Configuring the local network

Point-to-point interfaces

With a point-to-point interface, the software currently requires you to specify the IP address of the other end of the link as well. As we shall see in Chapter 20, there is no good reason to do this, but ifconfig insists on it. In addition, we need the network mask for a non-broadcast medium. The value is obvious Well, you’d think it was obvious. We’ll see on page 346 that some people think it should be something else : 1 you can reach exactly one address at the other end, so it must be 255.255.255.255. With this information, we could configure the PPP interface on gw:

# ifconfig tun0 139.130.136.133 139.130.136.129 net mask 255.255.255.255

In fact, this is almost never necessary; in Chapter 20 we’ll see that the PPP software usually sets the configuration automatically.

The loopback interface

The IP protocols require you to use an address to communicate with every system—even your own system. Theoretically, you could communicate with your system via the an Ethernet interface, but this is relatively slow: the data would have to go through the network stack. Instead, there is a special interface for communicating with other processes in the same system, the loopback interface. Its name is lo0, and it has the address 127.0.0.1. It’s straightforward enough to configure:

# ifconfig lo0 127.0.0.1

In fact, though, you don’t even need to do this much work: the system automatically sets it up at boot time.

Checking the interface configuration

ifconfig doesn’t just set the configuration: you can also use it to check the configuration. It’s a good idea to do this after you change something:

$ ifconfig
dc0:  flags=8843< UP, BROADCAST, RUNNING, SIMPLEX, MULTICAST > mtu 1500
    inet 223.147.37.5 net mask 0xffffff00 broadcast 223.147.37.255
    inet6 fe80::280:c6ff:fef9:d3fa%dc0 prefixlen 64 scopeid 0x1
    ether 00:80:c6:f9:d3:fa
    media: Ethernet autoselect (100baseTX < full-duplex >)
    status: active
lp0:  flags=8810<POINTOPOINT,SIMPLEX,MULTICAST> mtu 1500
lo0:  flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
    inet6 ::1 prefixlen 128
    inet6 fe80::1%lo0 prefixlen 64 scopeid 0x3
    inet 127.0.0.1 net mask 0xff000000
tun0: flags=8051<UP, POINTOPOINT, RUNNING, MULTICAST > mtu 1500
    inet 139.130.136.133 -- > 139.130.136.129 net mask 0xffffffff

There are a number of things to note here:

The configuration files

The system startup scripts summarize this configuration information in a number of configuration variables .See Chapter 29 for more details. At the moment, the following variables are of interest to us:

# hostname -s gw.example.org

Previously, FreeBSD also required you to set a variable network_interfaces, a list of the names of the interfaces to be configured. This variable now defaults to the value auto to specify that all interfaces should be configured. You only need to change it if you specifically want to exclude an interface from configuration.

For gw, we put the following information in /etc/rc.conf:

hostname=‘gw.example.org’ ifconfig_dc0=‘inet 223.147.37.5’

We don’t configure the tunO interface here; as we’ll see in Chapter 20, the PPP setup works differently.

Automatic configuration with DHCP

Maintaining the network configurations for a number of machines can be a pain, especially if they're laptops that come and go. There's analternative for larger networks: use DHCP, the Dynamic Host Configuration Protocol. DHCP enables a machine to get configuration information automatically from the network. The concept is expandable, but typically you get an IP address and net mask and the names of the default name servers and routers. In terms of the configuration we've seen so far, this replaces running the ifconfig and route programs, and also the file /etc/resolv.conf, which describes the locations of name servers. We'll look at it on page 366.

There are two parts to DHCP: the client and the server.

