Setting up a static IP for a Raspberry Pi over wifi using OpenBSD dhcpd

May 1, 2015

Like the rest of the world, I wanted to have a static IP for a Raspberry Pi that was on a wifi network. Like the rest of the world, I couldn’t figure out how to do it after three attempts. At that point, like the rest of the world I gave up and decided to make my DHCP server do the work instead of the Pi.

Here’s how I did it:

1. On the Pi, edit /etc/wpa_supplicant.conf and add:

network={
    ssid="My_SSID"
    psk="My_wifi_password"
}

2. Reboot and get an IP address through DHCP.

3. Confirm that I can see the world with the DHCP address.

4. ifconfig wlan0 and copy down the hardware Ethernet address for wlan0 (let’s pretend it was 00:11:22:33:44:56).

5. Go to the box running DHCP, and add a stanza inside my shared-network:

       host myserver {
               hardware ethernet 00:11:22:33:44:56;
               fixed-address 192.168.1.17;
               option host-name "myserver";
       }

6. Kill and restart the DHCP daemon.

7. Reboot the pi and confirm it’s getting the right static IP address now.

Leave a Comment » | firewall, openbsd, pi | Tagged: , , | Permalink
Posted by andrewmemory

Changing MAC address on OpenBSD

December 6, 2012

A little while ago, I needed to change my MAC address on the OpenBSD firewall I’ve got running. (My ISP kept feeding me a bad IP address from an old lease and I wanted a new one.)

It’s easy to do this on OpenBSD:

ifconfig vr1 down
ifconfig vr1 lladdr 00:11:22:33:44:55
ifconfig vr1 up

The question is, where’s the right place to put this to make it permanent? A few web searches revealed that a bunch of people had modified /etc/netstart by putting the ifconfig vr1 lladdr line somewhere near the beginning. I’d rather not sully my pristine /etc scripts with changes if I don’t have to.

Linux has /etc/network/interfaces, and OpenBSD has /etc/hostname.if. I just changed my /etc/hostname.vr1 to:

dhcp lladdr 00:11:22:33:44:55

and I was requesting an IP address using my new MAC address.

Leave a Comment » | firewall, openbsd | Tagged: | Permalink
Posted by andrewmemory

Final cleanup for the ALIX firewall

July 6, 2012

Finally, there are a few things that I either forgot to do or that make life easier.

Setting up localtime
By defaut, /etc/localtime is set to Alberta, where OpenBSD has its home. I need to set it to somewhere closer.

rm /etc/localtime; ln -s /usr/share/zoneinfo/US/Mountain /etc/localtime

Now date shows the correct time.

Blinkenlights
I wrote a script to make the LEDs move back and forth. I start this at boot. (In an earlier version of the firewall, I edited /etc/rc to turn LEDs on when certain thresholds had been passed in the boot process. But now I don’t want to muck up /etc/rc so much.)

First of all, you need to allow the ports to be written before OpenBSD gets all secure on you. Edit /etc/rc.securelevel and add:

#
# Place local actions here.
#
echo -n 'enabling LED pins'
gpioctl -q /dev/gpio0 6 set out iout
gpioctl -q /dev/gpio0 25 set out iout
gpioctl -q /dev/gpio0 27 set out iout

I got these numbers from the Status LEDs section of the ALIX manual.

Then create /usr/local/bin/cylon:

#!/bin/ksh -

led3on(){
gpioctl -q /dev/gpio0 6 0
gpioctl -q /dev/gpio0 25 0
gpioctl -q /dev/gpio0 27 1
}

led2on(){
gpioctl -q /dev/gpio0 6 0
gpioctl -q /dev/gpio0 25 1
gpioctl -q /dev/gpio0 27 0
}

led1on(){
gpioctl -q /dev/gpio0 6 1
gpioctl -q /dev/gpio0 25 0
gpioctl -q /dev/gpio0 27 0
}

ledsoff(){
gpioctl -q /dev/gpio0 6 0
gpioctl -q /dev/gpio0 25 0
gpioctl -q /dev/gpio0 27 0
}

while [ true ] ; do
 led1on
 sleep 1
 led2on
 sleep 1
 led3on
 sleep 1
 led2on
 sleep 1
done

Finally, start it from /etc/rc.local:

# Add your local startup actions here.
echo -n 'cylon'
sh /usr/local/bin/cylon &

On reboot, yay, blinky! That at least tells you the kernel hasn’t crashed.

