Board
https://www.amazon.de/gp/product/B01GEIEI7M
USB to RS232 Adapter
https://varia-store.com/de/produkt/13456-usb-zu-seriell-adapter.html
Wifi (optional):
https://www.ebay.de/itm/Compex-WLE200NX-a-b-g-n-miniPCI-Express-Karte/311708282947
screen /dev/ttyUSB0 115200
https://github.com/pcengines/apu2-documentation/blob/master/docs/firmware_flashing.md
BIOS updates require flashing the ROM. Create a bootable USB flash drive with TinyCore Linux from PC Engines. It includes flashrom but doesn’t include any ROM images you might need. Steps:
Download TinyCore Linux
curl -sSLO https://pcengines.ch/file/apu2-tinycore6.4.img.gz
sha256sum apu2-tinycore6.4.img.gz
# 4b834077ec5da535b07ab7e17215eb8d64b71dbcfd3f9076d51252a0f7158f3c apu2-tinycore6.4.img.gz
gunzip apu2-tinycore6.4.img.gz
Download and verify BIOS ROM
New Firmware Maintainer: https://docs.dasharo.com/variants/pc_engines/overview/
NOTE: this is for the APU2 board version. Change based on your board: APU3, APU4, …
gpg --fetch-keys https://raw.githubusercontent.com/3mdeb/3mdeb-secpack/master/customer-keys/pcengines/release-keys/pcengines-open-source-firmware-release-4.12-key.asc
curl -sO https://3mdeb.com/open-source-firmware/pcengines/apu2/apu2_v4.19.0.1.rom
curl -sO https://3mdeb.com/open-source-firmware/pcengines/apu2/apu2_v4.19.0.1.SHA256
curl -sO https://3mdeb.com/open-source-firmware/pcengines/apu2/apu2_v4.19.0.1.SHA256.sig
gpg -v --verify apu2_v4.19.0.1.SHA256.sig apu2_v4.19.0.1.SHA256
sha256sum -c apu2_v4.19.0.1.SHA256
Mount Image and copy BIOS ROM
[ -d /mnt/disk ] || sudo mkdir /mnt/disk
sudo mount -o loop,offset=1048576 apu2-tinycore6.4.img /mnt/disk
sudo cp apu2_v4.19.0.1.rom /mnt/disk
sudo umount /mnt/disk
Write image to Flash Drive
sudo dd if=apu2-tinycore6.4.img of=/dev/<your flashdrive> bs=1M status=progress
When you boot with the apu2_v4.19.0.1.rom installed, you will see this:
PC Engines apu2
coreboot build 20202910
BIOS version v4.19.0.1
4080 MB ECC DRAM
SeaBIOS (version rel-1.12.1.3-0-g300e8b70)
Press F10 key now for boot menu
To see the bios version, you must press F10, and then choose ‘3. Payload [setup]‘, after which you will see:
Booting from CBFS..
### PC Engines apu2 setup v4.6.20 ###
Boot order - type letter to move device to top.
a USB
b SDCARD
c mSATA
d SATA
e mPCIe1 SATA1 and SATA2
f iPXE (disabled)
r Restore boot order defaults
n Network/PXE boot - Currently Disabled
u USB boot - Currently Enabled
t Serial console - Currently Enabled
k Redirect console output to COM2 - Currently Disabled
o UART C - Currently Enabled
p UART D - Currently Enabled
m Force mPCIe2 slot CLK (GPP3 PCIe) - Currently Disabled
h EHCI0 controller - Currently Disabled
l Core Performance Boost - Currently Enabled
i Watchdog - Currently Disabled
j SD 3.0 mode - Currently Disabled
g Reverse order of PCI addresses - Currently Disabled
v IOMMU - Currently Disabled
y PCIe power management features - Currently Disabled
w Enable BIOS write protect - Currently Disabled
x Exit setup without save
s Save configuration and exit
If you determine you need to update the BIOS, follow these steps:
flashrom to update the BIOS. The ROM file will be in /media/SYSLINUX: flashrom -p internal -w /media/SYSLINUX/apu2_v4.12.0.6.romDownload and Flash the Image
wget https://ftp.hostserver.de/pub/OpenBSD/6.3/amd64/install63.fs
sha256sum install63.fs
# df19266be16079ccd6114447f7bb13bdedb9c5cb66ecc1ea98544290fa4dc138 install63.fs
sudo dd if=install63.fs of=/dev/<your flashdrive> bs=1M
The following settings are required for proper serial console output.
Enter them in the boot> prompt:
boot> stty com0 115200
boot> set tty com0
boot> <RETURN>
The driver used for wireless networking is athn(4). It might not work properly out of the box. Once OpenBSD is installed, run fw_update with no arguments. It will figure out which firmware updates are required and will download and install them. When it finishes, reboot.
Routing:
echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
Reload /etc/hostname.if configs:
sh /etc/netstart
There are several methods to configure the WAN interface, choose accordingly.
