HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems - BSD

This is a discussion on HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems - BSD ; Hi, all: I've slogged through getting an OpenBSD box functional as a firewall for a LAN, but always with the (simplest) configuration of two NICs, one for outside (xDSL, T-1, whatever), and one for inside, to the LAN. PF has ...

+ Reply to Thread
Results 1 to 9 of 9

Thread: HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems

  1. HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems

    Hi, all:

    I've slogged through getting an OpenBSD box functional as a firewall for a
    LAN, but always with the (simplest) configuration of two NICs, one for
    outside (xDSL, T-1, whatever), and one for inside, to the LAN. PF has been
    very good... to me.

    I'd like to create a LAN that will include an OpenBSD system. The OpenBSD
    system will do dial-up on demand for the other systems, all MS® Windows®.
    If anyone has any thoughts, hints or suggestions, I'd be very appreciative.
    I'm having a hard time finding stuff on this sort of configuration, mainly
    because, I think, no one uses dial-up, anymore!

    The users will turn on the firewall/gateway, say, in the morning, leave it
    on all day, use their Windows® systems, occasionally visiting the Internet.
    I'm not sure if the phone line for data will be exclusively used for that;
    it may also be needed for faxes. Of course, I know that while on the
    Internet, the office will not be able to receive faxes. But, it means that
    I can't just hog the line... I need to let it go after, say, 10 minutes of
    idleness.

    I'd like to figure out how to allow someone on the network the ability to
    shutdown the firewall/gateway without having to login to the system (I'm
    worried they'll freak out at having to look at a command-line), but that can
    wait, unless someone has a suggestion.

    Anyway, TIA.

    Best regards,

    Jim



  2. =?ISO-8859-1?Q?Re=3A_HOWTO_use_OpenBSD_as_on-demand_?==?ISO-8859-1?Q?dial-up_gateway_and_firewall_for_LAN_of_Win?==?ISO-8859-1?Q?dows=AE_systems?=

    J. Graue wrote:

    > Hi, all:
    >
    > I've slogged through getting an OpenBSD box functional as a firewall for a
    > LAN, but always with the (simplest) configuration of two NICs, one for
    > outside (xDSL, T-1, whatever), and one for inside, to the LAN. PF has been
    > very good... to me.
    >
    > I'd like to create a LAN that will include an OpenBSD system. The OpenBSD
    > system will do dial-up on demand for the other systems, all MS® Windows®.
    > If anyone has any thoughts, hints or suggestions, I'd be very appreciative.
    > I'm having a hard time finding stuff on this sort of configuration, mainly
    > because, I think, no one uses dial-up, anymore!
    >
    > The users will turn on the firewall/gateway, say, in the morning, leave it
    > on all day, use their Windows® systems, occasionally visiting the Internet.
    > I'm not sure if the phone line for data will be exclusively used for that;
    > it may also be needed for faxes. Of course, I know that while on the
    > Internet, the office will not be able to receive faxes. But, it means that
    > I can't just hog the line... I need to let it go after, say, 10 minutes of
    > idleness.
    >
    > I'd like to figure out how to allow someone on the network the ability to
    > shutdown the firewall/gateway without having to login to the system (I'm
    > worried they'll freak out at having to look at a command-line), but that can
    > wait, unless someone has a suggestion.
    >

    Just press the power off button, the system will fsck the filesystem
    automatically when it rebooted next time.

    Sam
    > Anyway, TIA.
    >
    > Best regards,
    >
    > Jim
    >
    >


  3. Re: HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems

    Hello, Sam:



    > I'd like to figure out how to allow someone on the network the ability to
    > > shutdown the firewall/gateway without having to login to the system (I'm
    > > worried they'll freak out at having to look at a command-line), but that

    can
    > > wait, unless someone has a suggestion.
    > >

    > Just press the power off button, the system will fsck the filesystem
    > automatically when it rebooted next time.
    >
    > Sam


    Thanks for the suggestion. I would welcome any others' thoughts on this.
    With all due respect to you, sam, I find this solution to be inelegant. If,
    on the LAN-side, someone could, say, shutdown the dial-up gateway from a Web
    page, that would be great.

    If you have any thoughts on how I might go about configuring an on-demand
    dialup gateway/firewall using OpenBSD, again, I would appreciate any input.

    Best regards,

    Jim



  4. Re: HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems

    In article <1191s8epv2svm40@corp.supernews.com>,
    J. Graue wrote:
    >Hello, Sam:
    >
    >
    >
    >> I'd like to figure out how to allow someone on the network the ability to
    >> > shutdown the firewall/gateway without having to login to the system (I'm
    >> > worried they'll freak out at having to look at a command-line), but that

    >can
    >> > wait, unless someone has a suggestion.
    >> >

    >> Just press the power off button, the system will fsck the filesystem
    >> automatically when it rebooted next time.


    You didn't mention what the hardware was, so I don't know what
    may be available.

    With some hardware, the system can hold the power up after you
    hit the power button until a complete and clean shutdown is performed.
    On these, the power off button is a reasonable approach. However, if
    the hardware does not support this, you could lose data as power drops
    between the time a logical write to disk has occurred and the time that
    the flush happens to assure a *physical* write to disk.

    >Thanks for the suggestion. I would welcome any others' thoughts on this.
    >With all due respect to you, sam, I find this solution to be inelegant. If,
    >on the LAN-side, someone could, say, shutdown the dial-up gateway from a Web
    >page, that would be great.


    Hmm ... perhaps a CGI script -- ideally locked out of access
    from outside, and available only to local IPs, which invokes the
    following command line:

    shutdown -h -p +5 web requested shutdown

    You may wish to tune either the time or the message which follows the
    time.

    It might be a good idea to have the CGI script check the current time of
    day and compare it to the normal working hours to decide whether to
    honor the web-based request. Or -- if you can find out how many systems
    are currently using the gateway, perhaps it should return a message
    indicating how many users are on, and refusing until the number is down
    to one.

    >If you have any thoughts on how I might go about configuring an on-demand
    >dialup gateway/firewall using OpenBSD, again, I would appreciate any input.


    I've only covered possibilities for making the shutdown web
    based to protect your users from the dreaded command line. However, it
    presents some interesting opportunities for Denial Of Service attacks if
    one of your internal users is feeling obnoxious. I would suggest that
    the CGI script also log the IP address (and system name, if available)
    for after-the-fact determination of the offending party.

    Good Luck,
    DoN.
    --
    Email: | Voice (all times): (703) 938-4564
    (too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
    --- Black Holes are where God is dividing by zero ---

  5. =?ISO-8859-1?Q?Re=3A_HOWTO_use_OpenBSD_as_on-demand_?==?ISO-8859-1?Q?dial-up_gateway_and_firewall_for_LAN_of_Win?==?ISO-8859-1?Q?dows=AE_systems?=

    On 05/20/05 6:58 PM, J. Graue wrote:

    > The users will turn on the firewall/gateway, say, in the morning, leave it
    > on all day, use their Windows® systems, occasionally visiting the Internet.
    > I'm not sure if the phone line for data will be exclusively used for that;
    > it may also be needed for faxes. Of course, I know that while on the
    > Internet, the office will not be able to receive faxes. But, it means that
    > I can't just hog the line... I need to let it go after, say, 10 minutes of
    > idleness.


    I did something similar before I had DSL; see the manual for ppp
    (especially the section titled DIAL ON DEMAND) and
    /etc/ppp/ppp.conf.sample for the details, but

    set timeout 600

    (assuming 10 minutes -- 600 seconds) and running it as

    ppp -auto [system]

    will do the trick. The userspace ppp software will always be running,
    but will only dial the ISP when an outgoing packet is detected. It will
    shutdown after 10 minutes of inactivity.

    > I'd like to figure out how to allow someone on the network the ability to
    > shutdown the firewall/gateway without having to login to the system (I'm
    > worried they'll freak out at having to look at a command-line), but that can
    > wait, unless someone has a suggestion.


    The system I was using was on all the time, but someone else in this
    thread suggested using a CGI script. A cron job could shut it down, but
    might cause a problem for someone working overtime...

    --
    Chris Odorjan - bobnet@canada.com

  6. =?ISO-8859-1?Q?Re=3A_HOWTO_use_OpenBSD_as_on-demand_?==?ISO-8859-1?Q?dial-up_gateway_and_firewall_for_LAN_of_Win?==?ISO-8859-1?Q?dows=AE_systems?=

    J. Graue wrote:

    > Hello, Sam:
    >
    >
    >
    >>I'd like to figure out how to allow someone on the network the ability to
    >>
    >>>shutdown the firewall/gateway without having to login to the system (I'm
    >>>worried they'll freak out at having to look at a command-line), but that

    >
    > can
    >
    >>>wait, unless someone has a suggestion.
    >>>

    >>
    >>Just press the power off button, the system will fsck the filesystem
    >>automatically when it rebooted next time.
    >>
    >>Sam

    >
    >
    > Thanks for the suggestion. I would welcome any others' thoughts on this.
    > With all due respect to you, sam, I find this solution to be inelegant. If,
    > on the LAN-side, someone could, say, shutdown the dial-up gateway from a Web
    > page, that would be great.
    >
    > If you have any thoughts on how I might go about configuring an on-demand
    > dialup gateway/firewall using OpenBSD, again, I would appreciate any input.
    >

    Just install webmin in openbsd, you can remote admin the system thru its
    web interface.

    Sam
    > Best regards,
    >
    > Jim
    >
    >


  7. Re: HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems


    "DoN. Nichols" wrote in message
    news:d6r7io$17j$1@Fuego.d-and-d.com...

