How to be protected by CloudFlare using FreeBSD...

[ZioMario]

How to configure the qemu-Debian vm (I opted for a qemu vm because I haven't been able to install cloudflare-warp inside the linuxulator ; but maybe it can be done) :

# apt install net-tools

# nano /etc/systemd/system/getty.target.wants/getty@tty1.service
ExecStart=-/sbin/agetty -o '-p -f -- \\u' --noclear --autologin marietto %I $TERM

# apt-get install python3-tk curl gpg sudo mousepad

# Add cloudflare gpg key :

# curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg | sudo gpg --yes --dearmor --output /usr/share/keyrings/cloudflare-warp-archive-keyring.gpg

# Add this repo to your apt repositories :

# echo "deb [signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/cloudflare-client.list

# Install :

# sudo apt-get update && sudo apt-get install cloudflare-warp
 
# nano /etc/apt/sources.list.d/cloudflare-client.list

deb [arch=amd64 signed-by=/usr/share/keyrings/cloudflare-warp-archive-keyring.gpg] https://pkg.cloudflareclient.com/ bookworm main

# warp-cli register

# cp /usr/sbin/iptables /usr/bin
# cp /usr/sbin/dhclient /usr/bin

# systemctl set-default multi-user.target

# nano /home/marietto/.profile
/usr/bin/warp

# nano /usr/bin/warp

function jumpto
{
        label=$1
        cmd=$(sed -n "/$label:/{:a;n;p;ba};" $0 | grep -v ':$')
        eval "$cmd"
        exit
}


start=${1:-"start"}


jumpto $start


start:
sleep 2
warp-cli disconnect
sleep 2
OLD_IP="$(curl -s api.ipify.org)"
#echo 1 > /proc/sys/net/ipv4/ip_forward # I've uncommented this parameter inside the file /etc/sysctl.conf)

sudo iptables -A POSTROUTING -t nat -s 192.168.1.5 -j MASQUERADE

warp-cli connect
sleep 2

NEW_IP="$(curl -s api.ipify.org)"
echo Connected to Cloudflare Warp...
echo OLD IP is $OLD_IP , NEW IP is $NEW_IP


mid :
sleep 2
if [ "$OLD_IP = $NEW_IP ]
then
echo OLD IP is $OLD_IP , NEW IP is $NEW_IP : it does not work anymore,reconnecting...
sleep 10
jump foo
else
echo OLD IP is $OLD_IP , NEW IP is $NEW_IP : it still works.
sleep 10
fi
sleep 2
jumpto mid


foo:
warp-cli disconnect
sleep 2
OLD_IP="$(curl -s api.ipify.org)"

warp-cli connect
sleep 2
NEW_IP="$(curl -s api.ipify.org)"
echo OLD IP is $OLD_IP , NEW IP is $NEW_IP : it works again.
sleep 2
jumpto mid

# chmod +x /usr/bin/warp

# nano /etc/sysctl.conf
net.ipv4.ip_forward=1

# nano /etc/sudoers
marietto ALL=(ALL) NOPASSWD: /usr/bin/iptables
marietto ALL=(ALL) NOPASSWD: /usr/bin/dhclient
marietto ALL=(ALL) NOPASSWD: /usr/bin/ifconfig

On FreeBSD :

nano /boot/loader.conf

if_tap_load="YES"
if_bridge_load="YES"
bridgestp_load="YES"

nano /etc/sysctl.conf :

net.link.tap.up_on_open=1
net.link.tap.user_open=1
net.inet.ip.forwarding=1
net.inet.ip.random_id=1

nano /etc/rc.conf :

cloned_interfaces="bridge0 tap0 tap1 tap2 tap3 tap4 tap5 tap6 tap7 tap8 tap9 tap10 tap11 tap12 tap13 tap14 tap15 tap16 tap17 tap18 tap19 tap20 em0 lo1"

ifconfig_bridge0="addm em0 addm tap0 addm tap1 addm tap2 addm tap3 addm tap4 addm tap5 addm tap6 addm tap7 addm tap8 addm tap9 addm tap10 addm tap11 addm tap12 addm tap13 addm tap14 addm tap15 addm tap16 addm tap17 addm tap18 addm tap19 addm tap20"

ifconfig_em0="inet 192.168.1.5 netmask 255.255.255.0"
defaultrouter="192.168.1.2"

# cp /usr/local/bin/qemu-system-x86_64 /usr/local/bin/qemu-system-x86_64-debian_warp

This script should be located inside the file /home/marietto/.zshrc (because I'm using zsh)

if ! pgrep -f qemu-system-x86_64-debian_warp &> /dev/null 2>&1; then
echo "The qemu / Debian-warp vm is not running,starting..."

/usr/local/bin/qemu-system-x86_64 -machine q35 -cpu kvm64,hv_relaxed,hv_time,hv_synic -m 1G -vga std \
-drive file=Debian-warp.img,format=raw -rtc base=localtime -device usb-ehci,id=usb,bus=pcie.0,addr=0x3 -device usb-tablet \
-device usb-kbd -smbios type=2 -nodefaults -netdev tap,id=mynet0,ifname=tap20,script=no,downscript=no
-device e1000,netdev=mynet0,mac=52:55:00:d1:55:01 -device ich9-ahci,id=sata \
-drive if=pflash,format=raw,readonly=on,file=/usr/local/share/edk2-qemu/QEMU_UEFI_CODE-x86_64.fd \
-drive if=pflash,format=raw,file=/usr/local/share/edk2-qemu/QEMU_UEFI_VARS-x86_64.fd -nographic -serial none -monitor none &

else
echo "The qemu / Debian-warp vm is already running."
fi

Et voila' : my Ip is protected by CloudFlare when I use FreeBSD.