In this document, we use the system configuration as follows. The network connecting terminals is called as lower-side network and the network having servers is called upper-side network.
upper-side network:192.168.0.0/24, 2001:1:2:3/64 Gateway to upper-side network:fxp1, 192.168.0.124, 2001:1:2:3::4 Gateway to lower-side network:fxp0, 192.168.1.1, 2001:5:6:7::1 lower-side network:192.168.1.0/24, 2001:5:6:7/64 |
Opengate recognizes the both addresses of IPv4 and IPv6, and controles the both firewalls. It can be used for IPv4 control only under the FreeBSD system that does not set up IPv6 environments.
Following is the proceddure of Opengate. The '*'mark means the mandatory items.
http://www.cc.saga-u.ac.jp/opengate/index-e.html |
Use FreeBSD4.x or later. FreeBSD6.1 or later is desirable. Choose distribution Developer(Full sources, binaries and doc) or all, because we have to prepare a kernel.
Add next line to "/etc/rc.conf", because you enable the gateway function.
gateway_enable="YES" |
Prepare kernel having ipfw and ip6fw functions.
Copy kernel options file.
# cd /usr/src/sys/i386/conf # cp GENERIC MYKERNEL |
Add next lines to the kernel.
(For FreeBSD6.0 or earlier)
options IPDIVERT options IPFIREWALL options IPFIREWALL_FORWARD options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=100 options IPV6FIREWALL options IPV6FIREWALL_VERBOSE options IPV6FIREWALL_VERBOSE_LIMIT=100 options IPSEC options IPSEC_ESP options TCP_DROP_SYNFIN |
(For FreeBSD6.1 or later)
options IPDIVERT options IPFIREWALL options IPFIREWALL_FORWARD options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=100 options IPSEC device crypto |
compile and install kernel having ipfw (and ip6fw) supports.
# config MYKERNEL # cd ../compile/MYKERNEL # make depend # make # make install |
"make clean" might be requested before "make depend".
Add next lines to "/etc/rc.conf".
(For FreeBSD6.0 or earlier)
firewall_enable="YES" firewall_script="/etc/rc.firewall" firewall_type="open" ipv6_firewall_enable="YES" ipv6_firewall_script="/etc/rc.firewall6" ipv6_firewall_type="open" natd_enable="YES" natd_interface="fxp1" |
(For FreeBSD6.1 or later)
firewall_enable="YES" firewall_script="/etc/rc.firewall" firewall_type="open" natd_enable="YES" natd_interface="fxp1" |
When setting the ipfw(and ip6fw) enable, be care to set the type 'OPEN' as to prevent mysteryous system behavior in installing procedure. For NAT, Enable natd and setup natd interface(Upper-side interface).
Connect PC to the lower-side network and check the IPv4 behavior.
As the DHCP does not setup yet, The PC network must be setup manually.
If you need IPv4 only, this section can be skipped. Though explanation is omitted, many pareameters like the following sample might be set in /etc/rc.conf. You must study about IPv6 and setup carefully.
##ENABLE IPv6 ipv6_enable="YES" ipv6_network_interfaces="gif0 fxp0" ##TUNNELLING INTERFACE gif_interfaces="gif0" gifconfig_gif0="192.168.0.124 192.168.0.126" ##IPv6 ADDRESS ipv6_prefix_fxp0="2001:5:6:7" ipv6_ifconfig_fxp0="2001:5:6:7::1 prefixlen 64" ##ADVERTISE rtadvd_enable="YES" rtadvd_interfaces="fxp0" ##DEFAULT GATEWAY ipv6_default_interface="gif0" ipv6_defaultrouter="fe80::a:b:c:d%gif0" ##ROUTING(RIPv6) ipv6_gateway_enable="YES" ipv6_router_enable="YES" ipv6_router="/usr/sbin/route6d" ipv6_router_flags="-O 2001:5:6:7::/64,gif0" |
Connect a PC to the lower-side network and check the behavior of IPv6
In WindowsPC, a command "ipv6 install" might be needed to activate IPv6.
You can ignore the DNS setting, if you control with IP address base or use existing DNS servers.
Installing BIND9 from ports is as follows. The "sysinstall" command can also be used for installation.
# cd /usr/ports/dns/bind9/ # make clean # make install clean ; rehash |
The directory "/etc/namedb(/var/named/etc/namedb)" is made in the installation.
For security, BIND9 is controlled by rndc command.
Create the rndc key as follows.
