{"id":12,"date":"2006-03-19T21:29:14","date_gmt":"2006-03-19T21:29:14","guid":{"rendered":"https:\/\/www.bishnet.net\/tim\/blog\/2006\/03\/19\/router-rebuild-or-an-excuse-to-play-with-ipv6\/"},"modified":"2010-11-11T13:02:09","modified_gmt":"2010-11-11T13:02:09","slug":"router-rebuild-or-an-excuse-to-play-with-ipv6","status":"publish","type":"post","link":"https:\/\/www.bishnet.net\/tim\/blog\/2006\/03\/19\/router-rebuild-or-an-excuse-to-play-with-ipv6\/","title":{"rendered":"Router rebuild (or, an excuse to play with IPv6?)"},"content":{"rendered":"

So recently my router decided it didn’t want to whir its fans anymore and consequently gave up on life. It’s a dual CPU machine and both CPU fans had managed to wedge. After fixing them and getting things running again I heard klunking noises coming from the front of the case; one of the disks in the mirror had failed. I rapidly copied everything off the remaining disk, but didn’t have a spare to hand. Next morning the remaining disk went too. I wasn’t having much luck really, but on the positive side I did have a full backup.<\/p>\n

After a day or so of fiddling with hardware I got something that resembled a working machine; I’d gone through a stack of various old disks by this point, most of which were dead. For a while I’d been pondering a fresh install for the machine, so this was the perfect opportunity. I decided to think about what I wanted it to do – this is what I came up with.<\/p>\n

    \n
  1. Obviously needs ADSL connection (via rather old, but working, USB modem)<\/li>\n
  2. I’d quite like a VPN connection to work for various (but not all) work servers<\/li>\n
  3. IPv6 routing both internally and out to the world<\/li>\n
  4. Internal NIC with my private and public address ranges<\/li>\n
  5. A second internal NIC for my wireless network<\/li>\n
  6. A better firewall setup (I decided on PF in the end)<\/li>\n<\/ol>\n

    Rather predictably I decided to do all this with FreeBSD. Nothing exciting about the install, other than I used gmirror this time. I’m still trying to find the best RAID solution on FreeBSD. So far I think gmirror has impressed me most compared to ataraid and gvinum.<\/p>\n

    So most of the things I wanted the router to do are things it did before. The new things were the VPN, IPv6 and PF. Those are what I’ll write about.<\/p>\n

    Setting up the VPN was straightforward. I installed the net\/pptpclient<\/a> port, bunged the sample config and my credentials in \/etc\/ppp\/ppp.conf, and knocked up a quick RC script (let me know if you’d like a copy). I also added specific entries to ppp.conf for the hosts I wanted to route over the VPN, rather than letting it route whole subnets.<\/p>\n

    Something worth noting about ppp is the -unitN flag. Using this you can make sure ppp always uses the same numbered tun device. For example, my VPN connection has -unit1 ensuring it is always tun1. This makes firewall configuration a bit more manageable.<\/p>\n

    I’ve also knocked up a slightly better RC script for starting the ADSL connection (compared to the one provided with net\/pppoa<\/a>) that checks the line is up before returning. This allows subsequent startup scripts to be pretty much guaranteed access to the Internet. Again, let me know if you’d like a copy.<\/p>\n

    The next task was getting the IPv6 connection going. I decided to use the BT IPv6 Tunnel Broker<\/a> service. In retrospect this might not have been the best choice; it’s been down for the last few days. I’ll let you know how I decide to proceed with that, but I’m reluctant to change because I’ll get a whole new address range. Getting this set up was pleasantly simple, particularly when compared with my past experiences trying to set up an IPv6 tunnel. Upon registering I was allocated an IP range and given a FreeBSD-compatible script to bring the link up. I decided to set things up more permanently using the excellent guide<\/a> on the FreeBSD Diary website and the details from the broker’s script.<\/p>\n

    Surprisingly with the relevant tunneling, routing, and advertisments going setting up clients was a doddle. On my FreeBSD desktop machine I turned on ipv6_enable in rc.conf and it sprang to life (after a reboot). Even on our Windows systems it was as simple as running \u00e2\u20ac\u0153ipv6 install\u00e2\u20ac\u009d.<\/p>\n

    This finally left PF. Now that I’ve finished setting it up I can happily say it seems much nicer than IPFW, but I won’t pretend the journey was easy. It took a while to get my head around the differences, the main one being last-match versus first-match rules. I still need to figure out some of the ALTQ stuff though; my last attempt left me throttling internal traffic to 0.5Mb\/s \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

    So recently my router decided it didn’t want to whir its fans anymore and consequently gave up on life. It’s a dual CPU machine and both CPU fans had managed to wedge. After fixing them and getting things running again I heard klunking noises coming from the front of the case; one of the disks in the mirror had failed. …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,4],"tags":[],"class_list":["post-12","post","type-post","status-publish","format-standard","hentry","category-computing","category-freebsd"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t