SEO

Hi, all:

I've slogged through getting an OpenBSD box functional as a firewall for a
LAN, but always with the (simplest) configuration of two NICs, one for
outside (xDSL, T-1, whatever), and one for inside, to the LAN. PF has been
very good... to me.

I'd like to create a LAN that will include an OpenBSD system. The OpenBSD
system will do dial-up on demand for the other systems, all MS® Windows®.
If anyone has any thoughts, hints or suggestions, I'd be very appreciative.
I'm having a hard time finding stuff on this sort of configuration, mainly
because, I think, no one uses dial-up, anymore!

The users will turn on the firewall/gateway, say, in the morning, leave it
on all day, use their Windows® systems, occasionally visiting the Internet.
I'm not sure if the phone line for data will be exclusively used for that;
it may also be needed for faxes. Of course, I know that while on the
Internet, the office will not be able to receive faxes. But, it means that
I can't just hog the line... I need to let it go after, say, 10 minutes of
idleness.

I'd like to figure out how to allow someone on the network the ability to
shutdown the firewall/gateway without having to login to the system (I'm
worried they'll freak out at having to look at a command-line), but that can
wait, unless someone has a suggestion.

Anyway, TIA.

Best regards,

Jim

J. Graue wrote:

> Hi, all:
>
> I've slogged through getting an OpenBSD box functional as a firewall for a
> LAN, but always with the (simplest) configuration of two NICs, one for
> outside (xDSL, T-1, whatever), and one for inside, to the LAN. PF has been
> very good... to me.
>
> I'd like to create a LAN that will include an OpenBSD system. The OpenBSD
> system will do dial-up on demand for the other systems, all MS® Windows®.
> If anyone has any thoughts, hints or suggestions, I'd be very appreciative.
> I'm having a hard time finding stuff on this sort of configuration, mainly
> because, I think, no one uses dial-up, anymore!
>
> The users will turn on the firewall/gateway, say, in the morning, leave it
> on all day, use their Windows® systems, occasionally visiting the Internet.
> I'm not sure if the phone line for data will be exclusively used for that;
> it may also be needed for faxes. Of course, I know that while on the
> Internet, the office will not be able to receive faxes. But, it means that
> I can't just hog the line... I need to let it go after, say, 10 minutes of
> idleness.
>
> I'd like to figure out how to allow someone on the network the ability to
> shutdown the firewall/gateway without having to login to the system (I'm
> worried they'll freak out at having to look at a command-line), but that can
> wait, unless someone has a suggestion.
>
Just press the power off button, the system will fsck the filesystem
automatically when it rebooted next time.

Sam
> Anyway, TIA.
>
> Best regards,
>
> Jim
>
>

Hello, Sam:

<SNIP everything else but this one issue that sam addressed>

> I'd like to figure out how to allow someone on the network the ability to
> > shutdown the firewall/gateway without having to login to the system (I'm
> > worried they'll freak out at having to look at a command-line), but that
can
> > wait, unless someone has a suggestion.
> >
> Just press the power off button, the system will fsck the filesystem
> automatically when it rebooted next time.
>
> Sam

Thanks for the suggestion. I would welcome any others' thoughts on this.
With all due respect to you, sam, I find this solution to be inelegant. If,
on the LAN-side, someone could, say, shutdown the dial-up gateway from a Web
page, that would be great.

If you have any thoughts on how I might go about configuring an on-demand
dialup gateway/firewall using OpenBSD, again, I would appreciate any input.

Best regards,

Jim

In article <1191s8epv2svm40@corp.supernews.com>,
J. Graue <info@nospam.com> wrote:
>Hello, Sam:
>
><SNIP everything else but this one issue that sam addressed>
>
>> I'd like to figure out how to allow someone on the network the ability to
>> > shutdown the firewall/gateway without having to login to the system (I'm
>> > worried they'll freak out at having to look at a command-line), but that
>can
>> > wait, unless someone has a suggestion.
>> >
>> Just press the power off button, the system will fsck the filesystem
>> automatically when it rebooted next time.

You didn't mention what the hardware was, so I don't know what
may be available.

With some hardware, the system can hold the power up after you
hit the power button until a complete and clean shutdown is performed.
On these, the power off button is a reasonable approach. However, if
the hardware does not support this, you could lose data as power drops
between the time a logical write to disk has occurred and the time that
the flush happens to assure a *physical* write to disk.

