PPP - Pedantic PPP Primer

Steve Sims

SimsS@IBM.net

This is a step-by-step guide for configuring FreeBSD systems to act as a dial-up router/gateway in a Local Area Environment. All entries may be assumed to be relevant to FreeBSD 2.2+, unless otherwise noted.


Table of Contents
Overview:
1 Building the Local Area Network
1.1 Typical Network Topology
1.2 Assumptions about the Local Area Network
2 FreeBSD System Configuration
2.1 Verifying the FreeBSD Host Name
2.1.1 Configuring the FreeBSD Host Name
2.2 Verifying the Ethernet Interface Configuration
2.2.1 Configuring your Ethernet Interface
2.3 Enabling Packet Forwarding
2.4 Creating the List of other LAN Hosts(/etc/hosts)
2.5 Testing the FreeBSD system
2.5.1 Verifying the operation of the loopback device
2.5.2 Verifying the operation of the Ethernet Device
3 Configuring the PPP Dial-Out Connection
3.1 Backing up the original PPP configuration files
3.2 Create your own PPP configuration files
3.2.1 The '/etc/ppp/ppp.conf' file
3.2.2 The '/etc/ppp/ppp.linkup' file
3.3 IP Aliasing
4 Configuring Windows Systems
4.1 Configuring Windows 95
4.2 Configuring Windows NT
4.3 Configuring Windows for Workgroups
5 Testing the Network
5.1 Testing the Dial-Up link:
5.2 Testing the Ethernet LAN
6 Exercises for the Interested Student
6.1 Creating a mini-DNS system
6.1.1 The /etc/namedb/named.boot file
6.1.2 The /etc/namedb/mydomain.db file
6.1.3 Starting the DNS Server
6.2 Playing with PPP filters

Overview:

The User-Mode PPP dialer in FreeBSD Version 2.2 (also known as: "IIJ-PPP" ) now supports Packet Aliasing for dial up connections to the Internet. This feature, also known as "Masquerading", "IP Aliasing", or "Network Address Translation", allows a FreeBSD system to act as a dial- on-demand router between an Ethernet-based Local Area Network and an Internet Service Provider. Systems on the LAN can use the FreeBSD system to forward information between the Internet by means of a single dial-connection.

This guide explains how to:



While the focus of this guide is to assist in configuring IP Aliasing, it also includes specific examples of the configuration steps necessary to configure and install each individual component; each section stands alone and may be used to assist in the configuration of various aspects of FreeBSD internetworking.


Chapter 1 Building the Local Area Network

While the ppp program can, and usually is, be configured to provide services to only the local FreeBSD box it can also be used to serve as a "Gateway" (or "router") between other LAN-connected resources and the Internet or other Dial-Up service.


1.1 Typical Network Topology

This guide assumes a typical Local Area Network lashed together as follows:

     
    +---------+       ----> Dial-Up Internet Connection
    | FreeBSD |       \       (i.e.: NetCom, AOL, AT&T, EarthLink,
    etc)
    |         |--------
    | "Curly" |
    |         |
    +----+----+
         |
    |----+-------------+-------------+----|  <-- Ethernet Network
         |             |             |
         |             |             |
    +----+----+   +----+----+   +----+----+
    |         |   |         |   |         |
    |  Win95  |   |   WFW   |   |  WinNT  |
    | "Larry" |   |  "Moe"  |   | "Shemp" |
    |         |   |         |   |         |
    +---------+   +---------+   +---------+



1.2 Assumptions about the Local Area Network

Some specific assumptions about this sample network are:

Three workstations and a Server are connected with Ethernet cabling:

  • a FreeBSD Server ("Curly") with an NE-2000 adapter configured as 'ed0'

  • a Windows-95 workstation ("Larry") with Microsoft's "native" 32-bit TCP/IP drivers

  • a Windows for Workgroups workstation ("Moe") with Microsoft's 16-bit TCP/IP extensions

  • a Windows NT workstation ("Shemp") with Microsoft's "native" 32-bit TCP/IP drivers



The IP addresses on the Ethernet side of this sample LAN have been taken from a pool addresses proposed reserved by RFC 1918 for use on private LANs, so you are free to use these actual IP addresses on your own LAN if you want. IP addresses are assigned as follows:

Name IP Address Comment
Curly 192.168.1.1 The FreeBSD box
Larry 192.168.1.2 The Win'95 box
Moe 192.168.1.3 The WfW box
Shemp 192.168.1.4 The Windows NT box

This guide assumes that the modem on the FreeBSD box is connected to the first serial port ('/dev/cuaa0' or 'COM1' in DOS-terms).

Finally, we will also assume that your Internet Service Provider (ISP) automatically provides the IP addresses of both your PPP/FreeBSD side as well as the ISP's side. (i.e.: Dynamic IP Addresses on both ends of the link.) Specific details for configuring the Dial-Out side of PPP will be addressed in Section 2, "Configuring the FreeBSD System".


Chapter 2 FreeBSD System Configuration

There are three basic pieces of information that must be known to the FreeBSD box before you can proceed with integrating the sample Local Area Network:



If you performed the installation of FreeBSD over a network connection some of this information may already be configured into your FreeBSD system.

Even if you believe that the FreeBSD system was properly configured when it was installed you should at least verify each of these bits of information to prevent trouble in subsequent steps.


2.1 Verifying the FreeBSD Host Name

It is possible that the FreeBSD host name was specified and saved when the system was initially installed. To verify that it was, enter the following command at a prompt:

    # hostname


The name of the host FreeBSD system will be displayed on a single line. If the name looks correct (this is very subjective :-) skip ahead to Section 2.2.

For example, in our sample network, we would see 'curly.my.domain' as a result of the `hostname` command if the name had been set correctly during, or after, installation. (At this point, do not worry too much about the ".my.domain" part, we will sort this out later. The important part is the name up to the first dot.)

If a host name was not specified when FreeBSD was installed you will probably see 'myname.my.domain` as a response. You will need to edit /etc/rc.conf to set the name of the machine.


2.1.1 Configuring the FreeBSD Host Name

Reminder: You must be logged in as 'root' to edit the system configuration files!

CAUTION: If you mangle the system configuration files, chances are your system WILL NOT BOOT correctly! Be careful!

The configuration file that specifies the FreeBSD system's host name when the system boots is in /etc/rc.conf. Use the default text editor ('ee') to edit this file.