Reducing the mail
Because flashrd is really OpenBSD, it sends mail more suited to a server than a firewall with limited disk.

First thing I noticed:

Running security(8):

Checking special files and directories.
Output format is:
        filename:
                criteria (shouldbe, reallyis)
etc/rc.conf.local:
        permissions (0644, 0755)

I fixed that with a chmod 0644 /etc/rc.conf.local. So now /usr/libexec/security shows no problems. Good.

Once that’s done, make things complain less:

crontab -uroot -e

and comment out:

#30     1       *       *       *       /bin/sh /etc/daily
#30     3       *       *       6       /bin/sh /etc/weekly

This prevents the daily and weekly reports, leaving just the monthly one.

Next, I noticed that sendmail gets run from root’s crontab, so it doesn’t need to run at boot:

/etc/rc.conf:

sendmail_flags=NO       # "-L sm-mta -C/etc/mail/localhost.cf -bd -q30m"

That should keep the thing running a little longer without running out of disk. Actually, /var/mail is on the MFS, so it will keep it from running out of ramdisk.

(This post is part of Building an ALIX firewall)

2 Comments | firewall, hardware, openbsd | Tagged: , , , , , , , , , , | Permalink
Posted by andrewmemory

Setting up BIND on the ALIX firewall

June 27, 2012

Setting up BIND is probably the part that took more thought than any other when building the firewall. This is not because of any particular technical challenges; rather, BIND is managed by a consortium and its doc is… voluminous.

In the end, I went with the default /var/named/etc/named.conf on the assumption that it would do the right thing. According to its comment, it does both “recursive and authoritative queries using one cache,” which is what I want.

There are four files that need to change:

  1. /etc/rc.conf
  2. /var/named/etc/named.conf
  3. /var/named/master/mydomain.net
  4. /var/name/master/mydomain.net.rev

The last two can be named anything, but I stuck with conventions as I saw them.

Warning
Unlike everything up to now, the BIND files live on /var/. In flashrd, /var gets unpacked at boot time into a RAM disk. So you need to save any changes you make somewhere else. Do not reboot until you’ve saved your changes! Ultimately, we’ll put these changes in /flash/var.tar so they get re-created when the device reboots.

/etc/rc.conf
To enable named, change:

named_flags=""

/var/named/etc/named.conf
I used the default named.conf, which is really just a copy of named-simple.conf.

I made one addition in the options section:

       forwarders { 8.8.8.8; };

This tells DNS to look for answers at the Google DNS server if it can’t find the answer on the local DNS server. (Actually, I put a few DNS servers that were specific to my ISP, but the Google server will work too.)

I also made a few changes near the end:

// Master zones
//
zone "mydomain.net" {
        type master;
        file "master/mydomain.net";
};

// Reverse mappings for mydomain.net domain
zone "150.168.192.in-addr.arpa" in {
     type master;
     file "master/mydomain.net.rev";
};

This tells named to look in /var/named/master/mydomain.net for mappings of mydomain.net, and to look in /var/named/master/mydomain.net.rev for mappings of 192.168.150.*.

/var/named/master/mydomain.net
Here’s my mydomain.net:

mydomain.net. IN SOA firewall.mydomain.net. myemail.yahoo.com. (
     1          ; Serial
     10800      ; Refresh after 3 hours
     3600       ; Retry after 1 hour
     604800     ; Expire after 1 week
     86400 )    ; Minimum TTL of 1 day

;
; Name Servers
;
mydomain.net.  IN NS   firewall.mydomain.net.

;
; Host addresses
;
localhost.mydomain.net.        IN A    127.0.0.1
firewall.mydomain.net.         IN A    192.168.150.1
firesign.mydomain.net.         IN A    192.168.150.170
frantics.mydomain.net.         IN A    192.168.150.171
bundolo.mydomain.net.          IN A    192.168.150.172

The first bit says my domain is called mydomain.net. I’ve published my email as myemail@yahoo.com (but note the dot instead of the at sign there).