>Thanks for the suggestion. I would welcome any others' thoughts on this.
>With all due respect to you, sam, I find this solution to be inelegant. If,
>on the LAN-side, someone could, say, shutdown the dial-up gateway from a Web
>page, that would be great.

Hmm ... perhaps a CGI script -- ideally locked out of access
from outside, and available only to local IPs, which invokes the
following command line:

shutdown -h -p +5 web requested shutdown

You may wish to tune either the time or the message which follows the
time.

It might be a good idea to have the CGI script check the current time of
day and compare it to the normal working hours to decide whether to
honor the web-based request. Or -- if you can find out how many systems
are currently using the gateway, perhaps it should return a message
indicating how many users are on, and refusing until the number is down
to one.

>If you have any thoughts on how I might go about configuring an on-demand
>dialup gateway/firewall using OpenBSD, again, I would appreciate any input.

I've only covered possibilities for making the shutdown web
based to protect your users from the dreaded command line. However, it
presents some interesting opportunities for Denial Of Service attacks if
one of your internal users is feeling obnoxious. I would suggest that
the CGI script also log the IP address (and system name, if available)
for after-the-fact determination of the offending party.

Good Luck,
DoN.
--
Email: <dnichols@d-and-d.com> | Voice (all times): (703) 938-4564
(too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
--- Black Holes are where God is dividing by zero ---

On 05/20/05 6:58 PM, J. Graue wrote:

> The users will turn on the firewall/gateway, say, in the morning, leave it
> on all day, use their Windows® systems, occasionally visiting the Internet.
> I'm not sure if the phone line for data will be exclusively used for that;
> it may also be needed for faxes. Of course, I know that while on the
> Internet, the office will not be able to receive faxes. But, it means that
> I can't just hog the line... I need to let it go after, say, 10 minutes of
> idleness.

I did something similar before I had DSL; see the manual for ppp
(especially the section titled DIAL ON DEMAND) and
/etc/ppp/ppp.conf.sample for the details, but

set timeout 600

(assuming 10 minutes -- 600 seconds) and running it as

ppp -auto [system]

will do the trick. The userspace ppp software will always be running,
but will only dial the ISP when an outgoing packet is detected. It will
shutdown after 10 minutes of inactivity.

> I'd like to figure out how to allow someone on the network the ability to
> shutdown the firewall/gateway without having to login to the system (I'm
> worried they'll freak out at having to look at a command-line), but that can
> wait, unless someone has a suggestion.

The system I was using was on all the time, but someone else in this
thread suggested using a CGI script. A cron job could shut it down, but
might cause a problem for someone working overtime...

--
Chris Odorjan - bobnet@canada.com

J. Graue wrote:

> Hello, Sam:
>
> <SNIP everything else but this one issue that sam addressed>
>
>>I'd like to figure out how to allow someone on the network the ability to
>>
>>>shutdown the firewall/gateway without having to login to the system (I'm
>>>worried they'll freak out at having to look at a command-line), but that
>
> can
>
>>>wait, unless someone has a suggestion.
>>>
>>
>>Just press the power off button, the system will fsck the filesystem
>>automatically when it rebooted next time.
>>
>>Sam
>
>
> Thanks for the suggestion. I would welcome any others' thoughts on this.
> With all due respect to you, sam, I find this solution to be inelegant. If,
> on the LAN-side, someone could, say, shutdown the dial-up gateway from a Web
> page, that would be great.
>
> If you have any thoughts on how I might go about configuring an on-demand
> dialup gateway/firewall using OpenBSD, again, I would appreciate any input.
>
Just install webmin in openbsd, you can remote admin the system thru its
web interface.

Sam
> Best regards,
>
> Jim
>
>

"DoN. Nichols" <dnichols@d-and-d.com> wrote in message
news:d6r7io$17j$1@Fuego.d-and-d.com...