# cd /etc/namebd/ # rndc-confgen -b 512 > rndc.conf |
By the command, following "rndc.conf" file is generated.
# Start of rndc.conf key "rndc-key" { algorithm hmac-md5; secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; }; options { default-key "rndc-key"; default-server 127.0.0.1; default-port 953; }; # End of rndc.conf # Use with the following in named.conf, adjusting the allow list as needed: # key "rndc-key" { # algorithm hmac-md5; # secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; # }; # # controls { # inet 127.0.0.1 port 953 # allow { 127.0.0.1; } keys { "rndc-key"; }; # }; # End of named.conf |
There is "/etc/namedb/named.conf" after installation.
Copy later half of "rndc.conf" file, remove comment, and add IPv6 configuration(if required).
# Use with the following in named.conf, adjusting the allow list as needed: key "rndc-key" { algorithm hmac-md5; secret "wMpASEmnRVnD602MtEb+RqtMee5+n0RVgpaUrlAHvPpgH3SoK7f2nRZBUH7a0urvmyBuAg0dwtk/Otg9Ker3gA=="; }; controls { inet ::1 port 953 allow { ::1; } keys { "rndc-key"; }; inet 127.0.0.1 port 953 allow { 127.0.0.1; } keys { "rndc-key"; }; }; # End of named.conf |
For security, it is better to write the "key" directive in the other file.
Edit "options" directive in "named.conf".
options { directory "/etc/namedb"; pid-file "/var/run/named/pid"; auth-nxdomain yes; listen-on-v6 { any; }; }; |
Make the corresponding directory to put "pid".
Edit "view" and "zone" directive in "named.conf".
The "view" directive is implemented in BIND9. Replying to the inquiry from matched-clients, BIND9 sends the information described in the corresponding view.
view "og" { match-clients { 192.168.1.0/24; }; recursion yes; zone "." { type hint; file "named.root"; }; zone "og.saga-u.ac.jp" { type master; file "og.saga-u.ac.jp"; }; zone "0.0.127.IN-ADDR.ARPA" { type master; file "master/localhost.rev"; }; // RFC 3152 zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA" { type master; file "master/localhost-v6.rev"; }; // RFC 1886 -- deprecated zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.\ 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.INT" { type master; file "master/localhost-v6.rev"; }; }; |
Make a "zone" file for the domain as "og.saga-u.ac.jp". The domain name and IPv4/6 addresses should be modified properly. If you don't need IPv6, the line "AAAA ...." should be removed.
$TTL 3600 $ORIGIN og.saga-u.ac.jp. @ IN SOA ns.og.saga-u.ac.jp. postmaster ( 2005051702 ; 3600 1200 2419200 86400 ) IN NS ns.og.saga-u.ac.jp. IN A 192.168.1.1 IN MX 10 opengate.og.saga-u.ac.jp. ns IN A 192.168.1.1 opengate IN A 192.168.1.1 AAAA 2001:5:6:7::1 |
Confirm starting of "named" after setting was completed.
# /usr/local/sbin/named -u bind -c /etc/namedb/named.conf |
If "named" starts without problems, Add next lines to "/etc/rc.conf" for auto start.
named_enable="YES" named_program="/usr/local/sbin/named" named_flags="-u bind -c /etc/namedb/named.conf" |
Because the management of a DNS server is complicated, You need to read manual of BIND9 carefully, and refer other document.
Many client PCs are connected. Thus the DHCP might be a desireble solution for assginment of IP addresses to these clients.
Installing isc-dhcp3 from ports is as follows. The "sysinstall" command can also be used for intallation.
# cd /usr/ports/net/isc-dhcp3-server # make clean # make install clean ; rehash |
There is a configuration file "/usr/local/etc/dhcpd.conf.sample" after instalation. Copy "dhcpd.conf.sample" to "dhcpd.conf" and edit the file. Following is an example setup. The lease time must be greater than the maximum usage duration (Duration/Max in opengatesrv.conf).
The domain name and IP addresses should be modified.
option domain-name "og.saga-u.ac.jp"; option domain-name-servers 192.168.1.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.1.255; option routers 192.168.1.1; default-lease-time 86400; max-lease-time 604800; ddns-update-style none; log-facility local7; subnet 192.168.55.0 netmask 255.255.255.0 { range 192.168.1.10 192.168.1.250; } |
Add next lines to "/etc/rc.conf" for auto start.
dhcpd_enable="YES" dhcpd_ifaces="fxp0" dhcpd_conf="/usr/local/etc/dhcpd.conf" |
In this description, the value of "dhcpd_ifaces" is the interface for DHCP service(the lower-side network).
