Movatterモバイル変換

Table of Contents

24.1. Overview of the network configuration files

24.2. Connecting to common LAN setups

24.2.1. Connecting using IEEE 802.11 (Wi-Fi)

24.3. Manually creating a small LAN

24.4. Connecting to a home/office ISP with PPPoE

24.4.1. Configuring a VLAN

24.4.2. Setting up MSS clamping

24.4.3. Obtaining IPv6 addresses via Prefix Delegation

24.5. Setting up an Internet gateway with NPF

24.6. Setting up a network bridge device

24.6.1. Bridge example

24.7. Ensuring interfaces are initialized in the correct order

24.8. Some useful commands

The following is a list of the files used to configure the network. The usage of these files, some of which have already been met the first chapters, will be described in the following sections.

In Local Area Networks that are centrally managed, one can expect Internet connectivity being available via some router, a DNS server being available, and most important, a DHCP server which hands out IP addresses to clients on request. To make a NetBSD client run in such an environment, it's usually enough to set

dhcpcd=YES

in/etc/rc.conf, and the IP address will be set automatically,/etc/resolv.conf will be created and routing setup to the default router.

ifconfig_iwm0="up"dhcpcd=YESwpa_supplicant=YES

#ifconfig iwm0 up#service dhcpcd start#service wpa_supplicant start

#wlanctl -aiwm0: mac 10:02:xx:xx:xx:xx bss 00:00:00:00:00:00

# Allow wpa_cli(8) to configure wpa_supplicantctrl_interface=/var/run/wpa_supplicantctrl_interface_group=wheelupdate_config=1# Automatically connect to the unprotected network "metalab".network={ssid="metalab"key_mgmt=NONEpriority=100}# Automatically connect to the protected network "discord" using the password "XXX".network={        ssid="discord"        psk="XXX"}

#service wpa_supplicant reload#service dhcpcd restart

#wpa_cli scan#wpa_cli scan_resultsSelected interface 'iwm0'16:01:33.578: bssid / frequency / signal level / flags / ssidxx:xx:xx:xx:xx:xx       5180    91      [WPA2-PSK-CCMP][ESS]    FRITZ!Box 1000 EZ

This section describes how to configure a LANmanually in order to describe the basics of the networking stack. Usually, this configuration is automatic throughdhcpcd(8), seeSection 24.2, “Connecting to common LAN setups”

First, the network cards must be installed and connected to a switch or directly.

Next, check that the network cards are recognized by the kernel, studying the output of thedmesg command. In the following example the kernel recognized correctly an NE2000 clone:

...ne0 at isa0 port 0x280-0x29f irq 9ne0: NE2000 Ethernetne0: Ethernet address 00:c2:dd:c1:d1:21...

The following command shows the network card's current configuration:

#ifconfig ne0ne0: flags=8822<BROADCAST,NOTRAILERS,SIMPLEX,MULTICAST> mtu 1500address: 00:50:ba:aa:a7:7fmedia: Ethernet autoselect (10baseT)inet6 fe80::250:baff:feaa:a77f%ne0 prefixlen 64 scopeid 0x1

The software configuration of the network card is very easy. The IP address“192.168.1.1” is assigned to the card.

#ifconfig ne0 inet 192.168.1.1 netmask 0xffffff00

Note that the networks 10.0.0.0/8 and 192.168.0.0/16 are reserved for private networks, which is what we're setting up here.

Repeating the previous command now gives a different result:

#ifconfig ne0ne0: flags=8863<UP,BROADCAST,NOTRAILERS,RUNNING,SIMPLEX,MULTICAST> mtu 1500address: 00:50:ba:aa:a7:7fmedia: Ethernet autoselect (10baseT)inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255inet6 fe80::250:baff:feaa:a77f%ne0 prefixlen 64 scopeid 0x1

The output ofifconfig has now changed: the IP address is now printed and there are two new flags,“UP” and“RUNNING” If the interface isn't“UP”, it will not be used by the system to send packets.

