Aquilenet

> > {{\>toc}}

# Firewall OpenBSD on PCEngines APU

**DISCLAIMER: This is not a step by step guide.**

This is a toolbox on various config files, scripts (like prometheus startup scripts, sounds on boot...) and various tips (adding hardware power button).

## Install an OpenBSD image

### Getting the OpenBSD image 

The list of the mirrors is here: https://www.openbsd.org/ftp.html

Get the last version, here 6.5

~~~

wget ftp://ftp.irisa.fr/pub/mirrors/OpenBSD/6.5/amd64/install65.fs

~~~

### Write the image to an USB Key

My usb key is on /dev/sde

~~~

dd if=install65.fs of=/dev/sde bs=1M

~~~

### Boot USB & install

Select the tty output in 115200 on com0

~~~

SeaBIOS (version rel-1.12.0.1-0-g393dc9c)

Press F10 key now for boot menu

Booting from Hard Disk...

Using drive 0, partition 3.

Loading......

probing: pc0 com0 com1 com2 com3 mem[639K 1918M a20=on] 

disk: hd0+ hd1+*

>> OpenBSD/amd64 BOOT 3.43

boot> stty com0 115200

boot> set tty com0

switching console to com>> OpenBSD/amd64 BOOT 3.43

boot>

~~~

Replying to answears

~~~

Welcome to the OpenBSD/amd64 6.5 installation program.

(I)nstall, (U)pgrade, (A)utoinstall or (S)hell? I

Terminal type? [vt220]

System hostname? (short form, e.g. 'foo') cerbere

Password for root account? (will not echo) 

Password for root account? (again) 

Start sshd(8) by default? [yes] 

Change the default console to com0? [yes] 

Available speeds are: 9600 19200 38400 57600 115200.

Which speed should com0 use? (or 'done') [115200] 

Setup a user? (enter a lower-case loginname, or 'no') [no] 

Since no user was setup, root logins via sshd(8) might be useful.

WARNING: root is targeted by password guessing attacks, pubkeys are safer.

Allow root ssh login? (yes, no, prohibit-password) [no] yes

Available disks are: sd0 sd1.

Which disk is the root disk? ('?' for details) [sd0] 

No valid MBR or GPT.

Use (W)hole disk MBR, whole disk (G)PT or (E)dit? [whole] 

~~~

80% /

10% swap

10% /var/log

### Configuration

#### /etc/sysctl.conf       

~~~

net.inet.ip.forwarding=1

net.inet.gre.allow=1

~~~

#### /root/.profile

~~~

export PS1="\H|\t|:\w\\$"                                                                                                                                               

umask 022

#export LS_OPTIONS='--color=auto'

alias ls='/usr/local/bin/colorls -G'

alias ll='ls -l'

alias l='ls -lA'

alias d="du --max-depth=1 -h"

#alias carp='ifconfig carp |grep -e "MASTER" -e "BACKUP" && ifconfig -g carp'

# Some more alias to avoid making mistakes:

alias rm='rm -i'

alias cp='cp -i'

alias mv='mv -i'

alias df='df -h'

alias b='echo "\n IP BLACKLISTED\n========================================================";pfctl -t BLACKLIST -T show;echo "\n TOP 10 states\n========================================================";pfctl -sS |sort -nrk4 |head -n 10 '

echo

echo "________________________________________________________________________"

echo

who

echo "________________________________________________________________________"

echo

last -n 20

echo "________________________________________________________________________"

echo

uptime

echo "________________________________________________________________________"

~~~

#### /home/sacha/.profile

~~~

# $OpenBSD: dot.profile,v 1.5 2018/02/02 02:29:54 yasuoka Exp $

#

# sh/ksh initialization

PATH=$HOME/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin:/usr/games

export PATH HOME TERM

export PS1="\H|\t|:\w\\$"

alias ls='colorls -G'

alias ll='ls -l'

alias l='ls -lA'

alias d="du --max-depth=1 -h"

# Some more alias to avoid making mistakes:

alias rm='rm -i'

alias cp='cp -i'

alias mv='mv -i'

alias df='df -h'

echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _"

echo

echo -n "     " && uname -a

echo

echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _"

echo

w

echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _"

echo && echo

