<h1 id="router-history">Router History</h1>
<p>Early Dialup</p>
<ul>
<li>Connection sharing</li>
</ul>
<p>DSL/Cable</p>
<ul>
<li>Linux PC with 2 NIC</li>
<li>Set up IP masquerading</li>
<li>Windows connection sharing</li>
<li>This may have been against TOS</li>
<li>$50 EBay PC</li>
<li>Mandrake MNF</li>
</ul>
<p>Found a PC on the Street</p>
<ul>
<li>IPCop</li>
<li>Infrequently updated</li>
<li>No updates required or abandoned?</li>
</ul>
<p>OpenBSD</p>
<ul>
<li>Reputation for Security</li>
<li>Something New</li>
<li>Good instructions for setting up home office.</li>
<li>Manual but straightforward</li>
</ul>
<p>WRT-54gl with tomato</p>
<ul>
<li>Linksys router sold specifically to run Linux</li>
<li>Purchased to be AP</li>
<li>Junk PC hardware failures - PSU or IDE disks</li>
<li>Frequently used as backup.</li>
</ul>
<p>PCEngines Alix</p>
<ul>
<li>Basically a PC in a router form factor</li>
<li>Serial port - NO VGA</li>
<li>No USB boot - Had to set up PXE boot tftp server.</li>
<li>Install OpenBSD</li>
<li>No Video out - Serial port only</li>
<li>Expensive for specs - 500MHz AMD CPU and 256M Ram</li>
</ul>
<p>Alix Limitations</p>
<ul>
<li>Worked great for a few years</li>
<li>Compact Flash limited replacements.</li>
<li>100M Ethernet</li>
<li>Found Spare on EBay as Backup, just in case.</li>
</ul>
<p>PCEngines APU2</p>
<ul>
<li>Serial only</li>
<li>OpenBSD 5.6 via USB drive</li>
<li>3 NIC - Lan, Trusted, Untrusted</li>
<li>Unifi AP for WiFi</li>
</ul>
<p>First playbook</p>
<ul>
<li>Missing some easy management
<ul>
<li>Local DNS</li>
<li>DHCP Reservations</li>
</ul></li>
<li><a
href="http://hackerpublicradio.org/eps.php?id=3187">http://hackerpublicradio.org/eps.php?id=3187</a>
<ul>
<li>CSV file with IP,MAC, Hostname</li>
<li>DHCP reservation and local DNS</li>
</ul></li>
</ul>
<p>Restricting Internet</p>
<ul>
<li>Open DNS and port redirects</li>
<li>Unbound included on OpenBSD base
<ul>
<li>Caching DNS resolver</li>
<li>Forward to Open DNS - Set to do some content filtering</li>
<li>PF rule to redirect all incoming port 53 to unbound</li>
</ul></li>
<li>PF scripts
<ul>
<li>PF table with IP addresses of devices</li>
<li>Table always blocked</li>
<li>cron jobs to add/remove IP addresses to table</li>
</ul></li>
</ul>
<p>APU2 limitations</p>
<ul>
<li>Installer Recommends Auto partitioning
<ul>
<li>Doesn't know how you plan to use OpenBSD</li>
<li>Doesn't know the future plans for project.</li>
</ul></li>
<li>16G msata drive</li>
<li>Small /usr</li>
<li>Re-linking growth</li>
<li>Moving src partitions</li>
</ul>
<p>PCEngines APU2</p>
<ul>
<li>Search /etc for changes</li>
<li>Ansible Playbook for everything not covered by DNS/DHCP playbook
<ul>
<li>email forwarding</li>
<li>sysctls</li>
<li>syslog to server</li>
</ul></li>
<li>Practice on OpenBSD VM
<ul>
<li>198.168 172.20 as variable</li>
<li>Normally with VM, I use the VirtIO NIC</li>
<li>I used vitalized Intel NIC so same device names: em0, em1, ...</li>
</ul></li>
</ul>
<p>Just Do It</p>
<ul>
<li>Update APU firmware - TODO retails
<ul>
<li>/usr/local/share/doc/pkg-readmes/flashrom</li>
</ul></li>
<li>Warned family internet would be offline a few hours</li>
<li>Replaced M2 Sata card with 120</li>
<li>It worked the first time</li>
</ul>
<p>Links</p>
<ul>
<li><a
href="https://www.ipcop.org/index_php.html">https://www.ipcop.org/index_php.html</a></li>
<li><a
href="https://www.pcengines.ch/alix2d3.htm">https://www.pcengines.ch/alix2d3.htm</a></li>
<li><a
href="https://pcengines.ch/apu2.htm">https://pcengines.ch/apu2.htm</a></li>
<li><a
href="https://pcengines.ch/howto.htm#OS_installation">https://pcengines.ch/howto.htm#OS_installation</a></li>
<li><a
href="https://www.openbsd.org/faq/pf/example1.html">https://www.openbsd.org/faq/pf/example1.html</a></li>
</ul>
