| | 1 | == gatekeeper.isi.deterlab.net == |
| | 2 | |
| | 3 | Gatekeeper is a bridging firewall running FreeBSD 7.3 and pf. |
| | 4 | |
| | 5 | === Hardware === |
| | 6 | |
| | 7 | * Dell PowerEdge Chassis |
| | 8 | * Pentium 4 2.4Ghz |
| | 9 | * 256Mb of RAM |
| | 10 | * 40GB Seagate ST340014A Hard Drive |
| | 11 | |
| | 12 | === Interfaces === |
| | 13 | * Dual Port Card 1 |
| | 14 | * em0 internet facing interface (verify) |
| | 15 | * ether 00:04:23:c2:8e:a8 |
| | 16 | * em1 testbed facing interface (verify) |
| | 17 | * ether 00:04:23:c2:8e:a9 |
| | 18 | |
| | 19 | * Dual Port Card 2 |
| | 20 | * em2 is unused |
| | 21 | * ether 00:04:23:a5:ac:ee |
| | 22 | * em3 10.0.23.0/24 network, address 10.0.23.254 |
| | 23 | * ether 00:04:23:a5:ac:ef |
| | 24 | |
| | 25 | === Bridging Configuration === |
| | 26 | |
| | 27 | * bridge0 consists of em0 and em1 |
| | 28 | * bridge0 is configured in rc.conf with the following lines: |
| | 29 | {{{ |
| | 30 | cloned_interfaces="bridge0" |
| | 31 | ifconfig_bridge0="inet 206.117.25.46 netmask 255.255.255.0 addm em0 addm em1 up" |
| | 32 | ifconfig_em0="up" |
| | 33 | ifconfig_em1="up" |
| | 34 | }}} |
| | 35 | |
| | 36 | === PF configuration === |
| | 37 | |
| | 38 | * Two sysctl variables need to be set in order to enable pf on a bridged interface in /etc/sysctl.conf. Rules on bridges have no direction. |
| | 39 | {{{ |
| | 40 | net.link.bridge.pfil_bridge=1 |
| | 41 | net.link.bridge.pfil_onlyip=1 |
| | 42 | }}} |
| | 43 | * pf is enabled in /etc/rc.conf |
| | 44 | {{{ |
| | 45 | pf_enable="YES" |
| | 46 | pflog_enable="YES" |
| | 47 | }}} |
| | 48 | |
| | 49 | * The pf.conf file is in CVS under /operations/configuration/gatekeeper |
| | 50 | |
| | 51 | * The kernel configuration in /operations/configuration/gatekeeper contains the pf and pflog devices: |
| | 52 | {{{ |
| | 53 | device pf |
| | 54 | device pflog |
| | 55 | }}} |
| | 56 | |
| | 57 | |
| | 58 | === NAT Configuration === |
| | 59 | |
| | 60 | * We have a NAT'ed network hanging off of gatekeeper for machines that need to access the internet, but do not need to have it. |
| | 61 | * The sysctl variable for ip forwarding is enabled in /etc/sysctl.conf: |
| | 62 | {{{ |
| | 63 | net.inet.ip.forwarding=1 |
| | 64 | }}} |
| | 65 | |