Logged in as user 'root' load /etc/rc.conf into the editor with the following command:

    # ee /etc/rc.conf


Using the arrow keys, scroll down until you find the line that specifies the host name of the FreeBSD system. By default, this section says:

    ---
    ### Basic network options: ###
    hostname="myname.my.domain" # Set this!
    ---
Change this section to say (in our example):
    ---
    ### Basic network options: ###
    hostname="curly.my.domain"  # Set this!
    ---


Once the change to the host name has been made, press the 'Esc' key to access the command menu. Select "leave editor" and make sure to specify "save changes" when prompted.


2.2 Verifying the Ethernet Interface Configuration

To reiterate our basic assumption, this guide assumes that the Ethernet Interface in the FreeBSD system is named 'ed0'. This is the default for NE-1000, NE-2000, WD/SMC models 8003, 8013 and Elite Ultra (8216) network adapters.

Other models of network adapters may have different device names in FreeBSD. Check the FAQ for specifics about your network adapter. If you are not sure of the device name of your adapter, check the FreeBSD FAQ to determine the device name for the card you have and substitute that name (i.e.: 'de0', 'zp0', or similar) in the following steps.

As was the case with the host name, the configuration for the FreeBSD system's Ethernet Interface may have been specified when the system was installed.

To display the configuration for the interfaces in your FreeBSD system (Ethernet and others), enter the following command:

    # ifconfig -a
(In layman's terms: "Show me the InterFace CONFIGuration for my network devices.")

An example:

    # ifconfig -a
     ed0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu
    1500
          inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255
          ether 01:02:03:04:05:06
     lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
     tun0: flags=8050<POINTOPOINT,RUNNING, MULTICAST> mtu 1500
     sl0: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 552
     ppp0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500
     lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
          inet 127.0.0.1 netmask 0xff000000
    # _


In this example, the following devices were displayed:

ed0: The Ethernet Interface

lp0: The Parallel Port Interface (ignored in this guide)

tun0: The "tunnel" device; This is the one user-mode ppp uses!

sl0: The SL/IP device (ignored in this guide)

ppp0: Another PPP device (for kernel ppp; ignored in this guide)

lo0: The "Loopback" device (ignored in this guide)

In this example, the 'ed0' device is up and running. The key indicators are:

  1. Its status is "UP",

  2. It has an Internet ("inet") address, (in this case, 192.168.1.1)

  3. It has a valid Subnet Mask ("netmask"; 0xffffff00 is the same as 255.255.255.0), and

  4. It has a valid broadcast address (in this case, 192.168.1.255).



If the line for the Ethernet card had shown something similar to:

    ed0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
            ether 01:02:03:04:05:06
then the Ethernet card has not been configured yet.

If the configuration for the Ethernet interface is correct you can skip forward to Section 2.4.


2.2.1 Configuring your Ethernet Interface

Reminder: You must be logged in as 'root' to edit the system configuration files!

CAUTION: If you mangle the system configuration files, chances are your system WILL NOT BOOT correctly! Be careful!

The configuration file that specifies settings for the network interfaces when the system boots is in /etc/rc.conf. Use the default text editor ('ee') to edit this file.

Logged in as user 'root' load /etc/rc.conf into the editor with the following command:

# ee /etc/rc.conf

About 20 lines from the top of /etc/rc.conf is the section that describes which network interfaces should be activated when the system boots. In the default configuration file the specific line that controls this is:

    network_interfaces="lo0"       # List of network interfaces (lo0 is loopback).


You will need to amend this line to tell FreeBSD that you want to add another device, namely the 'ed0' device. Change this line to read:

    network_interfaces="lo0 ed0"   # List of network interfaces (lo0 is loopback).


(Note the space between the definition for the loopback device ("lo0") and the Ethernet device ("ed0")!

Reminder: If your Ethernet card is not named 'ed0', specify the correct device name here instead.

If you performed the installation of FreeBSD over a network connection then the 'network_interfaces=' line may already include a reference to your Ethernet adapter. If it is, verify that it is the correct device name.

Specify the Interface Settings for the Ethernet device ('ed0'):

Beneath the line that specifies which interfaces should be activated are the lines that specify the actual settings for each interface. In the default /etc/rc.conf file is a single line that says:

    ifconfig_lo0="inet 127.0.0.1"   # default loopback device configuration.


You will need to add another line after that to specify the settings for your 'ed0' device.

If you performed the installation of FreeBSD over a network connection then there may already be an 'ifconfig_ed0=' line after the loopback definition. If so, verify that it has the correct values.

For our sample configuration we will insert a line immediately after the loopback device definition that says:

    ifconfig_ed0="inet 192.168.1.1 netmask 255.255.255.0"


When you have finished editing /etc/rc.conf to specify and configure the network interfaces the section should look really close to:

    ---
    network_interfaces="ed1 lo0"    # List of network interfaces (lo0 is loopback).
    ifconfig_lo0="inet 127.0.0.1"   # default loopback device configuration.
    ifconfig_ed1="inet 192.168.1.1  netmask 255.255.255.0"
    ---


Once all of the necessary changes to /etc/rc.conf have been made, press the 'Esc' key to invoke the control menu. Select "leave editor" and be sure to select "save changes" when prompted.


2.3 Enabling Packet Forwarding

By default the FreeBSD system will not forward IP packets between various network interfaces. In other words, routing functions (also known as gateway functions) are disabled.

If your intent is to use a FreeBSD system as stand-alone Internet workstation and not as a gateway between LAN nodes and your ISP you should skip forward to Section 2.4.

If you intend for the PPP program to service the local FreeBSD box as well as LAN workstations (as a router) you will need to enable IP forwarding.

To enable IP Packet forwarding you will need to edit the /etc/rc.conf file.

This file contains overrides of the defaults in /etc/defaults/rc.conf. The default gateway setting is controlled by the line

    gateway_enable="NO"

in that file. To override it, add a line like

    gateway_enable="YES"

/etc/rc.conf.

NOTE: This line may already be set to 'gateway_enable="YES"' if IP forwarding was enabled when the FreeBSD system was installed.


2.4 Creating the List of other LAN Hosts(/etc/hosts)

The final step in configuring the LAN side of the FreeBSD system is to create a list of the names and TCP/IP addresses of the various systems that are connected to the Local Area Network. This list is stored in the '/etc/hosts' file.

The default version of this file has only a single host name listing in it: the name and address of the loopback device ('lo0'). By networking convention, this device is always named "localhost" and always has an IP address of 127.0.0.1. Section 2.2.

To edit the /etc/hosts file enter the following command:

     # ee /etc/hosts


Scroll all the way to the bottom of the file (paying attention to the comments along the way; there is some good information there!) and enter (assuming our sample network) the following IP addresses and host names:

    192.168.1.1    curly  curly.my.domain  # FreeBSD System
    192.168.1.2    larry  larry.my.domain  # Windows '95 System
    192.168.1.3    moe    moe.my.domain    # Windows for Workgroups
    System
    192.168.1.4    shemp  shemp.my.domain  # Windows NT System


(No changes are needed to the line for the '127.0.0.1 localhost' entry.)

Once you have entered these lines, press the 'Esc' key to invoke the control menu. Select "leave editor" and be sure to select "save changes" when prompted.


2.5 Testing the FreeBSD system

Congratulations! Once you have made it to this point, the FreeBSD system is configured as a network-connected Unix system! If you made any changes to the /etc/rc.conf file you should probably re-boot your FreeBSD system. This will accomplish two important objectives:

  • Allow the changes to the interface configurations to be applied, and

  • Verify that the system restarts without any glaring configuration errors.



Once the system has been rebooted you should test the network interfaces.


2.5.1 Verifying the operation of the loopback device

To verify that the loopback device is configured correctly, log in as 'root' and enter:

    # ping localhost


You should see:

    # ping localhost
    PING localhost.my.domain. (127.0.0.1): 56 data bytes
    64 bytes from 127.0.0.1: icmp_seq=0 ttl=255 time=0.219 ms
    64 bytes from 127.0.0.1: icmp_seq=1 ttl=255 time=0.287 ms
    64 bytes from 127.0.0.1: icmp_seq=2 ttl=255 time=0.214 m
    [...]
messages scroll by until you hit Ctrl-C to stop the madness.


2.5.2 Verifying the operation of the Ethernet Device

To verify that the Ethernet device is configured correctly, enter:

    # ping curly


You should see:

    # ping curly
    PING curly.my.domain. (192.168.1.1): 56 data bytes
    64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=0.219 ms
    64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=0.200 ms
    64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=0.187 ms
    [...]
messages.

One important thing to look at in these two examples is that the names (loopback and curly) correctly correlate to their IP addresses (127.0.0.1 and 192.168.1.1). This verifies that the /etc/hosts files is correct.

If the IP address for "curly" is not 192.168.1.1 or the address for "localhost" is not 127.0.0.1, return to Section 2.4 and review your entries in '/etc/hosts'.

If the names and addresses are indicated correctly in the result of the ping command but there are errors displayed then something is amiss with the interface configuration(s). Return to Chapter 2 and verify everything again.

If everything here checks out, proceed with the next section.


Chapter 3 Configuring the PPP Dial-Out Connection

There are two basic modes of operation of the ppp driver: "Interactive" and "Automatic".

In Interactive mode you:



In Automatic mode, the PPP program silently watches what goes on inside the FreeBSD system and automagically connects and disconnects with your ISP as required to make the Internet a seamless element of your network.

In this section we will address the configuration(s) for both modes with emphasis on configuring your `ppp` environment to operate in "Automatic" mode.


3.1 Backing up the original PPP configuration files

Note: More recent versions of FreeBSD have the examples files in /usr/share/examples/ppp, so this step may not be necessary.

Before making any changes to the files which are used by PPP you should make a copy of the default files that were created when the FreeBSD system was installed.

Log in as the 'root' user and perform the following steps:

Change to the '/etc directory:

# cd /etc

Make a backup copy the original files in the 'ppp' directory:

# cp -R ppp ppp.ORIGINAL

You should now be able to see both a 'ppp' and a 'ppp.ORIGINAL' subdirectory in the '/etc' directory.


3.2 Create your own PPP configuration files

By default, the FreeBSD installation process creates a number of sample configuration files in the /etc/ppp and /usr/share/examples/ppp directories. Please take some time to review these files; they were derived from working systems and represent the features and capabilities of the PPP program.

You are strongly encouraged to learn from these sample files and apply them to your own configuration as necessary.

For detailed information about the `ppp` program, read the ppp manpage:

    # man ppp


For detailed information about the `chat` scripting language used by the PPP dialer, read the chat manpage:

    # man chat


The remainder of this section describes the recommended contents of the PPP configuration files.


3.2.1 The '/etc/ppp/ppp.conf' file

The '/etc/ppp/ppp.conf' file contains the information and settings required to set up a dial-out PPP connection. More than one configuration may be contained in this file. The FreeBSD handbook (XXX URL? XXX) describes the contents and syntax of this file in detail.

This section will describe only the minimal configuration to get a dial-out connection working.

Below is the /etc/ppp/ppp.conf file that we will be using to provide a dial-out Internet gateway for our example LAN:

Note: The full syntax for ppp.conf is described in ppp(8). Particularly, note that any line that is not a label that ends with a colon (e.g., default:, interactive:), a command that begins with ``!'' (e.g., !include), or a comment must be indented!

    ################################################################
    # PPP Configuration File ('/etc/ppp/ppp.conf')
    #
    # Default settings; These are always executed always when PPP
    # is invoked and apply to all system configurations.
    ################################################################
    default:
      set device /dev/cuaa0
      set speed 57600
      disable pred1
      deny pred1
      disable lqr
      deny lqr
      set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0 OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT"
      set redial 3 10
    #
    #
    ################################################################
    #
    # For interactive mode use this configuration:
    #
    # Invoke with `ppp -alias interactive`
    #
    ################################################################
    interactive:
      set authname Your_User_ID_On_Remote_System
      set authkey Your_Password_On_Remote_System
      set phone 1-800-123-4567
      set timeout 300
      set openmode active
      accept chap
    #
    ################################################################
    #
    # For demand-dial (automatic) mode we'll use this configuration:
    #
    # Invoke with: 'ppp -auto -alias demand'
    #
    ################################################################
    demand:
      set authname Your_User_ID_On_Remote_System
      set authkey Your_Password_On_Remote_System
      set phone 1-800-123-4567
      set timeout 300
      set openmode active
      accept chap
      set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0
      add 0 0 127.2.2.2
    ################################################################
    # End of /etc/ppp/ppp.conf
This file, taken verbatim from a working system, has three relevant configuration sections:


3.2.1.1 The "default" Section

The 'default:' section contains the values and settings used by every other section in the file. Essentially, this section is implicitly added to the configuration lines to each other section.

This is a good place to put "global defaults" applicable to all dial-up sessions; especially modem settings and dialing prefixes which typically do not change based on which destination system you are connecting to.

