cd /usr/src/sys/`uname -m`/conf cp GENERIC CUSTOM
echo "device pf device pflog device pfsync" >> CUSTOM
options ALTQ options ALTQ_CBQ # Class Bases Queuing (CBQ) options ALTQ_RED # Random Early Detection (RED) options ALTQ_RIO # RED In/Out options ALTQ_HFSC # Hierarchical Packet Scheduler (HFSC) options ALTQ_PRIQ # Priority Queuing (PRIQ) options ALTQ_NOPCC # Required for SMP build
cd /usr/src make buildkernel KERNCONF=CUSTOM make installkernel KERNCONF=CUSTOM
shutdown -r now
dhclient fxp0 ifconfig fxp1 inet 192.168.0.1 netmask 255.255.255.0
for d in {if_ath,ath_rate,ath_hal}; do kldload $d; done
for d in {wlan_wep_load,wlan_tkip_load,wlan_ccmp_load,wlan_xauth_load,wlan_acl_load}; do kldload $d; done
ifconfig ath0 inet 192.168.1.1 netmask 255.255.255.0 ssid YOURSSID mediaopt hostap
sysctl -w net.inet.ip.forwarding=1 pfctl -e
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # This configuration is set for use on a machine that is a router with # three (3) network cards: # ext_if - connects to the upstream link (cable/dsl modem, WAN, etc.) # wifi_if - wireless card for internal network # (if none present, remove all references to it in this file) # lan_if - wired card for internal network # (if none present, remove all references to it in this file) # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #------------------------------------------------------------------------ # macros #------------------------------------------------------------------------ logopt = "log" # interfaces ext_if = "fxp0" wifi_if = "ath0" lan_if = "fxp1" # publically accesible services (transport layer neutral) pubserv = "{ 22, 443 }" # internally accessible services (transport layer neutral) lanserv = "{ 22, 53, 67, 80, 443 }" # samba ports (transport layer neutral) samba_ports = "{ 137, 138, 139 }" # externally permitted inbound icmp types icmp_types = "echoreq" # internal network lan_net = "{ 192.168.0.0/24, 192.168.1.0/24 }" # hosts granted acces to samba (cifs/smb) shares smb_net = "{ 192.168.0.0/27, 192.168.1.0/27, 192.168.0.90, 192.168.1.90 }" # block these networks table { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, \ 169.254.0.0/16, 172.16.0.0/12, 192.0.2.0/24, 192.168.0.0/16, \ 224.0.0.0/3, 255.255.255.255 } #------------------------------------------------------------------------ # options #------------------------------------------------------------------------ # config set block-policy return set loginterface $ext_if set skip on lo0 # scrub #scrub all reassemble tcp no-df #scrub in all fragment reassemble scrub out all random-id #------------------------------------------------------------------------ # redirection (and nat, too!) #------------------------------------------------------------------------ # network address translation nat on $ext_if from $lan_net to any -> ($ext_if) #------------------------------------------------------------------------ # firewall policy #------------------------------------------------------------------------ # restrictive default rules block all block return-rst in $logopt on $ext_if proto tcp all block return-icmp in $logopt on $ext_if proto udp all block in $logopt on $ext_if proto icmp all block out $logopt on $ext_if all # trust localhost pass in quick on lo0 all pass out quick on lo0 all # anti spoofing block drop in $logopt quick on $ext_if from to any block drop out $logopt quick on $ext_if from any to antispoof for { $lan_if, $wifi_if, $ext_if } # anti fake return-scans block return-rst out on $ext_if proto tcp all block return-rst in on $ext_if proto tcp all block return-icmp out on $ext_if proto udp all block return-icmp in on $ext_if proto udp all # toy with script kiddies scanning us block in $logopt quick proto tcp flags FUP/WEUAPRSF block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF block in $logopt quick proto tcp flags SRAFU/WEUAPRSF block in $logopt quick proto tcp flags /WEUAPRSF block in $logopt quick proto tcp flags SR/SR block in $logopt quick proto tcp flags SF/SF # open firewall fully # warning: insecure. 