Setting up OpenBSD as a router/nat box to replace a Linksys BEFSR41

I removed the Linksys Router, and ran "sysctl -w net.inet.ip.forwarding=1". The line in the sysctl.conf file for "net.inet.ip.forwarding=1" is uncommented.

I have no blocks set up right now.

I also tested with those rules you posted for the pf.conf file, and commented out the line I had.

I was still unable to get the workstations to connect out the internet, even though the OpenBSD box can. None of the workstations will ping the OpenBSD box in that configuration still.

But for some reason I could not get everything working again when I put the Linksys router back inbetween the Cable Modem and the OBSD box. So right now I am just hooked up straight to the Linksys Router.

I do have the dc0 interface using DHCP however. During boot up, when its setup Cable Modem straight to the dc0 interface, it grabs an IP from a 10.x.x.x address. The IP that it grabs is not my public IP. I have dynamic IP ont he Cable Modem, but its been teh same IP for months now, and that number it finds for dc0 on boot up is not my public IP. But when it does this, I can still get out on the OBSD box.

The IP listed in "ipconfig dc0" when I do this, is 68.32.210.146 where as my public IP is really 69.244.xx.xx.

Should I not be running dchp on dc0 when I am just going straight from the cable modem to the dc0 interface on the OBSD box?

What is found in /etc/ifconfig.dc0 and /etc/ifconfig.dc1 ???

I do not have /etc/ifconfig.dc0 or /etc/ifconfig.dc1 files.

When I am setup without the Linksys router, this is what my ifconfig looks like (after I "ifconfig dc1 172.18.84.1 netmask 255.255.255.0" and bring the dc1 interface up).

edoras# ifconfig
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33224
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x6
dc0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        address: 00:04:5a:43:e2:d0
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet6 fe80::204:5aff:fe43:e2d0%dc0 prefixlen 64 scopeid 0x1
        inet 68.32.210.146 netmask 0xffffff00 broadcast 68.32.210.255
dc1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        address: 00:80:ad:7b:2c:50
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 172.18.84.1 netmask 0xffffff00 broadcast 172.18.84.255
        inet6 fe80::280:adff:fe7b:2c50%dc1 prefixlen 64 scopeid 0x2
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33224
pfsync0: flags=0<> mtu 2020
enc0: flags=0<> mtu 1536
edoras#

When I have the Linksys router included, the dc0 interface has "inet 192.168.1.100 netmask 0xffffff00 broadcast 192.168.1.255" instead of "inet 68.32.210.146 netmask 0xffffff00 broadcast 68.32.210.255"

I set it back up with the Linksys Router completely removed again. Rconfigured my workstations from dhcp to static IPs.

Rebooted the OBSD box for the heck of it... added the needed "ifconfig dc1 172.18.84.1 netmask 255.255.255.0" and then brought both interfaces back up.

Ran "pfctl -f /etc/pf.conf" and walked back to one of my workstations, and "poof" it was logging onto a messenger service I forgot to turn off. (I love that silent "poof" sound. Greatest sound in the world)

All seems to be working and routing correctly without the Linksys router. I will now setup up all the rest of the workstations again.

Can I ask you some followup questions about this?

1.) Am I supposed to run the pf.conf file manually like this, or is it supposed to be called into play by default on bootup?

2.) I have a /etc/hostname.dc0 but no /etc/hostname.dc1. I am assuming this is because I only had one network device installed during the reinstallation of the OS earlier this weekend. How do I setup the dc1 to have the correct configuration on bootup?

(from the OBSD box)

edoras# cat /etc/hostname.dc0
dhcp NONE NONE NONE
edoras#

(from one of the workstations - this one on windows)

C:\>tracert www.google.com

Tracing route to www.l.google.com [66.102.7.147]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  172.18.84.1
  2     8 ms    10 ms    12 ms  10.67.56.1
  3     7 ms     8 ms     7 ms  68.86.179.1
  4    12 ms    10 ms    12 ms  12.125.99.101

3.) Is that second hop on the 10.x.x.x IP my Cable Modem? It must be since its non-routable, but I'm not certain.

Lastly, I do not spend as much time as I used to on this site years ago... how many points do you really feel this was worth? I will set it accordingly before accepting your answer. Thanks for your assistance.

I will answer in 10 hours ( have to sleep btw )

1) no, probably
nat on (dc0) from (dc1:network) to any -> (dc0)
will accomodate ifconfig dc1
2) you have to add hostname.dc1
# media 10baseT
inet 172.18.84.1 netmask 255.255.255.0
to make ifconfig change happen before pf is loaded (??)
3) likely, or somewhere at your provider, refer to cable modem/dsl docs

I guess 250 is more than enough - problem is with normal configuration for personal use...
500 is appropriate if you ask for pf on bridge with -leven gigabit cards ....

gheist: thanks. Looking closer at the boot up messages, pf does NOT load, since there is no IP configured for dc1. So when I manually added the IP and netmask, PF was still not running, hence why it worked when I ran (as you suggested) "pfctl -f /etc/pf.conf"  I guess.

So if I add "inet 172.18.84.1 netmask 255.255.255.0" to a file for /etc/hostname.dc1, this will configure the dc1 interface during bootup automatically, allowing pf to run at boot up without error?

I will test this next weekend when I have some time to take the network down again (just in case I screw up and can't fix it again, ahaha)