The host was given the IP address 192.168.1.1, which belongs to the set of addresses reserved for internal networks which are not reachable from the Internet. The configuration is finished and must now be tested; if there is another active host on the network, aping can be tried. For example, if 192.168.1.2 is the address of the active host:

#ping 192.168.1.2PING ape (192.168.1.2): 56 data bytes64 bytes from 192.168.1.2: icmp_seq=0 ttl=255 time=1.286 ms64 bytes from 192.168.1.2: icmp_seq=1 ttl=255 time=0.649 ms64 bytes from 192.168.1.2: icmp_seq=2 ttl=255 time=0.681 ms64 bytes from 192.168.1.2: icmp_seq=3 ttl=255 time=0.656 ms^C----ape PING Statistics----4 packets transmitted, 4 packets received, 0.0% packet lossround-trip min/avg/max/stddev = 0.649/0.818/1.286/0.312 ms

With the current setup, at the next boot it will be necessary to repeat the configuration of the network card. In order to avoid repeating the card's configuration at each boot, add the following lines to/etc/rc.conf:

auto_ifconfig=yesifconfig_ne0="inet 192.168.1.1 netmask 0xffffff00"

In this example the variableifconfig_ne0 was set because the network card was recognized asne0 by the kernel; if you are using a different adapter, substitute the appropriate name in place of ne0.

At the next boot the network card will be configured automatically.

If you have a router that is connected to the internet, you can use it as default router, which will handle all your packets. To do so, setdefaultroute to the router's IP address in/etc/rc.conf:

defaultroute=192.168.0.254

Be sure to use the default router's IP address instead of name, in case your DNS server is beyond the default router. In that case, the DNS server couldn't be reached to resolve the default router's hostname and vice versa, creating a chicken-and-egg problem.

To reach hosts on your local network, and assuming you really have very few hosts, adjust/etc/hosts to contain the addresses of all the hosts belonging to the internal network. For example:

## Host Database# This file should contain the addresses and aliases# for local hosts that share this file.# It is used only for "ifconfig" and other operations# before the nameserver is started.##127.0.0.1             localhost::1                   localhost## RFC 1918 specifies that these networks are "internal".# 10.0.0.0    10.255.255.255# 172.16.0.0  172.31.255.255# 192.168.0.0 192.168.255.255192.168.1.1   ape.insetti.net ape192.168.1.2   vespa.insetti.net vespa192.168.1.0   insetti.net

To configure a machine as DNS client, you need to edit/etc/resolv.conf, and enter the DNS server's address, in addition to an optional domain name that will be appended to hosts with no domain, in order to create a FQDN for resolving. Assuming your DNS server's IP address is 192.168.1.2 and it is setup to serve for "home.net", put the following into/etc/resolv.conf:

# /etc/resolv.confdomain home.netnameserver 192.168.1.2

Summing up, to configure the network the following must be done: the network adapters must be installed and physically connected. Next they must be configured (withifconfig) and, finally, the file/etc/rc.conf must be modified to configure the interface and possibly default router, and/etc/resolv.conf and/etc/nsswitch.conf should be adjusted if DNS should be used. This type of network management is sufficient for small networks without sophisticated needs.

Many home/office ISPs use PPP (point to point protocol) to provide Internet access to their clients. NetBSD includespppoe(4) (PPP over Ethernet) functionality that can be used to connect to a modem which communicates with the ISP, typically not using Ethernet, allowing NetBSD to be used as a gateway on small home and office networks.

We start by configuring the kernel for PPPoE use by bumping the tty queue size. This setting can be made permanent by editing/etc/sysctl.conf:

#sysctl -w kern.tty.qsize=32768

Now, create the interface withifconfig(8):

#ifconfig pppoe0 create#ifconfig inet 0.0.0.0 0.0.0.1 down#ifconfig re0 up#pppoectl -e re0 pppoe0

We are using our computer'sre0 interface to connect to our DSL modem.

Then, configure the PPPoE connection to use our ISP's provided username and password:

#pppoectl pppoe0 myauthproto=pap 'myauthname=XXX' 'myauthsecret=YYY' hisauthproto=none

We are now ready to test a first connection. Since something may be wrong, we will restrict retries for now:

#pppoectl pppoe0 max-auth-failure=1#ifconfig pppoe0 up#pppoectl -d pppoe0pppoe0: state = sessionSession ID: 0x254fPADI retries: 0PADR retries: 0

This example output shows a working setup. The PPPoE session has been established and is still in use (state = session). We can now check the IP negotiation of PPP:

#ifconfig pppoe0pppoe0: flags=8851<UP,POINTOPOINT,RUNNING,SIMPLEX,MULTICAST> mtu 1492inet 117.80.111.85 -> 118.5.113.169 netmask 0xff000000

We can make the configuration permanent by creating/etc/ifconfig.pppoe0:

create# Mark the physical interface used by this PPPoE interface up! /sbin/ifconfig re0 up# Let $int use re0 as its Ethernet interface! /sbin/pppoectl -e re0 $int# Configure authentication! /sbin/pppoectl $int myauthproto=pap 'myauthname=XXX' 'myauthsecret=YYY' hisauthproto=none# Configure the PPPoE interface itself. These addresses are magic# meaning we don't care about either address and let the remote# ppp choose them.0.0.0.0 0.0.0.1 up

