نحوه نصب و راه اندازی FreeBSD Access Point

witch named

pkg_add -r bind9

witch hostapd

ls –l /usr/src/sys

cd /usr/src/sys/`uname -m`/conf
cp GENERIC CUSTOM

echo "device pf
device pflog
device pfsync" >> CUSTOM

options         ALTQ
options         ALTQ_CBQ        # Class Bases Queuing (CBQ)
options         ALTQ_RED        # Random Early Detection (RED)
options         ALTQ_RIO        # RED In/Out
options         ALTQ_HFSC       # Hierarchical Packet Scheduler (HFSC)
options         ALTQ_PRIQ       # Priority Queuing (PRIQ)
options         ALTQ_NOPCC      # Required for SMP build

cd /usr/src
make buildkernel KERNCONF=CUSTOM
make installkernel KERNCONF=CUSTOM

shutdown -r now

fxp0 - ext_if - DHCP configured from upstream (e.g. let cable modem provide an IP) 
fxp1 - lan_if - static IP, 192.168.0.1; wired subnet will be 192.168.0.0/24; clients on LAN configured via DHCP 
ath0 - wifi_if - static IP, 192.168.1.1; wireless subnet will be 192.168.1.0/24; clients on WLAN configured via DHCP 

dhclient fxp0

ifconfig fxp1 inet 192.168.0.1 netmask 255.255.255.0

for d in {if_ath,ath_rate,ath_hal}; do kldload $d; done

for d in {wlan_wep_load,wlan_tkip_load,wlan_ccmp_load,wlan_xauth_load,wlan_acl_load}; do kldload $d; done

ifconfig ath0 inet 192.168.1.1 netmask 255.255.255.0 ssid YOURSSID mediaopt hostap

sysctl -w net.inet.ip.forwarding=1

pfctl -e

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
# This configuration is set for use on a machine that is a router with
# three (3) network cards:
# ext_if - connects to the upstream link (cable/dsl modem, WAN, etc.)
# wifi_if - wireless card for internal network
#           (if none present, remove all references to it in this file)
# lan_if  - wired card for internal network
#           (if none present, remove all references to it in this file)
#
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#------------------------------------------------------------------------
# macros
#------------------------------------------------------------------------
logopt = "log"
# interfaces
ext_if  = "fxp0"
wifi_if = "ath0"
lan_if  = "fxp1"
# publically accesible services (transport layer neutral)
pubserv = "{ 22, 443 }"
# internally accessible services (transport layer neutral)
lanserv = "{ 22, 53, 67, 80, 443 }"
# samba ports (transport layer neutral)
samba_ports = "{ 137, 138, 139 }"
# externally permitted inbound icmp types
icmp_types = "echoreq"
# internal network
lan_net = "{ 192.168.0.0/24, 192.168.1.0/24 }"
# hosts granted acces to samba (cifs/smb) shares
smb_net = "{ 192.168.0.0/27, 192.168.1.0/27, 192.168.0.90, 192.168.1.90 }"
# block these networks
table  { 0.0.0.0/8, 10.0.0.0/8, 20.20.20.0/24, 127.0.0.0/8, \
       ۱۶۹٫۲۵۴٫۰٫۰/۱۶, ۱۷۲٫۱۶٫۰٫۰/۱۲,  ۱۹۲٫۰٫۲٫۰/۲۴, ۱۹۲٫۱۶۸٫۰٫۰/۱۶, \
       ۲۲۴٫۰٫۰٫۰/۳,    ۲۵۵٫۲۵۵٫۲۵۵٫۲۵۵ }
#------------------------------------------------------------------------
# options
#------------------------------------------------------------------------
# config
set block-policy return
set loginterface $ext_if
set skip on lo0
# scrub
#scrub all reassemble tcp no-df
#scrub in all fragment reassemble
scrub out all random-id
#------------------------------------------------------------------------
# redirection (and nat, too!)
#------------------------------------------------------------------------
# network address translation
nat on $ext_if from $lan_net to any -> ($ext_if)
#------------------------------------------------------------------------
# firewall policy
#------------------------------------------------------------------------
# restrictive default rules
block all
block return-rst  in  $logopt on $ext_if proto tcp all
block return-icmp in  $logopt on $ext_if proto udp all
block             in  $logopt on $ext_if proto icmp all
block             out $logopt on $ext_if all
# trust localhost
pass in  quick on lo0 all
pass out quick on lo0 all
# anti spoofing
block drop in  $logopt quick on $ext_if from  to any
block drop out $logopt quick on $ext_if from any to 
antispoof for { $lan_if, $wifi_if, $ext_if }
# anti fake return-scans
block  return-rst  out on $ext_if proto tcp all 
block  return-rst  in  on $ext_if proto tcp all 
block  return-icmp out on $ext_if proto udp all
block  return-icmp in  on $ext_if proto udp all 
# toy with script kiddies scanning us
block in $logopt quick proto tcp flags FUP/WEUAPRSF 
block in $logopt quick proto tcp flags WEUAPRSF/WEUAPRSF 
block in $logopt quick proto tcp flags SRAFU/WEUAPRSF 
block in $logopt quick proto tcp flags /WEUAPRSF 
block in $logopt quick proto tcp flags SR/SR 
block in $logopt quick proto tcp flags SF/SF 
# open firewall fully
# warning: insecure. 'nuff said.
#pass in  quick all
#pass out quick all
# allow permitted icmp
pass in inet proto icmp all icmp-type $icmp_types keep state
# allow permitted services
pass in on $ext_if            inet proto tcp       from any      to any port $pubserv flags S/SA keep state
pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $lan_net to any port $lanserv            keep state
pass in on {$lan_if $wifi_if} inet proto {tcp udp} from $smb_net to any port $samba_ports        keep state
# permit access between LAN hosts
pass in  from $lan_net to $lan_net keep state
pass out from $lan_net to $lan_net keep state
# permit full outbound access 
# warning: potentially insecure. you may wish to lock down outbound access.
pass out from any to any keep state