DHCP client

To get a configuration, you run dhclient. In previous releases of FreeBSD, dhclient printed out information about the addresses it received. In Release 5, it does not print anything. Simply start it with the name of the interface:

# dhclient dc0

To assign an address automatically at boot time, put the special value DHCP in the ifconfig_dc0 variable:

ifconfig_dc0=DHCP

DHCP server

DHCP requires a server. The server is not included as part of the base system; instead, install the net/isc-dhcp3 port:

# cd /usr/ports/net/isc-dhcp3
# make install

To configure dhcpd, edit the configuration file /usr/local/etc/isc-dhcpd.conf. Here's an example:

ddns-update-style ad-hoc;

# 100 Mb/s Ethernet
subnet 223.147.37.0 net mask 255.255.255.0 {
  range 223.147.37.90 223.147.37.110;
  option domain-name-servers freebie.example.com, presto.example.com;
  option domain-name " example.com ";
  option routers gw.example.com;
  option subnet-mask 255.255.255.0;
  option broadcast-address 223.147.37.255;
  default-lease-time 86400;
  max-lease-time 259200;
  use-host-decl-names on;  use the specified name as host name
  host andante {
    hardware ethernet 0:50:da:cf:7:35;
  }
}

This configuration file tells dhcpd:

The variables default-lease-time and max-lease-time, which are specified in seconds, determine how long it will be before a system checks its configuration. The values here represent one day and three days respectively.

use-host-decl-names tells dhcpd to use the name on the host line as the host name of the system. Otherwise you would need an additional option host-name specification for every system. For one machine it doesn’t makemuch difference, but if you have twenty such machines, you'll notice the difference.

One of the problems with dhcpd is that by default it doesn’t allocate a static IP address. Theoretically you could attach a laptop to the same DHCP server and get a different address every time, but in fact dhcpd does its best to keep the same address, and sometimes you may find it impossible to change its mind. In this configuration file, though, we have explicitly told dhcpd about andante, which is recognized by its Ethernet address. This works relatively well for fixed machines, but there’s problem with laptops and PC Card: dhcpd recognizes the network interface, not the machine, and if you swap the interface card, the IP address moves tothe new machine.

Starting dhcpd

The dhcpd port installs a sample startup file in the directory /usr/local/etc/rc.d. It's called isc-dhcpd.sh.sample, a name which ensures that it won't get executed. This file doesn't normally require any configuration; simply copy it to isc-dhcpd.sh in the same directory. This enables the system startup to find it and start dhcpd.

To start dhcpd during normal system operation, just run this same script:

# /usr/local/etc/rc.d/isc-dhcpd.sh start
Mar  14  15:45:09  freebie dhcpd: Internet Software Consortium DHCP Server V3.0rc10
Mar  14  15:45:09  freebie dhcpd: Copyright 1995-2001 Internet Software Consortium.
Mar  14  15:45:09  freebie dhcpd: All rights reserved.
Mar  14  15:45:09  freebie dhcpd: For info, please visit http://www.isc.org/products/DHCP
Mar  14  15:45:09  freebie dhcpd: Wrote 0 deleted host decls to leases file.
Mar  14  15:45:09  freebie dhcpd: Wrote 0 new dynamic host decls to leases file.
Mar  14  15:45:09  freebie dhcpd: Wrote 14 leases to leases file.
Mar  14  15:45:09  freebie dhcpd: Listening on BPF/xl0/00:50:da:cf:07:35/223.147.37.0/24
Mar  14  15:45:09  freebie dhcpd: Sending on BPF/xl0/00:50:da:cf:07:35/223.147.37.0/24
Mar  14  15:45:09  freebie dhcpd: Sending on Socket/fallback/fallback-net

When you change the configuration file /usr/local/etc/isc-dhcpd.conf, you must restart dhcpd:

# /usr/local/etc/rc.d/isc-dhcpd.sh restart

Configuring PC Card networking cards

We've looked at PC Card devices on page 159, but there are some special issues involved in configuring networking cards. Of course, ifconfig works with PC Card networking cards in exactly the same way as it does with PCI and ISA cards, but you can’t configure them in the same manner at startup, because they might not yet be present.