To automatically get aroute(8) to the outside world, we useifwatchd(8). Create the following scripts:

#!/bin/sh/sbin/route add default $5

#!/bin/sh/sbin/route delete default $5

And make them executable by root:

#chmod +x /etc/ppp/ip-up /etc/ppp/ip-down

Now, edit/etc/rc.conf to enable ifwatchd:

ifwatchd=YESifwatchd_flags="-u /etc/ppp/ip-up -d /etc/ppp/ip-down pppoe0"

And start the service:

#service ifwatchd start

#ifconfig vlan0 create#ifconfig vlan0 vlan 6 vlanif pppoe0

createvlan 6 vlanif pppoe0

# Obey interface MTUs when calculating MSSnet.inet.tcp.mss_ifmtu=1

procedure "norm4" {normalize: "random-id", "max-mss" 1440}procedure "norm6" {normalize: "random-id", "max-mss" 1420}group "external" on "pppoe0" {pass stateful out final family inet4 all apply "norm4"pass stateful out final family inet6 all apply "norm6"}

# sysctl -w net.inet6.ip6.accept_rtadv=1

duidipv6onlyrequire dhcp_server_identifieroption interface_mtunoipv6rsslaac privateinterface pppoe0  option rapid_commit  ipv6rs  iaid 1  ia_na 1  ia_pd 2/::/64 re1/1

npf(7) (NetBSD Packet Filter) is NetBSD's firewall. It can be used to protect a local network from the dangers of the wider Internet, and can also perform Network Address Translation (NAT) in order to make sure IPv4 packets reach the correct destination computer.

Some usage examples of NPF can be found in the subdirectory/usr/share/examples/npf. Look at the filesoho_gw-npf.conf for an example of a configuration for a small home/office gateway.

In order to use NetBSD as a gateway, the packet forwardingsysctl(8) options must be enabled. You can add them to/etc/sysctl.conf.

#sysctl -w net.inet.ip.forwarding=1net.inet.ip.forwarding = 1#sysctl -w net.inet6.ip6.forwarding=1net.inet6.ip6.forwarding = 1

And enable NPF in/etc/rc.conf:

npf=YES

The following configuration performs straightforward NAT, usingre0 as the external network andre1 as the internal network interface. If you have multiple internal network interfaces, you might want to bridge them. SeeSection 24.6, “Setting up a network bridge device”

$ext_if = "re0"$int_if = "re1"$ext_addrs = { ifaddrs($ext_if) }$localnet = { 192.168.0.0/24 }# Allow pings.alg "icmp"# Perform IPv4 NAT.map inet4($ext_if) dynamic $localnet -> inet4($ext_if)group "external" on $ext_if {# Allow all outbound traffic        pass stateful out all# Block all incoming trafficblock in all}group "internal" on $int_if {# We trust the internal network.pass in final allpass out final all}group default {pass final on lo0 allblock all}

Usually, you will want to configuredhcpd(8) so clients are automatically assigned IP addresses in the correct range:

subnet 192.168.0.0 netmask 255.255.255.0 {        option routers 192.168.0.1;option domain-name-servers 9.9.9.9;        option subnet-mask 192.168.0.0;        range 192.168.0.100 192.168.0.254;        default-lease-time 604800; # default lease 7 days}

A bridge can be used to combine different physical networks into one logical network, i.e. connect them at layer 2 of the ISO-OSI model, not at layer 3, which is what a router would do. It can allow multiple network interfaces to be addressed as one. The NetBSD“bridge” driver provides bridge functionality on NetBSD systems.

$ifconfig bridge0 create

$brconfig bridge0 add ne0 add ne1 up

create!brconfig $int add ne0 add ne1 up

createinet 192.168.0.1 netmask 255.255.255.0up!ifconfig bridge0 create!brconfig bridge0 add $int add ne0 add ne1 up

In our previous exampleSection 24.6, “Setting up a network bridge device”, we created abridge(4) andtap(4) that are dependent upon other networking interfaces to function. This can present a problem ifrc(8) initializes them before the interfaces they depend upon. Fortunately, it is possible to force a specific initialization order in/etc/rc.conf:

auto_ifconfig=NOnet_interfaces="ne0 ne1 pppoe0 bridge0 tap0"

With these lines,/etc/ifconfig.ne0 will be read first, and/etc/ifconfig.tap0 last. The same applies ififconfig_ne0="up" lines are used in/etc/rc.conf instead of dedicated configuration files.

The following commands can be useful for diagnosing problems: