On Tue, 27 Oct 2009 06:51:26 -0700 (PDT), Dánielisz László 
<laszlo_daniel...@yahoo.com> wrote:
> Hello,
> 
> I am looking to configure my FreeBSD 8.0 machine for the purpose specified in 
> the subject.
> Let's say I have two NICs in my PC: ext_if (for wan/pppoe connection) and 
> int_if for my LAN.
> How would you manage to get work NAT with pf using PPPoE from my ISP; I'd 
> like to use DHCP on my LAN.

It's quite easy, I did this in the past with FreeBSD 5.


1. PPPoE
--------
Setup /etc/ppp/ppp.conf with the correct data for your ISP.
It woule be like this:

<pppoe provider name, arbitrary>:
        set device PPPoE:<external interface>
        set authname <username for PPPoE connection>
        set authkey <password>
        set dial
        set login
        add default HISADDR

In /etc/rc.conf, enter

        ifconfig_<external_interface>="up"
        ppp_enable="YES"
        ppp_profile="<pppoe provider name as in /etc/ppp/ppp.conf>"
        ppp_mode="ddial"
        ppp_nat="YES"

for the external interface, and for the internal one:

        ifconfig_<internal_interface>="inet 192.168.100.1  netmask 0xffffff00"
                (or any other subnet definition you like)
        dhcpd_enable="YES"
        dhcpd_conf="/usr/local/etc/dhcpd.conf"
        dhcpd_ifaces="<internal_interface>"
        dhcpd_flags="-q"

Keep in mind that you have to load

        netgraph_load="YES"
        ng_ether_load="YES"
        ng_pppoe_load="YES"
        ng_socket_load="YES"

per /boot/loader.conf in order to enable the Netgraph
subsystem. I think tho


2. PF
-----
Sorry, I'm not familiar with PF, I always used IPFW. So I
had the rule

        add divert natd ip from any to any via <external interface>

prior to the other rules that formed a setting to be
described as: "Only allow those (named) ports for connections,
disallow anything else."


3. DHCP
-------
Install the ISC DHCP server from ports and configure the
settings for the local network as intended. THis is usually
done in /usr/local/etc/dhcpd.conf with a content like this:

        option domain-name-servers <your ISP's name servers>;
        ddns-update-style none;
        subnet 192.168.100.0 netmask 255.255.255.0 {
                range 192.168.100.2 192.168.100.250;
                option routers 192.168.100.1;
        }

You can add "host" entries for "well-known" so they always
get the same IP according to their MAC, and "deny unknown-clients;"
to force MAC knowledge.

Since I ran this setting in v5, kernel configuration required
to have

        options         DUMMYNET
        options         IPFIREWALL
        options         IPFIREWALL_VERBOSE
        options         IPFIREWALL_DEFAULT_TO_ACCEPT
        options         IPDIVERT

in the file. I'm sure this is not needed anymore, because
there are modules for this. Of course, you can include the
options for NETGRAPH here, too.



IMPORTANT NOTE: I'm not using such a setting anymore, so I'm
not sure if this is still recommended or even working on v8.




-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"

Reply via email to