diff options
| author | Jordan K. Hubbard <jkh@FreeBSD.org> | 1997-01-17 15:01:03 +0000 |
|---|---|---|
| committer | Jordan K. Hubbard <jkh@FreeBSD.org> | 1997-01-17 15:01:03 +0000 |
| commit | ea56062c34acc89057c09b436d24804d3ac13963 (patch) | |
| tree | a81a79067db1042168a0ce526d7fac69773b1781 /en | |
| parent | 88748e54481fde8a63e7bc2f2f0331b36ef3dadd (diff) | |
Notes
Diffstat (limited to 'en')
| -rw-r--r-- | en/tutorials/Makefile | 2 | ||||
| -rw-r--r-- | en/tutorials/index.sgml | 11 | ||||
| -rw-r--r-- | en/tutorials/ppp/Makefile | 4 | ||||
| -rw-r--r-- | en/tutorials/ppp/ppp.sgml | 1933 |
4 files changed, 1948 insertions, 2 deletions
diff --git a/en/tutorials/Makefile b/en/tutorials/Makefile index 7f32f2a5d2..c32c458f52 100644 --- a/en/tutorials/Makefile +++ b/en/tutorials/Makefile @@ -1,4 +1,4 @@ DOCS= index.sgml SUBDIR= disklessx -DOCSUBDIR= ddwg devel fonts mh multios newuser +DOCSUBDIR= ddwg devel fonts mh multios newuser ppp .include "../web.mk" diff --git a/en/tutorials/index.sgml b/en/tutorials/index.sgml index dff738bb1c..897accc191 100644 --- a/en/tutorials/index.sgml +++ b/en/tutorials/index.sgml @@ -1,6 +1,6 @@ <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN" [ <!ENTITY base CDATA ".."> -<!ENTITY date "$Date: 1997-01-13 18:05:53 $"> +<!ENTITY date "$Date: 1997-01-17 15:00:57 $"> <!ENTITY title "FreeBSD Tutorials"> <!ENTITY % includes SYSTEM "../includes.sgml"> %includes; ]> @@ -19,18 +19,27 @@ <li><a href="mh/mh.html">An introduction to the MH mail software</a> (<a href="mh/mh.ps">postscript</a>, <a href="mh/mh-html.tar.gz">gzipd tar file</a>)</li> + <li><a href="devel/devel.html">A User's Guide to FreeBSD Programming Tools</a> (<a href="devel/devel.ps">postscript</a>, <a href="devel/devel-html.tar.gz">gzipd tar file</a>)</li> + <li><a href="ddwg/ddwg.html">Writing device drivers for FreeBSD</a> (<a href="ddwg/ddwg.ps">postscript</a>, <a href="ddwg/ddwg-html.tar.gz">gzipd tar file</a>)</li> + + <li><a href="ppp/ppp.html">Pedantic PPP primer - IP Aliasing</a> + (<a href="ppp/ppp.ps">postscript</a>, + <a href="ppp/ppp-html.tar.gz">gzipd tar file</a>)</li> + <li><a href="multios/multios.html">Using FreeBSD with other operating systems</a> (<a href="multios/multios.ps">postscript</a>, <a href="multios/multios-html.tar.gz">gzipd tar file</a>)</li> + <li><a href="fonts/fonts.html">Fonts and FreeBSD</a> (<a href="fonts/fonts.ps">postscript</a>, <a href="fonts/fonts-html.tar.gz">gzipd tar file</a>)</li> + <li><a href="http://lightstorm.gage.com/~black/ipalias.html">IP Aliasing</a></li> </ul> diff --git a/en/tutorials/ppp/Makefile b/en/tutorials/ppp/Makefile new file mode 100644 index 0000000000..d3a25caa5f --- /dev/null +++ b/en/tutorials/ppp/Makefile @@ -0,0 +1,4 @@ +DOC= ppp +SRCS= ppp.sgml + +.include <bsd.sgml.mk> diff --git a/en/tutorials/ppp/ppp.sgml b/en/tutorials/ppp/ppp.sgml new file mode 100644 index 0000000000..dd0952c1bc --- /dev/null +++ b/en/tutorials/ppp/ppp.sgml @@ -0,0 +1,1933 @@ +<!DOCTYPE linuxdoc PUBLIC "-//FreeBSD//DTD linuxdoc//EN"> +<!-- $Id: ppp.sgml,v 1.1 1997-01-17 15:01:03 jkh Exp $ --> + +<article> + +<title>PPP - Pedantic PPP Primer +<author>Maintainer: Steve Sims <tt><htmlurl +url="mailto:SimsS@IBM.NET" + name="<SimsS@IBM.NET>"></tt> + +<date>$Date: 1997-01-17 15:01:03 $ +<abstract> +This is a step-by-step guide for configuring FreeBSD systems to act +as +a dial-up router/gateway in a Local Area Environment. All entries may +be +assumed to be relevant to FreeBSD 2.2+, unless otherwise noted. +</abstract> + +<toc> + +<sect> +<heading>Overview:</heading> +<p> +The User-Mode PPP dialer in FreeBSD Version 2.2 (also known as: +<it>"IIJ-PPP"</it> ) now supports Packet Aliasing for dial up +connections to the +Internet. This feature, also known as "<IT/Masquerading/", "<IT/IP +Aliasing/", or +"<IT/Network Address Translation/", allows a FreeBSD system to act as a +dial- +on-demand router between an Ethernet-based Local Area Network and an +Internet Service Provider. Systems on the LAN can use the FreeBSD +system to forward information between the Internet by means of a +single dial-connection. + +<sect1> +<heading>Purpose of this Guide.</heading> +<p> +This guide explains how to: +<itemize> +<item>Configure the FreeBSD system to support dial-out connections, +<item>Share a dial-out connection with other systems in a network, +<item>Configure Windows platforms to use the FreeBSD system as a +gateway to the Internet. +</itemize> +<p> +While the focus of this guide is to assist in configuring IP Aliasing, + +it also includes specific examples of the configuration steps necessary + +to configure and install each individual component; each section stands + +alone and may be used to assist in the configuration of various aspects + +of FreeBSD internetworking. +</sect> + +<sect> +<heading>Building the Local Area Network</heading> + +<p> While the ppp program can, and usually is, be configured to provide +services +to <em/only/ the local FreeBSD box it can also be used to serve as a +"Gateway" (or +"router") between other LAN-connected resources and the Internet or +other Dial-Up +service. + +<sect1> +<heading>Typical Network Topology</heading> + +<p>This guide assumes a typical Local Area Network lashed together as +follows: +<verb> ++---------+ ----> Dial-Up Internet Connection +| FreeBSD | \ (i.e.: NetCom, AOL, AT&T, EarthLink, +etc) +| |-------- +| "Curly" | +| | ++----+----+ + | +|----+-------------+-------------+----| <-- Ethernet Network + | | | + | | | ++----+----+ +----+----+ +----+----+ +| | | | | | +| Win95 | | WFW | | WinNT | +| "Larry" | | "Moe" | | "Shemp" | +| | | | | | ++---------+ +---------+ +---------+ +</verb> + +<sect1> +<heading>Assumptions about the Local Area Network</heading> + +<p>Some specific assumptions about this sample network are: + +<p>Three workstations and a Server are connected with Ethernet +cabling: +<itemize> +<item>a FreeBSD Server ("Curly") with an NE-2000 adapter configured as +'ed0' +<item>a Windows-95 workstation ("Larry") with Microsoft's "native" +32-bit TCP/IP drivers +<item>a Windows for Workgroups workstation ("Moe") with Microsoft's +16-bit TCP/IP extensions +<item>a Windows NT workstation ("Shemp") with Microsoft's "native" +32-bit TCP/IP drivers +</itemize> + +<p>The IP Addresses on the Ethernet side of this sample LAN have been + +taken from the pool of "reserved" addresses proposed in RFC-1597. +IP addresses are assigned as follows: +<verb>Name IP Address +"Curly" 192.168.1.1 # The FreeBSD box +"Larry" 192.168.1.2 # The Win'95 box +"Moe" 192.168.1.3 # The WfW box +"Shemp" 192.168.1.4 # The Windows NT box +</VERB> + +<p>This guide assumes that the modem on the FreeBSD box is connected +to the first serial port ('<tt>/dev/cuaa0</tt>' or '<tt>COM1:</tt>' in +DOS-terms). + +<p>Finally, we'll also assume that your Internet Service Provider (ISP) + +automatically provides the IP addresses of both your PPP/FreeBSD side + +as well as the ISP's side. (i.e.: Dynamic IP Addresses on both ends +of the link.) Specific details for configuring the Dial-Out side of +PPP will be addressed in Section 2, "Configuring the FreeBSD System". +</sect> + +<sect> +<heading>FreeBSD System Configuration</heading> + +<p>There are three basic pieces of information that must be known to the + +FreeBSD box before you can proceed with integrating the sample Local +Area Network: +<itemize> +<item>The Host Name of the FreeBSD system; in our example it's +"Curly", +<item>The Network configuration, +<item>The <tt>/etc/hosts</tt> file (which lists the names and IP +addresses of +the other systems in your network) +</itemize> + +<p>If you performed the installation of FreeBSD over a network +connection +some of this information may already be configured into your FreeBSD +system. + +<p>Even if you believe that the FreeBSD system was properly configured + +when it was installed you should at least verify each of these bits +of information to prevent trouble in subsequent steps. + +<sect1> +<heading>Verifying the FreeBSD Host Name</heading> + +<p>It's possible that the FreeBSD host name was specified and saved when + +the system was initially installed. To verify that it was, enter the + +following command at a prompt,:<p> +<tscreen><verb> +# hostname +</verb></tscreen> + +<p>The name of the host FreeBSD system will be displayed on a +single line. If the name looks correct (this is very subjective :-) +skip ahead to Section 3.2, "Verifying the Ethernet Interface +Configuration". + +<p>For example, in our sample network, we would see 'curly.my.domain' + +as a result of the `hostname` command if the name had been set +correctly during, or after, installation. (At this point, +don't worry too much about the ".my.domain" part, we'll sort +this out later. The important part is the name up to the first dot.) + +<p>If a host name wasn't specified when FreeBSD was installed you'll +probably see 'myname.my.domain` as a response. You'll need to edit +<tt>/etc/sysconfig</tt> to set the name of the machine. + +<sect2><heading>Configuring the FreeBSD Host Name</heading> + +<p><em><bf>*** Reminder: You must be logged in as 'root' to edit the +system +configuration files!