Date: Fri, 7 Dec 2012 15:29:15 +0000 From: Tom Evans <tevans.uk@googlemail.com> To: Ronald Klop <ronald-freebsd8@klop.yi.org> Cc: freebsd-stable@freebsd.org Subject: Re: Using dhclient on WAN if on a box serving DHCP to LAN if Message-ID: <CAFHbX1%2Bft3x5Ocw3pGtG9QTv5YFVRCtAWmfM8xE8oBVNVzgr-w@mail.gmail.com> In-Reply-To: <op.wox4tlex8527sy@ronaldradial.versatec.local> References: <CAFHbX1LViMrh95sAm3uMJ1dt3RtUwKbPCtHQCTU2xaALaf7n7A@mail.gmail.com> <op.wox4tlex8527sy@ronaldradial.versatec.local>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Dec 7, 2012 at 12:25 PM, Ronald Klop
<ronald-freebsd8@klop.yi.org> wrote:
> On Fri, 07 Dec 2012 12:38:45 +0100, Tom Evans <tevans.uk@googlemail.com>
>
> What is in dhcpd.conf?
>
> Ronald.
>
dhcpd.conf is straightforward:
option domain-name "xxxxx.com";
option subnet-mask 255.255.255.0;
default-lease-time 3600;
max-lease-time 86400;
ddns-update-style none;
subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.200 192.168.1.253;
option domain-name-servers 192.168.1.1;
option routers 192.168.1.1;
}
Ian: I had already specified dhcpd_ifaces to be just the internal
interface, which is why it had confused me! I haven't yet got any
complaints from dhcpd about the subnet on the extif, so far as I can
see.
For clarity, this is my pf.conf, which again is very simple:
ext_if="ale0"
int_if="{ em0 }"
antispoof_if="{ lo0 em0 }"
tcp_services="{ 22 443 }"
icmp_types="{ echoreq echorep unreach }"
# options
set block-policy return
set loginterface $ext_if
set skip on lo0
# tables
table <sshguard> persist
# scrub
#match in all scrub (no-df)
# nat/rdr
nat on $ext_if from !($ext_if) -> ($ext_if:0)
nat-anchor "ftp-proxy/*"
rdr-anchor "ftp-proxy/*"
# filter rules
block in
pass out keep state
anchor "ftp-proxy/*"
antispoof quick for $antispoof_if
block in quick on $ext_if from <sshguard> label "ssh bruteforce"
pass in on $ext_if inet proto tcp from any to ($ext_if) port
$tcp_services flags S/SA keep state
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in quick on $int_if
Ideally, I would like the configuration to not specify the details of
the configuration. Eg, if I instead had a dynamic IP, how could I
configure that, as I would not know IP, netmask, broadcast and router
addresses beforehand.
Cheers
Tom
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAFHbX1%2Bft3x5Ocw3pGtG9QTv5YFVRCtAWmfM8xE8oBVNVzgr-w>