Following are the descriptions of each line in the "default" section of the sample '/etc/ppp/ppp.conf' file:

    set device /dev/cuaa0
This statement informs the PPP program that it should use the first serial port. Under FreeBSD the '/dev/cuaa0' device is the same port that's known as "COM1" under DOS, Windows, Windows 95, etc....

If your modem is on COM2 you should specify '/dev/cuaa1; COM3 would be '/dev/cuaa2'.

    set speed 57600


This line sets the transmit and receive speed for the connection between the serial port and the modem. While the modem used for this configuration is only a 28.8 device, setting this value to 57600 lets the serial link run at a higher rate to accommodate higher throughput as a result of the data compression built into late-model modems.

If you have trouble communicating with your modem, try setting this value to 38400 or even as low as 19200.

    disable pred1
    deny pred1


These two lines disable the "CCP/Predictor type 1" compression features of the PPP program. The current version of `ppp` supports data compression in accordance with draft Internet standards. Unfortunately many ISPs use equipment that does not support this capability. Since most modems try to perform on-the-fly compression anyway you are probably not losing much performance by disabling this feature on the FreeBSD side and denying the remote side from forcing it on you.

    disable lqr
    deny lqr


These two lines control the "Line Quality Reporting" functions which are part of the complete Point-to-Point (PPP) protocol specification. (See RFC-1989 for details.)

The first line, "disable lqr", instructs the PPP program to not attempt to report line quality status to the device on the remote end.

The second line, "deny lqr", instructs the PPP program to deny any attempts by the remote end to reports line quality.

As most modern dial-up modems have automatic error correction and detection and LQR reporting is not fully implemented in many vendor's products it is generally a safe bet to include these two lines in the default configuration.

    set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0
    OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT"


NOTE: (This statement should appear on a single line; ignore any line wrapping that may appear in this document.)

This line instructs the PPP program how to dial the modem and specifies some rudimentary guidelines for doing so:

  • Attempts to dial should fail if the modem returns a "BUSY" result code,

  • Attempts to dial should also fail if the modem returns a "NO CARRIER" result code,

  • The PPP program should expect each of the following events to complete within a 5-second timeout period:

    • The PPP program will initially expect nothing (specified above by the \"\" portion of the statement) from the modem

    • The program will send the modem initialization string "ATE1Q0M0" to the modem and await a response of "OK". If a response is not received, the program should send an attention command to the modem ("AT") and look again for a response of "OK",

    • The program should delay for one second (specified by the "\\d" part of the statement, and send the dialing string to the modem. The "ATDT" portion of the statement is the standard modem prefix to dial using tone-dialing; if you do not have touch-tone service on your local phone line, replace the "ATDT" with "ATDP". The "\\T" string is a placeholder for the actual phone number (which will be automatically inserted as specified by the "set dial 123-4567").



  • Finally, before a (maximum) timeout of 40 seconds, the PPP program should expect to see a "CONNECT" result code returned from the modem.



A failure at any point in this dialog will be interpreted as a dialing failure and the PPP program will fail to connect.

(For a detailed description of the mini-scripting language used by the PPP dialer, refer to the "chat" manpage.)

    set redial 3 10
This line specifies that if a dial connection cannot immediately be made the PPP program should retry (up to 3 times if necessary) with a delay of 10 seconds between redialing attempts.


3.2.1.2 The "interactive" Section

The 'interactive:' section contains the values and settings used to set up an "interactive" PPP session with a specific remote system. Settings in this section will have the lines included in the "default" section included automatically.

The example cited in this section of the guide presumes that you will be connecting to a remote system that understands how to authenticate a user without any fancy scripting language. That is, this sample uses the CHAP protocol to set up the connection.

A good rule of thumb is that if the Windows '95 dialer can set up a connection by just clicking the "Connect" button this sample configuration should work OK.

If, on the other hand, when you connect to your ISP using Microsoft Windows '95 Dial-Up Networking you need to resort to using the "Dial Up Scripting Tool" from the Microsoft Plus! pack or you have to select "Bring up a terminal windows after dialing" in the Windows '95 connection options then you will need to look at the sample PPP configuration files and the ppp manpage for examples of "expect / response" scripting to make your ISP connection. The "set login" command is used for this purpose.

Or even better, find an ISP who knows how to provide PAP or CHAP authentication!

The configuration examples shown here have been successfully used to connect to:



Following are descriptions for each line in the "interactive" section of the sample '/etc/ppp/ppp.conf' file:

    set authname Your_User_ID_On_Remote_System
This line specifies the name you would use to log in to the remote system.

    set authkey Your_Password_On_Remote_System
This is the password you would use to log in to the remote system.

    set phone 1-800-123-4567
This is the phone number of the remote system. If you are inside a PBX you can prepend '9, ' to the number here.

    set timeout 300
This tells the PPP program that it should automatically hang up the phone if no data has be exchanged for 300 seconds (5 minutes). You may wish to tailor this number to your specific requirements.

    set openmode active
This tells the PPP program that once the modems are connected it should immediately attempt to negotiate the connection. Some remote sites do this automatically, some do not. This instructs your side of the link to take the initiative and try to set up the connection.

    accept chap

This tells the PPP program to use the "Challenge-Handshake Authentication Protocol" to authenticate you. The values exchanged between the local and remote side for UserID and password are taken from the 'authname' and 'authkey' entries above.


3.2.1.3 The "demand" Section

The "demand" section contains the values and settings used to set up a "Dial-on-demand" PPP session with a specific remote system. Settings in this section will also have the lines included in the "default" section included automatically.

Except for the last two lines in this section it is identical to the configuration section which defines the "interactive" configuration.

As noted earlier, the examples cited in this section of the guide presume that you will be connecting to a remote system that understands how to use the CHAP protocol to set up the connection.

Following are descriptions for each line in the "demand" section of the sample '/etc/ppp/ppp.conf' file:

    set authname Your_User_ID_On_Remote_System
This line specifies the name you would use to log in to the remote system.

    set authkey Your_Password_On_Remote_System
This is the password you would use to log in to the remote system.

    set phone 1-800-123-4567
This is the phone number of the remote system.

    set timeout 300


This tells the PPP program that it should automatically hang up the phone if no data has be exchanged for 300 seconds (5 minutes). You may wish to tailor this number to your specific requirements.

    set openmode active


This tells the PPP program that once the modems are connected it should immediately attempt to negotiate the connection. Some remote sites do this automatically, some do not. This instructs your side of the link to take the initiative and try to set up the connection.

    accept chap


This tells the PPP program to use the "Challenge-Handshake Authentication Protocol" to authenticate you. The values exchanged between the local and remote side for UserID and password are taken from the 'authname' and 'authkey' entries above.

    set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0


This command sets up a pair of "fake" IP addresses for the local and remote sides of the PPP link. It instructs the PPP program to create an IP address of 127.1.1.1 for the local side of the 'tun0' (tunnel) device and 127.2.2.2 for the remote side. Appending '/0' to each address tells the PPP program that zero of the bits that make up these addresses are significant and can (in fact, must!) be negotiated between the local and remote systems when the link is established. The 255.255.255.0 string tells the PPP program what Subnet mask to apply to these pseudo-interfaces.