    > In article <1191s8epv2svm40@corp.supernews.com>,
    > J. Graue wrote:
    > >Hello, Sam:
    > >
    > >
    > >
    > >> I'd like to figure out how to allow someone on the network the ability

    to
    > >> > shutdown the firewall/gateway without having to login to the system

    (I'm
    > >> > worried they'll freak out at having to look at a command-line), but

    that
    > >can
    > >> > wait, unless someone has a suggestion.
    > >> >
    > >> Just press the power off button, the system will fsck the filesystem
    > >> automatically when it rebooted next time.

    >
    > You didn't mention what the hardware was, so I don't know what
    > may be available.
    >
    > With some hardware, the system can hold the power up after you
    > hit the power button until a complete and clean shutdown is performed.
    > On these, the power off button is a reasonable approach. However, if
    > the hardware does not support this, you could lose data as power drops
    > between the time a logical write to disk has occurred and the time that
    > the flush happens to assure a *physical* write to disk.
    >
    > >Thanks for the suggestion. I would welcome any others' thoughts on this.
    > >With all due respect to you, sam, I find this solution to be inelegant.

    If,
    > >on the LAN-side, someone could, say, shutdown the dial-up gateway from a

    Web
    > >page, that would be great.

    >
    > Hmm ... perhaps a CGI script -- ideally locked out of access
    > from outside, and available only to local IPs, which invokes the
    > following command line:
    >
    > shutdown -h -p +5 web requested shutdown
    >
    > You may wish to tune either the time or the message which follows the
    > time.
    >
    > It might be a good idea to have the CGI script check the current time of
    > day and compare it to the normal working hours to decide whether to
    > honor the web-based request. Or -- if you can find out how many systems
    > are currently using the gateway, perhaps it should return a message
    > indicating how many users are on, and refusing until the number is down
    > to one.
    >
    > >If you have any thoughts on how I might go about configuring an on-demand
    > >dialup gateway/firewall using OpenBSD, again, I would appreciate any

    input.
    >
    > I've only covered possibilities for making the shutdown web
    > based to protect your users from the dreaded command line. However, it
    > presents some interesting opportunities for Denial Of Service attacks if
    > one of your internal users is feeling obnoxious. I would suggest that
    > the CGI script also log the IP address (and system name, if available)
    > for after-the-fact determination of the offending party.
    >
    > Good Luck,
    > DoN.
    > --
    > Email: | Voice (all times): (703) 938-4564
    > (too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
    > --- Black Holes are where God is dividing by zero ---


    Thanks, DoN. Your suggestion is a good one, and I'll see what I can do.

    Best regards,

    Jim



  8. Re: HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems


    "sam" wrote in message
    news:d6rr8o$2s6i$1@news.hgc.com.hk...



    > > If you have any thoughts on how I might go about configuring an

    on-demand
    > > dialup gateway/firewall using OpenBSD, again, I would appreciate any

    input.
    > >

    > Just install webmin in openbsd, you can remote admin the system thru its
    > web interface.


    I'll check into this. It's nothing with which I'm familiar, but I'm happy
    to learn new things.

    Best regards,

    Jim



  9. Re: HOWTO use OpenBSD as on-demand dial-up gateway and firewall for LAN of Windows® systems


    "Chris 'Bob' Odorjan" wrote in message
    news:fnn7m2-tjr.ln1@bobnet.odorjan.ca...

    > On 05/20/05 6:58 PM, J. Graue wrote:
    >
    > > The users will turn on the firewall/gateway, say, in the morning, leave

    it
    > > on all day, use their Windows® systems, occasionally visiting the

    Internet.
    > > I'm not sure if the phone line for data will be exclusively used for

    that;
    > > it may also be needed for faxes. Of course, I know that while on the
    > > Internet, the office will not be able to receive faxes. But, it means

    that
    > > I can't just hog the line... I need to let it go after, say, 10 minutes

    of
    > > idleness.

    >
    > I did something similar before I had DSL; see the manual for ppp
    > (especially the section titled DIAL ON DEMAND) and
    > /etc/ppp/ppp.conf.sample for the details, but
    >
    > set timeout 600
    >
    > (assuming 10 minutes -- 600 seconds) and running it as
    >
    > ppp -auto [system]
    >
    > will do the trick. The userspace ppp software will always be running,
    > but will only dial the ISP when an outgoing packet is detected. It will
    > shutdown after 10 minutes of inactivity.
    >
    > > I'd like to figure out how to allow someone on the network the ability

    to
    > > shutdown the firewall/gateway without having to login to the system (I'm
    > > worried they'll freak out at having to look at a command-line), but that

    can
    > > wait, unless someone has a suggestion.

    >
    > The system I was using was on all the time, but someone else in this
    > thread suggested using a CGI script. A cron job could shut it down, but
    > might cause a problem for someone working overtime...
    >
    > --
    > Chris Odorjan - bobnet@canada.com


    Thank you, very much, for addressing this and giving a hint. I'll dive in
    and see if I can make this system do my bidding!

    Best regards,

    Jim



+ Reply to Thread