pfctl -Fa -f /etc/pf.conf

pkg_add -r isc-dhcp3-server

###
### GLOBAL SETTINGS
###
ddns-update-style none;
always-broadcast on;
default-lease-time 7200;
max-lease-time 7200;
authoritative;
option domain-name-servers 192.168.1.1;
option domain-name "localnet.localdomain";
option netbios-name-servers 192.168.1.1;
###
### WIRED LOCAL AREA NETWORK
###
subnet 192.168.0.0 netmask 255.255.255.0 {
        #
        # NOTES:
        # (۱) allocation of endings 100-199 by DHCP is 
        # inteded for clients that are not specified
        # later in this file.
        # (۲) allocation is done in increments of 10
        # and this is done intentionally.
        #
        range 192.168.0.100 192.168.0.199;
        option broadcast-address 192.168.0.255;
        option subnet-mask 255.255.255.0;
        option routers 192.168.0.1;
}
###
### WIRELESS NETWORK 
###
subnet 192.168.1.0 netmask 255.255.255.0 {
        # NOTE: See: wired->range.notes
        range 192.168.1.100 192.168.1.199;
        option broadcast-address 192.168.1.255;
        option subnet-mask 255.255.255.0;
        option routers 192.168.1.1;
}
###
### ASSIGN SPECIFIC IP ADDRESSES TO SPECIFIC HOSTS BASED ON MAC ADDRESS
### (optional)
###
## host foo
#host foo {
#        hardware ethernet XX:XX:XX:XX:XX:XX;
#        fixed-address 192.168.0.XYZ;
#}
## host bar
#host bar {
#        hardware ethernet XX:XX:XX:XX:XX:XX;
#        fixed-address 192.168.1.XYZ;
#}

interface=ath0
driver=bsd
logger_syslog=-1
logger_syslog_level=0
logger_stdout=-1
logger_stdout_level=0
debug=3
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=wheel
#### IEEE 802.11 related config ####
ssid=YOURSSID
macaddr_acl=0
auth_algs=1
#### IEEE 802.1X related config ####
ieee8021x=0
#### WPA/IEEE 802.11i config #####
wpa=1
wpa_passphrase=ENTER_YOUR_PASSPHRASE_HERE
wpa_key_mgmt=WPA-PSK
wpa_pairwise=CCMP TKIP 

### GENERAL SETTINGS
gateway_enable="YES"
hostname="wifiap"
### CONFIGURATION FOR EXTERNAL INTERFACE (UPSTREAM LINK)
### example: link to cable/dsl modem
ifconfig_fxp0="DHCP"
### CONFIGURATION FOR INTERNAL WIRED NETWORK
ifconfig_fxp1="inet 192.168.0.1 netmask 255.255.255.0"
### CONFIGURATION FOR INTERNAL WIRELESS NETWORK
ifconfig_ath0="inet 192.168.1.1 netmask 255.255.255.0 ssid YOURSSID mediaopt hostap"
### CONFIGURATION FOR PACKET FILTER
### requires kernel recompile, see:
### http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-pf.html
pf_enable="YES"                 # Set to YES to enable packet filter (pf)
pf_rules="/etc/pf.conf"         # rules definition file for pf
pf_program="/sbin/pfctl"        # where the pfctl program lives
pf_flags=""                     # additional flags for pfctl
pflog_enable="YES"              # Set to YES to enable packet filter logging
pflog_logfile="/var/log/pflog"  # where pflogd should store the logfile
### DAEMONS FOR LAN
hostapd_enable="YES"            # wireless services (clients use wpa_supplicant)
named_enable="YES"              # dns for clients
dhcpd_enable="YES"              # dhcp configure clients
sshd_enable="YES"               # so we can remotely access this box 

wlan_wep_load="YES"
wlan_tkip_load="YES"
wlan_ccmp_load="YES"
wlan_xauth_load="YES"
wlan_acl_load="YES"

shutdown -r now