From fe443b66f9658a85fd8515e28623c4049427e38e15eebed81d886371ff4379f2 Mon Sep 17 00:00:00 2001 From: ADAM David Alan Martin Date: Thu, 14 May 2026 15:37:35 -0400 Subject: [PATCH] Update with two pre-canned configurations. --- README.md | 39 ++++++++++++++++ .../basic-legacy/{cards.conf => local.conf} | 0 samples/basic-legacy/pf.conf | 2 +- samples/basic-legacy/rc.conf | 4 +- samples/basic/local.conf | 5 +++ samples/basic/pf.conf | 44 +++++++++++++++++++ samples/basic/rc.conf | 7 +++ 7 files changed, 98 insertions(+), 3 deletions(-) rename samples/basic-legacy/{cards.conf => local.conf} (100%) create mode 100644 samples/basic/local.conf create mode 100644 samples/basic/pf.conf create mode 100644 samples/basic/rc.conf diff --git a/README.md b/README.md index 404811e..f117e84 100644 --- a/README.md +++ b/README.md @@ -44,6 +44,18 @@ embeddable configuration commands. This directory contains the base templates for some generated file types. +#### `${rc_router_dir}/samples` + +This directory contains subdirectories with sample configurations for common +use cases. Each subdirectory is named for its purpose. The `basic` +configuration is recommended as a good starting point. Users should fill +in some small details in a "local.conf" file in those configuration samples. +When these samples are used, the entire configuration of the router for that +purpose should be complete. On next reboot, it should function according +to that use case, with no other settings changes necessary. It is +recommended that users copy the `sample` configurations as a starting +point, rather than modify them in place + #### `${rc_router_dir}/harness` This directory contains a testing harness to allow running many of these @@ -109,6 +121,33 @@ necessary configuration files from various `rc.conf` variables and hints. drive this process, such that more customized configurations can be co-mingled with its patterns. +## How to setup using the `basic` sample configuration + +Executing this sequence of sample commands will setup a fully-functional SOHO +router using this framework. You'll need to fill in the appropriate choices +for your ISP and your network interfaces. + +``` +$ cd /etc +$ mkdir router-conf +$ cd router-conf +$ git init . +$ git submodule add rc.router https://gitea.nerdland.org/adam/rc.router +$ rc.router/scripts/install-dependencies.sh +$ cp rc.router/samples/basic/* . +$ cat << EOF > local.conf +external_card="abc0" +internal_card="xy0" +my_isp="verizon_fios" +EOF +$ git add rc.conf local.conf pf.conf +$ git commit -m "FIRST POST!!!" +$ echo 'rc_router_dir="/etc/router-conf/rc.router"' >> /etc/rc.conf +$ echo 'rc_router_conf_dir="/etc/router-conf"' >> /etc/rc.conf +$ echo ". ${rc_router_dir}/rc.entry" >> /etc/rc.conf +$ reboot # Router is ready +``` + ## How to setup (Easy dual-stack example With Git) Executing this sequence of sample commands will setup a basic Dual-stack router diff --git a/samples/basic-legacy/cards.conf b/samples/basic-legacy/local.conf similarity index 100% rename from samples/basic-legacy/cards.conf rename to samples/basic-legacy/local.conf diff --git a/samples/basic-legacy/pf.conf b/samples/basic-legacy/pf.conf index 91e6ccc..faca804 100644 --- a/samples/basic-legacy/pf.conf +++ b/samples/basic-legacy/pf.conf @@ -1,4 +1,4 @@ -include "cards.conf" +include "local.conf" set block-policy drop set loginterface external diff --git a/samples/basic-legacy/rc.conf b/samples/basic-legacy/rc.conf index 0a6fa94..ce4fe14 100644 --- a/samples/basic-legacy/rc.conf +++ b/samples/basic-legacy/rc.conf @@ -1,7 +1,7 @@ -. ${rc_router_dir}/sample/basic_legacy/cards.conf +. ${rc_router_conf_dir}/local.conf add_v4_net ${internal_card} 0 main add_v4_isp ${external_card} dhcp -pf_config=${rc_router_dir}/sample/basic-legacy/pf.conf +pf_config=${rc_router_conf_dir}/pf.conf diff --git a/samples/basic/local.conf b/samples/basic/local.conf new file mode 100644 index 0000000..a25f01b --- /dev/null +++ b/samples/basic/local.conf @@ -0,0 +1,5 @@ +external_card="em0" +internal_card="bge0" +my_isp="verizon_fios" + + diff --git a/samples/basic/pf.conf b/samples/basic/pf.conf new file mode 100644 index 0000000..dd11b3c --- /dev/null +++ b/samples/basic/pf.conf @@ -0,0 +1,44 @@ +include "local.conf" + +set block-policy drop +set loginterface external + +set skip on lo0 +set skip on lo + +# Unroutable networks: +table { 127.0.0.0/8 192.168.0.0/16 172.16.0.0/12 10.0.0.0/8 192.88.99.0/24 198.18.0.0/15 } + +table { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8, 192.88.99.0/24 198.18.0.0/15 2001:db8::/32 3fff::/20 } + +nat on $external_card inet from !($external_card) -> ($external_card:0) +nat-anchor "ftp-proxy/*" +rdr-anchor "ftp-proxy/*" + +block drop in quick on external from + +block drop in quick from # User defined junk table +block drop out quick to # User defined junk table + +# Scrub stuff via a matchrule: +match in all scrub ( random-id reassemble tcp fragment reassemble ) + + +# Start with a paranoid default: +block all + +# ICMP is important, don't block it +pass proto { icmp ipv4-icmp } keep state + +# DHCPv4 from ISP +pass in quick on external inet proto udp to (external) port { 67, 68 } + +# DHCPv6 and NDP with ISP +pass in quick on external inet6 proto udp to fe80::/64 port 546 + +pass out all + +antispoof for internal +antispoof for external + +pass in on internal all diff --git a/samples/basic/rc.conf b/samples/basic/rc.conf new file mode 100644 index 0000000..99a265a --- /dev/null +++ b/samples/basic/rc.conf @@ -0,0 +1,7 @@ +. ${rc_router_conf_dir}/local.conf + +add_v4_net ${internal_card} 0 main + +add_canned_isp ${external_card} my_isp ${my_isp} + +pf_config=${rc_router_conf_dir}/pf.conf