~~~

#### /etc/ssh/sshd_config

~~~

Port 55555

PasswordAuthentication no

ChallengeResponseAuthentication no

~~~

+ Ajouter le réseau local sur em2 sour la forme 10.10.département/24

#### /etc/dhcpd.conf

En fonction du réseau local, exemple:

~~~

subnet 10.10.79.0 netmask 255.255.255.0 {

  range 10.10.79.100 10.10.79.199;

  default-lease-time 600;

  max-lease-time 7200;

  option subnet-mask 255.255.255.0;

  option broadcast-address 10.10.79.255;

  option routers 10.10.79.254;

  option domain-name-servers 10.10.79.254, 185.233.100.100;

  option domain-name "niort.rosedor.fr";

}

~~~

~~~

echo 'dhcpd_flags="em2"' >>/etc/rc.conf.local

~~~

#### /etc/resolv.conf 

~~~

search brest.openlux.fr 

nameserver 10.10.79.254

lookup file bind

~~~

#### /etc/ntpd.conf

~~~

# $OpenBSD: ntpd.conf,v 1.14 2015/07/15 20:28:37 ajacoutot Exp $

#

# See ntpd.conf(5) and /etc/examples/ntpd.conf

#listen on 172.16.1.254 

servers fr.pool.ntp.org

~~~

#### boot sound

* Exemples:

~~~

echo -e "l4mn<b.>e8a2mspg+e8c+f+8b2" > /dev/speaker

echo -e "<cd<a#~<a#>f" > /dev/speaker

echo "o2 AAA ml o2l8F P16 o3l16C o2 l4A  l8F o3P16l16C o2 l4A p4 o3 EEE ml l8F P16 o3l16C o2 l4A- l8F o3P16l16C o2 l4A"  > /dev/speaker

echo -e "ec" > /dev/speaker

echo -e "t255l8c.f.afc~c.f.afc~c.f.afc.f.a..f.~c.f.afc~c.f.afc~c.f.afc~c.f.." > /dev/speaker

echo -e "<cd<a#~<a#>f" > /dev/speaker

echo -e "t240<cfcfgagaa#b#>dc<a#a.~fg.gaa#.agagegc.~cfcfgagaa#b#>dc<a#a.~fg.gga.agfgfgf.">/dev/speaker

echo -e "t255cf8f8edc<a>~cf8f8edd#e~ce8cdce8cd.<a>c8c8c#def8af8" > /dev/speaker

echo -e "olcega.a8f>cd2bgc.c8dee2" > /dev/speaker

echo -e "msl16oldcd4mll8pcb-agf+4.g4p4<msl16dcd4mll8pa.a+f+4p16g4" > /dev/speaker

echo -e "l2b.f+.p16a.c+.p l4mn<b.>e8a2mspg+e8c+f+8b2" > /dev/speaker

Beatles

"T255O3< < L2 A > > > L4 C# < A B > L2 C#.L2 N0 L4 C# < L2 B A F#A B A F# L1 E.< < L2 A > > > L4 C# < A B > L2 C#.L2 N0 L4 C# < L2 B A L2 F#.> L4 C# < L2 B A L1 B B L1 N0< < L2 A > > > L4 C# < L2 B > L2 C# < L2 A.> L4 C# < A B > L2 C#.< < L2 A > > > L4 C# < L2 B > C# < L2 A.L4 N0 A L2 B AL2 N0 > L2 C# < B A N0L4 F# A B E A B D A B A G# F# E"

sw

"t136 mn o3 l8 ddgfe-dc o2 b-ag o3 d2. l12 ddd l8 g4 p4 p2 p2 t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 c o2 b o3 c l2 ml o2 a1a4 p4 mn t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 c o2 b o3 c l2 ml o2 a1a4 p4 mn t136 mn o3 l8 p4 mn o2 l8 d4 e4.e o3c o2 bag l12 gab l8 a8. e16f+4d8. d e4.e o3 c o2 bag o3 d8.o2   a16 ml a4a4 mn d4 e4.e O3 c o2 bag l12 gaba8. e16 f+4 o3 d8. d16 l16   g8. fe-8. d c8. o2 b-a8. g o3 d2 t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 co2 b o3c l2 ml o2a1a4 p4 mn t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2ba ml l2 o3gdd mn l6 co2bo3c l2 ml o2a1a4 p4 mn l6 o3 mn ddd ml l1 gggg4 p4 p4 mn l12 dddg2"

Reveille: t255l8c.f.afc~c.f.afc~c.f.afc.f.a..f.~c.f.afc~c.f.afc~c.f.afc~c.f..

Close Encounters: <cd<a#~<a#>f

Lord of the Dance (aka Simple Gifts): t240<cfcfgagaa#b#>dc<a#a.~fg.gaa#.agagegc.~cfcfgagaa#b#>dc<a#a.~fg.gga.agfgfgf.

Loony Toons theme: t255cf8f8edc<a>~cf8f8edd#e~ce8cdce8cd.<a>c8c8c#def8af8

standard villain's entrance music: mst200o2ola.l8bc.~a.~>l2d#

a trope from 'The Right Stuff' score by Bill Conti: olcega.a8f>cd2bgc.c8dee2

opening bars of Bach's Toccata and Fugue in D Minor": msl16oldcd4mll8pcb-agf+4.g4p4<msl16dcd4mll8pa.a+f+4p16g4

opening bars of the theme from Star Trek Classic: l2b.f+.p16a.c+.p l4mn<b.>e8a2mspg+e8c+f+8b2