Remember, we have assumed that your ISP provides the IP addresses for both ends of the link! If your ISP assigned you a specific IP address that you should use on your side when configuring your system, enter that IP address here instead of 127.1.1.1.

Conversely, if your ISP gave you a specific IP address that he uses on his end you should enter that IP address here instead of 127.2.2.2.

In both cases, it is probably a good idea to leave the '/0' on the end of each address. This gives the PPP program the opportunity to change the address(es) of the link if it has to.

    add 0 0 127.2.2.2


This last line tells the PPP program that it should add a default route for IP traffic that points to the (fake) IP address of the ISP's system.

Note: If you used an ISP-specified address instead of 127.2.2.2 on the preceding line, use the same number here instead of 127.2.2.2.

By adding this "fake" route for IP traffic, the PPP program can, while idle:

  • Accept packets that FreeBSD does not already know how to forward,

  • Establish a connection to the ISP "on-the-fly",

  • Reconfigure the IP addresses of the local and remote side of the link,

  • Forward packets between your workstation and the ISP.

automatically!

Once the number of seconds specified by the timeout value in the "default" section have elapsed without any TCP/IP traffic the PPP program will automatically close the dial-up connection and the process will begin again.


3.2.2 The '/etc/ppp/ppp.linkup' file

The other file needed to complete the PPP configuration is found in '/etc/ppp/ppp.linkup'. This file contains instructions for the PPP program on what actions to take after a dial-up link is established.

In the case of dial-on-demand configurations the PPP program will need to delete the default route that was created to the fake IP address of the remote side (127.2.2.2 in our example in the previous section) and install a new default route that points the actual IP address of the remote end (discovered during the dial-up connection setup).

A representative '/etc/ppp/ppp.linkup' file:

    #########################################################################=
    
    # PPP Link Up File ('/etc/ppp/ppp.linkup')
    #
    #  This file is checked after PPP establishes a network connection.
    # 
    #  This file is searched in the following order.
    #
    #  1) First, the IP address assigned to us is searched and
    #     the associated command(s) are executed.
    #
    #  2) If the IP Address is not found, then the label name specified at
    
    #     PPP startup time is searched and the associated command(s) 
    #     are executed.
    #
    #  3) If neither of the above are found then commands under the label
    #     'MYADDR:' are executed.
    #
    #########################################################################=
    
    #
    # This section is used for the "demand" configuration in
    #   /etc/ppp/ppp.conf:
    demand:
     delete ALL
     add 0 0 HISADDR
    #
    # All other configurations in /etc/ppp/ppp.conf use this:
    #
    MYADDR:
     add 0 0 HISADDR
    ########################################################################
    # End of /etc/ppp/ppp.linkup
Notice that there is a section in this file named "demand:", identical to the configuration name used in the '/etc/ppp/ppp.conf' file. This section instructs the PPP program that once a link is established using this configuration, it must:
  1. Remove any IP routing information that the PPP program has created

  2. Add a default route the remote end's actual address.



It is critical that those configurations in '/etc/ppp/ppp.conf' which include the 'set ifaddr' and 'add 0 0' statements (i.e.: those configurations used for Dial-on-Demand configurations) execute the "delete ALL" and "add 0 0 HISADDR" commands in /etc/ppp/ppp.linkup.

This is the mechanism that controls the actual on-demand configuration of the link.

All configurations not explicitly named in /etc/ppp/ppp.linkup will use whatever commands are in the "MYADDR:" section of the file. This is where non-Demand-Dial configurations (such as our "interactive:" sample) will fall through to. This section simply adds a default route to the ISP's IP address (at the remote end).


3.3 IP Aliasing

All of the configuration steps described thus far are relevant to any FreeBSD system which will be used to connect to an ISP via dial-up connection.

If your sole objective in reading this guide is to connect your FreeBSD box to the Internet using dial-out ppp you can proceed to Chapter 5.

One very attractive feature of the PPP program in on-demand mode is its ability to route IP traffic between other systems on the Local Area Network automatically. This feature is known by various names, "IP Aliasing", "Network Address Translation", "Address Masquerading" or "Transparent Proxying".

Regardless of the terminology used, this mode is not, however, automatic. If the PPP program is started normally then the program will not forward packets between LAN interface(s) and the dial-out connection. In effect, only the FreeBSD system is connected to the ISP; other workstations cannot "share" the same connection.

For example, if the program is started with either of the following command lines:

# ppp interactive (Interactive mode)

or

# ppp -auto demand (Dial-on-Demand mode)

then the system will function as an Internet-connected workstation only for the FreeBSD box.

To start the PPP program as a gateway between LAN resources and the Internet, one of the following command lines would be used instead:

# ppp -alias interactive (Interactive mode)

or

# ppp -auto -alias demand (Dial-on-Demand mode)

You can alternatively use the command ``alias enable yes'' in your ppp configuration file (refer to the manual page for details).

Keep this in mind if you intend to proceed with Chapter 4.


Chapter 4 Configuring Windows Systems

As indicated in Section 1, our example network consists of a FreeBSD system ("Curly") which acts as a gateway (or router) between a Local Area Network consisting of two different flavors of Windows Workstations. In order for the LAN nodes to use Curly as a router they need to be properly configured. Note that this section does not explain how to configure the Windows workstations for Dial-Up networking. If you need a good explanation of that procedure, I recommend http://www.aladdin.co.uk/techweb/.


4.1 Configuring Windows 95

Configuring Windows 95 to act as an attached resource on your LAN is relatively simple. The Windows 95 network configuration must be slightly modified to use the FreeBSD system as the default gateway to the ISP. Perform the following steps:

Create the Windows 95 "hosts" file:

In order to connect to the other TCP/IP systems on the LAN you will need to create an identical copy of the "hosts" file that you installed on the FreeBSD system in Section 2.4.

