Vamos iniciar com a preparação do ambiente de rede do
OpenBSD 4.3:
Arquivos das interfaces de rede (
/etc/hostname.xx0).
Vamos primeiramente editar esses arquivos de forma que fiquem parecidos com os descritos abaixo:
Supondo que o nome de minha interface de entrada de internet seja ste0 (link 1):
# vi /etc/hostname.ste0
Teremos o seguinte:
inet 200.xxx.xxx.xxx 255.xxx.xxx.xxx NONE
!route add -mpath default 200.xxx.xxx.xxx
Salve e feche.
Agora vamos editar a segunda placa de entrada de internet, supondo que o nome da interface seja ste1 (link2):
# vi /etc/hostname.ste1
Teremos o seguinte:
inet 201.xxx.xxx.xxx 255.xxx.xxx.xxx NONE
!route add -mpath default 201.xxx.xxx.xxx
Salve e feche.
Agora vamos configurar sua placa de rede interna e seus clientes. Supondo que o nome de minha interface seja em0 (rede interna):
# vi /etc/hostname.em0
Teremos o seguinte:
inet 192.168.0.1 255.255.255.0 NONE
Somente isso, não é necessário a adição de rota (!route add -mpath default xxx.xxx.xxx.xxx) porque esta interface não é uma entrada e nem saída de internet.
Salve e feche.
Já estamos com nosso ambiente de rede configurado. Vamos editar os arquivos do OpenBSD.
Edite o arquivo
/etc/sysctl.conf:
# vi /etc/sysctl.conf
Teremos o seguinte:
# $OpenBSD: sysctl.conf,v 1.46 2008/01/05 18:38:37 mbalmer Exp $
#
# This file contains a list of sysctl options the user wants set at
# boot time. See sysctl(3) and sysctl(8) for more information on
# the many available variables.
#
net.inet.ip.forwarding=1
# 1=Permit forwarding (routing) of IPv4 packets <<<<<<<<<<< DESCOMENTE ESSA LINHA
net.inet.ip.mforwarding=1
# 1=Permit forwarding (routing) of IPv4 multicast packets <<<< DESCOMENTE ESSA LINHA
net.inet.ip.multipath=1
# 1=Enable IP multipath routing <<<<<<<<<<<<<<<<<<<<<< DESCOMENTE ESSA LINHA
#net.inet6.ip6.forwarding=1 # 1=Permit forwarding (routing) of IPv6 packets
#net.inet6.ip6.mforwarding=1 # 1=Permit forwarding (routing) of IPv6 multicast packets
#net.inet6.ip6.multipath=1 # 1=Enable IPv6 multipath routing
#net.inet6.ip6.accept_rtadv=1 # 1=Permit IPv6 autoconf (forwarding must be 0)
#net.inet.tcp.rfc1323=0 # 0=Disable TCP RFC1323 extensions (for if tcp is slow)
#net.inet.tcp.rfc3390=0 # 0=Disable RFC3390 for TCP window increasing
#net.inet.esp.enable=0 # 0=Disable the ESP IPsec protocol
#net.inet.ah.enable=0 # 0=Disable the AH IPsec protocol
#net.inet.esp.udpencap=0 # 0=Disable ESP-in-UDP encapsulation
#net.inet.ipcomp.enable=1 # 1=Enable the IPCOMP protocol
#net.inet.etherip.allow=1 # 1=Enable the Ethernet-over-IP protocol
#net.inet.tcp.ecn=1 # 1=Enable the TCP ECN extension
#net.inet.carp.preempt=1 # 1=Enable carp(4) preemption
#net.inet.carp.log=1 # 1=Enable logging of carp(4) packets
#ddb.panic=0 # 0=Do not drop into ddb on a kernel panic
#ddb.console=1 # 1=Permit entry of ddb from the console
#fs.posix.setuid=0 # 0=Traditional BSD chown() semantics
#vm.swapencrypt.enable=0 # 0=Do not encrypt pages that go to swap
#vfs.nfs.iothreads=4 # Number of nfsio kernel threads
#net.inet.ip.mtudisc=0 # 0=Disable tcp mtu discovery
#kern.usercrypto=0 # 0=Disable userland use of /dev/crypto
#kern.splassert=2 # 2=Enable with verbose error messages
#kern.nosuidcoredump=2 # 2=Put suid coredumps in /var/crash
#kern.watchdog.period=32 # >0=Enable hardware watchdog(4) timer if available
#kern.watchdog.auto=0 # 0=Disable automatic watchdog(4) retriggering
#machdep.allowaperture=2 # See xf86(4)
#machdep.apmwarn=10 # battery % when apm status messages enabled
#machdep.apmhalt=1 # 1=powerdown hack, try if halt -p doesn't work
#machdep.kbdreset=1 # permit console CTRL-ALT-DEL to do a nice halt
#machdep.userldt=1 # allow userland programs to play with ldt,
# required by some ports
#kern.emul.aout=1 # enable running dynamic OpenBSD a.out bins
#kern.emul.bsdos=1 # enable running BSD/OS binaries
#kern.emul.freebsd=1 # enable running FreeBSD binaries
#kern.emul.ibcs2=1 # enable running iBCS2 binaries
#kern.emul.linux=1 # enable running Linux binaries
#kern.emul.svr4=1 # enable running SVR4 binaries
Após descomentar as linhas indicadas (net.inet.ip.forwarding=1 / net.inet.ip.mforwarding=1 / net.inet.ip.multipath=1), salve e feche o arquivo.
