Contributed by merdely on from the embedded-packet-passing dept.
I recently purchased a new Soekris net5501 to replace my beige box firewall. I had previously set up a net4501 but I wasn't happy with it and sold it to a friend. Large file transfers would grind it to a halt and the performance wasn't as good as my beige box. The net5501 has increased horsepower (faster processor, more memory) and a better network chipset (vr(4)). And, most of all, because there are 4 network ports! At my house I have 3 network + my FiOS connection. I have my internal LAN (wired with full access to everything), my wireless network (requires authentication and has limited access to the LAN) and my DMZ (for my web server; no access to the LAN or wireless networks).
For my installation, I use Yaifo so I don't have to deal with a serial console or setting up pxeboot. (I actually did hook up a serial console to update the bios, which I'll discuss later). Also, I use a custom rc and a flashdist-like system so I can mount my CF read-only. My "fdlite" script doesn't rely on a customized install like flashdist. It does use some of the device modifications Chris uses to make the read-only / work properly, though.
Preparing the CompactFlash card
- Download the (yet to be released) Yaifo 0.5 for OpenBSD 4.2 or check out the latest yaifo from CVS:
- Run: cvs -d:pserver:firstname.lastname@example.org:/cvsroot/yaifo login
- Run: cvs -z3 -d:pserver:email@example.com:/cvsroot/yaifo co -P yaifo
- Copy your ~/.ssh/authorized_keys to the yaifo directory.
- If upgrading or migrating, copy the /etc/ssh/ssh_host_* files to the yaifo directory.
- Uncomment the two lines in yaifo/boot.conf to enable booting to the serial console. The Soekris will not boot without this.
- Edit the yaifo/config file to specify the NIC to use for Yaifo and optionally static IP information.
- With current CVS sources checked out to /usr/src, build Yaifo (make obj; make).
- Connect a CompactFlash card reader (with the CF card).
- Copy the yaifo.fs image to the CF card: dd if=yaifo.fs of=/dev/rsd0c (substitute the correct device).
Installing OpenBSD 4.2
- Choose either locally mirrored files or an official mirror.
- Go through the OpenBSD installation process normally with the following exceptions:
- During the label editing phase, create / with $SIZE - 1 blocks and a swap with 1 block.
- Limit the installation sets. I chose bsd, bsd.rd, base42.tgz, etc42.tgz and man42.tgz. It's taking up 172MB of my 256MB CF.
- When prompted at the end, choose to redirect output to a serial console. It's best to choose 19200 baud because that's what the net5501 defaults to.
- When the installation is complete, wait before rebooting.
Setting up the Read-only /
- Download my fdlite.sh script.
- Download my fdlite.rc to "./rc".
- Run: sh ./fdlite.sh
- Assuming you renamed fdlite.rc to rc, press Enter when prompted.
- Reboot when finished.
- Expect things to break. In fact, something is seriously wrong if things didn't break!
- When the system boots, log in as root and mount / read-write; run: mount -uw /
- Edit /etc/rc for the system's configuration.
- I configure /etc/syslog.conf to send syslogs to a remote server. For a firewall, consider using the pflogrotate method described in the PF FAQ. The existence of /etc/pflogrotate automatically sets up newsyslog and pflogrotate in root's crontab.
- Make sure /etc/resolv.conf exists and is correct. Same with /etc/mygate.
- Consider setting a profile for root (or the whole system) by downloading something like my example profile for either /root/.profile or /etc/profile.
- Edit /etc/pf.conf
- It's probably best to reboot at this point to test the boot process. Or, set root back to read-only with: mount -ur /
After following these steps, my Soekris net5501 is running perfectly with a read-only root, logging to a remote host.
Updating My Soekris's BIOS
- Download the newest BIOS file.
- Set up a serial connection and use tip to connect: tip -19200 ttyU0 (for example)
- Install, if necessary, the lrzsz port: pkg_add lrzsz
- Reboot the Soekris into Monitor mode (Ctrl+P).
- Type: download
- Type: ~C (that's tilde, shift+c)
- Type: lsz -X b5501_132d.bin
- After the file is downloaded, type: flashupdate
- Reboot the Soekris into the newest BIOS version.
(Comments are closed)