  • Click the "Start" button; select "Run..."; enter "notepad \WINDOWS\HOSTS" (without the quotes) and click "OK"

  • In the editor, enter the addresses and system names from the hosts file shown in Section 2.4.

  • When finished editing, close the notepad application (making sure that you save the file!).



Configure the Windows 95 TCP/IP Network Configuration settings:

  • Click the "Start" button on the taskbar; select "Settings" and "Control Panel".

  • Double-click the "Network" icon to open it.

    The settings for all Network Elements are displayed.

  • With the "Configuration" tab selected, scroll down the list of installed components and highlight the "TCP/IP->YourInterfaceType" line (where "YourInterfaceType" is the name or type of Ethernet adapter in your system).

    If TCP/IP is not listed in the list of installed network components, click the "Add" button and install it before proceeding.

    (Hint: "Add | Protocol | Microsoft | TCP/IP | OK")

  • Click on the "Properties" button to display a list of the settings associated with the TCP component.



Configure the IP Address Information:

  • Click the "IP Address" tab

  • Click the "Specify an IP address" radio button.

    (In our example LAN the Windows 95 system is the one we have called "Larry".)

  • In the "IP Address" field enter "192.168.1.2".

  • Enter 255.255.255.0 in the "Subnet Mask" field.



Configure the Gateway information:

  • Click on the "Gateway" tab

    For our example network the FreeBSD box will be acting as our gateway to the Internet (routing packets between the Ethernet LAN and the PPP dial-up connection. Enter the IP address of the FreeBSD Ethernet interface, 192.168.1.1, in the "New gateway" field and click the "Add" button. If any other gateways are defined in the "Installed gateways" list you may wish to consider removing them.



Configure the DNS Information:

This guide assumes that your Internet Service Provider has given you a list of Domain Name Servers (or "DNS Servers") that you should use. If you wish to run a DNS server on your local FreeBSD system, refer to Section 6, "Exercise for the Interested Student" for tips on setting up DNS on your FreeBSD system.

  • Click the "DNS Configuration" tab

  • Make sure that the "Enable DNS" radio button is selected.

    (If this button is not selected only the entries that we put in the host file(s) will be available and your Net-Surfing will not work as you expect!)

  • In the "Host" field enter the name of the Windows 95 box, in this case: "Larry".

  • In the "Domain" field enter the name of our local network, in this case: "my.domain"

  • In the "DNS Server Search Order" section, enter the IP address of the DNS server(s) that your ISP provided, clicking the "Add" button after every address is entered. Repeat this step as many times as necessary to add all of the addresses that your ISP provided.



Other Windows 95 TCP/IP options:

For our purposes the settings under the "Advanced", "WINS Configuration" and "Bindings" tabs are not necessary.

If you wish to use the Windows Internet Naming Service ("WINS") your attention is invited to http://www.localnet.org/ for more information about WINS settings, specifically regarding sharing files transparently across the Internet.

Mopping up:

  • Click on the "OK" button to close the TCP/IP Properties window.

  • Click on the "OK" button to close the Network Control Panel.

  • Reboot your computer if prompted to do so.



That is it!


4.2 Configuring Windows NT

Configuring Windows NT to act as a LAN resource is also relatively straightforward. The procedures for configuring Windows NT are similar to Windows 95 with minor exceptions in the user interface.

The steps shown here are appropriate for a Windows NT 4.0 Workstation, but the principles are the same for NT 3.5x. You may wish to refer to the "Configuring Windows for Workgroups" section if you are configuring Windows NT 3.5x, since the user interface is the same for NT 3.5 and WfW.

Perform the following steps:

Create the Windows NT "hosts" file:

In order to connect to the other TCP/IP systems on the LAN you will need to create an identical copy of the "hosts" file that you installed on the FreeBSD system in Section 3.4

  • Click the "Start" button; select "Run..."; enter "notepad \WINNT\SYSTEM32\DRIVERS\ETC\HOSTS" (without the quotes) and click "OK"

  • In the editor, enter the addresses and system names from Section 3.4.

  • When finished editing, close the notepad application (making sure that you save the file!).



Configure the Windows NT TCP/IP Network Configuration settings:

  • Click the "Start" button on the taskbar; select "Settings" and "Control Panel".

  • Double-click the "Network" icon to open it.

  • With the "Identification" tab selected, verify the "Computer Name" and "Workgroup" fields. In this example we will use "Shemp" for the name and "Stooges" for the workgroup. Click the "Change" button and amend these entries as necessary.

  • Select the "Protocols" tab.

    The installed Network Protocols will be displayed. There may be a number of protocols listed but the one of interest to this guide is the "TCP/IP Protocol". If "TCP/IP Protocol" is not listed, click the "Add" button to load it.

    (Hint: "Add | TCP/IP Protocol | OK")

  • Highlight "TCP/IP Protocol" and click the "Properties" button.

    Tabs for specifying various settings for TCP/IP will be displayed.



Configuring the IP Address:

Make sure that the Ethernet Interface is shown in the "Adapter" box; if not, scroll through the list of adapters until the correct interface is shown.

  • Click the "Specify an IP address" radio button to enable the three text boxes.

    In our example LAN the Windows NT system is the one we have called "Shemp"

  • In the "IP Address" field enter "192.168.1.4".

  • Enter 255.255.255.0 in the "Subnet Mask" field.



Configure the Gateway information:

For our example network the FreeBSD box will be acting as our gateway to the Internet (routing packets between the Ethernet LAN and the PPP dial-up connection.

  • Enter the IP address of the FreeBSD Ethernet interface, 192.168.1.1, in the "New gateway" field and click the "Add" button.

    If any other gateways are defined in the "Installed gateways" list you may wish to consider removing them.



Configuring DNS:

Again, this guide assumes that your Internet Service Provider has given you a list of Domain Name Servers (or "DNS Servers") that you should use.

If you wish to run a DNS server on your local FreeBSD system, refer to Section 6, "Exercise for the Interested Student" for tips on setting up DNS on your FreeBSD system.

  • Click the "DNS" tab

  • In the "Host Name" field enter the name of the Windows NT box, in this case: "Shemp".

  • In the "Domain" field enter the name of our local network, in this case: "my.domain"

  • In the "DNS Server Search Order" section, enter the IP address of the DNS server that your ISP provided, clicking the "Add" button after every address is entered. Repeat this step as many times as necessary to add all of the addresses that your ISP provided.



Other Windows NT TCP/IP options:

For our purposes the settings under the "WINS Address" and "Routing" tabs are not used.

