> On 5/31/05, [EMAIL PROTECTED] <[EMAIL PROTECTED]>
> wrote:
>> Is there somebody using OpenBSD as AP for his WLAN?
>> I would need help after 7 guys checked my PF and nobody found a
>> misstake...
>>
>> It still dosn't work (NAT)... :-(
>> So I would be happy if somebody who use also OpenBSD as AP would contact
>> me and help me to set up an AP on OpenBSD (it's my first AP on
>> OpenBSD..).
>
> If you can use DNS from your wifi-clients, you seem to have some sort of
> connectivity. If your pf ruleset isn't wrong, perhaps there are other
> config
> problems. But who can tell, if all you say is "this doesn't work".
>
> So post some actual useful data, perhaps then someone has an idea
> what goes wrong. This isn't some paid support hotline, where everyone
> is happy to pull the needed pieces of information out of your nose.
>
> --knitti
Well ok:
Here are all configs I used:
ath0 (router):
ifconfig ath0 nwkey 0x1deadbeef1
ifconfig ath0 inet 10.10.10.1 255.255.255.0 NONE media autoselect mediaopt
hosta p nwid my_net chan 11
wi0 (client)
ifconfig wi0 nwkey 0x1deadbeef1
ifconfig wi0 10.10.10.10 255.255.255.0 nwid my_net
WLAN with the "test"-key from the Manpages works well.
PF:
Ext = "tun0" # Device an dem das Internet angeschlossen ist
Int = "xl0" # Device an dem das interne Netz haengt
IntNet = "192.168.0.0/16" # Adressraum des internen Netzes
RouterIP = "192.168.0.1" # IP Adresse des Routers
Int2 = "ath0"
IntNet2 = "10.10.10.0/24"
RouterIP2 = "10.10.10.1"
Loop = "lo0" # Loopback Device
table <NoRoute> { 127.0.0.1/8, 172.16.0.0/12, 192.168.0.0/16, !$IntNet,
10.0.0.0/8, !$IntNet2, 255.255.255.255/32 }
# Ports die geoeffnet werden sollen
InServicesTCP = "{ ssh, auth, http }"
### OPTIONS ###
# Macht Statistiken fuer die DSL-Verbindung (pfctl -s info)
set loginterface $Ext
# Beendet inaktive Verbindungen schneller - geringerer Speicherverbrauch.
set optimization aggressive
# Fragmentierte Pakete saeubern
scrub on $Ext all fragment reassemble random-id
altq on $Ext priq bandwidth 100Kb queue { q_pri, q_def }
queue q_pri priority 7
queue q_def priority 1 priq(default)
### NAT & FORWARD ###
# NAT aktivieren (unter Linux als Masquerading bekannt)
nat on $Ext from $IntNet to any -> $Ext static-port
nat on $Ext from $IntNet2 to any -> $Ext static-port
# Active FTP - Umleitung zu unserem ftp-proxy
rdr on $Int proto tcp from !$RouterIP to !$IntNet port 21 -> 127.0.0.1
port 8021
rdr on $Int2 proto tcp from !$RouterIP2 to !$IntNet2 port 21 -> 127.0.0.1
port 8021
rdr-anchor redirect
### FILTER ###
# Zum Debuggen....
#pass out quick all # Alles durchlassen
#pass in quick all # Alles durchlassen
# Generelle Block Regel
block on $Ext
# Freiwillig machen wir keinen mucks ;)
block return log on $Ext
# Wir wollen kein IPv6.0
block quick inet6
# Loopback Device darf alles
pass quick on $Loop
# Erschwert scannen mit nmap und co.
block in log quick on $Ext inet proto tcp from any to any flags FUP/FUP
block in log quick on $Ext inet proto tcp from any to any flags SF/SFRA
block in log quick on $Ext inet proto tcp from any to any flags /SFRA
block in log quick on $Ext os NMAP
# IP Spoofing verhindern
block in log quick on $Ext inet from <NoRoute> to any
block in log quick on $Ext inet from any to <NoRoute>
# Active FTP erlauben
pass in quick on $Ext inet proto tcp from any to any port > 49151 user
proxy flags S/SAFR keep state
# Ping akzeptieren (ablehnen ist uebrigends wenig sinnvoll)
pass in quick on $Ext inet proto icmp all icmp-type 8 code 0 keep state
# Ports nach aussen oeffnen
pass in quick on $Ext inet proto tcp from any to any port $InServicesTCP
flags S/SAFR keep state label ServicesTCP
anchor passin
# Raus darf (fast) alles
pass out quick on $Ext keep state queue (q_def,q_pri)
########
Problem:
dddddddd
I can reach all internal Services (e.g. DNS, NFS) so PF knows that the
notebooks is allowed to acces them.
Here's something from my notebook:
------------------------------------------------------
# nslookup www.openbsd.org
Server: 10.10.10.1
Address: 10.10.10.1#53
Non-authoritative answer:
Name: www.openbsd.org
Address: 129.128.5.191
# lynx
Alert!: Unable to connect to remote host.
Looking up www.OpenBSD.org
Making HTTP connection to www.OpenBSD.org
Alert!: Unable to connect to remote host.
lynx: Can't access startfile http://www.OpenBSD.org/
------------------------------------------------------
I've just the problem that I can't acces any service outsite my Network so
I think there's something wrong with the NAT-Rule.
I tried also to use a lower MTU because I readed somewhere that that could
be a Problem too but that didn't helped.
My gateware/dns is 10.10.10.1 and the Client has no running PF.
If you need any other informations please ask me.
Kind regards,
Sebastian
