HOWTOs

HOWTO Create point-to-multipoint OpenVPN server using users and passwords instead of certificates

First create certification authority, server certificate and secret key as shown above and save them in rc.conf. (clients do not need certificates, but server does)

Please note openvpn_config_delimiter variable. Sometimes in real config file, there should be two lines with the same variable name but different value. It is not possible to accomplish in standard way in rc.conf, you need to use one variable name and delimiter as is shown in example bellow.

Then configure rc.conf link this:

    openvpn_enable="YES"
    openvpn_config_delimiter="_NEXT_"
    openvpn_tls_server="YES"

    openvpn_mode="server"
    openvpn_dev="tap"
    openvpn_proto="tcp-server"
    openvpn_port="5001"
    openvpn_ifconfig="10.150.0.1 255.255.255.0"

    openvpn_ifconfig_pool="10.150.0.65 10.150.0.126 255.255.255.0"
    openvpn_duplicate_cn="YES"

    openvpn_push="\"route-gateway 10.150.0.1\"_NEXT_\"redirect-gateway\"_NEXT_\"dhcp-option DOMAIN out.idc.cz\"_NEXT_\"dhcp-option DNS 1.2.3.4\"_NEXT_\"dhcp-option DNS 4.5.6.7\""

    openvpn_ca="/usr/local/etc/openvpn/ca.crt"
    openvpn_cert="/usr/local/etc/openvpn/server.crt"
    openvpn_key="/usr/local/etc/openvpn/server.key"
    openvpn_dh="/usr/local/etc/openvpn/dh1024.pem"

    openvpn_comp_lzo="YES"
    openvpn_verb="3"
    openvpn_keepalive="10 60"
    
    openvpn_log_append="/var/log/openvpn"
    openvpn_daemon="openvpn"
	 

and append configuration for users/passwords

    openvpn_auth_user_pass_verify="/usr/local/etc/openvpn/auth.sh via-env"
    openvpn_client_cert_not_required="YES"
    openvpn_username_as_common_name="YES"
    
    openvpn_secret_file="/usr/local/etc/openvpn/users"
    openvpn_secret_file_generate="YES"
    
    openvpn_secret_users="USERNAME"
    openvpn_secret_user_USERNAME_password="userpassword"
	 

Client side

You only have to copy public certificate of certification authority to check you are connecting to right server

userpass file contains only two lines, first your username and second your password

up and down directives are paths to files to run after start / before exit. We use them for setting up DNS servers. It is not neccesary to define this.

Client configuration file should look like this:

FreeBSD

Substitue IP_OF_REMOTE_VPN_SERVER by real ip. Correct path to certificate of certification authority and to userpass file.

    remote IP_OF_REMOTE_VPN_SERVER
    tls-client
    dev tap
    proto tcp-client
    port 5001
    pull
    
    ca /usr/local/etc/openvpn/holecek_certs_idc/ca.crt
    auth-user-pass /usr/local/etc/openvpn/holecek_certs_idc/userpass

    up /usr/local/etc/openvpn/up.sh
    down /usr/local/etc/openvpn/down.sh
    
    comp-lzo
    verb 3
    #ping-restart 10
    
    log-append /var/log/openvpn
    status /var/run/openvpn/vpn.status 10
    
    daemon openvpn
    
	 

Mac OS X

HOWTO Setting up a PPTP VPN server

Install WiBSD and configure rc.conf like that:

    ppp_conf_enable="YES"
    #
    # convention is to use x.x.x.64/26 for clients, x.x.x.32/27 for
    # static IP's
    ppp_conf_section_pptp_set_ifaddr="10.44.44.1 10.44.44.65-10.44.44.126 255.255.255.255"
    #
    #
    pptpd_enable="YES"
    #
    # generating /etc/ppp/ppp.secret file
    ppp_secret_enable="YES"
    ppp_secret_users="jp"
    ppp_secret_user_jp_password="SECRET_KEY"
    # convention is to use x.x.x.32/27 for static IP's
    ppp_secret_user_jp_ip="10.44.44.44"
    #
    # generate pptpd.conf when booting (or not)
    pptpd_conf_enable="YES"
    # option 'noipparam' is very important in FreeBSD 5.x/6.x - it's not working without this option 
    pptpd_conf_commands="option localip remoteip pidfile noipparam"
    pptpd_conf_command_localip="10.44.44.1"
    # convention is to use x.x.x.64/26 for dynamic IP's
    pptpd_conf_command_remoteip="10.44.44.65-126"