If you wish to use the Windows Internet Naming Service ("WINS") your attention is invited to http://www.localnet.org/ for more information about WINS settings, specifically regarding sharing files transparently across the Internet.

Mopping up:

  • Click on the "OK" button to close the TCP/IP Properties section.

  • Click on the "Close" button to close the Network Control Panel.

  • Restart your computer if prompted to do so.



That is it!


4.3 Configuring Windows for Workgroups

Configuring Windows for Workgroups to act as a network client requires that the Microsoft TCP/IP-32 driver diskette has been installed on the workstation. The TCP/IP drivers are not included with the WfW CD or diskettes; if you need a copy they are available at ftp://ftp.microsoft.com/peropsys/windows/public/tcpip/.

Once the TCP/IP drivers have been loaded, perform the following steps:

Create the Windows for Workgroups "hosts" file:

In order to connect to the other TCP/IP systems on the LAN you will need to create an identical copy of the "hosts" file that you installed on the FreeBSD system in Section 3.4.

  • In Program Manager, click the "File" button; select "Run"; and enter: "notepad \WINDOWS\HOSTS" (without the quotes) and click "OK"

  • In the editor, enter the addresses and system names from the hosts file shown in Section 3.4.

  • When finished editing, close the notepad application (making sure that you save the file!).



Configure the Windows 95 TCP/IP Network Configuration settings

  • In the main window of Program Manager, open the "Network" group by double-clicking the icon.

  • Double click on the "Network Setup" icon.

  • In the "Network Drivers Box" double-click the "Microsoft TCP/IP-32" entry.



Configure the Windows for Workgroups IP Address:

Ensure the correct Ethernet Interface is selected in the "Adapter" list. If not, scroll down until it is displayed and select it by clicking on it.

  • Ensure that the "Enable Automatic DHCP Configuration" check box is blank. If it is checked, click it to remove the "X".

  • In our example LAN the Windows for Workgroups system is the one we have called "Moe"; in the "IP Address" field enter "192.168.1.3".

  • Enter 255.255.255.0 in the "Subnet Mask" field.



Configure the Gateway information:

For our example network the FreeBSD box will be acting as our gateway to the Internet (routing packets between the Ethernet LAN and the PPP dial-up connection).

  • Enter the IP address of the FreeBSD system, 192.168.1.1, in the "Default Gateway" field.



Configuring DNS:

Again, this guide assumes that your Internet Service Provider has given you a list of Domain Name Servers (or "DNS Servers") that you should use. If you wish to run a DNS server on your local FreeBSD system, refer to Section 6, "Exercise for the Interested Student" for tips on setting up DNS on your FreeBSD system.

  • Click the "DNS" button.

  • In the "Host Name" field enter the name of the Windows for Workgroups box, in this case: "Moe".

  • In the "Domain" field enter the name of our local network, in this case: "my.domain"

  • In the "Domain Name Service (DNS) Search Order" section, enter the IP address of the DNS server that your ISP provided, clicking the "Add" button after each address is entered. Repeat this step as many times as necessary to add all of the addresses that your ISP provided.

  • Click on the "OK" button to close the DNS Configuration window.



Mopping up:

  • Click on the "OK" button to close the TCP/IP Configuration window.

  • Click on the "OK" button to close the Network Setup window.

  • Reboot your computer if prompted.



That is it!


Chapter 5 Testing the Network

Once you have completed that appropriate tasks above you should have a functioning PPP gateway to the Internet.


5.1 Testing the Dial-Up link:

The first thing to test is that the connection is being made between your modem and the ISP.


Chapter 6 Exercises for the Interested Student

6.1 Creating a mini-DNS system

While managing a Domain Name Service (DNS) hierarchy can be a black art, it is possible to set up a Mini-DNS server on the FreeBSD system that also acts as your gateway to your ISP.

Building on the files in /etc/namedb when the FreeBSD system was installed it is possible to create a name server that is both authoritative for the example network shown here as well as a front-door to the Internet DNS architecture.

In this minimal DNS configuration, only three files are necessary:

    /etc/namedb/named.boot
    /etc/namedb/named.root
    /etc/namedb/mydomain.db


The /etc/namedb/named.root file is automatically installed as part of the FreeBSD base installation; the other two files must be created manually.


6.1.1 The /etc/namedb/named.boot file

The /etc/namedb/named.boot file controls the startup settings of the DNS server. Essentially, it tells the Name Server:

  1. Where to find configuration files,

  2. What "domain names" it is responsible for, and

  3. Where to find other DNS servers.



Using the 'ee' editor, create a /etc/namedb/named.boot with the following contents:

    ; boot file for mini-name server
    
    directory   /etc/namedb
    
    ; type    domain        source host/file        backup file
    
    cache     .         named.root
    primary   my.domain.        mydomain.db


Lines that begin with a semi-colon are comments. The significant lines in this file are:

  • directory /etc/namedb

    Tells the Name Server where to find the configuration files referenced in the remaining sections of the '/etc/namedb/named.boot' file.

  • cache . named.root

    Tells the Name Server that the list of "Top-Level" DNS servers for the Internet can be found in a file called 'named.root'. (This file is included in the base installation and its contents are not described in this document.)

  • primary my.domain. mydomain.db

    Tells the Name Server that it will be "authoritative" for a DNS domain called "my.domain" and that a list of names and IP addresses for the systems in "my.domain" (the local network) can be found in a file named 'mydomain.db'.



Once the /etc/namedb/named.boot file has been created and saved, proceed to the next section to create the /etc/namedb/mydomain.db file.


6.1.2 The /etc/namedb/mydomain.db file

The /etc/namedb/mydomain.db file lists the names and IP addresses of every system in the Local Area Network.

For a detailed description of the statements used in this file, refer to the named manpage.

The /etc/namedb/mydomain.db file for our minimal DNS server has the following contents:

    @  IN SOA  my.domain. root.my.domain.  (
                    961230  ; Serial
                    3600    ; Refresh
                    300 ; Retry
                    3600000 ; Expire
                    3600 )  ; Minimum
        IN NS   curly.my.domain.
    
    curly.my.domain.    IN A    192.168.1.1 # The FreeBSD box
    larry.my.domain.    IN A    192.168.1.2 # The Win'95 box
    moe.my.domain.      IN A    192.168.1.3 # The WfW box
    shemp.my.domain.    IN A    192.168.1.4 # The Windows NT box
    
    $ORIGIN 1.168.192.IN-ADDR.ARPA
            IN NS   curly.my.domain.
    1       IN PTR  curly.my.domain.
    2       IN PTR  larry.my.domain.
    3       IN PTR  moe.my.domain.
    4       IN PTR  shemp.my.domain.
    
