This article was written by John J. Rushford Jr. jjr@alisa.org Last modified 5/26/01

See also this ONLamp article.

To meet his requirements, I chose high speed DSL connections to the internet with the local phone company using their business class DSL service. The business class DSL service is low cost, roughly $100.00 per month, and provides 5 leased public static IP addresses with network bandwidth of 1 Mbits up and down.

For his two subnets, I chose two machines running FreeBSD 4.2-STABLE as firewall gateway machines for the two private subnets being built. In addition to the firewall functionality, the FreeBSD machines would act as his web server, mail server, and as a Samba server (see Figure 1). The gateway designated bsd1 would act as the primary domain controller for Windows, primary WINS server, and Windows master browser for the MS domain we shall call scanningcomp.

In the remainder of this document, bsd1 refers to the FreeBSD 4.2 machine with the private IP address 192.168.1.254 and bsd2 refers to the FreeBSD 4.2 machine with the private IP address 192.168.2.254. These private IP's are used to configure all private subnet services. The public IP's are only only used with external DNS registration and for connecting the endpoints of the VPN. For purposes of this document, the public IP addresses are 172.16.1.254 and 172.17.1.254.

Figure 1

All the Windows PC's were configured to obtain their IP addresses from bsd1 or bsd2 as appropriate using the DHCP server loaded on the two FreeBSD machines. The DHCP servers were configured only to run on the private network interfaces and in addition to providing the IP address to a PC it also provides the respective default route, the domain-name, the domain-name-servers (which are bsd1 at 192.168.1.254 and bsd2 at 192.168.2.254), broadcast-address, and netbios-name-servers 192.168.1.254.

bsd1 was configured to be the mail server for the domain with the appropriate DNS MX record set in the telephone companies DNS servers. Microsoft Outlook on all PC's is set to use bsd1, 192.168.1.254, as the SMTP and POP3 server. /usr/ports/mail/qpopper was loaded and configured on bsd1

Also, named was configured on both machines to provide DNS services where forwarding to the telephone companies DNS servers is used. Both bsd1 and bsd2 act as the primary DNS server for 1.168.192.in-addr.arpa and 2.168.192.in-addr.arpa as well as the domain name scanningcomp.com so that bsd1 may resolve and allow mail relaying from the PC's. The Cw flag was set in /etc/mail/sendmail.cf to scanningcomp.com and The /etc/mail/sendmail.cw file was also set to scanningcomp.com.

Managing user ids and other servers is done with Webmin which is loaded only on bsd1. The user id module on Webmin is configured so that the smbpasswd is set along with the unix password so that the two passwords are synchronized.

# IP security (crypto; define w/ IPSEC)
options	IPSEC
options	IPSEC_ESP
options	IPSEC_DEBUG

# Generic tunnel interface
pseudo-device	gif	4

# Berkeley packet filter used by dhcp server.
pseudo-device	bpf	4

# Firewall flags
options	IPFIREWALL
options	IPDIVERT
options	IPFILTER
options	IPFILTER_LOG

gateway_enable="YES"
defaultrouter="172.x.1.110"  # assigned by the telephone company
firewall_enable="YES"
firewall_type="open"
natd_enable="YES"
natd_interface="rl0"
named_enable="YES"

I found that I did not have to modify the default configuration file so, I left /usr/local/etc/racoon.conf untouched. I edited the key file, /usr/local/etc/racoon/psk.txt, and installed my private encryption keys:

# /usr/local/etc/racoon/psk.txt
# IPv4/v6 addresses
#
192.168.1.254	foobar
192.168.2.254	foobar

# chown root.wheel /usr/local/etc/racoon/psk.txt
# chmod 0600 /usr/local/etc/racoon/psk.txt

#!/bin/sh
#
# /etc/rc.local
#
# dhcp server
if [ -x /usr/local/sbin/dhcpd ]; then
   echo -n "dhcpd "
   /usr/local/sbin/dhcpd -cf /etc/dhcpd.conf rl1
fi
# webmin server
if [ -x /etc/webmin/start ]; then
   echo -n "webmin "
   /etc/webmin/start
fi
# racoon key exchange server
if [ -x /usr/local/sbin/racoon ]; then
   echo -n "racoon "
   /usr/local/sbin/racoon -f /usr/local/etc/racoon/racoon.conf
fi

#!/bin/sh
#
BSD1_IP="192.168.1.254"
BSD1_PUB_IP="172.16.1.254"
BSD1_NET="192.168.1.0/24"
BSD2_IP="192.168.2.254"
BSD2_PUB_IP="172.17.1.254"
BSD2_NET="192.168.2.0/24"
GIF0="gif0 inet"
GIFCONFIG="/usr/sbin/gifconfig"
IFCONFIG="/sbin/ifconfig"
HOSTNAME=`/bin/hostname`
NETMASK="255.255.255.0"

echo "\nStarting ipsec tunnel... "

case $HOSTNAME in
   bsd1.scanningcomp.com)
        $GIFCONFIG $GIF0 $BSD1_PUB_IP $BSD2_PUB_IP
        $IFCONFIG $GIF0 $BSD1_IP $BSD2_IP $NETMASK
        /usr/sbin/setkey -FP
        /usr/sbin/setkey -F
        /usr/sbin/setkey -c << EOF
        spdadd $BSD1_NET $BSD2_NET any -P out ipsec
         esp/tunnel/${BSD1_IP}-${BSD2_IP}/require;
        spdadd $BSD2_NET $BSD1_NET any -P in ipsec
         esp/tunnel/${BSD2_IP}-${BSD1_IP}/require;
EOF
         /sbin/route add $BSD2_NET $BSD1_IP
	 ;;
   bsd2.scanningcomp.com)
        $GIFCONFIG $GIF0 $BSD2_PUB_IP $BSD1_PUB_IP
        $IFCONFIG $GIF0 $BSD2_IP $BSD1_IP $NETMASK
        /usr/sbin/setkey -FP
        /usr/sbin/setkey -F
        /usr/sbin/setkey -c << EOF
        spdadd $BSD2_NET $BSD1_NET any -P out ipsec
         esp/tunnel/${BSD2_IP}-${BSD1_IP}/require;
        spdadd $BSD1_NET $BSD2_NET any -P in ipsec
         esp/tunnel/${BSD1_IP}-${BSD2_IP}/require;
EOF
         /sbin/route add $BSD1_NET $BSD2_IP
         ;;
esac

• "Teach Yourself Samba in 24 Hours"; by Gerald Carter with Richard Sharpe; Sams, 1999; ISBN 0-672-31609-9.
• "The Complete FreeBSD"; by Greg Lehey; Walnut Creek CDROM, 1999; ISBN 1-57176-246-9.