On inserting a PC Card device, you will see something like this on the console:

Manufacturer ID: 01015751
Product version: 5.0
Product name: 3Com Corporation | 3CCFE575BT | LAN Card bus Card | 001 |
Functions: Network Adaptor, Memory
CIS reading done
cardbus0: Resource not specified in CIS: id=14, size=80
cardbus0: Resource not specified in CIS: id=18, size=80
xl0: <3Com 3c575B Fast Ether link XL> port 0x1080-0x10bf mem 0x88002400-0x8800247
f,0x88002480-0x880024ff irq 11 at device 0.0 on cardbus0
xl0: Ethernet address: 00:10:4b:f8:fd:20
miibus0: <MII bus> on xl0
tdkphy0: <TDK 78Q2120 media interface> on miibus0
tdkphy0: 10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, auto

After this, ifconfig shows:

$ ifconfig xl0
  xl0:  flags=8802<BROADCAST,SIMPLEX,MULTICAST> mtu 1500
  ether 00:10:4b:f8:fd:20
  media: Ethernet autoselect (100baseTX <full-duplex>)

The card is there, but it’s not configured. FreeBSD uses the devd daemon to perform user land configuration after a card has been attached. We've already looked at devd on page 159. When devd establishes that the card is a networking card, it calls /etc/pccard_ether to configure it. In the following, we'll see how /etc/pccard_ether configures our xlO interface. It performs the following steps:

That's a lot of choice. What do you use when? That depends on what you want to do. The first thing to note is that nothing happens unless your interface name is in the variable removable_interfaces, and the variable ifconfig_xl0 exists. The question is, what do you put in ifconfig_xl0?

In principle, it’s the same as with other network cards: either IP address and other options, or DHCP. The third alternative is important, though. Let’s consider the case where you want to start a number of services when the system is connected. You might want to run ntpdate, then start ntpd and rwhod, and you may want to mount some NFS file systems. You can do all this at startup with normal network cards, but /etc/pccard_ether isn't clever enough to do all that. Instead, create a file called /etc/startjf.xl0 and give it the following contents:

dhclient xl0
ntpdate freebie
killall ntpd
ntpd 
killall rwhod
rwhod 
mount –t nfs -a

Don’t forget to start DHCP or otherwise set the IP address, because this method bypasses the standard startups.

In addition, you put this in /etc/rc.conf:

devd_enable=YES
ifconfig_xl0=NO
removable interfaces="wi0 xe0 xl0"

The values in the last line only need to include xl0, of course, but it’s good to put in every interface name that you would possibly use.

Detaching network cards

When you remove a network card, devd invokes /etc/pccard_ether again. The actions are similar to the one it performs when the card is attached:

If you travel elsewhere with a laptop and suspend the system, make sure you unmount any NFS file systems first. You can't do it once you're no longer connected to the network, and it’s possible that things will hang trying to access NFS-mounted files.

Setting up wireless networking

We saw in Chapter 16 that wireless cards have a few more tricks up their sleeves than conventional Ethernets. To set them up correctly, you need to know:

Each of these translates into an ifconfig command. Here are some typical examples:

ifconfig wi0 ssid Example                       join Example network
ifconfig wi0 media autoselect media opt -adhoc  set BSS mode
ifconfig wi0 channel 3                          select channel 3 (if not in BSS mode)
ifconfig wi0 wepmode on                         turn encryption on (if using WEP)
ifconfig wi0 wepkey 0x42726f6b21                encryption key (for WEP)

When setting media options, you must also select the media, even if it is unchanged; thus the media autoselect in the example above.

You have a choice of where to put these specifications. For example, if you were connecting to the Example network, which is IBSS, you could put this in your /etc/rc.conf

devd_enable=YES
ifconfig_wi0="192.168.27.4 ssid Example media autoselect media opt adhoc \
channel 3 wepmode on wepkey 0x42726f6b21 removable interfaces="wi0 xe0 xl0"

You don't need to do anything special to become an IBSS master in an IBSS network: if there is no master already, and your card supports it, your system will become the IBSS master.

If, on the other hand, you were connecting to a non-encrypted network, you would not need the WEP key, and you might enter:

ifconfig_wi0="192.168.27.4 ssid Example media autoselect media opt ibss-master channel 3 wepmode off"

What we can do now

At this point, we have configured the link layer. We can communicate with directly connected machines. To communicate with machines that are not directly connected, we need to set up routing. We'll look at that next.

