GoWiki
Index
Sections
Search
Login
openbsd
Router
# OpenBSD Router # TODO * https://github.com/pcengines/apu2-documentation/blob/master/docs/apu_CPU_boost.md # Hardware Board https://www.amazon.de/gp/product/B01GEIEI7M * PC Engines APU.2C4 * power supply * black casing * 16GB mSATA SSD USB to RS232 Adapter https://varia-store.com/de/produkt/13456-usb-zu-seriell-adapter.html Wifi (optional): https://www.ebay.de/itm/Compex-WLE200NX-a-b-g-n-miniPCI-Express-Karte/311708282947 https://www.ebay.de/itm/2-x-Antenne-Adapter-SMA-u-FL-IPX-Wlan-Fritz-Box-Speedport-6dBi-DUALBAND-WIFI/222749423884 ## Serial Console `screen /dev/ttyUSB0 115200` ## BIOS https://github.com/pcengines/apu2-documentation/blob/master/docs/firmware_flashing.md BIOS updates require flashing the ROM. Create a bootable USB flash drive with TinyCore Linux from PC Engines. It includes flashrom but doesn’t include any ROM images you might need. Steps: Download TinyCore Linux ``` curl -sSLO https://pcengines.ch/file/apu2-tinycore6.4.img.gz sha256sum apu2-tinycore6.4.img.gz # 4b834077ec5da535b07ab7e17215eb8d64b71dbcfd3f9076d51252a0f7158f3c apu2-tinycore6.4.img.gz gunzip apu2-tinycore6.4.img.gz ``` Download and verify BIOS ROM New Firmware Maintainer: https://docs.dasharo.com/variants/pc_engines/overview/ **NOTE:** this is for the APU2 board version. Change based on your board: APU3, APU4, ... ``` gpg --fetch-keys https://raw.githubusercontent.com/3mdeb/3mdeb-secpack/master/customer-keys/pcengines/release-keys/pcengines-open-source-firmware-release-4.12-key.asc curl -sO https://3mdeb.com/open-source-firmware/pcengines/apu2/apu2_v4.19.0.1.rom curl -sO https://3mdeb.com/open-source-firmware/pcengines/apu2/apu2_v4.19.0.1.SHA256 curl -sO https://3mdeb.com/open-source-firmware/pcengines/apu2/apu2_v4.19.0.1.SHA256.sig gpg -v --verify apu2_v4.19.0.1.SHA256.sig apu2_v4.19.0.1.SHA256 sha256sum -c apu2_v4.19.0.1.SHA256 ``` Mount Image and copy BIOS ROM ``` [ -d /mnt/disk ] || sudo mkdir /mnt/disk sudo mount -o loop,offset=1048576 apu2-tinycore6.4.img /mnt/disk sudo cp apu2_v4.19.0.1.rom /mnt/disk sudo umount /mnt/disk ``` Write image to Flash Drive ``` sudo dd if=apu2-tinycore6.4.img of=/dev/<your flashdrive> bs=1M status=progress ``` When you boot with the **apu2_v4.19.0.1.rom** installed, you will see this: ``` PC Engines apu2 coreboot build 20202910 BIOS version v4.19.0.1 4080 MB ECC DRAM SeaBIOS (version rel-1.12.1.3-0-g300e8b70) Press F10 key now for boot menu ``` To see the bios version, you must press **F10**, and then choose '3. Payload [setup]', after which you will see: ``` Booting from CBFS.. ### PC Engines apu2 setup v4.6.20 ### Boot order - type letter to move device to top. a USB b SDCARD c mSATA d SATA e mPCIe1 SATA1 and SATA2 f iPXE (disabled) r Restore boot order defaults n Network/PXE boot - Currently Disabled u USB boot - Currently Enabled t Serial console - Currently Enabled k Redirect console output to COM2 - Currently Disabled o UART C - Currently Enabled p UART D - Currently Enabled m Force mPCIe2 slot CLK (GPP3 PCIe) - Currently Disabled h EHCI0 controller - Currently Disabled l Core Performance Boost - Currently Enabled i Watchdog - Currently Disabled j SD 3.0 mode - Currently Disabled g Reverse order of PCI addresses - Currently Disabled v IOMMU - Currently Disabled y PCIe power management features - Currently Disabled w Enable BIOS write protect - Currently Disabled x Exit setup without save s Save configuration and exit ``` If you determine you need to update the BIOS, follow these steps: 1. Power off the APU2 2. Insert the USB flash drive to one of the APU2's USB slots 3. Connect the serial console cable 4. Power on the APU2 5. Press F10 to enter the APU2 boot menu. In the boot menu, opt to boot from the USB flash drive (usually option number 1) 6. Once you get to a prompt, use `flashrom` to update the BIOS. The ROM file will be in `/media/SYSLINUX`: `flashrom -p internal -w /media/SYSLINUX/apu2_v4.12.0.6.rom` 7. When verification is done, reboot the APU2 so changes take effect # Installing OpenBSD Download and Flash the Image ``` wget https://ftp.hostserver.de/pub/OpenBSD/6.3/amd64/install63.fs sha256sum install63.fs # df19266be16079ccd6114447f7bb13bdedb9c5cb66ecc1ea98544290fa4dc138 install63.fs sudo dd if=install63.fs of=/dev/<your flashdrive> bs=1M ``` ## Serial console settings The following settings are required for proper serial console output. Enter them in the `boot> ` prompt: ``` boot> stty com0 115200 boot> set tty com0 boot> <RETURN> ``` ## Firmware The driver used for wireless networking is [athn(4)](http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man4/athn.4?query=athn). It might not work properly out of the box. Once OpenBSD is installed, run `fw_update` with no arguments. It will figure out which firmware updates are required and will download and install them. When it finishes, `reboot`. ## Configuration Routing: ``` echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf ``` Reload /etc/hostname.if configs: ``` sh /etc/netstart ``` ### WAN There are several methods to configure the WAN interface, choose accordingly. Interface: em0 #### DHCP ``` echo "ignore domain-name-servers;" > /etc/dhclient.conf echo "dhcp description WAN" > /etc/hostname.em0 chmod 640 /etc/hostname.em0 ``` #### PPPoE Configure em0 as up and lay the pppoe interface above it. Restrict access to pppoe0 further as there are your provider secrets stored. ``` echo "up" > /etc/hostname.em0 chmod 640 /etc/hostname.em0 cat <<"EOF">/etc/hostname.pppoe0 inet 0.0.0.0 255.255.255.255 NONE \ pppoedev em0 authproto pap \ authname 'somecredentials' authkey 'somepassword' up dest 0.0.0.1 !/sbin/route add default -ifp pppoe0 0.0.0.1 EOF chmod 600 /etc/hostname.pppoe0 ``` ##### PPPoE Deutsche Telekom (German Telekom, DTAG) Deutsche Telekom communicates over VLAN7, you have to configure the pppoe0 interface above a vlan7 interface and than above the em0 interface. ``` echo "up" > /etc/hostname.em0 chmod 640 /etc/hostname.em0 cat <<EOF>/etc/hostname.vlan7 vlan 7 vlandev em0 up EOF chmod 640 /etc/hostname.vlan7 cat <<"EOF">/etc/hostname.pppoe0 inet 0.0.0.0 255.255.255.255 NONE \ pppoedev vlan7 authproto pap \ authname '111111111111222222222222#0001@t-online.de' authkey '12345678' \ description WAN \ up dest 0.0.0.1 !