When using IPv6 function, Opengate needs Apache2 supporting IPv6. In default, Apache2 supports SSL which is desirable for secure authentication.
Installing Apache2 from ports is as follows. The "sysinstall" command can also be used for installation.
# cd /usr/ports/www/apache22 # make clean # make install clean ; rehash |
It is better to obtain a formal key from some CA. But we shows the procedure to make a self-signed private key and certificate.
Make a private key as follows.
# cd /usr/local/etc/apache22 # mkdir ssl.key ssl.crt # chmod 700 ssl.key ssl.crt # /usr/bin/openssl genrsa -out /usr/local/etc/apache22/server.key 1024 |
Make a certificate from the key as follows.
# /usr/bin/openssl req -new -x509 -days 365 \ -key /usr/local/etc/apache22/server.key \ -out /usr/local/etc/apache22/server.crt You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:JP State or Province Name (full name) [Some-State]:Saga Locality Name (eg, city) []:Saga-city Organization Name (eg, company) [Internet Widgits Pty Ltd]:Saga-university Organizational Unit Name (eg, subsection) []:Opengate Management Common Name (eg, YOUR name) []:opengate.og.saga-u.ac.jp Email Address []:administrator@opengate.og.saga-u.ac.jp Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: |
Edit "/usr/local/etc/apache22/extra/httpd-ssl.conf" like the following example.
ssl.conf |
<VirtualHost _default_:443> DocumentRoot "/usr/local/www/apache22/data" ServerName opengate.og.saga-u.ac.jp:443 ServerAdmin administrator@opengate.og.saga-u.ac.jp ErrorLog "|/usr/bin/logger -p local6.info" CustomLog "|/usr/bin/logger -p local5.info" combined SSLEngine on SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL SSLCertificateFile /usr/local/etc/apache22/server.crt SSLCertificateKeyFile /usr/local/etc/apache22/server.key </VirtualHost> |
As Apache2 has many settings, be familiar with Apache2 configuration for adequate control.
Edit "/usr/local/etc/apache22/httpd.conf" as follows.
Opengate send back the authentication page for any kind of HTTP request. To do so, add next line to httpd.conf. This means that the top page is sent back at HTTP_ERROR 404(file not found) error.
ErrorDocument 404 / |
Add ExecCGI to execute CGI program in cgi-bin directory.
<Directory "/usr/local/www/cgi-bin"> ... Options ExecCGI ... </Directory> |
Remove the comment mark to enable the following setting
AddHandler cgi-script .cgi AddHandler type-map .var |
Add "index.html.var" into DirectoryIndex.
DirectoryIndex index.html.var index.html |
Include ssl conf file.
Include etc/apache22/extra/httpd-ssl.conf |
Set Server name.
ServerName opengate.og.saga-u.ac.jp |
Start Apache2 with "apachectl start" and check the normal action. Then add next lines to "/etc/rc.conf" for auto start.
apache22_enable="YES" apache22ssl_enable="YES" |
If the system shows "Failed to enable the 'httpready' Accept Filter", add following into /boot/loader.conf
accf_http_load="YES" |
Unfold the package of Opengate.
# tar xzvf opengatexxxx.tar.gz |
It have following directorys.
doc: Documentations conf: Configuration file and firewall control perl script sample javahtml: Client Java Programs and HTML files opengatesrv: Server CGI programs tools: Some related tools ezxml: XML parser (Copyright Aaron Voisine) |
Check setting in "opengatesrv/Makefile" and modify properly.
HTMLTOP = /usr/local/www/apache22 DOCDIR = /data CGIDIR = /cgi-bin OPENGATEDIR = /opengate CONFIGPATH = /etc/opengate |
Compile and Install.
# make clean # make install |
Copy sample config file "/etc/opengate/opengatesrv.conf.sample" to "/etc/opengate/opengatesrv.conf" and modify. Following settings must be changed.
<OpengateServerName>opengate.og.saga-u.ac.jp</OpengateServerName> <AuthServer> <Protocol>pop3s</Protocol> <Address>192.168.0.2</Address> </AuthServer> |
In <OpengateServerName>, set HOSTNAME(FQDN) or IP address of opengate gateway server. If you want to use IPv6 function, you need to set FQDN corresponding to IPv4 and IPv6 both addresses.