    # Optionaly
    # you can use another DNS servers
    ppp_conf_section_pptp_sets="${ppp_conf_section_pptp_sets} dns"
    ppp_conf_section_pptp_set_dns="YOUR_DNS_SERVER"
    
    # Don't forget to allow pptp and gre in firewall
    fw_allowed_access="... pptp gre"
    fw_allowed_pptp_access="any:tcp:1723:setup:x:"
    fw_allowed_access_gre="any:gre:::x:"
    

On client's side, create ppp.conf section like that:

    server:
      set authname "jp"
      set authkey "SECRET_KEY"
      disable dns
    

And then you can connect to the server via PPTP (you must have pptpclient installed; see /usr/ports/net/pptpclient if using FreeBSD):

    pptp server.xxx.cz server
    

HOWTO Setting up local watchdog of services (daemons)

We prepared some local scripts which check if some services are running. You can configure it to crontab to run those scripts periodicaly.

To enable srmgmt_watchdog

    srmgmtd_watchdog_enable="YES"
    crontab_lines="$crontab_lines wdog_srmgmtd"
    crontab_line_wdog_srmgmtd_comment="(wibsd.conf) watch the srmgmtd daemon"
    # check it every 2 minutes
    crontab_line_wdog_srmgmtd="*/2 * * * * root /usr/local/bin/wdog_srmgmtd.sh"
    

To enable temporary pipes when login portal is not accessible

    #=====================================================================
    # enable emergency pipe system if login portal is not accessible. If
    # enabled, every user that tries to login will get a pipe no matter
    # whether he is a valid user or not. No login/password check is
    # performed. We then periodically from crontab check the login portal
    # and when it begins accessible again, all these temporary pipes are
    # deleted which effectively force all users to login via portal as
    # usual.
    sr_ap_temporary_pipes_enable="NO"
    # if login portal is not accessible, use this bandwidth for temporary
    # pipse; bw is in kilobytes
    sr_ap_temporary_pipes_bw="64"
    # you can change this if you run into name collision problem
    sr_ap_temporary_pipes_user_prefix="emerg_user-"
    # probably you will never need change this; if you do, remember that
    # CGI scripts are run under user 'nobody'
    sr_ap_temporary_pipes_db="/tmp/.temp_pipes.db"
    #
    # we need /etc/crontab for this
    crontab_lines="${crontab_lines} temp_pipes"
    crontab_line_temp_pipes_comment="(wibsd.conf) check temporary pipes in srmgmtd"
    crontab_line_temp_pipes="*/2 * * * * root /usr/local/bin/wdog_temp_pipes_system.sh"
    

HOWTO Setting up bind9 as caching only or primary nameserver

General settings

    bind9_enable="YES"

    # Leave bind9_listen_on variable empty to listen on all interfaces,
    # or insert ip address of interface where to listen. 
    # REMEMBER: More addresses MUST be divided by semicolon
    bind9_listen_on=""
    

Caching only nameserver

    bind9_forward_only="YES"
    
    # REMEMBER: More addresses MUST be divided by semicolon
    bind9_forwarders="1.2.3.4; 3.4.5.6"
    

Primary nameserver for domain

first enter symbolic names for zones you want to configure in bind9_zones and their domains in _domain variables

    bind9_forward_only="NO"

    bind9_zones="wibsd"
    bind9_zone_wibsd_domain="wibsd.cz"
    

set necessary SOA record, some variables uses adequate defaults if empty

    bind9_zone_wibsd_serial="2006012001"		# necessary
    bind9_zone_wibsd_refresh="3600"			# default: 3600
    bind9_zone_wibsd_retry="900"			# default: 900
    bind9_zone_wibsd_expire="3600000"			# default: 3600000
    bind9_zone_wibsd_minimum="3600"			# default: 3600
    bind9_zone_wibsd_nameserver="server.wibsd.cz"	# default: ns.{domain}
    bind9_zone_wibsd_email="root@wibsd.cz"		# default: root@{domain}
    

in bind9_zone_?_records insert some symbolic name for each record you want to have

    bind9_zone_wibsd_records="nameserver server mail" 
    

and for each name from _records create its settings

    bind9_zone_wibsd_record_nameserver_name=""
    bind9_zone_wibsd_record_nameserver_type="NS"
    bind9_zone_wibsd_record_nameserver_address="server.wibsd.cz."

    bind9_zone_wibsd_record_server_name="server"
    bind9_zone_wibsd_record_server_type="A"
    bind9_zone_wibsd_record_server_address="192.168.1.1"

    bind9_zone_wibsd_record_mail_name="@"
    bind9_zone_wibsd_record_mail_type="MX	10"
    bind9_zone_wibsd_record_mail_address="server"
    