Routing

Looking back at our example network on page 294, we'll reconsider a problem we met there: when a system receives normal data packet, what does it do with it? There are four possibilities:

These decisions are the basis of routing. The implementation performs them with the aid of a routing table, which tells the system which addresses are available where. We've already seen the net mask in Chapter 16, on page 290. We’ll see that it also plays a significant role in the routing decision. Table 17-1 shows a symbolic view of the routing table for gv.example.org. It looks very similar to the ifconfig output in the previous section:

And that's all there is to it! Well, sort of. In our example configuration, we're hidden in one corner of the Internet, and there's only one way out to the rest of the network. Things look different when you are connected to more than one network. On page 310 we'll look at the differences we need for the ISP example.net. In the middle of the Internet, things are even more extreme. There may be dozens of interfaces, and the choice of a route for a particular address may be much more complicated. In such an environment, two problems occur:

Adding routes automatically

FreeBSD comes with all the currently available routing software, primarily the daemon . An alternative in the Ports Collection is zebra.

All these daemons have one thing in common: you don't need them. At any rate, you don’t need them until you have at least two different connections to the Internet, and even then it’s not sure. As a result, we won’t discuss them here. If you do need to run routing daemons, read all about them in TCP/IP Network Administration, by Craig Hunt.

From our point of view, however, the routing protocols have one particular significance: the system expects the routing table to be updated automatically. As a result, it is designed to use the information supplied by the routing protocols to perform the update. This information consists of two parts:

Adding routes manually

As we saw in the previous section, the routing software uses only addresses, and not the interface name. To add routes manually, we have to give the same information.

The program that adds routes manually is called route. We need it to add routes to systems other than those to which we are directly connected.

To set up the routing tables for the systems connected only to our reference network (freebie, presto, bumble and wait), we could write:

# route add default gw

During system startup, the script /etc/rc.network performs this operation automatically if you set the following variable in /etc/rc.conf:

default router="223.147.37.5"  # Set to default gateway (or NO).

Note that we enter the address of the default router as an IP address, not a name. This command is executed before the name server is running. We can’t change the sequence in which we start the processes: depending on where our name server is, we may need to have the route in place to access the name server.

On system gw, the default route goes via the tunO interface:

#default router="139.130.136.129" # Set to default gateway (or NO).
gateway enable="YES "             # Set to YES if this host will be a gateway.

This is a PPP interface, so you don't need a default router entry; if you did, it would look like the commented-out entry above. Later we'll see how PPP sets the default route.

We need to enable gateway functionality on this system, since it receives data packets on behalf of other systems. We’ll look at this issue in more depth on page 313.

ISP's route setup

At the ISP site, things are slightly more complicated than at example.org. Let’s look at the gateway machine free-gw.example.net. It has three connections, to the global Internet, to example.org and to another network, biguser.com (the network serviced by interface pppO). To add the routes requires something like the following commands:

# route add default 139.130.237.65             igw.example.net
# route add -net 223.147.37.0 139.130.136.133  gw.example.org
# route add -net 223.147.38.0 -iface ppp0      local ppp0 interface

The first line tells the system that the default route is via gw.example.org. The second shows that the network with the base IP address 223.147.37.0 (example.org) can be reached via the gateway address 139.130.136.133, which is the remote end of the PPP link connected via ppp3. In the case of biguser.com, we don’t know the address of the remote end; possibly it changes every time it’s connected. As a result, we specify the name of the interface instead: we know it's always connected via pppO.

The procedure to add this information to /etc/rc.conf is similar to what we did for the interface addresses:

The variable static_routes contains a list of the static routes that are to be configured.

For each route, a variable corresponding to the route name specified in static_routes, with the text route_ prepended. Unlike the interfaces, you can assign any name you want to them, as long as it starts with route. It makes sense for them to be related to the domain name, but they don't have to. For example, we would have liked to have called our network freebie.org, but there's a good chance that this name has been taken, so we called it example.org instead. The old name live in the name of the route, route_freebie. In the case of biguser.com, we have called the route variable route_biguser.