'nuff said. #pass in quick all #pass out quick all # allow permitted icmp pass in inet proto icmp all icmp-type $icmp_types keep state # allow permitted services pass in on $ext_if inet proto tcp from any to any port $pubserv flags S/SA keep state pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $lan_net to any port $lanserv keep state pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $smb_net to any port $samba_ports keep state # permit access between LAN hosts pass in from $lan_net to $lan_net keep state pass out from $lan_net to $lan_net keep state # permit full outbound access # warning: potentially insecure. you may wish to lock down outbound access. pass out from any to any keep state
pfctl -Fa -f /etc/pf.conf
pkg_add -r isc-dhcp3-server
### ### GLOBAL SETTINGS ### ddns-update-style none; always-broadcast on; default-lease-time 7200; max-lease-time 7200; authoritative; option domain-name-servers 192.168.1.1; option domain-name "localnet.localdomain"; option netbios-name-servers 192.168.1.1; ### ### WIRED LOCAL AREA NETWORK ### subnet 192.168.0.0 netmask 255.255.255.0 { # # NOTES: # (1) allocation of endings 100-199 by DHCP is # inteded for clients that are not specified # later in this file. # (2) allocation is done in increments of 10 # and this is done intentionally. # range 192.168.0.100 192.168.0.199; option broadcast-address 192.168.0.255; option subnet-mask 255.255.255.0; option routers 192.168.0.1; } ### ### WIRELESS NETWORK ### subnet 192.168.1.0 netmask 255.255.255.0 { # NOTE: See: wired->range.notes range 192.168.1.100 192.168.1.199; option broadcast-address 192.168.1.255; option subnet-mask 255.255.255.0; option routers 192.168.1.1; }
interface=ath0 driver=bsd logger_syslog=-1 logger_syslog_level=0 logger_stdout=-1 logger_stdout_level=0 debug=3 dump_file=/tmp/hostapd.dump ctrl_interface=/var/run/hostapd ctrl_interface_group=wheel #### IEEE 802.11 related config #### ssid=YOURSSID macaddr_acl=0 auth_algs=1 #### IEEE 802.1X related config #### ieee8021x=0 #### WPA/IEEE 802.11i config ##### wpa=1 wpa_passphrase=ENTER_YOUR_PASSPHRASE_HERE wpa_key_mgmt=WPA-PSK wpa_pairwise=CCMP TKIP
### GENERAL SETTINGS gateway_enable="YES" hostname="wifiap" ### CONFIGURATION FOR EXTERNAL INTERFACE (UPSTREAM LINK) ### example: link to cable/dsl modem ifconfig_fxp0="DHCP" ### CONFIGURATION FOR INTERNAL WIRED NETWORK ifconfig_fxp1="inet 192.168.0.1 netmask 255.255.255.0" ### CONFIGURATION FOR INTERNAL WIRELESS NETWORK ifconfig_ath0="inet 192.168.1.1 netmask 255.255.255.0 ssid YOURSSID mediaopt hostap" ### CONFIGURATION FOR PACKET FILTER ### requires kernel recompile, see: ### http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-pf.html pf_enable="YES" # Set to YES to enable packet filter (pf) pf_rules="/etc/pf.conf" # rules definition file for pf pf_program="/sbin/pfctl" # where the pfctl program lives pf_flags="" # additional flags for pfctl pflog_enable="YES" # Set to YES to enable packet filter logging pflog_logfile="/var/log/pflog" # where pflogd should store the logfile ### DAEMONS FOR LAN hostapd_enable="YES" # wireless services (clients use wpa_supplicant) named_enable="YES" # dns for clients dhcpd_enable="YES" # dhcp configure clients sshd_enable="YES" # so we can remotely access this box
wlan_wep_load="YES" wlan_tkip_load="YES" wlan_ccmp_load="YES" wlan_xauth_load="YES" wlan_acl_load="YES"
/etc/rc.d/pflog start /etc/rc.d/named start /etc/rc.d/dhcpd start /etc/rc.d/hostapd start
