PPPoE and PF at system boot

S

strldd

Hi guys
I run FreeBSD 9.1 as a firewall PPPoE {mpd 5.6} with pf. When the system boots pf blocks traffic by default and i'm forced to run:
Code: 
/sbin/pfctl -f /etc/pf.conf
so the nat/firewall start working properly!
Is there any way you force PPPoE to run before pf or together?
 
You could use 'set iface up-script script' directive to reload rules once connection was established.

http://mpd.sourceforge.net/doc5/mpd28.html#28

I personally use following scripts:

MPD5 config:
Code: 
# cat mpd.conf
startup:
# Name password password_user
  set user myuser mypass admin
# console on localhost
  set console self 127.0.0.1 5005
  set console open
  set web self 0.0.0.0 5006
  set web open

# default settings
default:
  load pppoe_client_101
  load pppoe_client_102

pppoe_client_101:
  create bundle static B1
  set iface name adsl1
  set iface enable tcpmssfix 
  set iface up-script /usr/local/etc/mpd5/up-script_fib_0.sh
  set iface down-script /usr/local/etc/mpd5/down-script_fib_0.sh
# Default route is added via up-script
#  set iface route default
  set ipcp ranges 0.0.0.0/0 0.0.0.0/0
  create link static L1 pppoe
  set link action bundle B1
  set auth authname YYYYYYYYY
  set auth password XXXXXXXXX
  set link max-redial 0
  set link mtu 1492
  set link mru 1492
  set link keep-alive 10 60
# interface to PPPoE
  set pppoe iface vlan101
#  set pppoe iface pif0 
  set pppoe service ""
# start connection
  open 

pppoe_client_102:
  create bundle static B2
  set iface name adsl2
  set iface enable tcpmssfix 
  set iface up-script /usr/local/etc/mpd5/up-script_fib_1.sh
  set iface down-script /usr/local/etc/mpd5/down-script_fib_1.sh
# Default route is added via up-script
#  set iface route default
  set ipcp ranges 0.0.0.0/0 0.0.0.0/0
  create link static L2 pppoe
  set link action bundle B2
  set auth authname YYYYYYYYY
  set auth password XXXXXXXXX
  set link max-redial 0
  set link mtu 1492
  set link mru 1492
  set link keep-alive 10 60
# interface to PPPoE
  set pppoe iface vlan102
#  set pppoe iface pif0
  set pppoe service ""
# start connection
  open

Scripts:
Code: 
# cat up-script_fib_0.sh
#!/bin/sh

echo "`date` UP   $@" >> /tmp/firewall.sh.log

# Manually adding default route to avoid error with identical destination gateways 
EXT_IF_IP=$4
setfib 0 route add default -interface $1 

#/etc/rc.d/pf reload
#/sbin/pfctl -d
#/sbin/pfctl -f /etc/pf.conf
#/sbin/pfctl -e
/etc/firewall &
/usr/local/etc/mpd5/check-rules.sh &

exit 0

# cat down-script_fib_0.sh
#!/bin/sh

echo "`date` DOWN $@" >> /tmp/firewall.sh.log

# Manually adding default route to avoid error with identical destination gateways
setfib 0 route del default -interface $1 


#/etc/rc.d/pf reload
#/sbin/pfctl -d
#/sbin/pfctl -f /etc/pf.conf
#/sbin/pfctl -e
/etc/firewall &
/usr/local/etc/mpd5/check-rules.sh &

exit 0

Although I personally use IPFW you could easily adapt these config's to PF.
 
Does it have to work with net/mpd5? I have a PPPoE connection using the 'standard' FreeBSD PPP. After it comes up it automatically reloads my PF rules.
 
Thanks mesouug
I added the script to the mpd.conf file, however I wrote it in perl !
Works great
Thanks again !
 
You must log in or register to reply here.
Back
Top