    $ORIGIN 0.0.127.IN-ADDR.ARPA
            IN NS   curly.my.domain.
    1       IN PTR  localhost.my.domain.


In simple terms, this file declares that the local DNS server is:

  • The Start of Authority for ("SOA") for a domain called 'my.domain',

  • The Name Server ("NS") for 'my.domain',

  • Responsible for the reverse-mapping for all IP addresses that start with '192.168.1.' and '127.0.0.' ("$ORIGIN ...")



To add workstation entries to this file you will need to add two lines for each system; one in the top section where the name(s) are mapped into Internet Addresses ("IN A"), and another line that maps the addresses back into names in the $ORIGIN 1.168.192.IN-ADDR.ARPA section.


6.1.3 Starting the DNS Server

By default the DNS server ('/usr/sbin/named') is not started when the system boots. You can modify this behavior by changing a single line in '/etc/rc.conf' as follows:

Using the 'ee' editor, load /etc/rc.conf. Scroll down approximately 40 lines until you come to the section that says:

    ---
    named_enable="NO"                       # Run named, the DNS server (or NO).
    named_flags="-b /etc/namedb/named.boot" # Flags to named (if enabled).
    ---
Change this section to read:
    ---
    named_enable="YES"                      # Run named, the DNS server (or NO).
    named_flags="-b /etc/namedb/named.boot" # Flags to named (if enabled).
    ---
Save the file and reboot.

Alternatively, start the Name Server daemon by entering the following command:

    # named -b /etc/namedb/named.boot


Whenever you modify any of the files in /etc/namedb you will need to kick-start the Name Server process to make it pick up the modifications. This is performed with the following system command:

    # kill -HUP `cat /var/run/named.pid`



6.2 Playing with PPP filters

The PPP program has the ability to apply selected filtering rules to the traffic it routes. While this is not nearly as secure as a formal firewall it does provide some access control as to how the link is used.

('man ipfw' for information on setting up a more secure FreeBSD system.)

The complete documentation for the various filters and rules under PPP are available in the PPP manual page.

There are four distinct classes of rules which may be applied to the PPP program:

  • alive filter - Access Counter (or "Keep Alive") filters

    These control which events are ignored by the set timeout= statement in the configuration file.

  • dial filter - Dialing filters

    These filtering rules control which events are ignored by the demand-dial mode of PPP.

  • in filter - Input filters

    Control whether incoming packets should be discarded or passed into the system.

  • out filter - Output filters

    Control whether outgoing packets should be discarded or passed into the system.



What follows is a snippet from an operating system which provides a good foundation for "normal" Internet operations while preventing PPP from pumping all data over the dial-up connection. Comments briefly describe the logic of each rule set:

    #
    # KeepAlive filters
    # Don't keep Alive with ICMP,DNS and RIP packet
    #
     set filter alive 0 deny icmp
     set filter alive 1 deny udp src eq 53
     set filter alive 2 deny udp dst eq 53
     set filter alive 3 deny udp src eq 520
     set filter alive 4 deny udp dst eq 520
     set filter alive 5 permit 0/0 0/0
    #
    # Dial Filters:
    #  Note:  ICMP will trigger a dial-out in this configuration!
    #
     set filter dial 0 permit 0/0 0/0
    #
    # Allow ident packet pass through
    #
     set filter in 0 permit tcp dst eq 113
     set filter out 0 permit tcp src eq 113
    #
    # Allow telnet connection to the Internet
    #
     set filter in 1 permit tcp src eq 23 estab
     set filter out 1 permit tcp dst eq 23
    #
    # Allow ftp access to the Internet
    #
     set filter in 2 permit tcp src eq 21 estab
     set filter out 2 permit tcp dst eq 21
     set filter in 3 permit tcp src eq 20 dst gt 1023
     set filter out 3 permit tcp dst eq 20
    #
    # Allow access to DNS lookups
    #
     set filter in 4 permit udp src eq 53
     set filter out 4 permit udp dst eq 53
    #
    # Allow DNS Zone Transfers
    #
     set filter in 5 permit tcp src eq 53
     set filter out 5 permit tcp dst eq 53
    #
    # Allow access from/to local network
    #
     set filter in 6 permit 0/0 192.168.1.0/24
     set filter out 6 permit 192.168.1.0/24 0/0
    #
    # Allow ping and traceroute response
    #
     set filter in 7 permit icmp
     set filter out 7 permit icmp
     set filter in 8 permit udp dst gt 33433
     set filter out 9 permit udp dst gt 33433
    #
    # Allow cvsup
    #
     set filter in 9 permit tcp src eq 5998
     set filter out 9 permit tcp dst eq 5998
     set filter in 10 permit tcp src eq 5999
     set filter out 10 permit tcp dst eq 5999
    #
    # Allow NTP for Time Synchronization
    #
     set filter in 11 permit tcp src eq 123 dst eq 123
     set filter out 11 permit tcp src eq 123 dst eq 123
     set filter in 12 permit udp src eq 123 dst eq 123
     set filter out 12 permit udp src eq 123 dst eq 123
    #
    # SMTP'd be a good idea!
    #
     set filter in 13 permit tcp src eq 25
     set filter out 13 permit tcp dst eq 25
    #
    #
    # We use a lot of `whois`, let's pass that
    #
     set filter in 14 permit tcp src eq 43
     set filter out 14 permit tcp dst eq 43
     set filter in 15 permit udp src eq 43
     set filter out 15 permit udp dst eq 43
    #
    # If none of above rules matches, then packet is blocked.
    #-------


Up to 20 distinct filtering rules can be applied to each class of filter. Rules in each class are number sequentially from 0 to 20 but none of the rules for a particular filter class take affect until ruleset '0' is defined!

If you choose not to use Filtering Rules in the PPP configuration then ALL traffic will be permitted both into and out of your system while it is connected to your ISP.

If you decide that you want to implement filtering rules, add the above lines to your /etc/ppp/ppp.conf file in either the "default:", "demand:", or "interactive:" section (or all of them - the choice is yours).


This, and other documents, can be downloaded from ftp://ftp.FreeBSD.org/pub/FreeBSD/doc/.

For questions about FreeBSD, read the documentation before contacting <questions@FreeBSD.org>.
For questions about this documentation, e-mail <doc@FreeBSD.org>.