HOWTO Automatically backup configuration files

In rc.conf set up tftp server address, files to backup and directory on server where to put our files

    backup_tftp_server_ip="192.168.1.1"
    backup_tftp_server_directory="wibsd"
    backup_tftp_files="/etc/rc.conf /etc/rc.firewall"
    

save_config script can called manually after every change or just add it to crontab on right place

    crontab_lines="$crontab_lines saveconfig"
    crontab_line_saveconfig_comment="save our config files every day"
    crontab_line_saveconfig="0 0 * * * root /usr/sbin/save_config"
    

There is the system called dashboard which allows (in conjuction with srmgmt) to manage users accessing internet through your router

NOTE: It is necessary to have smart router management sw running on your box

If you want to use this, you have to define a few important variables:

Enable this feature by srmgmt_enable="YES" and sr_ap_usermgmt_enable="YES"

sr_ap_usermgmt_multilogin says, that user cannot log in more than ones (ie. if he tries, he will be stoped on old address and access will be allowed only from new address). Setting "NO" to multilogin variable says, that user can log in as many times as he want and from any address.

sr_ap_usermgmt_page_ext_url is address of web page that will be shown on the same page as login page (usually description of your AP or some warning or anything).

    #
    # srmgmt specific configuration
    srmgmt_enable="YES"
    srmgmt_lan_interfaces="wi0"
    # turn NAT translation on/off  (yes/no)
    srmgmt_ap_fw_client_interfaces="wi0"
    srmgmt_ap_fw_allowed_nameservers="$ns1 $ns2"
    srmgmt_ap_accounting_interval="1"

    #
    # SmartRouter simple UserManagement
    sr_ap_usermgmt_enable="YES"
    sr_ap_usermgmt_multilogin="NO"
    sr_ap_usermgmt_page_ext_url="http://www.example.com"
    # a.b.c.d is IP address of www.example.com
    # e.f.g.h is IP address of local thttpd (for ex. 10.0.99.1)
    # srmgmt allows http and https ports for IP addreses on the firewall
    srmgmt_ap_fw_authentication_servers="a.b.c.d e.f.g.h" 
    

    fw_allowed_access="http"
    fw_allowed_access_http="any:tcp:80:setup keep-state::y"
    

You have to setup where is login page/script stored. We already cooked dashboard.cgi in WiBSD which build a login page from rc.conf variables described bellow. e.f.g.h is IP address of local system (for ex. 10.0.99.1). (See variables with prefix sr_ap_usermgmt_page_)

    #
    # login page
    www_config_inc_redirect="e.f.g.h/dashboard.cgi"

	 

Next, you have to define user names and passwords, maximal bandwidth and idle time as in following example

   sr_ap_usermgmt_users="john tom ian"
   
   sr_ap_usermgmt_user_john_password="hjohnh"
   sr_ap_usermgmt_user_john_bw="512/128"
   sr_ap_usermgmt_user_john_max_idle="100"
   
   sr_ap_usermgmt_user_tom_password="htomh"
   sr_ap_usermgmt_user_tom_bw="212/12"
   sr_ap_usermgmt_user_tom_max_idle="200"
   
   sr_ap_usermgmt_user_ian_password="hianh"
   sr_ap_usermgmt_user_ian_bw="112/28"
   sr_ap_usermgmt_user_ian_max_idle="1800"
	

There is no possibility for users after successfull login to log out. You can solve it with periodically calling dashboard_idle.sh script to remove users with greater idle time than defined in rc.conf. Crontab can be used for this:

   crontab_lines="$crontab_lines dashboard"
   crontab_line_dashboard_comment="delete idle users from srmgmt"
   crontab_line_dashboard="*/5 * * * * root /usr/local/bin/dashboard_idle.sh"
   

There are many other variables, especially for defining how the page will look like. Feel free to change them as you like. You can use HTML also.

   sr_ap_usermgmt_page_title=".: Login portal :."
   sr_ap_usermgmt_page_bgcolor="red"
   sr_ap_usermgmt_page_username="Username: "
   sr_ap_usermgmt_page_password="Password: "
   sr_ap_usermgmt_page_login="Login"
   sr_ap_usermgmt_page_noframes="Frames must be enabled to access this site"
   sr_ap_usermgmt_page_badpassword="Bad username or password"
   sr_ap_usermgmt_page_goodpassword="Okay, you are logged in"
   sr_ap_usermgmt_page_error="Internal error"