</bf></em> + +<it><bf>*** CAUTION: If you mangle the system configuration files, +chances are your system WILL NOT BOOT correctly! Be +careful!</bf></it> + +<p>The configuration file that specifies the FreeBSD system's host +name when the system boots is in <tt>/etc/sysconfig</tt>. Use the +default +text editor ('<tt/ee/') to edit this file. +<p> +Logged in as user 'root' load <tt>/etc/sysconfig</tt> into the editor +with +the following command: +<tscreen><verb> +# ee /etc/sysconfig +</verb></tscreen> + +<p>Using the arrow keys, scroll down until you find the line that +specifies the host name of the FreeBSD system. By default, this +section says: +<tscreen><verb> +--- +# Set to the name of your host - this is pretty important! +hostname=myname.my.domain +--- +</verb></tscreen> +Change this section to say (in our example): +<tscreen><verb> +--- +# Set to the name of your host - this is pretty important! +hostname=curly.my.domain +--- +</verb></tscreen> + +Once the change to the host name has been made, press the 'Esc' +key to access the command menu. Select "leave editor" and make +sure to specify "save changes" when prompted. + +<sect1> +<heading>Verifying the Ethernet Interface Configuration</heading> +<p> +To reiterate our basic assumption, this guide assumes that the Ethernet + +Interface in the FreeBSD system is named '<tt/ed0/'. This is the +default +for NE-1000, NE-2000, WD/SMC models 8003, 8013 and Elite Ultra (8216) + +network adapters. + +<p>Other models of network adapters may have different device names in + +FreeBSD. Check the FAQ for specifics about your network adapter. +If you're not sure of the device name of your adapter, check the +FreeBSD FAQ to determine the device name for the card you have and +substitute that name (i.e.: '<tt/de0/', '<tt/zp0/', or similar) in the +following +steps. + +<p>As was the case with the host name, the configuration for the FreeBSD + +system's Ethernet Interface may have been specified when the system +was installed. + +To display the configuration for the interfaces in your +FreeBSD system (Ethernet and others), enter the following command: +<tscreen><verb> +# ifconfig -a +</verb></tscreen> +(In layman's terms: "Show me the <BF/I/nter<BF/F/ace <BF/CONFIG/uration +for my +network devices".) + +An example: +<code> +# ifconfig -a + ed0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu +1500 + inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255 + ether 01:02:03:04:05:06 + lp0: flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500 + tun0: flags=8050<POINTOPOINT,RUNNING, MULTICAST> mtu 1500 + sl0: flags=c010<POINTOPOINT,LINK2,MULTICAST> mtu 552 + ppp0: flags=8010<POINTOPOINT,MULTICAST> mtu 1500 + lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384 + inet 127.0.0.1 netmask 0xff000000 +# _ +</code> +<p>In this example, the following devices were displayed:<p> +<tt/ed0:/ The Ethernet Interface<p> +<tt/lp0:/ The Parallel Port Interface (ignored in this guide)<p> +<tt/tun0:/ The "tunnel" device; <em/This is the one ppp uses!/<p> +<tt/sl0:/ The SL/IP device (ignored in this guide)<p> +<tt/ppp0:/ Another PPP device (ignored in this guide)<p> +<tt/lo0:/ The "Loopback" device (ignored in this guide)<p> + +In this example, the 'ed0' device is up and running. The key +indicators are: +<enum> +<item>Its status is "<tt/UP/", +<item>It has an Internet ("<tt/inet/") address, (in this case, +192.168.1.1) +<item>It has a valid Subnet Mask ("netmask"; 0xffffff00 is the same as +255.255.255.0), and +<item>It has a valid broadcast address (in this case, 192.168.1.255). +</enum> + +<p>If the line for the Ethernet card had shown something similar to: +<code> +ed0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500 + ether 01:02:03:04:05:06 +</code> +then the Ethernet card hasn't been configured yet. + +<p>If the configuration for the Ethernet interface is correct you can +skip +forward to Section 3.4, "Creating the list of other LAN hosts". +Otherwise, proceed with the next section. +<sect2> +<heading>Configuring your Ethernet Interface</heading> + +<p><em><bf>*** Reminder: You must be logged in as 'root' to edit the +system +configuration files!</bf></em> + +<it><bf>*** CAUTION: If you mangle the system configuration files, +chances are your system WILL NOT BOOT correctly! Be +careful!</bf></it> + +<p>The configuration file that specifies settings for the network +interfaces when the system boots is in <tt>/etc/sysconfig</tt>. Use the + +default text editor ('ee') to edit this file. +<p> +Logged in as user 'root' load <tt>/etc/sysconfig</tt> into the editor +with +the following command: +<p> +<tt> # ee /etc/sysconfig</tt> +<p> +About 100 lines from the top of <tt>/etc/sysconfig</tt> is the section +that +describes which network interfaces should be activated when the +system boots. In the default configuration file the specific line +that controls this is: + +<tscreen><verb> +network_interfaces="lo0" +</verb></tscreen> + +<p>You'll need to amend this line to tell FreeBSD that you want to +add another device, namely the '<tt/ed0/' device. Change this line +to read: + +<tscreen><verb> +network_interfaces="lo0 ed0" +</verb></tscreen> + +<p>(Note the space between the definition for the loopback device +("lo0") +and the Ethernet device ("<tt/ed0/")! + +<p>*** Reminder: If your Ethernet card isn't named '<tt/ed0/', specify +the +correct device name here instead. + +<p>If you performed the installation of FreeBSD over a network +connection +then the '<tt/network_interfaces=/' line may already include a +reference to your Ethernet adapter. If it is, verify that it is the +correct device name. + +<p>Specify the Interface Settings for the Ethernet device +('<tt/ed0/'): + +<p>Beneath the line that specifies which interfaces should be activated + +are the lines that specify the actual settings for each interface. +In the default <tt>/etc/sysconfig</tt> file is a single line that +says: + +<tscreen><verb> +ifconfig_lo0="inet localhost" +</verb></tscreen> + +<p>You'll need to add another line after that to specify the settings + +for your '<tt/ed0/' device. + +<p>If you performed the installation of FreeBSD over a network +connection +then there may already be an '<tt>ifconfig_ed0=</tt>' line after the + +loopback definition. If so, verify that it has the correct values. + +<p>For our sample configuration we'll insert a line immediately after + +the loopback device definition that says: + +<tscreen><verb> +ifconfig_ed0="inet 192.168.1.1 netmask 255.255.255.0" +</verb></tscreen> + +<p>When you've finished editing <tt>/etc/sysconfig</tt> to specify and +configure +the network interfaces the section should look really close to: + +<tscreen><verb> +--- +network_interfaces="lo0 ed0" +ifconfig_lo0="inet localhost" +ifconfig_ed0="inet 192.168.1.1 netmask 0xffffff00" +--- +</verb></tscreen> + +<p>Once all of the necessary changes to <tt>/etc/sysconfig</tt> have +been made, +press the 'Esc' key to invoke the control menu. Select "leave editor" + +and be sure to select "save changes" when prompted. + +<sect1> +<heading>Enabling Packet Forwarding</heading> + +<p>By default the FreeBSD system will not forward IP packets between +various network interfaces. In other words, routing functions (also +known as gateway functions) are disabled. + +<p>If your intent is to use a FreeBSD system as stand-alone Internet +workstation and not as a gateway between LAN nodes and your ISP you +should skip forward to Section 3.4, "Creating the List of Other +LAN