OpenBSD Sysadmin

  1	INTERNAL_IP="10.4.4.1"
  2	EXTERNAL_IP="10.0.2.40"
  3	DEFAULT_GATEWAY="10.0.2.2"
  4	LAN_NET="10.4.4.0/24"
  5	LAN_SUBNET="10.4.4"
  6	DHCP_RANGE_START="100"
  7	DHCP_RANGE_END="250"
  8	INT_NIC="em1"
  9	EXT_NIC="em0"
 10	FORWARD_DNS="8.8.8.8"
 11
 12	echo "Updating the internal interface config!"
 13	echo "inet $INTERNAL_IP 255.255.255.0 NONE -inet6" > /etc/hostname.$INT_NIC
 14	echo "inet $EXTERNAL_IP 255.255.255.0 NONE -inet6" > /etc/hostname.$EXT_NIC
 15	echo $DEFAULT_GATEWAY > /etc/mygate
 16
 17	sh /etc/netstart
 18
 19	echo "net.inet.ip.forwarding=1
 20	net.inet.ip.mforwarding=0
 21	net.inet6.ip6.forwarding=0
 22	net.inet6.ip6.mforwarding=0
 23	kern.maxclusters=128000
 24	net.bpf.bufsize=1048576" >> /etc/sysctl.conf
 25
 26	sysctl net.inet.ip.forwarding=1
 27	sysctl net.inet.ip.mforwarding=0
 28	sysctl net.inet6.ip6.forwarding=0
 29	sysctl net.inet6.ip6.mforwarding=0
 30	sysctl kern.maxclusters=128000
 31	sysctl net.bpf.bufsize=1048576
 32
 33	echo "configuring the pf firewall!"
 34
 35	echo "ext_if=\"$EXT_NIC\"
 36	int_if = \"$INT_NIC\"
 37	lan_net = \"$LAN_NET\"
 38
 39	set skip on lo0
 40	match in all scrub (no-df)
 41
 42	block log all
 43	block in quick from urpf-failed
 44
 45	pass in quick on \$ext_if inet proto tcp from any to any port = ssh keep state
 46
 47	pass in on \$int_if from \$lan_net
 48	pass out on \$int_if to \$lan_net
 49
 50	pass out on \$ext_if proto { tcp udp icmp } all modulate state
 51
 52	match out log on \$ext_if from \$int_if:network nat-to (\$ext_if:0)" > /etc/pf.conf
 53
 54	pfctl -f /etc/pf.conf
 55
 56	echo "Configuring unbound dns cache!"
 57
 58	echo "# \$OpenBSD: unbound.conf,v 1.4 2014/04/02 21:43:30 millert Exp \$
 59
 60	server:
 61        interface: 127.0.0.1
 62        interface: $INTERNAL_IP
 63        do-ip6: no
 64        verbosity: 3
 65        log-queries: yes
 66
 67        access-control: 0.0.0.0/0 refuse
 68        access-control: 127.0.0.0/8 allow
 69        access-control: $LAN_NET allow
 70        access-control: ::0/0 refuse
 71        access-control: ::1 refuse
 72
 73        hide-identity: yes
 74        hide-version: yes
 75
 76	forward-zone:
 77        name: "."                               
 78        forward-addr: $FORWARD_DNS
 79	" > /var/unbound/etc/unbound.conf
 80	rcctl enable unbound
 81	rcctl start unbound
 82
 83	echo "Configuring DHCP server!"
 84
 85	echo "shared-network LOCALHOST-BIZ {
 86        default-lease-time 86400;
 87        option  domain-name \"LOCALHOST.biz\";
 88        option  domain-name-servers $INTERNAL_IP;
 89
 90        subnet $LAN_SUBNET.0 netmask 255.255.255.0 {
 91                option subnet-mask 255.255.255.0;
 92                option broadcast-address $LAN_SUBNET.255;
 93                option routers $INTERNAL_IP;
 94                range $LAN_SUBNET.$DHCP_RANGE_START $LAN_SUBNET.$DHCP_RANGE_END;
 95        }
 96	}
 97
 98	" > /etc/dhcpd.conf
 99
100	touch /var/db/dhcpd.leases
101
102	echo "dhcpd_flags=\"$INT_NIC\"" >> /etc/rc.conf.local
103
104	rcctl enable dhcpd
105	rcctl start dhcpd
106
107	echo "nameserver 127.0.0.1" > /etc/resolv.conf