Interface: em0
echo "ignore domain-name-servers;" > /etc/dhclient.conf
echo "dhcp description WAN" > /etc/hostname.em0
chmod 640 /etc/hostname.em0
Configure em0 as up and lay the pppoe interface above it. Restrict access to pppoe0 further as there are your provider secrets stored.
echo "up" > /etc/hostname.em0
chmod 640 /etc/hostname.em0
cat <<"EOF">/etc/hostname.pppoe0
inet 0.0.0.0 255.255.255.255 NONE \
pppoedev em0 authproto pap \
authname 'somecredentials' authkey 'somepassword' up
dest 0.0.0.1
!/sbin/route add default -ifp pppoe0 0.0.0.1
EOF
chmod 600 /etc/hostname.pppoe0
Deutsche Telekom communicates over VLAN7, you have to configure the pppoe0 interface above a vlan7 interface and than above the em0 interface.
echo "up" > /etc/hostname.em0
chmod 640 /etc/hostname.em0
cat <<EOF>/etc/hostname.vlan7
vlan 7 vlandev em0 up
EOF
chmod 640 /etc/hostname.vlan7
cat <<"EOF">/etc/hostname.pppoe0
inet 0.0.0.0 255.255.255.255 NONE \
pppoedev vlan7 authproto pap \
authname '111111111111222222222222#0001@t-online.de' authkey '12345678' \
description WAN \
up
dest 0.0.0.1
!/sbin/route add default -ifp pppoe0 0.0.0.1
EOF
chmod 600 /etc/hostname.pppoe0
Interface: em1
echo "inet 192.168.1.1 255.255.255.0 192.168.1.255 description LAN" > /etc/hostname.em1
chmod 640 /etc/hostname.em1
Interface: em2
echo "inet 192.168.2.1 255.255.255.0 192.168.2.255 description WIFI" > /etc/hostname.em2
chmod 640 /etc/hostname.em2
Interface: athn0
cat <<EOF> /etc/hostname.athn0
media autoselect mode 11n mediaopt hostap chan 1
nwid <SSID> wpakey <WPA2 Key/Password>
inet 192.168.2.1 255.255.255.0 192.168.2.255 description WIFI
EOF
chmod 640 /etc/hostname.athn0
cat <<EOF> /etc/ntpd.conf
listen on 192.168.1.1
listen on 192.168.2.1
servers pool.ntp.org
sensor *
constraints from "https://www.google.com"
EOF
rcctl restart ntpd
cat <<EOF> /etc/dhcpd.conf
subnet 192.168.1.0 netmask 255.255.255.0 {
option routers 192.168.1.1;
option domain-name-servers 192.168.1.1;
range 192.168.1.100 192.168.1.254;
}
subnet 192.168.2.0 netmask 255.255.255.0 {
option routers 192.168.2.1;
option domain-name-servers 192.168.2.1;
range 192.168.2.2 192.168.2.254;
}
EOF
rcctl enable dhcpd
# for external WIFI
rcctl set dhcpd flags em1 em2
# for internal WIFI
rcctl set dhcpd flags em1 athn0
rcctl start dhcpd
See OpenBSD DNS Resolver.
...
server:
interface: 192.168.1.1
interface: 192.168.2.1
interface: 127.0.0.1
access-control: 192.168.1.0/24 allow
access-control: 192.168.2.0/24 allow
...
See OpenBSD Ads List for reference.
Ads filter update script:
cat <<"EOF"> /usr/local/sbin/update-ads
#!/bin/sh
ads_conf="/var/unbound/etc/unbound_ads_filter.conf.gz"
ftp -o ${ads_conf} https://dl.giftfish.de/ads/unbound_ads_filter.conf.gz
gunzip -f ${ads_conf}
unbound-control reload
rm -f ${ads_conf}
EOF
chmod 755 /usr/local/sbin/update-ads
echo "30 1 * * * /usr/local/sbin/update-ads 2>&1 >/dev/null" >> /var/cron/tabs/root
cat <<EOF> /etc/pf.conf
lan = "em1"
wifi = "em2" # or athn0
table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \
172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16 \
198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/3 }
set skip on lo0
# masquerading
#match in all scrub (no-df random-id max-mss 1440)
match out on egress inet from !(egress:network) to any nat-to (egress:0)
# block orphan networks
block in from no-route
block in quick from urpf-failed
block in quick on $ext_if from <martians> to any
block return out quick on $ext_if from any to <martians>
block all
# allow clients internet access
pass out quick inet
pass in on $lan proto tcp to any port ssh
pass in on { $lan $wifi } inet
# port forwarding rule
pass in on egress inet proto tcp from any to (egress) port { 80 443 } rdr-to 192.168.1.2
EOF
Read the upgrade guide: https://www.openbsd.org/faq/upgrade66.html
Mount disk partition:
Is the disk partition already mounted? [yes] n
Run sysmerge for config files and syspatch for the latest binary patches.
https://github.com/mordak/divert_rbl
https://github.com/OISF/suricata