Hosts". + +<p>If you intend for the PPP program to service the local FreeBSD box + +as well as LAN workstations (as a router) you'll need to enable IP +forwarding. + +<p>To enable IP Packet forwarding you'll need to edit the +<tt>/etc/sysconfig</tt> file. +Load this file into your editor with the following command: +<tscreen><verb> +# ee /etc/sysconfig +</verb></tscreen> + +<p>About 250 lines down from the top of the file will be the +configuration +section which controls IP forwarding, which will look like: +<tscreen><verb> +===== +# If you want this host to be a gateway, set to YES. +gateway=NO +===== +</verb></tscreen> + +<p>Change this line to read: +<tscreen><verb> +===== +# If you want this host to be a gateway, set to YES. +gateway=YES +===== +</verb></tscreen> + +and exit the editor (saving the changes!). + +<p>*** NOTE: This line may already be set to '<tt/gateway=YES/' if IP +forwarding +was enabled when the FreeBSD system was installed. + +<sect1> +<heading>Creating the List of other LAN +Hosts(<tt>/etc/hosts</tt>)</heading> + +<p>The final step in configuring the LAN side of the FreeBSD system is +to +create a list of the names and TCP/IP addresses of the various systems + +that are connected to the Local Area Network. This list is stored in + +the '<tt>/etc/hosts</tt>' file. + +<p>The default version of this file has only a single host name listing + +in it: the name and address of the loopback device ('lo0'). By +networking convention, this device is always named "localhost" +and always has an IP address of 127.0.0.1. (See the interface +configuration example in Section 3.2.) +<p> +To edit the <tt>/etc/hosts</tt> file enter the following command: +<tscreen><verb> +# ee /etc/hosts +</verb></tscreen> + +<p>Scroll all the way to the bottom of the file (paying attention to +the comments along the way; there's some good information there!) +and enter (assuming our sample network) the following IP addresses +and host names: +<code> +192.168.1.1 curly curly.my.domain # FreeBSD System +192.168.1.2 larry larry.my.domain # Windows '95 System +192.168.1.3 moe moe.my.domain # Windows for Workgroups +System +192.168.1.4 shemp shemp.my.domain # Windows NT System +</code> + +<p>(No changes are needed to the line for the '<tt>127.0.0.1 +localhost</tt>' +entry.) + +<p>Once you've entered these lines, press the 'Esc' key to invoke the +control +menu. Select "leave editor" and be sure to select "save changes" when + +prompted. + +<sect1> +<heading>Testing the FreeBSD system</heading> +<p> +Congratulations! Once you've made it to this point, the FreeBSD system + +is configured as a network-connected UNIX system! If you made any +changes +to the <tt>/etc/sysconfig</tt> file you should probably re-boot your +FreeBSD system. +This will accomplish two important objectives: +<itemize> +<item>Allow the changes to the interface configurations to be applied, +and +<item>Verify that the system restarts without any glaring configuration +errors. +</itemize> + +Once the system has been rebooted you should test the network +interfaces. +<p> +<sect2> +<heading>Verifying the operation of the loopback device</heading> + +<p>To verify that the loopback device is configured correctly, log in as +'root' and enter: +<tscreen><verb> +# ping localhost +</verb></tscreen> + +<p>You should see: +<code> +# ping localhost +PING localhost.my.domain. (127.0.0.1): 56 data bytes +64 bytes from 127.0.0.1: icmp_seq=0 ttl=255 time=0.219 ms +64 bytes from 127.0.0.1: icmp_seq=1 ttl=255 time=0.287 ms +64 bytes from 127.0.0.1: icmp_seq=2 ttl=255 time=0.214 m +[...] +</code> +messages scroll by until you hit Ctrl-C to stop the madness. + +<sect2> +<heading>Verifying the operation of the Ethernet Device</heading> + +<p>To verify that the Ethernet device is configured correctly, enter: + +<tscreen><verb> +# ping curly +</verb></tscreen> + +You should see: +<code> +# ping curly +PING curly.my.domain. (192.168.1.1): 56 data bytes +64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=0.219 ms +64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=0.200 ms +64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=0.187 ms +[...] +</code> +messages. + +<p>One important thing to look at in these two examples is that the +names +(loopback and curly) correctly correlate to their IP addresses +(127.0.0.1 and 192.168.1.1). This verifies that the <tt>/etc/hosts</tt> +files +is correct. + +<p>If the IP address for "curly" isn't 192.168.1.1 or the +address for "localhost" isn't 127.0.0.1, return to Section 3.4 and +review your entries in '<tt>/etc/hosts</tt>'. + +<p>If the names and addresses are indicated correctly in the result of +the ping command +but there are errors displayed then something is amiss with the +interface configuration(s). Return to Section 3.1 and verify everything +again. + +<p>If everything here checks out, proceed with the next section. +</sect> + +<sect> +<heading>Configuring the PPP Dial-Out Connection</heading> +<p> +There are two basic modes of operation of the ppp driver: "Interactive" + +and "Automatic". + +In Interactive mode you:<p> +<itemize> +<item>Manually establish a connection to your ISP, +<item>Browse, surf, transfer files and mail, etc..., +<item>Manually disconnect from your ISP. +</itemize> + +<p>In Automatic mode, the PPP program silently watches what goes on +inside the FreeBSD +system and automagically connects and disconnects with your ISP as +required to make +the Internet a seamless element of your network. + +<p>In this section we'll address the configuration(s) for both modes +with emphasis +on configuring your `ppp` environment to operate in "Automatic" mode. + +<sect1> +<heading>Backing up the original PPP configuration files</heading> + +<p>Before making any changes to the files which are used by PPP you +should make a copy of the default files that were created when the +FreeBSD system +was installed. + +Log in as the 'root' user and perform the following steps: + +Change to the '<tt>/etc</tt> directory: +<p><tt># cd /etc</tt> + +Make a backup copy the original files in the 'ppp' directory: +<p><tt># cp -R ppp ppp.ORIGINAL</TT> + +<p>You should now be able to see both a '<tt>ppp</tt>' and a +'<tt>ppp.ORIGINAL</tt>' subdirectory +in the '<tt>/etc</tt>' directory. + +<sect1> +<heading>Create your own PPP configuration files</heading> + +<p>By default, the FreeBSD installation process creates a number of +sample configuration files +in the /etc/ppp directory. Please take some time to review these files; +they were derived +from working systems and represent the features and capabilities of the +PPP program. + +<p>I <em/strongly/ encourage you to learn from these sample files and +apply them to your +own configuration as necessary. + +<p>For detailed information about the `ppp` program, read the ppp +manpage: +<tscreen><verb> +# man ppp +</verb></tscreen> + +<p>For detailed information about the `chat` scripting language used by +the PPP dialer, read +the chat manpage: +<tscreen><verb> +# man chat +</verb></tscreen> + +<p>The remainder of this section describes the recommended contents of +the PPP configuration files. + +<sect2> +<heading>The '<tt>/etc/ppp/ppp.conf</tt>' file</heading> + +<p>The '<tt>/etc/ppp/ppp.conf</tt>' file contains the information and +settings required to set up a +dial-out PPP connection. More than one configuration may be contained +in this file. +The FreeBSD handbook (XXX URL? XXX) describes the contents and syntax of +this file in detail. + +<p>This section will describe only the minimal configuration to get a +dial-out connection working. + +<p>Below is the /etc/ppp/ppp.conf file that we'll be using to provide a +dial-out Internet gateway +for our example LAN: +<code> +################################################################ +# PPP Configuration File ('/etc/ppp/ppp.conf') +# +# Default settings; These are always executed always when PPP +# is invoked and apply to all system configurations. +################################################################ +default: +set device /dev/cuaa0 +set speed 57600 +disable pred1 +deny pred1 +disable lqr +deny lqr +set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0 +OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT" +set redial 3 10 +# +# +################################################################ +# +# For interactive mode use this configuration: +# +# Invoke with `ppp -alias interactive` +# +################################################################ +interactive: +set authname Your_User_ID_On_Remote_System +set authkey Your_Password_On_Remote_System +set phone 1-800-123-4567 +set timeout 300 +set openmode active +accept chap +# +################################################################ +# +# For demand-dial (automatic) mode we'll use this configuration: +# +# Invoke with: 'ppp -auto -alias demand' +# +################################################################ +demand: +set authname Your_User_ID_On_Remote_System +set authkey Your_Password_On_Remote_System +set phone 1-800-123-4567 +set timeout 300 +set openmode active +accept chap +set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0 +add 0 0 127.2.2.2 +################################################################ +# End of /etc/ppp/ppp.conf +</code> +This file, taken verbatim from a working system, has three relevant +configuration sections: + +<sect3> +<heading>The "<tt>default</tt>" Section</heading> + +<p>The '<tt>default:</tt>' section contains the values and settings used +by every other +section in the file. Essentially, this section is implicitly added to +the configuration +lines to each other section. + +<p>This is a good place to put "global defaults" applicable to all +dial-up sessions; +especially modem settings and dialing prefixes which typically don't +change based +on which destination system you're connecting to. + +<p>Following are the descriptions of each line in the "default" section +of the sample +'<tt>/etc/ppp/ppp.conf</tt>' file: +<tscreen><verb> +set device /dev/cuaa0 +</verb></tscreen> +This statement informs the PPP program that it should use the first +serial port. +Under FreeBSD the '<tt>/dev/cuaa0</tt>' device is the same port that's +known as "<tt>COM1:</tt>" +under DOS, Windows, Windows 95, etc.... + +<p>If your modem is on <tt>COM2:</tt> you should specify +'<tt>/dev/cua01</tt>;, <tt>COM3:</tt> +would be '<tt>/dev/cua02</tt>'. +<tscreen><verb> +set speed 57600 +</verb></tscreen> +This line sets the transmit and receive speed for the connection between +the serial port +and the modem. While the modem used for this configuration is only a +28.8 device, setting +this value to 57600 lets the serial link run at a higher rate to +accommodate higher +throughput as a result of the data compression built into late-model +modems. + +If you have trouble communicating with your modem, try setting this +value to 38400 or even +as low as 19200. + +<tscreen><verb> +disable pred1 +deny pred1 +</verb></tscreen> +These two lines disable the "CCP/Predictor type 1" compression features +of the PPP program. +The current version of `ppp` supports data compression in accordance +with draft Internet +standards. Unfortunately many ISPs use equipment that does not support +this capability. +Since most modems try to perform on-the-fly compression anyway you're +probably not losing +much performance by disabling this feature on the FreeBSD side and +denying the remote side +from forcing it on you. + +<tscreen><verb> +disable lqr +deny lqr +</verb></tscreen> +These two lines control the "Line Quality Reporting" functions which are +part of the +complete Point-to-Point (PPP) protocol specification. (See RFC-1989 for +details.) + +The first line, "disable lqr", instructs the PPP program to not attempt +to report line +quality status to the device on the remote end. + +The second line, "deny lqr", instructs the PPP program to deny any +attempts by the +remote end to reports line quality. + +As most modern dial-up modems have automatic error correction and +detection and LQR +reporting is not fully implemented in many vendor's products it's +generally a safe +bet to include these two lines in the default configuration. + +<tscreen><verb> +set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATE1Q0M0 +OK-AT-OK\\dATDT\\T TIMEOUT 40 CONNECT" +</verb></tscreen> + +<em>NOTE: (This statement should appear on a single line; ignore any +line wrapping that may appear +in this document.)</em> + +This line instructs the PPP program how to dial the modem and specifies +some rudimentary +guidelines for doing so: +<itemize> +<item>Attempts to dial should fail if the modem returns a "BUSY" result +code, +<item>Attempts to dial should also fail if the modem returns a "NO +CARRIER" result code, +<item>The PPP program should expect each of the following events to +complete within a 5-second timeout period: +<itemize> +<item>The PPP program will initially expect nothing (specified above by +the \"\" portion of the statement) from the modem +<item>The program will send the modem initialization string "ATE1Q0M0" +to the modem and await a response of "OK". If a response is not +received, the program should send an attention command to the modem +("AT") and look again for a response of "OK", +<item>The program should delay for one second (specified by the "\\d" +part of the statement, and send the dialing string to the modem. The +"ATDT" portion of the statement is the standard modem prefix to dial +using tone-dialing; if you do not have touch-tone service on your local +phone line, replace the "ATDT" with "ATDP". The "\\T" string is a +placeholder for the actual phone number (which will be automatically +inserted as specified by the "set dial 123-4567"). +</itemize> +<item>Finally, before a (maximum) timeout of 40 seconds, the PPP program +should expect to see a "CONNECT" result code returned from the modem. +</itemize> + +A failure at any point in this dialog will be interpreted as a dialing +failure and the PPP +program will fail to connect. + +(For a detailed description of the mini-scripting language used by the +PPP dialer, refer +to the "chat" manpage.) + +<tscreen><verb> +set redial 3 10 +</verb></tscreen> +This line specifies that if a dial connection cannot immediately be made +the PPP program +should retry (up to 3 times if necessary) with a delay of 10 seconds +between redialing +attempts. + +<sect3> +<heading>The "<tt>interactive</tt>" Section</heading> + +<p>The '<tt>interactive:</tt>' section contains the values and settings +used to set up an +"interactive" PPP session with a specific remote system. Settings in +this section will +have the lines included in the "default" section included +automatically. + +<p>The example cited in this section of the guide presumes that you'll +be connecting +to a remote system that understands how to authenticate a user without +any fancy +scripting language. That is, this sample uses the CHAP protocol to set +up the connection. + +<p>A good rule of thumb is that if the Windows '95 dialer can set up a +connection by +just clicking the "Connect" button this sample configuration should work +OK. + +<p>If, on the other hand, when you connect to your ISP using Microsoft +Windows '95 +Dial-Up Networking you need to resort to using the "Dial Up Scripting +Tool" from +the Microsoft Plus! pack or you have to select "Bring up a terminal +windows after dialing" +in the Windows '95 connection options then you'll need to look at the +sample PPP configuration +files and the ppp manpage for examples of "expect / response" scripting +to make your ISP +connection. + +<p>Or even better, find an ISP who knows how to provide PAP or CHAP +authentication! + +<p>The configuration examples shown here have been successfully used to +connect to: +<itemize> +<item>Various Shiva LanRovers +<item>The IBM Network (<url url="http://www.ibm.net">) +<item>AT&T WorldNet (<url url="http://att.com/worldnet">) +<item>Erol's (<url url="http://www.erols.com">) +</itemize> + +Following are descriptions for each line in the "interactive" section of +the sample +'<tt>/etc/ppp/ppp.conf</tt>' file: + +<tscreen><verb> +set authname Your_User_ID_On_Remote_System +</verb></tscreen> +This line specifies the name you would use to log in to the remote +system. + +<tscreen><verb> +set authkey Your_Password_On_Remote_System +</verb></tscreen> +This is the password you'd use to log in to the remote system. + +<tscreen><verb> +set phone 1-800-123-4567 +</verb></tscreen> +This is the phone number of the remote system. If you're inside a PBX +you can +prepend '<tt>9, </tt>' to the number here. + +<tscreen><verb> +set timeout 