~~~

~~~

echo 'echo -e "<cd<a#~<a#>f" > /dev/speaker' >> /etc/rc.local

echo '"O3L30cO4L30cO5L30cO5L30g" > /dev/speaker' >> /etc/rc.local

~~~

#### Unbound

~~~

ln -s /var/unbound/etc/unbound.conf /etc/unbound.conf

~~~

~~~

# $OpenBSD: unbound.conf,v 1.14 2018/12/16 20:41:30 tim Exp $

server:

        interface: 127.0.0.1

        interface: 172.16.1.254

        #interface: 127.0.0.1@5353      # listen on alternative port

#       interface: ::1

        do-ip6: no

        # override the default "any" address to send queries; if multiple

        # addresses are available, they are used randomly to counter spoofing

        #outgoing-interface: 192.0.2.1

        #outgoing-interface: 2001:db8::53

        access-control: 0.0.0.0/0 refuse

        access-control: 127.0.0.0/8 allow

        access-control: 172.16.1.254/16 allow 

        access-control: ::0/0 refuse

        access-control: ::1 allow

        hide-identity: yes

        hide-version: yes

        # Uncomment to enable DNSSEC validation.

        #

        #auto-trust-anchor-file: "/var/unbound/db/root.key"

        #val-log-level: 2

        # Uncomment to synthesize NXDOMAINs from DNSSEC NSEC chains

        # https://tools.ietf.org/html/rfc8198

        #

        #aggressive-nsec: yes

        # Serve zones authoritatively from Unbound to resolver clients.

        # Not for external service.

        #

        #local-zone: "local." static

        #local-data: "mycomputer.local. IN A 192.0.2.51"

        #local-zone: "2.0.192.in-addr.arpa." static

        #local-data-ptr: "192.0.2.51 mycomputer.local"

        # UDP EDNS reassembly buffer advertised to peers. Default 4096.

        # May need lowering on broken networks with fragmentation/MTU issues,

        # particularly if validating DNSSEC.

        #

        #edns-buffer-size: 1480

        # Use TCP for "forward-zone" requests. Useful if you are making

        # DNS requests over an SSH port forwarding.

        #

        #tcp-upstream: yes

remote-control:

        control-enable: yes

        control-interface: /var/run/unbound.sock

# Use an upstream forwarder (recursive resolver) for some or all zones.

#

#forward-zone:

#       name: "."                               # use for ALL queries

#       forward-addr: 192.0.2.53                # example address only

#       forward-first: yes                      # try direct if forwarder fails

~~~

~~~

rcctl enable unbound

rcctl start unbound

~~~

#### Install Prometheus  node exporter

~~~

pkg_add go git gmake python-3.6 colorls gnuwatch mtr pftop curl bash 

ln -s /usr/local/bin/python3 /usr/local/bin/python

cd /home/sacha

go get github.com/prometheus/node_exporter

cd /home/sacha/go/src/github.com/prometheus/node_exporter

gmake

mv node_exporter /usr/local/bin/

~~~

##### script de démarage: /etc/rc.d/node_exporter

~~~

vim /etc/login.conf

(...)

node_exporter:\

  :tc=daemon:

~~~

~~~

cap_mkdb /etc/login.conf

groupadd -g 2222 _node_exporter

useradd -u 2222 -g 2222 -c "Prometheus Node Exporter agent" -d /var/empty -s /sbin/nologin -L node_exporter _node_exporter