The next bit is serial number / expiration times. You’re supposed to bump up the serial number every time you edit, but I usually just kill and restart named.

After that, I say that the firewall will be the nameserver for the domain.

Next is the interesting bit: the mapping of host names to host addresses. They must all end in . because BIND requires it. It’s very easy to miss a . in your config file and be confused about why things aren’t working.

/var/name/master/mydomain.net.rev
In addition to DNS doing lookup for names, it usually also does lookup for IP addresses. This is what you get when you do nslookup 192.168.150.1, for instance. The reverse domain name file holds that:


150.168.192.in-addr.arpa. IN SOA firewall.mydomain.net. myemail.yahoo.com. (
     1          ; Serial
     10800      ; Refresh after 3 hours
     3600       ; Retry after 1 hour
     604800     ; Expire after 1 week
     86400 )    ; Minimum TTL of 1 day

;
; Name Servers
;
150.168.192.in-addr.arpa.       IN NS   firewall.mydomain.net.

;
; Addresses point to canonical name
;
1.150.168.192.in-addr.arpa.     IN PTR  firewall.mydomain.net.
170.150.168.192.in-addr.arpa.   IN PTR  firesign.mydomain.net.
171.150.168.192.in-addr.arpa.   IN PTR  frantics.mydomain.net.
172.150.168.192.in-addr.arpa.   IN PTR  bundolo.mydomain.net.

Once again, watch for . characters at the end of .arpa. and .net.

At this point, you can kill and restart named, then:

nslookup
server localhost
frantics

You should see something like:

Server:         localhost
Address:        127.0.0.1#53

Name:   frantics.mydomain.net
Address: 192.168.150.171

/etc/resolv.conf.tail
The DHCP client overwrites /etc/resolv.conf, but then appends whatever/s in /etc/resolv.conf.tail to that. So let’s tell OpenBSD that Change /etc/resolv.conf to point to the running nameserver:

nameserver 192.168.150.1
domain mydomain.net
search mydomain.net
lookup bind file

This sets up the firewall as the nameserver to look for, tells what my domain is, says to search foo.mydomain.net when looking for foo, and to look up via bind first and then /etc/hosts.

/etc/dhcpd.conf
Now is a good time to change dhcpd.conf to point to your nameserver instead of someone else:

option domain-name-servers 192.168.150.1;

Save those changes
To save the changes that are in /var, use the following command:

tar cf /flash/var.tar -C /var .

Might as well save a copy somewhere else too:

tar cf /root/named.tar /var/named

Things are saved away as well as they’re going to be; time to reboot and hope you didn’t miss anything!

(This post is part of Building an ALIX firewall)

1 Comment | firewall, openbsd | Tagged: , , | Permalink
Posted by andrewmemory

Setting up PF for the ALIX firewall

June 26, 2012

The next step on the firewall is to set up the packet filter PF. Most of what I do here comes from the OpenBSD PF FAQ.

Setting up PF itself
The file to edit is /etc/pf.conf. Here’s mine:

# macros
int_if="vr0"
ext_if="vr1"

# FTP Proxy rules
anchor "ftp-proxy/*"
pass in quick on $int_if inet proto tcp to any port ftp \
    divert-to 127.0.0.1 port 8021

# options
set block-policy return
set loginterface $ext_if
set skip on lo

# match rules
match out on egress inet from !(egress) to any nat-to (egress:0)

# filter rules
block in log
pass out quick
antispoof quick for { lo $int_if }
# uncomment this to respond to pings
# pass in inet proto icmp all icmp-type echoreq
pass in on $int_if

It’s basically the example config file for home or small office, with a couple of changes:

  1. I define an int_if and ext_if for internal network and external network
  2. I don’t have any port forwarding from outside through to the inside network except ftp-proxy
  3. I block all incoming ICMP traffic (which is broken according to spec, but might keep me safer from denial of service attacks).
  4. I keep port 22 closed on the firewall machine.