In <AuthServer>, set the information of authentication server. Opengate support various auth protocols. See the config file for details. To separate the problem between auth server and opengate server, try the following setting firstly. This means that any userid and password are accepted.
****Do not use this setting in real service**** <AuthServer> <Protocol>accept</Protocol> <AuthServer> |
The config file is XML form. The # mark in the file does not mean the start of a comment. Use XML-formed comment as <!-- Comment String --> to disable description.
Opengate can switch auth setting with "userid@extid" pattern. See the config file for details. By this function, you can divide the authentication servers for many sections or guests.
When default auth server is not replied, Opengate can re-request to other auth servers. See the config file for details.
Caution: Do not delete the IPv6 related setting in config file. The IPv6 access is executed when the FQDN for IPv6 is prepared.
Write ipfw rules for Opengate.
(For FreeBSD6.0 or earlier)
IPv4 packets are controlled by ipfw, and IPv6 packets by ip6fw.
Sample setup scripts for both commands are prepared as "/etc/opengate/rc.firewall4.sample" and "/etc/opengate/rc.firewall6.sample"
Copy these script and modify properly.
# cd /etc/opengate # cp rc.firewall4.sample rc.firewall4 # cp rc.firewall6.sample rc.firewall6 # vi rc.firewall4 # vi rc.firewall6 |
Modify firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.
firewall_enable="YES" firewall_script="/etc/opengate/rc.firewall4" ipv6_firewall_enable="YES" ipv6_firewall_script="/etc/opengate/rc.firewall6" |
Then modify "/etc/opengatesrv.conf" from <Ip6fwPath>/sbin/ipfw</Ip6fwPath> to <Ip6fwPath>/sbin/ip6fw</Ip6fwPath>
(For FreeBSD6.1 or later)
Both of IPv4 and IPv6 packets are controlled by ipfw.
Sample setup scripts for the system are prepared as "/etc/opengate/rc.firewall.sample"
Copy the script and modify properly. If you don't know IPv6, set IPv6 addresses as localhost(*net6="0", *ip6="::1").
# cd /etc/opengate # cp rc.firewall.sample rc.firewall # vi rc.virewall |
Modify firewall setting in /erc/rc.conf as follows. Be care that accesses after this setting might be denied by the firewall.
firewall_enable="YES" firewall_script="/etc/opengate/rc.firewall" |
Be familiar with the ipfw command. Opengate is a software to send out ipfw add/delete command.
Edit /etc/syslog.conf to save log file for Opengate.
| Separeted by TAB code V local1.* /var/log/opengate.log |
Make the log file as follows. Be care to control the size of this log file.
# touch /var/log/opengate.log |
Connect a PC to the lower-side network and access to a site in the upper-side network. If it does not work properly, refer doc/progflow.html and doc/protocol.txt to understand the procedure. And see the log file for Opengate, httpd, system and others. To dump more information from Opengate, set the <Debug> switch "2" in opengatesrv.conf. Check also the functions of related software. The error checking document(errcheck.html) and Q and A document (qa.html, recentqa.html in web) might be used for problem solving.
If you want to modify the contents of web pages, edit the html files in Opengate directories. The relative path cannot use in httpkeep.html. Use the URL of full description. The descriptions such as %%XXX%% are variables replaced with some proper values in CGI.
This is optional. When you want to watch the state of Opengate, MRTG can be used but is not required usually.
MRTG(Multi Router Traffic Grapher) is system to watch network traffic. MRTG makes graphic images and HTML files.
You can install MRTG to gateway server or another server. If you must watch plural Opengate, you had better install MRTG to another server.
# cd /usr/ports/net-mgmt/mrtg/ # make clean # make install clean ; rehash |
There is "/usr/local/etc/mrtg/mrtg.cfg.sample" as configuration file after instalation. Copy mrtg.cfg.sample to opengate.cfg and edit configuration file.
################################################## # opengate user counter WorkDir: /usr/home/user/public_html/mrtg/opengate/ ##### Options Options[^]: growright,gauge,nopercent,integer Target[opengate]:`/usr/home/user/bin/input.sh` Title[opengate]: Opengate user counter PageTop[opengate]: <h1>Opengate user counter</h1> <p>Show the number of people using Opengate</p> # Max Number MaxBytes[opengate]: 200 # Title of Y axis YLegend[opengate]: Opengate User # unit ShortLegend[opengate]: s # Title of graph LegendI: first line LegendO: second line LegendI[opengate]: IPv6 Users LegendO[opengate]: Total Users |
make a directory which you appointed in "WorkDir". MRTG makes graphic images and HTML files in WorkDir.