/sbin/route add default -ifp pppoe0 0.0.0.1 EOF chmod 600 /etc/hostname.pppoe0 ``` ### LAN Interface: em1 ``` echo "inet 192.168.1.1 255.255.255.0 192.168.1.255 description LAN" > /etc/hostname.em1 chmod 640 /etc/hostname.em1 ``` ### WIFI Interface: em2 ``` echo "inet 192.168.2.1 255.255.255.0 192.168.2.255 description WIFI" > /etc/hostname.em2 chmod 640 /etc/hostname.em2 ``` Interface: athn0 ``` cat <<EOF> /etc/hostname.athn0 media autoselect mode 11n mediaopt hostap chan 1 nwid <SSID> wpakey <WPA2 Key/Password> inet 192.168.2.1 255.255.255.0 192.168.2.255 description WIFI EOF chmod 640 /etc/hostname.athn0 ``` ### NTP Server ``` cat <<EOF> /etc/ntpd.conf listen on 192.168.1.1 listen on 192.168.2.1 servers pool.ntp.org sensor * constraints from "https://www.google.com" EOF rcctl restart ntpd ``` ### DHCP Server ``` cat <<EOF> /etc/dhcpd.conf subnet 192.168.1.0 netmask 255.255.255.0 { option routers 192.168.1.1; option domain-name-servers 192.168.1.1; range 192.168.1.100 192.168.1.254; } subnet 192.168.2.0 netmask 255.255.255.0 { option routers 192.168.2.1; option domain-name-servers 192.168.2.1; range 192.168.2.2 192.168.2.254; } EOF rcctl enable dhcpd # for external WIFI rcctl set dhcpd flags em1 em2 # for internal WIFI rcctl set dhcpd flags em1 athn0 rcctl start dhcpd ``` ### DNS Server See [OpenBSD DNS Resolver](/openbsd/DNS+Resolver). ``` ... server: interface: 192.168.1.1 interface: 192.168.2.1 interface: 127.0.0.1 access-control: 192.168.1.0/24 allow access-control: 192.168.2.0/24 allow ... ``` See [OpenBSD Ads List](/openbsd/Ads+List) for reference. Ads filter update script: ``` cat <<"EOF"> /usr/local/sbin/update-ads #!/bin/sh ads_conf="/var/unbound/etc/unbound_ads_filter.conf.gz" ftp -o ${ads_conf} https://dl.giftfish.de/ads/unbound_ads_filter.conf.gz gunzip -f ${ads_conf} unbound-control reload rm -f ${ads_conf} EOF chmod 755 /usr/local/sbin/update-ads echo "30 1 * * * /usr/local/sbin/update-ads 2>&1 >/dev/null" >> /var/cron/tabs/root ``` ### Firewall ``` cat <<EOF> /etc/pf.conf lan = "em1" wifi = "em2" # or athn0 table <martians> { 0.0.0.0/8 10.0.0.0/8 127.0.0.0/8 169.254.0.0/16 \ 172.16.0.0/12 192.0.0.0/24 192.0.2.0/24 192.168.0.0/16 \ 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/3 } set skip on lo0 # masquerading #match in all scrub (no-df random-id max-mss 1440) match out on egress inet from !(egress:network) to any nat-to (egress:0) # block orphan networks block in from no-route block in quick from urpf-failed block in quick on $ext_if from <martians> to any block return out quick on $ext_if from any to <martians> block all # allow clients internet access pass out quick inet pass in on $lan proto tcp to any port ssh pass in on { $lan $wifi } inet # port forwarding rule pass in on egress inet proto tcp from any to (egress) port { 80 443 } rdr-to 192.168.1.2 EOF ``` # Upgrading OpenBSD Read the upgrade guide: https://www.openbsd.org/faq/upgrade66.html Mount disk partition: ``` Is the disk partition already mounted? [yes] n ``` Run `sysmerge` for config files and `syspatch` for the latest binary patches. # Optional ## Real Time Blacklist https://github.com/mordak/divert_rbl ## IDS / IPS https://github.com/OISF/suricata # Sources * https://github.com/elad/openbsd-apu2 * https://www.openbsd.org/faq/pf/example1.html