Basically, I present a blank wall to the Internet. Traffic I initiate can get out, but outside doesn’t get in except via ftp-proxy.

One thing to note is that if you mess up pf, you can get into a state where you can’t talk to your ALIX over the network. So make sure you have a serial port handy to talk to it. I’d recommend making changes to pf.conf over serial, and then testing with the network.

To test, run:

pfctl -F all
pfctl -f /etc/pf.conf

The first command flushes whatever existing PF config is there; the second command loads your new pf config.

Next, hook up a machine to the switch that’s connected to the LAN side of the firewall, and see if you have Internet. If you do, life is good!

Getting FTP running
You might have noticed I use ftp-proxy in my pf.conf. That’s a daemon that needs to be enabled in /etc/rc.conf:

ftpproxy_flags=""

According to the PF FAQ, you can run ftp-proxy to get the daemon going, but I rebooted instead after changing /etc/rc.conf. Also according to the FAQ, some (fussy) clients may need “-r” on ftpproxy_flags.

Blocking IP addresses using PF
I haven’t done this before, but I wanted to try blocking ad servers by IP address using PF. Some instructions are here.

My list of IP addresses came from the excellent pgl.yoyo.org/adservers site. I picked “list ad server IP addresses” as plain HTML text, checked the “view list as plain text” button, and pressed “go”. This gave me a URL that I copied.

I wanted a semi-automatic way to download this list. Luckily, OpenBSD’s ftp is a lot more than plain FTP. You can use it instead of wget/curl/etc. Here’s the command I used:

ftp -o /etc/pf.blocked.ip.conf "http://pgl.yoyo.org\
/adservers/iplist.php?ipformat=plain&;showintro=1&\
mimetype=plaintext"

Then I updated my pf.conf to account for that:

# macros
int_if="vr0"
ext_if="vr1"

# Table of IP addresses to block
table <blockedips> persist file "/etc/pf.blocked.ip.conf"

# FTP Proxy rules
anchor "ftp-proxy/*"
pass in quick on $int_if inet proto tcp to any port ftp \
    divert-to 127.0.0.1 port 8021

# options

set block-policy return
set loginterface $ext_if
set skip on lo

# match rules

match out on egress inet from !(egress) to any nat-to (egress:0)

# filter rules

# These two rules block traffic from blacklisted IP addresses
block drop in quick on $ext_if from <blockedips> to any
block return out quick from any to <blockedips>

block in log
pass out quick

antispoof quick for { lo $int_if }

# pass in inet proto icmp all icmp-type $icmp_types

pass in on $int_if

I’m not sure if this strategy will work long term. Previously I excluded ad servers in named instead. Excluding by IP address seems to take less RAM (I’ve got about 163M free of my 256M RAM with this table loaded) and has the advantage of blocking sneaky servers that use IP address URLs. The downside is that if another server uses the same IP address, I won’t get the content, and I have no real way to unblock by name if I need to.

At any rate, to update, I just need to do the ftp command again, and then:

pfctl -t blockedips -T replace -f /etc/pf.blocked.ip.conf

(This post is part of Building an ALIX firewall)

1 Comment | firewall, openbsd | Tagged: , , , , , , , | Permalink
Posted by andrewmemory

Setting up networking for the ALIX firewall

June 24, 2012

The next step in building an ALIX firewall is to set up networking.

Setting the hostname

  1. Edit the file /etc/myname to be the hostname you want (don’t forget to rw first if you need to).
  2. Run:

    hostname `cat /etc/myname`

    to set the hostname in lieu of rebooting.

Figuring out which port is which
On my ALIX, Ethernet port vr1 is the port nearest to the
serial port and vr0 is the one nearest to the power cable. I figured this out by plugging one port into the network and running ifconfig. In my case I saw:

vr1: flags=8802 mtu 1500
        lladdr 00:0d:ba:36:d9:30
        priority: 0
        media: Ethernet autoselect (none)
        status: active

whereas vr0 had status: no carrier. That told me that vr1 was the one on the network. I labelled the ports so I wouldn’t forget. (Since my plan is to have a firewall with one port for the internal LAN and another for the world, I used labels vr0:lan and vr1:world.)