300 +</verb></tscreen> +This tells the PPP program that it should automatically hang up the +phone if no data has +be exchanged for 300 seconds (5 minutes). You may wish to tailor this +number to your +specific requirements. + +<tscreen><verb> +set openmode active +</verb></tscreen> +This tells the PPP program that once the modems are connected it should +immediately +attempt to negotiate the connection. Some remote sites do this +automatically, some +don't. This instructs your side of the link to take the initiative and +try to set +up the connection. + +<tscreen><verb> +accept chap +</verb></tscreen> +This tells the PPP program to use the "Challenge-Handshake +Authentication Protocol" to +authenticate you. The values exchanged between the local and remote +side for UserID and +password are taken from the 'authname' and 'authkey' entries above. + +<sect3> +<heading>The "<tt>demand</tt>" Section</heading> + +<p>The "<tt>demand</tt>" section contains the values and settings used +to set up a +"Dial-on-demand" PPP session with a specific remote system. Settings in +this section +will also have the lines included in the "default" section included +automatically. + +<p>Except for the last two lines in this section it is identical to the +configuration section +which defines the "interactive" configuration. + +<p>As noted in Paragraph ???, the examples cited in this section of the +guide presume +that you'll be connecting to a remote system that understands how to use +the CHAP protocol +to set up the connection. + +<p>Following are descriptions for each line in the "demand" section of +the sample +'<tt>/etc/ppp/ppp.conf</tt>' file: + +<tscreen><verb> +set authname Your_User_ID_On_Remote_System +</verb></tscreen> +This line specifies the name you would use to log in to the remote +system. + +<tscreen><verb> +set authkey Your_Password_On_Remote_System +</verb></tscreen> +This is the password you'd use to log in to the remote system. + +<tscreen><verb> +set phone 1-800-123-4567 +</verb></tscreen> +This is the phone number of the remote system. + +<tscreen><verb> +set timeout 300 +</verb></tscreen> +This tells the PPP program that it should automatically hang up the +phone if no data +has be exchanged for 300 seconds (5 minutes). You may wish to tailor +this number to +your specific requirements. + +<tscreen><verb> +set openmode active +</verb></tscreen> +This tells the PPP program that once the modems are connected it should +immediately +attempt to negotiate the connection. Some remote sites do this +automatically, some +don't. This instructs your side of the link to take the initiative and +try to set +up the connection. + +<tscreen><verb> +accept chap +</verb></tscreen> +This tells the PPP program to use the "Challenge-Handshake +Authentication Protocol" to +authenticate you. The values exchanged between the local and remote +side for UserID +and password are taken from the 'authname' and 'authkey' entries +above. + +<tscreen><verb> +set ifaddr 127.1.1.1/0 127.2.2.2/0 255.255.255.0 +</verb></tscreen> +This command sets up a pair of "fake" IP addresses for the local and +remote sides of +the PPP link. It instructs the PPP program to create an IP address of +127.1.1.1 +for the local side of the '<tt/tun0/' (tunnel) device (refer back to +section ?? for +a description of this device) and 127.2.2.2 for the remote side. +Appending '<tt>/0</tt>' to each address tells the PPP program that zero +of the bits +that make up these addresses are significant and can (in fact, must!) be +negotiated +between the local and remote systems when the link is established. The +255.255.255.0 +string tells the PPP program what Subnet mask to apply to these +pseudo-interfaces. + +<p>Remember, we've assumed that your ISP provides the IP addresses for +both ends of the link! +If your ISP assigned you a specific IP address that you should use on +your side when configuring +your system, enter that IP address here <em/instead/ of +<tt>127.1.1.1</tt>. + +Conversly, if your ISP gave you a specific IP address that he uses on +his end you should +enter that IP address here <em/instead/ of <tt>127.2.2.2</tt>. + +In both cases, it's probably a good idea to leave the '<tt>/0</tt>' on +the end of each address. +This gives the PPP program the opportunity to change the address(es) of +the link if it <em/has/ to. + +<tscreen><verb> +add 0 0 127.2.2.2 +</verb></tscreen> +This last line tells the PPP program that it should add a default route +for IP traffic that +points to the (fake) IP address of the ISP's system. + +<em>*** Note: If you used an ISP-specified address instead of +<tt>127.2.2.2</tt> on the preceeding +line, use the same number here instead of <tt>127.2.2.2</tt></em>. + +<p>By adding this "fake" route for IP traffic, the PPP program can, +while idle: +<itemize> +<item>Accept packets that FreeBSD doesn't already know how to +forward, +<item>Establish a connection to the ISP "<em/on-the-fly/", +<item>Reconfigure the IP addresses of the local and remote side of the +link, +<item>Forward packets between your workstation and the ISP. +</itemize> +automatically! + +<p>Once the number of seconds specified by the timeout value in the +"default" section +have elapsed without any TCP/IP traffic the PPP program will +automatically close the +dial-up connection and the process will begin again. + +<sect2> +<heading>The '<tt>/etc/ppp/ppp.linkup</tt>' file</heading> + +<p>The other file needed to complete the PPP configuration is found in + +'<tt>/etc/ppp/ppp.linkup</tt>'. This file contains instructions for the +PPP +program on what actions to take after a dial-up link is established. + +In the case of dial-on-demand configurations the PPP program will need +to delete the +default route that was created to the fake IP address of the remote side +(127.2.2.2 +in our example in the previous section) and install a new default route +that points +the actual IP address of the remote end (discovered during the dial-up +connection setup). + +A representative '<tt>/etc/ppp/ppp.linkup</tt>' file: +<code> +#########################################################################= + +# PPP Link Up File ('/etc/ppp/ppp.linkup') +# +# This file is checked after PPP establishes a network connection. +# +# This file is searched in the following order. +# +# 1) First, the IP address assigned to us is searched and +# the associated command(s) are executed. +# +# 2) If the IP Address is not found, then the label name specified at + +# PPP startup time is searched and the associated command(s) +# are executed. +# +# 3) If neither of the above are found then commands under the label +# 'MYADDR:' are executed. +# +#########################################################################= + +# +# This section is used for the "demand" configuration in +# /etc/ppp/ppp.conf: +demand: + delete ALL + add 0 0 HISADDR +# +# All other configurations in /etc/ppp/ppp.conf use this: +# +MYADDR: + add 0 0 HISADDR +######################################################################## +# End of /etc/ppp/ppp.linkup +</code> +Notice that there is a section in this file named "demand:", identical +to the +configuration name used in the '<tt>/etc/ppp/ppp.conf</tt>' file. This +section instructs the +PPP program that once a link is established using this configuration, it +must: +<enum> + <item>Remove any IP routing information that the PPP program has +created + <item>Add a default route the remote end's actual address. +</enum> + +<p>It's critical that those configurations in +'<tt>/etc/ppp/ppp.conf</tt>' which include +the '<tt/set ifaddr/' and '<tt/add 0 0/' statements (i.e.: those +configurations used for +Dial-on-Demand configurations) execute the "delete ALL" and "add 0 0 +HISADDR" commands +in <tt>/etc/ppp/ppp.linkup</tt>. + +<p><bf><em>This is the mechanism that controls the actual on-demand +configuration of the link.