"Target[opengate]" is path to program to hand data to MRTG. explain below th details.
Put this shellscript as "/usr/home/user/bin/input.sh".
#!/bin/sh ####################################### ## ## show opengate status for MRTG ## ## 1 line : IPv6 Users ## 2 line : Total Users ## 3 line : uptime ## 4 line : comment for data ## ####################################### LANG=C COLUMNS=256 export LANG export COLUMNS ### IPv6 prefix prefix="2001:2f8:22:801:" ###opengateprocessname process="opengatesrv.cgi" ###tmp file name tmp_all="/tmp/og_count_all.tmp" tmp_6="/tmp/og_count_6.tmp" ###################################################### psax | grep $process > $tmp_all COUNT = `wc-l $tmp_all | awk '{print $1}'` grep $prefix $tmp_all > $tmp_6 COUNT6=`wc -l $tmp_6 | awk '{print $1}'` UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` rm $tmp_all rm $tmp_6 echo "$COUNT6" echo "$COUNT" echo "$UPTIME" echo "Opengate User Counter" |
carry out this shell script alone and confirm that you can acquire the following data.
5 48 10days Opengate User Counter |
Put this shellscript as "/usr/home/user/bin/input.sh" on another server.
#!/bin/sh ####################################### ## ## input data for MRTG ## ## 1 line : IPv6 Users ## 2 line : Total Users ## 3 line : uptime ## 4 line : comment for data ## ####################################### # tmp file name file="/tmp/opengate.tmp" # URL of output.sh at opengate url="http://opengate.saga-u.ac.jp/cgi-bin/output.sh" fetch -o $file $url &> /dev/null more $file |
Put this shell script as "/usr/local/apache2/cgi-bin/output.sh" on Opengate server. And set this URL to $url in script explained by the above.
#!/bin/sh ####################################### ## ## show opengate status for MRTG ## ## 1 line : IPv6 Users ## 2 line : Total Users ## 3 line : uptime ## 4 line : comment for data ## ####################################### LANG=C COLUMNS=256 export LANG export COLUMNS ### IPv6 prefix prefix="2001:2f8:22:801:" ###opengateprocessname process="opengatesrv.cgi" ###tmp file name tmp_all="/tmp/og_count_all.tmp" tmp_6="/tmp/og_count_6.tmp" ###################################################### psax | grep $process > $tmp_all COUNT = `wc-l $tmp_all | awk '{print $1}'` grep $prefix $tmp_all > $tmp_6 COUNT6=`wc -l $tmp_6 | awk '{print $1}'` UPTIME=`uptime | awk '{print $3$4}' | sed -e "s/,//g"` rm $tmp_all rm $tmp_6 echo "Content-type: text/plain; charset=iso-8859-1" echo echo "$COUNT6" echo "$COUNT" echo "$UPTIME" echo "Opengate User Counter" |
carry out "input.sh" shell script on another server and confirm that you can acquire the following data.
5 48 10days Opengate User Counter |
Confirm after setting was completed.
# /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg |
Various WARNING is output the first and second time.
There is some files in "WorkDir".
> ls -l -rw-r--r-- 1 root wheel 538 12 14 04:40 mrtg-l.png -rw-r--r-- 1 root wheel 414 12 14 04:40 mrtg-m.png -rw-r--r-- 1 root wheel 1759 12 14 04:40 mrtg-r.png -rw-r--r-- 1 root wheel 2941 12 20 15:15 opengate-day.png -rw-r--r-- 1 root wheel 2146 12 20 14:35 opengate-month.png -rw-r--r-- 1 root wheel 2867 12 20 14:55 opengate-week.png -rw-r--r-- 1 root wheel 1897 12 20 05:00 opengate-year.png -rw-r--r-- 1 root wheel 5961 12 20 15:15 opengate.html -rw-r--r-- 1 root wheel 48786 12 20 15:15 opengate.log -rw-r--r-- 1 root wheel 48784 12 20 15:10 opengate.old |
Add next line to "/etc/crontab".
*/5 * * * * root /usr/local/bin/mrtg /usr/local/etc/mrtg/opengate.cfg |
This is optional. At the abnormal termination of Opengate process, superfluous rule might be left bihind. Though it is very rare, a script dealing with the case is prepared in tools/rulechk. This script is compatible with Opengate Ver1.3.1 or later. This script compares the Opengate process list and the firewall rule list, and deletes the superfluous rules.