Setting up the DHCP client on vr1
My ISP assigns me an IP address using DHCP. In the older flashdist, you had to edit /etc/rc to start up dhclient to get this address. With flashrd, it’s easier once again:
echo dhcp > /etc/hostname.vr1
sh /etc/netstart

At this point the ALIX will go to your local network and request an IP address via dhclient. Hopefully you have a DHCP server somewhere on your network; otherwise you’ll need to read Section 6 of the OpenBSD FAQ.

Setting up the LAN interface
I decided that I wouldn’t mess around with IPv6 just yet… I want to set up a NAT firewall using IPv4. To start with, I had to pick an IP address for my internal network. I’m going to use my ALIX box for DHCP, name resolution, and as a gateway. (Yes, I know this is bad practice… but I’m on a limited budget!)

I picked address 192.168.150.* for my network. This means my firewall will be 192.168.150.1, and I’ll use that as the gateway address of other machines which are its DHCP clients.

echo inet 192.168.150.1 255.255.255.0 NONE > /etc/hostname.vr0
sh /etc/netstart

Run the dhcpd server
So that the firewall can serve IP addresses, it needs to have dhcpd enabled. The right place to do this is in a section of rc.conf.local, but I got lazy and edited it in /etc/rc.conf. If I had to do this over, I’d use /etc/rc.conf.local. The code I changed was:

dhcpd_flags=""

Next we need to tell it what the subnet is that it will serve DHCP addresses to. This is defined in /etc/dhcpd.conf:

option domain-name "mydomain.net";
option domain-name-servers 8.8.8.8;

subnet 192.168.150.0 netmask 255.255.255.0 {
option routers 192.168.150.1;

range 192.168.150.32 192.168.150.127;

# host static-client {
# hardware ethernet 22:33:44:55:66:77;
# fixed-address 192.168.1.200;
# }

# host pxe-client {
# hardware ethernet 02:03:04:05:06:07;
# filename "pxeboot";
# next-server 192.168.1.1;
# }

In my case for absolutely arbitrary reasons, I said to serve from 192.168.150.32 to 192.168.150.63. I left the pxe-client and static-client things in case I needed them later.

Also note that right now I’m using Google’s 8.8.8.8 as the DNS server. I could have used my ISP’s instead – either way, it’s going to change once I get BIND running on the firewall.

Add myself to hosts
This is a good time to add myself to the /etc/hosts file (both under the short name and fully-qualified domain name):

192.168.150.1 myname myname.mydomain.net

Enabling port forwarding
Next we need to allow the firewall to forward IPv4 traffic. To do this, edit /etc/sysctl.conf:

net.inet.ip.forwarding=1

Update the time from the network
Since the ALIX doesn’t have a real time clock that stores the time, we need to update it from the network every time we reboot. This is in /etc/rc.conf:

ntpd_flags="-s"

The -s says “update the time now to the server time and don’t try to adjust it slowly.” That’s the right thing to do when the box thinks the time is way in the past.

At this point, I figured it was time to reboot the device and see if everything came up as expected.

/sbin/shutdown -r now

Now plug a switch into the vr0:lan port, a computer into the switch, and see if you can get an IP address. You’re not doing enough yet to have an Internet connection, but ipconfig /all on a Windows laptop should show a correct IPv4 address, subnet mask, gateway, dhcp server and DNS server. Groovy, you’ve got a network!

(This post is part of Building an ALIX firewall)

1 Comment | firewall, openbsd | Tagged: , , , , , , , | Permalink
Posted by andrewmemory

Getting OpenBSD 5.1 on the ALIX firewall

June 20, 2012

Getting OpenBSD on the ALIX used to be quite an effort. You had to figure out what your CF card looked like, enter the right drive parameters, and hope. Now it’s dead easy:

  1. Download the flashrd binary image. I used flashimg.i386.wd0.com0-20120531.gz, which is root wd0, com0 38400 console. This matches the Alix BIOS default, which also spits out 38400 serial.
  2. Unzip the image with gzip -d
  3. Write the image to the CF card. I have Cygwin installed, so I was able to use dd. Since I’m running this on Windows 7, I had to open my Cygwin shell as Administrator. The command I used: 
    dd if=flashdist.i386.wd0.com0-20120531 of=/dev/sdd bs=128k

    I was pleasantly surprised that dd worked. (I found the device by doing sfdisk -l /dev/sda, then sdb, then sdc, until I found a partition table that looked like my 4 GB flash drive.) I picked 128k as the block size because the image was evenly divisible by that. I don’t know if it makes a difference, but I figured why risk it.