</em></bf> + +<p>All configurations not explicitly named in +<tt>/etc/ppp/ppp.linkup</tt> will use whatever +commands are in the "MYADDR:" section of the file. This is where +non-Demand-Dial configurations +(such as our "interactive:" sample) will fall through to. This section +simply adds a +default route to the ISP's IP address (at the remote end). + +<sect1> +<heading>IP Aliasing</heading> + +<p>All of the configuration steps described thus far are relevant to any + +FreeBSD system which will be used to connect to an ISP via dial-up +connection. + +<p>If your sole objective in reading this guide is to connect your +FreeBSD box to the +Internet using dial-out ppp you can proceed to Section 6, "Testing the +Network". + +One very attractive feature of the PPP program in on-demand mode is its +ability to +route IP traffic between other systems on the Local Area Network +automatically. +This feature is known by various names, "<em/IP Aliasing/", "<em/Network +Address Translation/", +"<em/Address Masquerading/" or "<em/Transparent Proxying/". + +<p>Regardless of the terminology used, this mode is not, however, +automatic. +If the PPP program is started normally then the program will not forward +packets +between LAN interface(s) and the dial-out connection. In effect, only +the FreeBSD system is +connected to the ISP; other workstations cannot "share" the same +connection. + +For example, if the program is started with either of the following +command lines: +<p><tt># ppp interactive (Interactive mode)</tt><p> or +<p><tt># ppp -auto demand (Dial-on-Demand mode)</tt> +<p>then the system will function as an Internet-connected workstation +<em/only/ for the +FreeBSD box. + +To start the PPP program as a gateway between LAN resources and the +Internet, +one of the following command lines would be used instead: +<p><tt># ppp -alias interactive (Interactive mode)</tt><p> or +<p><tt># ppp -auto -alias demand (Dial-on-Demand mode)</tt> +<p>Keep this in mind if you intend to proceed with Section 5, +"Configuring Windows Systems". +</sect> + +<sect> +<heading>Configuring Windows Systems</heading> +<p> +As indicated in Section 1, our example network consists of a FreeBSD +system ("Curly") which acts as a gateway (or router) between a Local +Area Network consisting of two different flavors of Windows +Workstations. In order for the LAN nodes to use Curly as a router they +need to be properly configured. Note that this section does not explain +how to configure the Windows workstations for Dial-Up networking. If +you need a good explanation of that procedure, I recommend +<url url="http://www.aladdin.co.uk/techweb">. + +<sect1> +<heading> Configuring Windows 95</heading> + +<p>Configuring Windows 95 to act as an attached resource on your LAN is +relatively simple. +The Windows 95 network configuration must be slightly modified to use +the FreeBSD system +as the default gateway to the ISP. +Perform the following steps: + +<p><bf>Create the Windows 95 "hosts" file:</bf> + +<p>In order to connect to the other TCP/IP systems on the LAN you'll +need +to create an identical copy of the "hosts" file that you installed on +the +FreeBSD system in Section 3.4. +<itemize> +<item>Click the "Start" button; select "Run..."; enter "notepad +\WINDOWS\HOSTS" (without the quotes) and click "OK" +<item>In the editor, enter the addresses and system names from the hosts +file shown in Section 3.4. +<item>When finished editing, close the notepad application (making sure +that you save the file!). +</itemize> + +<p><bf>Configure the Windows 95 TCP/IP Network Configuation +settings</bf>: +<itemize> +<item>Click the "Start" button on the taskbar; select "Settings" and +"Control Panel". +<item>Double-click the "Network" icon to open it.<p> + The settings for all Network Elements are displayed. +<item>With the "Configuration" tab selected, scroll down the list of +installed + components and highlight the "TCP/IP-><em/YourInterfaceType/" line +(where + "<em/YourInterfaceType/" is the name or type of Ethernet adapter in + your system). + <p>If TCP/IP is not listed in the list of installed network components, + + click the "Add" button and install it before proceeding. + <p>(Hint: "Add | Protocol | Microsoft | TCP/IP | OK") +<item>Click on the "Properties" button to display a list of the settings +associated with the TCP component. +</itemize> + +<p><bf>Configure the IP Address Information:</bf> +<itemize> +<item>Click the "IP Address" tab +<item>Click the "Specify an IP address" radio button. + <p>(In our example LAN the Windows 95 system is the one we've called +"Larry".) +<item>In the "IP Address" field enter "192.168.1.2". +<item>Enter 255.255.255.0 in the "Subnet Mask" field. +</itemize> + +<p><bf>Configure the Gateway information:</bf> +<itemize> +<item>Click on the "Gateway" tab + <p>For our example network the FreeBSD box will be acting as our +gateway to the Internet (routing packets between the Ethernet LAN and +the PPP dial-up connection. Enter the IP address of the FreeBSD +Ethernet interface, 192.168.1.1, in the "New gateway" field and click +the "Add" button. +If any other gateways are defined in the "Installed gateways" list you +may wish to consider removing them. +</itemize> + +<p><bf>Configure the DNS Information:</bf> + +<p>This guide assumes that your Internet Service Provider has given +you a list of Domain Name Servers (or "DNS Servers") that you should +use. +If you wish to run a DNS server on your local FreeBSD system, refer to + +Section 6, "Exercise for the Interested Student" for tips on setting +up DNS on your FreeBSD system. + +<itemize> +<item>Click the "DNS Configuration" tab +<item>Make sure that the "Enable DNS" radio button is selected. + <p>(If this button is not selected only the entries that + we put in the host file(s) will be available and your Net-Surfing + will not work as you expect!) +<item>In the "Host" field enter the name of the Windows 95 box, in this +case: "Larry". +<item>In the "Domain" field enter the name of our local network, in this +case: "my.domain" +<item>In the "DNS Server Search Order" section, enter the IP address of +the DNS server(s) + that your ISP provided, clicking the "Add" button after every address +is entered. + Repeat this step as many times as necessary to add all of the addresses +that your + ISP provided. +</itemize> + +<p><bf>Other Windows 95 TCP/IP options:</bf> + +<p>For our purposes the settings under the "Advanced", "WINS +Configuration" and +"Bindings" tabs are not necessary. + +<p>If you wish to use the Windows Internet Naming Service ("WINS") your +attention is +invited to <url url="http://www.localnet.org"> for more information +about WINS +settings, specifically regarding sharing files transparently across the +Internet. + +<p><bf>Mopping up:</bf> +<itemize> +<item>Click on the "OK" button to close the TCP/IP Properties window. + +<item>Click on the "OK" button to close the Network Control Panel. +<item>Reboot your computer if prompted to do so. +</itemize> + +<p> That's it! +<sect1> +<heading>Configuring Windows NT</heading> + +<p>Configuring Windows NT to act as a LAN resource is also relatively +straightforward. +The procedures for configuring Windows NT are similar to Windows 95 with +minor exceptions +in the user interface. + +<p>The steps shown here are appropriate for a Windows NT 4.0 +Workstation, but the +principles are the same for NT 3.5x. You may wish to refer to the +"Configuring Windows for Workgroups" +section if you're configuring Windows NT 3.5<it/x/, since the user +interface is the same for NT 3.5 and +WfW. + +<p>Perform the following steps: + +<p><bf>Create the Windows NT "hosts" file:</bf> + +<p>In order to connect to the other TCP/IP systems on the LAN you'll +need to create +an identical copy of the "hosts" file that you installed on the FreeBSD +system in Section 3.4 +<itemize> +<item>Click the "Start" button; select "Run..."; enter "notepad +\WINDOWS\SYSTEM\DRIVERS\ETC\HOSTS" (without the quotes) and click +"OK" +<item>In the editor, enter the addresses and system names from Section +3.4. +<item>When finished editing, close the notepad application (making sure +that you save the file!). +</itemize> + +<p><bf>Configure the Windows NT TCP/IP Network Configuation +settings</bf>: +<itemize> +<item>Click the "Start" button on the taskbar; select "Settings" and +"Control Panel". +<item>Double-click the "Network" icon to open it. +<item>With the "Identification" tab selected, verify the "Computer Name" +and "Workgroup" fields. In this example we'll use "Shemp" for the name +and "Stooges" for the workgroup. Click the "Change" button and amend +these entries as necessary. +<item>Select the "Protocols" tab. + <p>The installed Network Protocols will be displayed. There may