Update with two pre-canned configurations.

2026-05-14 15:37:35 -04:00
parent 0ba30c7440
commit fe443b66f9
7 changed files with 98 additions and 3 deletions
@@ -44,6 +44,18 @@ embeddable configuration commands.

 This directory contains the base templates for some generated file types.

+#### `${rc_router_dir}/samples`
+
+This directory contains subdirectories with sample configurations for common
+use cases.  Each subdirectory is named for its purpose.  The `basic`
+configuration is recommended as a good starting point.  Users should fill
+in some small details in a "local.conf" file in those configuration samples.
+When these samples are used, the entire configuration of the router for that
+purpose should be complete.  On next reboot, it should function according
+to that use case, with no other settings changes necessary.  It is
+recommended that users copy the `sample` configurations as a starting
+point, rather than modify them in place
+
 #### `${rc_router_dir}/harness`

 This directory contains a testing harness to allow running many of these
@@ -109,6 +121,33 @@ necessary configuration files from various `rc.conf` variables and hints.
 drive this process, such that more customized configurations can be
 co-mingled with its patterns.

+## How to setup using the `basic` sample configuration
+
+Executing this sequence of sample commands will setup a fully-functional SOHO
+router using this framework.  You'll need to fill in the appropriate choices
+for your ISP and your network interfaces.
+
+```
+$ cd /etc
+$ mkdir router-conf
+$ cd router-conf
+$ git init .
+$ git submodule add rc.router https://gitea.nerdland.org/adam/rc.router
+$ rc.router/scripts/install-dependencies.sh
+$ cp rc.router/samples/basic/* .
+$ cat << EOF > local.conf
+external_card="abc0"
+internal_card="xy0"
+my_isp="verizon_fios"
+EOF
+$ git add rc.conf local.conf pf.conf
+$ git commit -m "FIRST POST!!!"
+$ echo 'rc_router_dir="/etc/router-conf/rc.router"' >> /etc/rc.conf
+$ echo 'rc_router_conf_dir="/etc/router-conf"' >> /etc/rc.conf
+$ echo ". ${rc_router_dir}/rc.entry" >> /etc/rc.conf
+$ reboot # Router is ready
+```
+
 ## How to setup (Easy dual-stack example With Git)

 Executing this sequence of sample commands will setup a basic Dual-stack router
@@ -1,4 +1,4 @@
-include "cards.conf"
+include "local.conf"

 set block-policy drop
 set loginterface external
@@ -1,7 +1,7 @@
-. ${rc_router_dir}/sample/basic_legacy/cards.conf
+. ${rc_router_conf_dir}/local.conf

 add_v4_net ${internal_card} 0 main

 add_v4_isp ${external_card} dhcp 

-pf_config=${rc_router_dir}/sample/basic-legacy/pf.conf
+pf_config=${rc_router_conf_dir}/pf.conf
@@ -0,0 +1,5 @@
+external_card="em0"
+internal_card="bge0"
+my_isp="verizon_fios"
+
+
@@ -0,0 +1,44 @@
+include "local.conf"
+
+set block-policy drop
+set loginterface external
+
+set skip on lo0
+set skip on lo
+
+# Unroutable networks:
+table <v4_priv_nets> { 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 192.88.99.0/24 198.18.0.0/15 }
+
+table <priv_nets> { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 192.88.99.0/24 198.18.0.0/15 2001:db8::/32 3fff::/20 }
+
+nat on $external_card inet from !($external_card) -> ($external_card:0)
+nat-anchor "ftp-proxy/*"
+rdr-anchor "ftp-proxy/*"
+
+block drop in quick on external from <priv_nets>
+
+block drop in quick from <junk> # User defined junk table
+block drop out quick to <junk> # User defined junk table
+
+# Scrub stuff via a matchrule:
+match in all scrub ( random-id reassemble tcp fragment reassemble )
+
+
+# Start with a paranoid default:
+block all
+
+# ICMP is important, don't block it
+pass proto { icmp ipv4-icmp } keep state
+
+# DHCPv4 from ISP
+pass in quick on external inet proto udp to (external) port { 67, 68 }
+
+# DHCPv6 and NDP with ISP
+pass in quick on external inet6 proto udp to fe80::/64 port 546
+
+pass out all
+
+antispoof for internal
+antispoof for external
+
+pass in on internal all
@@ -0,0 +1,7 @@
+. ${rc_router_conf_dir}/local.conf
+
+add_v4_net ${internal_card} 0 main
+
+add_canned_isp ${external_card} my_isp ${my_isp}
+
+pf_config=${rc_router_conf_dir}/pf.conf