  4. Next I hooked up a DB9 F/F mini null modem to my PC serial port, connected that to the Alix serial port, ran hypertrm (which I had to get from an earlier Windows release) and was talking to OpenBSD. Root password was “root” (no quotes).
  5. At this point I reset the password:
    rw
    passwd root
    ro

    rw is the flashrd way to say “mount the file system read/write”, and ro says “mount the file system read-only”. flashrd boots up read-only (which saves wear on the flash card) so you need to set it to read/write if you want to do pretty much anything.

That’s all there is to it!

(This post is part of Building an ALIX firewall)

1 Comment | firewall, openbsd | Tagged: , , | Permalink
Posted by andrewmemory

Building an ALIX firewall

June 20, 2012

It’s been a long time since I updated my firewall. Right now it’s a PC Engines ALIX 2c2 that I’ve been really happy with. I used flashdist and put OpenBSD 4.4 on it.

I think that’s a winning combination, but it’s time to upgrade. First, I want to go to OpenBSD 5.1. Next, flashdist has been replaced with flashrd, which is easier to install and use, and more appropriate for larger CF cards.

I started by getting an ALIX 2d2 (just one more IDE header than the 2c2, not much change). I bought it from mini-box.com, and I also picked up the custom enclosure for it and a power supply.

I already had a 4 GB CF card: a Kingston 4GB elite pro 133X, which was new when I built the original firewall. Make sure you have a good CF writer. I’ve had failures with cheapies, but got a Kingston FCR-HS219/1 and that worked.

There are a number of steps to get a working firewall. They are:

  1. Getting OpenBSD 5.1 on the ALIX
  2. Setting up networking for the ALIX firewall
  3. Setting up PF for the ALIX firewall
  4. Setting up BIND on the ALIX firewall
  5. Final cleanup for the ALIX firewall

5 Comments | firewall, openbsd, quietpc | Tagged: , , , , , | Permalink
Posted by andrewmemory

A minimal xorg.conf with modeline

March 25, 2010

Back in the Bad Old Days, the X configuration file was miles long and you had to get it all right. Nowadays, X guesses at most things pretty accurately. This means you might not have anything in your xorg.conf file. This makes changing the Monitor section trickier.

Here’s a default xorg.conf file with a modeline. (This is for a Sharp LL-172C-B monitor; your modeline will probably differ.)

Section "Device"
        Identifier      "Configured Video Device"
EndSection

Section "Monitor"
        Identifier      "Configured Monitor"
        # Modeline "1280x1024"  MHz  HSize HTotal HSyncEnd HSyncDelay  VSize VSyncStart VSyncEnd VTotal -hsync +vsync
        Modeline "1280x1024"  109.00  1280 1322 1450 1700  1024 1027 1034 1066 -hsync +vsync
EndSection

Section "Screen"
        Identifier      "Default Screen"
        Monitor         "Configured Monitor"
        Device          "Configured Video Device"
EndSection

Leave a Comment » | openbsd, video | Tagged: , , | Permalink
Posted by andrewmemory

Simple backup using rsync

December 3, 2009

A simple way to back up your data from one drive to another is rsync. The magical incantation (assuming the data drive is /dev/sda1 mounted on /data and the backup drive is /dev/sdb1 mounted on /databackup, and you normally keep the backup drive mounted read-only):

sudo mount -o remount,rw /dev/sdb1 /databackup
sudo rsync -a --delete --progress /data/ /databackup
sudo mount -o remount,ro /dev/sdb /databackup

Leave a Comment » | openbsd, ubuntu | Tagged: , | Permalink
Posted by andrewmemory

Next Entries »