be a +number of + protocols listed but the one of interest to this guide is the + "TCP/IP Protocol". If "TCP/IP Protocol" is not listed, click the + "Add" button to load it. + <p>(Hint: "Add | TCP/IP Protocol | OK") +<item>Highlight "TCP/IP Protocol" and click the "Properties" button. + <p>Tabs for specifying various settings for TCP/IP will be displayed. + +</itemize> + +<p><bf>Configuring the IP Address:</bf> + +<p>Make sure that the Ethernet Interface is shown in the "Adapter" box; +if not, +scroll through the list of adapters until the correct interface is +shown. +<itemize> +<item>Click the "Specify an IP address" radio button to enable the three +text boxes. + <p>In our example LAN the Windows NT system is the one we've called +"Shemp" +<item>In the "IP Address" field enter "192.168.1.4". +<item>Enter 255.255.255.0 in the "Subnet Mask" field. +</itemize> + +<p><bf>Configure the Gateway information:</bf> + +<p>For our example network the FreeBSD box will be acting as our gateway +to the Internet +(routing packets between the Ethernet LAN and the PPP dial-up +connection. +<itemize> +<item>Enter the IP address of the FreeBSD Ethernet interface, +192.168.1.1, in the + "New gateway" field and click the "Add" button. + <p>If any other gateways are defined in the "Installed gateways" list + + you may wish to consider removing them. +</itemize> +<p><bf>Configuring DNS:</bf> +<p>Again, this guide assumes that your Internet Service Provider has +given you +a list of Domain Name Servers (or "DNS Servers") that you should use. + +If you wish to run a DNS server on your local FreeBSD system, +refer to Section 6, "Exercise for the Interested Student" for tips on + +setting up DNS on your FreeBSD system. +<itemize> +<item>Click the "DNS" tab +<item>In the "Host Name" field enter the name of the Windows NT box, in +this case: "Shemp". +<item>In the "Domain" field enter the name of our local network, in this +case: "my.domain" +<item>In the "DNS Server Search Order" section, enter the IP address of +the DNS server that your ISP provided, clicking the "Add" button after +every address is entered. Repeat this step as many times as necessary +to add all of the addresses that your ISP provided. +</itemize> + +<p><bf>Other Windows NT TCP/IP options:</bf> + +<p>For our purposes the settings under the "WINS Address" and "Routing" +tabs are not used. + +<p>If you wish to use the Windows Internet Naming Service ("WINS") your +attention is +invited to <url url="http://www.localnet.org"> for more information +about WINS +settings, specifically regarding sharing files transparently across the +Internet. + +<p><bf>Mopping up:</bf> +<itemize> +<item>Click on the "OK" button to close the TCP/IP Properties section. + +<item>Click on the "Close" button to close the Network Control Panel. + +<item>Restart your computer if prompted to do so. +</itemize> + +<p>That's it! + +<sect1> +<heading>Configuring Windows for Workgroups</heading> + +<p>Configuring Windows for Workgroups to act as a network client +requires that the +Microsoft TCP/IP-32 driver diskette has been installed on the +workstation. +The TCP/IP drivers are not included with the WfW CD or diskettes; if you +need a +copy they're available at <url +url="ftp://ftp.microsoft.com:/peropsys/windows/public/tcpip">. + +<p>Once the TCP/IP drivers have been loaded, perform the following +steps: + +<p><bf>Create the Windows for Workgroups "hosts" file:</bf> + +<p>In order to connect to the other TCP/IP systems on the LAN you'll +need +to create an identical copy of the "hosts" file that you installed on +the +FreeBSD system in Section 3.4. +<itemize> +<item>In Program Manager, click the "File" button; select "Run"; and +enter: "notepad \WINDOWS\HOSTS" (without the quotes) and click "OK" +<item>In the editor, enter the addresses and system names from the hosts +file shown in Section 3.4. +<item>When finished editing, close the notepad application (making sure +that you save the file!). +</itemize> + +<p><bf>Configure the Windows 95 TCP/IP Network Configuation +settings</bf> +<itemize> +<item>In the main window of Program Manager, open the "Network" group by +double-clicking the icon. +<item>Double click on the "Network Setup" icon. +<item>In the "Network Drivers Box" double-click the "Microsoft +TCP/IP-32" entry. +</itemize> + +<p><bf>Configure the Windows for Workgroups IP Address:</bf> +<p>Ensure the correct Ethernet Interface is selected in the "Adapter" +list. If not, +scroll down until it is displayed and select it by clicking on it. +<itemize> +<item>Ensure that the "Enable Automatic DHCP Configuration" check box is +blank. If it is checked, click it to remove the "X". +<item>In our example LAN the Windows for Workgroups system is the one +we've called "Moe"; in the "IP Address" field enter "192.168.1.3". +<item>Enter 255.255.255.0 in the "Subnet Mask" field. +</itemize> + +<p><bf>Configure the Gateway information:</bf> + +<p>For our example network the FreeBSD box will be acting as our gateway +to the Internet +(routing packets between the Ethernet LAN and the PPP dial-up +connection). +<itemize> +<item>Enter the IP address of the FreeBSD system, 192.168.1.1, in the +"Default Gateway" field. +</itemize> + +<p><bf>Configuring DNS:</bf> + +<p>Again, this guide assumes that your Internet Service Provider has +given you +a list of Domain Name Servers (or "DNS Servers") that you should use. +If you wish +to run a DNS server on your local FreeBSD system, refer to Section 6, +"Exercise +for the Interested Student" for tips on setting up DNS on your FreeBSD +system. +<itemize> +<item>Click the "DNS" button. +<item>In the "Host Name" field enter the name of the Windows for +Workgroups box, in this case: "Moe". +<item>In the "Domain" field enter the name of our local network, in this +case: "my.domain" +<item>In the "Domain Name Service (DNS) Search Order" section, enter the +IP address of the DNS server that your ISP provided, clicking the "Add" +button after each address is entered. Repeat this step as many times as +necessary to add all of the addresses that your ISP provided. +<item>Click on the "OK" button to close the DNS Configuration window. + +</itemize> + +<p><bf>Mopping up:</bf> +<itemize> +<item>Click on the "OK" button to close the TCP/IP Configuration window. + +<item>Click on the "OK" button to close the Network Setup window. +<item>Reboot your computer if prompted. +</itemize> + +<p>That's it! + +<sect> +<heading>Testing the Network</heading> + +<p> Once you've completed that appropriate tasks above you should have a + +functioning PPP gateway to the Internet. + +<sect1> +<heading>Testing the Dial-Up link:</heading> + +<p> The first thing to test is that the connection is being made between +your +modem and the ISP. + +<sect1> +<heading>Testing the Ethernet LAN</heading> + +<p> *** TBD *** +</sect> + +<sect> +<heading>Exercises for the Interested Student</heading> + +<p> +<sect1> +<heading>Creating a mini-DNS system</heading> + +<p>While managing a Domain Name Service (DNS) hierarchy can be a black +art, it is possible to set up a Mini-DNS server +on the FreeBSD system that also acts as your gateway to your ISP. + +<p>Building on the files in <tt>/etc/namedb</tt> when the FreeBSD system +was installed it's +possible to create a name server that is both authoritative for the +example network shown here +as well as a front-door to the Internet DNS architecture. + +<p>In this minimal DNS configuration, only three files are necessary: +<tscreen><verb> +/etc/namedb/named.boot +/etc/namedb/named.root +/etc/namedb/mydomain.db +</verb></tscreen> + +<p>The <tt>/etc/namedb/named.root</tt> file is automatically installed +as part of the FreeBSD base installation; the other +two files must be created manually. + +<sect2> +<heading>The <tt>/etc/namedb/named.boot</tt> file</heading> +<p>The <tt>/etc/namedb/named.boot</tt> file controls the startup +settings of the DNS server. +Esentially, it tells the Name Server: +<enum> +<item>Where to find configuration files, +<item>What "domain names" it's responsible for, and +<item>Where to find other DNS servers. +</enum> + +<p>Using the '<tt/ee/' editor, create a <tt>/etc/namedb/named.boot</tt> +with the following contents: +<code> +; boot file for mini-name server + +directory /etc/namedb + +; type domain source host/file