh

#######################################
##
## show opengate status for MRTG
##
##   1 line : IPv6 Users
##   2 line : Total Users
##   3 line : uptime
##   4 line : comment for data
##
#######################################

LANG=C
COLUMNS=256

export LANG
export COLUMNS

### IPv6 prefix
prefix="2001:2f8:22:801:"
###opengateprocessname
process="opengatesrv.cgi" 

###tmp file name
tmp_all="/tmp/og_count_all.tmp"
tmp_6="/tmp/og_count_6.tmp"

######################################################
psax | grep $process > $tmp_all 
COUNT = `wc-l $tmp_all | awk '{print $1}'` 
grep $prefix $tmp_all >  $tmp_6
COUNT6=`wc -l $tmp_6 | awk '{print $1}'`
UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"`
rm $tmp_all
rm $tmp_6

echo "Content-type: text/plain; charset=iso-8859-1"
echo

echo "$COUNT6"
echo "$COUNT"
echo "$UPTIME"
echo "Opengate User Counter"

carry out "input.sh" shell script on another server and confirm that you can acquire the following data.

5
48
10days
Opengate User Counter
back top

G.3 Start confirmation

Confirm after setting was completed.

# /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg

Various WARNING is output the first and second time.

There is some files in "WorkDir".

> ls -l
-rw-r--r--  1 root  wheel    538 12 14 04:40 mrtg-l.png
-rw-r--r--  1 root  wheel    414 12 14 04:40 mrtg-m.png
-rw-r--r--  1 root  wheel   1759 12 14 04:40 mrtg-r.png
-rw-r--r--  1 root  wheel   2941 12 20 15:15 opengate-day.png
-rw-r--r--  1 root  wheel   2146 12 20 14:35 opengate-month.png
-rw-r--r--  1 root  wheel   2867 12 20 14:55 opengate-week.png
-rw-r--r--  1 root  wheel   1897 12 20 05:00 opengate-year.png
-rw-r--r--  1 root  wheel   5961 12 20 15:15 opengate.html
-rw-r--r--  1 root  wheel  48786 12 20 15:15 opengate.log
-rw-r--r--  1 root  wheel  48784 12 20 15:10 opengate.old
back top

G.4 Setup crontab

Add next line to "/etc/crontab".

*/5 * * * * root /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg
back top

H rulechk Install(Optional)

This is optional. At the abnormal termination of Opengate process, superfluous rule might be left bihind. Though it is very rare, a script dealing with the case is prepared in tools/rulechk. This script is compatible with Opengate Ver1.3.1 or later. This script compares the Opengate process list and the firewall rule list, and deletes the superfluous rules.

back top