Agora vamos editar outro arquivo do OpenBSD (
/etc/rc.conf):
# vi /etc/rc.conf
Teremos o seguinte:
#!/bin/sh -
#
# $OpenBSD: rc.conf,v 1.128 2008/01/31 14:18:03 reyk Exp $
# set these to "NO" to turn them off. otherwise, they're used as flags
routed_flags=NO # for normal use: "-q"
ripd_flags=NO # for normal use: ""
mrouted_flags=NO # for normal use: "", if activated
# be sure to enable multicast_router below.
dvmrpd_flags=NO # for normal use: ""
ospfd_flags=NO # for normal use: ""
ospf6d_flags=NO # for normal use: ""
bgpd_flags=NO # for normal use: ""
rarpd_flags=NO # for normal use: "-a"
bootparamd_flags=NO # for normal use: ""
rbootd_flags=NO # for normal use: ""
sshd_flags="" # for normal use: ""
named_flags=NO # for normal use: ""
rdate_flags=NO # for normal use: [RFC868-host] or [-n RFC2030-host]
timed_flags=NO # for normal use: ""
nmeaattach_flags=NO # for normal use: "[options] cua-device"
ntpd_flags=NO # for normal use: ""
isakmpd_flags=NO # for normal use: ""
sasyncd_flags=NO # for normal use: ""
mopd_flags=NO # for normal use: "-a"
apmd_flags=NO # for normal use: ""
dhcpd_flags=NO # for normal use: ""
dhcrelay_flags=NO # for normal use: "-i interface [server]"
rtadvd_flags=NO # for normal use: list of interfaces
# be sure to set net.inet6.ip6.forwarding=1
route6d_flags=NO # for normal use: ""
# be sure to set net.inet6.ip6.forwarding=1
rtsold_flags=NO # for normal use: interface
# be sure to set net.inet6.ip6.forwarding=0
# be sure to set net.inet6.ip6.accept_rtadv=1
lpd_flags=NO # for normal use: "" (or "-l" for debugging)
sensorsd_flags=NO # for normal use: ""
hotplugd_flags=NO # for normal use: ""
watchdogd_flags=NO # for normal use: ""
ftpproxy_flags=NO # for normal use: ""
hostapd_flags=NO # for normal use: ""
ifstated_flags=NO # for normal use: ""
relayd_flags=NO # for normal use: ""
snmpd_flags=NO # for normal use: ""
# use -u to disable chroot, see httpd(8)
httpd_flags=NO # for normal use: "" (or "-DSSL" after reading ssl(8))
# For normal use: "-L sm-mta -bd -q30m", and note there is a cron job
sendmail_flags="-L sm-mta -C/etc/mail/localhost.cf -bd -q30m"
spamd_flags=NO # for normal use: "" and see spamd(8)
spamd_black=NO # set to YES to run spamd without greylisting
spamlogd_flags="" # use eg. "-i interface" and see spamlogd(8)
# Set to NO if ftpd is running out of inetd
ftpd_flags=NO # for non-inetd use: "-D"
# Set to NO if identd is running out of inetd
identd_flags=NO # for non-inetd use: "-b -elo"
# On some architectures, you must also disable console getty in /etc/ttys
xdm_flags=NO # for normal use: ""
# For enabling console mouse support (i386 alpha amd64)
wsmoused_flags=NO # for ps/2 or usb mice: "", serial: "-p /dev/cua00"
# set the following to "YES" to turn them on
rwhod=NO
nfs_server=NO # see sysctl.conf for nfs client configuration
lockd=NO
amd=NO
pf=YES # Packet filter / NAT <<<<<<<<<<<<<<<<<<<<<<<<<< MUDE O PADRÃO "NO" PARA "YES"
ipsec=NO # IPsec
portmap=NO # Note: inetd(8) rpc services need portmap too
inetd=NO # almost always needed <<<<<<<<<<<<<<<<<<<<<<< MUDE O PADRAO "YES" PARA "NO"
check_quotas=YES # NO may be desirable in some YP environments
accounting=NO # process accounting (using /var/account/acct)
krb5_master_kdc=NO # KerberosV master KDC. Run 'info heimdal' for help.
krb5_slave_kdc=NO # KerberosV slave KDC.
afs=NO # mount and run afs
# Multicast routing configuration
# Please look at netstart(8) for a detailed description if you change these
multicast_host=NO # Route all multicast packets to a single interface
multicast_router=NO # A multicast routing daemon will be run, e.g. mrouted
# miscellaneous other flags
# only used if the appropriate server is marked YES above
savecore_flags= # "-z" to compress
ypserv_flags= # E.g. -1 for YP v1, -d for DNS etc
yppasswdd_flags=NO # "-d /etc/yp" if passwd files are in /etc/yp
nfsd_flags="-tun 4" # Crank the 4 for a busy NFS fileserver
amd_dir=/tmp_mnt # AMD's mount directory
amd_master=/etc/amd/master # AMD 'master' map
syslogd_flags= # add more flags, ie. "-u -a /chroot/dev/log"
pf_rules=/etc/pf.conf # Packet filter rules file
ipsec_rules=/etc/ipsec.conf # IPsec rules file
pflogd_flags= # add more flags, ie. "-s 256"
afsd_flags= # Flags passed to afsd
shlib_dirs= # extra directories for ldconfig, separated
# by space
local_rcconf="/etc/rc.conf.local"
[ -f ${local_rcconf} ] && . ${local_rcconf} # Do not edit this line
Edite os locais indicados (pf=YES / inetd=NO), salve e feche.
Edite também o arquivo
/etc/mygate:
# vi /etc/mygate
Deixe ele em branco, sem nenhum valor escrito.
Pronto! Agora seu ambiente está totalmente configurado, vamos editar as regras do PF (Packet Filter).