We put the following entries into free-gw's /etc/rc.conf:

default router="139.130.237.65"  # Set to default gateway (or NO).
static_routes="freebie biguser"  # list of static routes 
route_freebie="-net 223.147.37.0 139.130.237.129" 
route_biguser="-net 223.147.38.0 139.130.237.9"

Looking at the routing tables

You can show the routing tables with the netstat tool. Option -r shows the routing tables. For example, on freebie you might see:

# net stat -r
Routing tables

Internet:
Destination  Gateway            Flags  Refs    Use  Netif  Expire
default      gw                 UGSc     9    8732    rl0  
localhost    localhost          UH       0    1255    lo0  
223.147.37   link#2             UC       0       0    
presto       0:0:c0:44:a5:68    UHLW    13  139702    rl0    1151
freebie      0:a0:24:37:d:2b    UHLW     3   38698    lo0  
wait         0:60:97:40:fb:e1   UHLW     6    1062    rl0     645
bumble       8:0:20:e:2c:98     UHLW     2      47    rl0    1195
gw           0:60:97:40:fb:e1   UHLW     6    1062    rl0     645
broadcast    ff:ff:ff:ff:ff:ff  UHLWb    2    5788    rl0  

There’s lot to notice about this information:

The first column is the name of a host or a network to which packets can be sent, or the keyword default.

The second column, the gateway, indicates the path to the destination. This field differs significantly even from older versions of UNIX. It can be the name of a host (for example, gw), a pointer to an interface (link#2, which means the second Internet interface; the output from ifconfig is in the same sequence), or an Ethernet address (8:0:20:e:2c:98). Older versions of UNIX do not use the last two forms.

We’ll look at the fags below. The most important ones to note are G (gateway) and H (host).

The fields Refs, Use and Expire are only of interest when you're running a routing protocol. See the man page netstat(l) for more details.

Netif is the name of the interface by which the gateway can be reached. In the case of a link, this is the interface, so the Netif field is empty.

The order of the entries is not important. The system searches the table for a best fit, not a first fit.

The default entry points to gw, as we would expect. The interface, rl0, is the interface by which gw can be reached.

You will also get some additional output for IPv6 ("Internet "). If you're not using IPv6, you can ignore it. If it gets on your nerves, you can limit your view to IPv4 by entering the command netstat -rfinet. The -f fag specifies which address family you're interested in, and inet specifies IPv4.

Flags

Compared to earlier versions of netstat, the current version displays many more fags. The following table gives you an overview.

Packet forwarding

We saw above that when a system receives packet that is not intended for itself, it looks for a route to the destination. In fact, this is not always the case: by default, FreeBSD just silently drops the packet. This is desirable for security reasons, and indeed it’s required by RFC 1122, but if you want to access the Internet via another machine on your local net, it’s less than convenient.

The rationale for this is that most systems are only connected to one network, and it doesn't make sense to have packet forwarding enabled. Earlier systems made this a kernel option, so that disabling packet forwarding also made the kernel fractionally smaller. In current versions of FreeBSD, the code is always there, even if it is disabled.

It’s straightforward enough to set up your machine as a router (or gateway): you can set it with the sysctl command:

# sysctl -w net.inet.ip.forwarding=1
net.inet.ip.forwarding: 0 -> 1

In /etc/rc.conf you can set this with the variable gateway_enable:

gateway_enable="YES "  # Set to YES if this host will be a gateway.

Configuration summary

In the course of this chapter, we've discussed a number of different configurations. In this section we'll summarize the configuration for for free-gw.example.net, since it is the most complicated. You enter the following information in your /etc/rc.conf:

hostname="free-gw.exarrple. net "

ifconfig_rl0="inet 139.130.237.117"

defaultrouter="139.130.237.65" # Set to default gateway (or NO).

static_routes="freebie biguser" # Set to static route list

route_freebie="-net 223.147.37.0 139.130.136.133" route_biguser="-net 223.147.38.0 -iface ppp0"

gateway enable="YES "  # Set to YES if this host will be a gateway.

Without the comments, this gives the following entries:

hostname="free-gw.example.net"
ifconfig_rl0="inet 139.130.237.117"
default router="139.130.237.65"  # Set to default gateway (or NO).
static_routes="freebie biguser"  # Set to static route list
route_freebie="-net 223.147.37.0 139.130.136.133"
route_biguser="-net 223.147.38.0 -iface ppp0"
gateway enable="YES "            # Set to YES if this host will be a gateway.

For machine configured with DHCP, you might have:

hostname="andante.example.net"
ifconfig_wi0=DHCP