backup file + +cache . named.root +primary my.domain. mydomain.db +</code> +<p>Lines that begin with a semi-colon are comments. The significant +lines in this file are: +<itemize> +<item><tt>directory /etc/namedb</tt> +<p>Tells the Name Server where to find the configuration files +referenced in the remaining sections of +the '<tt>/etc/namedb/named.boot</tt>' file. +<item><tt>cache . named.root</tt> +<p>Tells the Name Server that the list of "Top-Level" DNS servers for +the Internet can be found in +a file called '<tt>named.root</tt>'. (This file is included in the base +installation and its +contents are not described in this document.) +<item><tt>primary my.domain. mydomain.db</tt> +<p>Tells the Name Server that it will be "authoritative" for a DNS +domain called "my.domain" and that +a list of names and IP addresses for the systems in "my.domain" (the +local network) +can be found in a file named '<tt>mydomain.db</tt>'. +</itemize> +<p>Once the <tt>/etc/namedb/named.boot</tt> file has been created and +saved, proceed to the next +section to create the <tt>/etc/namedb/mydomain.db</tt> file. + +<sect2> +<heading>The <tt>/etc/namedb/mydomain.db</tt> file</heading> + +<p>The <tt>/etc/namedb/mydomain.db</tt> file lists the names and IP +addresses of <em/every/ +system in the Local Area Network. + +<p><em>For a detailed description of the statements used in this file, +refer to the <tt/named/ manpage.</em> + +<p>The <tt>/etc/namedb/mydomain.db</tt> file for our minimal DNS server +has the following contents: +<code> +@ IN SOA my.domain. root.my.domain. ( + 961230 ; Serial + 3600 ; Refresh + 300 ; Retry + 3600000 ; Expire + 3600 ) ; Minimum + IN NS curly.my.domain. + +curly.my.domain. IN A 192.168.1.1 # The FreeBSD box +larry.my.domain. IN A 192.168.1.2 # The Win'95 box +moe.my.domain. IN A 192.168.1.3 # The WfW box +shemp.my.domain. IN A 192.168.1.4 # The Windows NT box + +$ORIGIN 1.168.192.IN-ADDR.ARPA + IN NS curly.my.domain. +1 IN PTR curly.my.domain. +2 IN PTR larry.my.domain. +3 IN PTR moe.my.domain. +4 IN PTR shemp.my.domain. + +$ORIGIN 0.0.127.IN-ADDR.ARPA + IN NS curly.my.domain. +1 IN PTR localhost.my.domain. +</code> +<p>In simple terms, this file declares that the local DNS server is: +<itemize> +<item>The Start of Authority for ("SOA") for a domain called +'my.domain', +<item>The Name Server ("NS") for 'my.domain', +<item>Responsible for the reverse-mapping for all IP addresses that +start with '192.168.1.' and +'127.0.0.' ("$ORIGIN ...") +</itemize> + +<p>To add workstation entries to this file you'll need to add two lines +for each system; +one in the top section where the name(s) are mapped into Internet +Addresses ("IN A"), and +another line that maps the addresses back into names in the <tt>$ORIGIN +1.168.192.IN-ADDR.ARPA</tt> section. + +<sect2> +<heading>Starting the DNS Server</heading> + +<p>By default the DNS server ('<tt>/usr/sbin/named</tt>') is not started +when the system boots. You can modify this behavior +by changing a single line in '<tt>/etc/sysconfig</tt>' as follows: + +<p> Using the '<tt/ee/' editor, load <tt>/etc/sysconfig</tt>. Scroll +down approximately 200 lines until you come to the section that says: +<code> +--- +# Set to appropriate flags for named, if you have a full-time +# connection to the Internet. +# For most hosts, flags should be "-b /etc/namedb/named.boot" +namedflags="NO" +--- +</code> +Change this section to read: +<code> +--- +# Set to appropriate flags for named, if you have a full-time +# connection to the Internet. +# For most hosts, flags should be "-b /etc/namedb/named.boot" +namedflags="-b /etc/namedb/named.boot" +--- +</code> +Save the file and reboot. + +Alternatively, start the Name Server daemon by entering the following +command: +<code> +# named -b /etc/namedb/named.boot +</code> + +<p>Whenever you modify any of the files in <tt>/etc/namedb</tt> you'll +need to kick-start the Name Server process to make it pick up the +modifications. This is performed with the following system command: +<code> +# kill -HUP `cat /var/run/named.pid` +</code> + +<sect1> +<heading>Playing with PPP filters</heading> + +<p>The PPP program has the ability to apply selected filtering rules to +the traffic it routes. +While this is not nearly as secure as a formal firewall it does provide +some access control as to how +the link is used. + +<p>('<tt>man ipfw</tt>' for information on setting up a more secure +FreeBSD system.) + +<p>The complete documentation for the various filters and rules under +PPP are availabe in the PPP manpage. + +<p>There are four distinct classes of rules which may be applied to the +PPP program: +<itemize> +<item><tt/afilter/ - Access Counter (or "Keep Alive") filters +<p>These control which events are ignored by the <tt/set timeout=/ +statement in the configuration file. +<item><tt/dfilter/ - Dialing filters +<p>These filtering rules control which events are ignored by the +demand-dial mode of PPP. +<item><tt/ifilter/ - Input filters +<p>Control whether incoming packets should be discarded or passed into +the system. +<item><tt/ofilter/ - Output filters +<p>Control whether outgoing packets should be discarded or passed into +the system. +</itemize> +<p> + +What follows is a snippet from an operating system which provides a good +foundation for "normal" +Internet operations while preventing PPP from pumping <em/all/ data over +the dial-up connection. Comments +briefly describe the logic of each rule set: +<code> +# +# KeepAlive filters +# Don't keep Alive with ICMP,DNS and RIP packet +# + set afilter 0 deny icmp + set afilter 1 deny udp src eq 53 + set afilter 2 deny udp dst eq 53 + set afilter 3 deny udp src eq 520 + set afilter 4 deny udp dst eq 520 + set afilter 5 permit 0/0 0/0 +# +# Dial Filters: +# Note: ICMP will trigger a dial-out in this configuration! +# + set dfilter 0 permit 0/0 0/0 +# +# Allow ident packet pass through +# + set ifilter 0 permit tcp dst eq 113 + set ofilter 0 permit tcp src eq 113 +# +# Allow telnet connection to the Internet +# + set ifilter 1 permit tcp src eq 23 estab + set ofilter 1 permit tcp dst eq 23 +# +# Allow ftp access to the Internet +# + set ifilter 2 permit tcp src eq 21 estab + set ofilter 2 permit tcp dst eq 21 + set ifilter 3 permit tcp src eq 20 dst gt 1023 + set ofilter 3 permit tcp dst eq 20 +# +# Allow access to DNS lookups +# + set ifilter 4 permit udp src eq 53 + set ofilter 4 permit udp dst eq 53 +# +# Allow DNS Zone Transfers +# + set ifilter 5 permit tcp src eq 53 + set ofilter 5 permit tcp dst eq 53 +# +# Allow access from/to local network +# + set ifilter 6 permit 0/0 192.168.1.0/24 + set ofilter 6 permit 192.168.1.0/24 0/0 +# +# Allow ping and traceroute response +# + set ifilter 7 permit icmp + set ofilter 7 permit icmp + set ifilter 8 permit udp dst gt 33433 + set ofilter 9 permit udp dst gt 33433 +# +# Allow cvsup +# + set ifilter 9 permit tcp src eq 5998 + set ofilter 9 permit tcp dst eq 5998 + set ifilter 10 permit tcp src eq 5999 + set ofilter 10 permit tcp dst eq 5999 +# +# Allow NTP for Time Synchronization +# + set ifilter 11 permit tcp src eq 123 dst eq 123 + set ofilter 11 permit tcp src eq 123 dst eq 123 + set ifilter 12 permit udp src eq 123 dst eq 123 + set ofilter 12 permit udp src eq 123 dst eq 123 +# +# SMTP'd be a good idea! +# + set ifilter 13 permit tcp src eq 25 + set ofilter 13 permit tcp dst eq 25 +# +# +# We use a lot of `whois`, let's pass that +# + set ifilter 14 permit tcp src eq 43 + set ofilter 14 permit tcp dst eq 43 + set ifilter 15 permit udp src eq 43 + set ofilter 15 permit udp dst eq 43 +# +# If none of above rules matches, then packet is blocked. +#------- +</code> +<p>Up to 20 distinct filtering rules can be applied to each class of +filter. Rules in each class are +number sequentially from 0 to 20 <em/but none of the rules for a +particular filter class take affect +until ruleset '0' is defined!/ + +<p>If you choose <em/not/ to use Filtering Rules in the PPP +configuration then <em/ALL/ traffic will +be permitted both into and out of your system while it's connected to +your ISP. + +If you decide that you want to implement filtering rules, add the above +lines to your +<tt>/etc/ppp/ppp.conf</tt> file in either the "default:", "demand:", or +"interactive:" section (or all of them - the choice is yours). + +</sect> + +</article> + |