> In article <1191s8epv2svm40@corp.supernews.com>,
> J. Graue <info@nospam.com> wrote:
> >Hello, Sam:
> >
> ><SNIP everything else but this one issue that sam addressed>
> >
> >> I'd like to figure out how to allow someone on the network the ability
to
> >> > shutdown the firewall/gateway without having to login to the system
(I'm
> >> > worried they'll freak out at having to look at a command-line), but
that
> >can
> >> > wait, unless someone has a suggestion.
> >> >
> >> Just press the power off button, the system will fsck the filesystem
> >> automatically when it rebooted next time.
>
> You didn't mention what the hardware was, so I don't know what
> may be available.
>
> With some hardware, the system can hold the power up after you
> hit the power button until a complete and clean shutdown is performed.
> On these, the power off button is a reasonable approach. However, if
> the hardware does not support this, you could lose data as power drops
> between the time a logical write to disk has occurred and the time that
> the flush happens to assure a *physical* write to disk.
>
> >Thanks for the suggestion. I would welcome any others' thoughts on this.
> >With all due respect to you, sam, I find this solution to be inelegant.
If,
> >on the LAN-side, someone could, say, shutdown the dial-up gateway from a
Web
> >page, that would be great.
>
> Hmm ... perhaps a CGI script -- ideally locked out of access
> from outside, and available only to local IPs, which invokes the
> following command line:
>
> shutdown -h -p +5 web requested shutdown
>
> You may wish to tune either the time or the message which follows the
> time.
>
> It might be a good idea to have the CGI script check the current time of
> day and compare it to the normal working hours to decide whether to
> honor the web-based request. Or -- if you can find out how many systems
> are currently using the gateway, perhaps it should return a message
> indicating how many users are on, and refusing until the number is down
> to one.
>
> >If you have any thoughts on how I might go about configuring an on-demand
> >dialup gateway/firewall using OpenBSD, again, I would appreciate any
input.
>
> I've only covered possibilities for making the shutdown web
> based to protect your users from the dreaded command line. However, it
> presents some interesting opportunities for Denial Of Service attacks if
> one of your internal users is feeling obnoxious. I would suggest that
> the CGI script also log the IP address (and system name, if available)
> for after-the-fact determination of the offending party.
>
> Good Luck,
> DoN.
> --
> Email: <dnichols@d-and-d.com> | Voice (all times): (703) 938-4564
> (too) near Washington D.C. | http://www.d-and-d.com/dnichols/DoN.html
> --- Black Holes are where God is dividing by zero ---

Thanks, DoN. Your suggestion is a good one, and I'll see what I can do.

Best regards,

Jim

"sam" <root@localhost.com> wrote in message
news:d6rr8o$2s6i$1@news.hgc.com.hk...

<SNIP>

> > If you have any thoughts on how I might go about configuring an
on-demand
> > dialup gateway/firewall using OpenBSD, again, I would appreciate any
input.
> >
> Just install webmin in openbsd, you can remote admin the system thru its
> web interface.

I'll check into this. It's nothing with which I'm familiar, but I'm happy
to learn new things.

Best regards,

Jim

"Chris 'Bob' Odorjan" <bobnet@canada.com> wrote in message
news:fnn7m2-tjr.ln1@bobnet.odorjan.ca...

> On 05/20/05 6:58 PM, J. Graue wrote:
>
> > The users will turn on the firewall/gateway, say, in the morning, leave
it
> > on all day, use their Windows® systems, occasionally visiting the
Internet.
> > I'm not sure if the phone line for data will be exclusively used for
that;
> > it may also be needed for faxes. Of course, I know that while on the
> > Internet, the office will not be able to receive faxes. But, it means
that
> > I can't just hog the line... I need to let it go after, say, 10 minutes
of
> > idleness.
>
> I did something similar before I had DSL; see the manual for ppp
> (especially the section titled DIAL ON DEMAND) and
> /etc/ppp/ppp.conf.sample for the details, but
>
> set timeout 600
>
> (assuming 10 minutes -- 600 seconds) and running it as
>
> ppp -auto [system]
>
> will do the trick. The userspace ppp software will always be running,
> but will only dial the ISP when an outgoing packet is detected. It will
> shutdown after 10 minutes of inactivity.
>
> > I'd like to figure out how to allow someone on the network the ability
to
> > shutdown the firewall/gateway without having to login to the system (I'm
> > worried they'll freak out at having to look at a command-line), but that
can
> > wait, unless someone has a suggestion.
>
> The system I was using was on all the time, but someone else in this
> thread suggested using a CGI script. A cron job could shut it down, but
> might cause a problem for someone working overtime...
>
> --
> Chris Odorjan - bobnet@canada.com

Thank you, very much, for addressing this and giving a hint. I'll dive in
and see if I can make this system do my bidding!

Best regards,

Jim