~~~

* /etc/rc.d/node_exporter

~~~

#!/bin/sh

#

daemon="/usr/local/bin/node_exporter"

node_exporter_textfile_dir="/var/node_exporter"

daemon_flags="--collector.textfile.directory==${node_exporter_textfile_dir}"

daemon_user="_node_exporter"

daemon_group="_node_exporter"

. /etc/rc.d/rc.subr

pexp="${daemon}.*"

rc_bg=YES

rc_reload=NO

rc_pre() { 

    if ! id ${daemon_user}; then

        groupadd _node_exporter

        useradd -g _node_exporter -c "Prometheus Node Exporter agent"\

        -d /var/empty -s /sbin/nologin -L node_exporter _node_exporter

    fi

    if [ ! -d ${node_exporter_textfile_dir} ]; then

        install \

            -d \

            -o ${daemon_user} \

            -g ${daemon_group} \

            -m 1755 \

            ${node_exporter_textfile_dir}

    fi

}

rc_start() {

    ${rcexec} "${daemon} ${daemon_flags} < /dev/null 2>&1"

}

rc_cmd $1

~~~

~~~

chmod 0755 /etc/rc.d/node_exporter

chown root:wheel /etc/rc.d/node_exporter

rcctl enable node_exporter

rcctl start node_exporter

~~~

---

## Firewall

~~~

touch /etc/BLACKLIST

vi /etc/WHITELIST

~~~

### Standard: 1 ADSL

~~~

#######################################################

#         Firewall PF - OpenBSD -                     #

# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- #

# V1.0 - 20190612                                     #

#######################################################

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#               MACROS                  #

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#-----------------------------------------#

#               Interfaces                #

#-----------------------------------------#

#=====----> ADSL

ADSL       = "pppoe0"

#=====----> LAN

LAN             = "em2"

LAN_VoIP        = "em3"

#-----------------------------------------#

#               Hosts                     #

#-----------------------------------------#

#-----------------------------------------#

#       W H I T E  L I S T                #

#-----------------------------------------#

table <WHITELIST> persist file "/etc/WHITELIST"

#-----------------------------------------#

#       B L A C K  L I S T                #

#-----------------------------------------#

table <BLACKLIST> counters persist file "/etc/BLACKLIST"

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#               OPTIONS                 #

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

set loginterface $ADSL

#set optimization aggressive

set block-policy drop

set skip on lo0 

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#               LOG                     #

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

match log all

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#               NORMALISATION           #

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

# Nettoyer les paquets entrant

match in scrub (reassemble tcp random-id)

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#                NAT                    #

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

match out on $ADSL inet from ($LAN:network) to any nat-to ($ADSL)

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#               FILTRAGE                #

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

block log all

#-----------------------------------------#

#               Anti-Flood                #

#-----------------------------------------#

#NOFLOOD ="synproxy state (source-track rule max-src-conn 500, max-src-conn-rate 50/10, overload <BLACKLIST> flush global)"

NOFLOOD ="keep state (source-track rule, max-src-states 100)"

block in log quick on $ADSL from no-route to any

block out log quick on $ADSL from no-route to any

block in log quick on $ADSL from any to 255.255.255.255

#-----------------------------------------#

#               Blacklists                #

#-----------------------------------------#

block in quick from <BLACKLIST>

block in log quick on $ADSL inet proto icmp from any to any icmp-type redir

block in log quick on $ADSL inet6 proto icmp6 from any to any icmp6-type redir

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#               Anti-spoof                  #

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

antispoof log quick for $ADSL label "antispoof"

#---------------------------------------#

#               ICMP                    #

#---------------------------------------#

pass inet proto icmp all icmp-type { echorep, echoreq, timex, unreach }

#---------------------------------------#

#               Trace Route             #

#---------------------------------------#

pass in on { $LAN } proto udp from any to any port 33433 >< 33626 keep state

#---------------------------------------#

#               WHITELIST               #

#---------------------------------------#

pass in quick on $ADSL proto tcp from <WHITELIST> to any port 55555 

#---------------------------------------#

#                 LAN                   #

#---------------------------------------#

#=====----> Firewall to Lan

pass out on $LAN inet to $LAN:network

#=====----> ssh LAN

pass in quick on $LAN proto tcp from $LAN:network to $LAN port 55555

#pass in quick proto tcp from any to port 55555

#=====----> dns

pass in quick on $LAN proto udp from $LAN:network to $LAN port 53 

#=====----> dhcp

pass in quick on $LAN inet from $LAN:network to 255.255.255.255 

#=====----> Permit Lan to output

pass in on $LAN inet from $LAN:network to any

pass out on $LAN inet from $LAN:network to any

#---------------------------------------#

#            ACCEPT OUTGOING            #

#---------------------------------------#

pass out on $ADSL

~~~