X-Git-Url: https://gitweb.dragonflybsd.org/ikiwiki.git/blobdiff_plain/386182ecca63e4aef3e9db7804d8bf607a0c2eb6..HEAD:/docs/docs/howtos/HowToPF6and4/index.mdwn

diff --git a/docs/docs/howtos/HowToPF6and4/index.mdwn b/docs/docs/howtos/HowToPF6and4/index.mdwn
index b7f2e906..4ee5c244 100644
--- a/docs/docs/howtos/HowToPF6and4/index.mdwn
+++ b/docs/docs/howtos/HowToPF6and4/index.mdwn
@@ -1,6 +1,14 @@
-A small LAN running services and having an IPv6 tunnel and a VoIP phone
+I have a small LAN running services, an IPv6 tunnel and a VoIP phone. Its router was a Linksys running DD-WRT, but the router stopped displaying the list of forwarded ports, and eventually wouldn't even change the forwarded ports when told to do so on the command line. I decided to replace it with a DragonFly box called "zyxomma" (the last word in dragonflies) using pf.
+
+What I'd like to do is:
+
+* Several ports are forwarded to the same port on one of the machines behind the firewall. I'd like those ports to be accessible on IPv6 as well.
+* Some ports are redirected to a different port on the LAN. They should be accessible via IPv6 at the inside port.
+* All other ports on IPv6 should be blocked. They should also be blocked on IPv4 as well, in case some malware running on zyxomma opens a port, but I couldn't get that to work.
+* The tunnel should come up, regardless of what IP address I get from DHCP.
+* The phone should get its allocated bandwidth at a higher priority so that phone conversations won't have dropouts. Next highest priority is DNS.
+* One of my boxes watches SSH connections and blocks all access from IP addresses that make too many password guesses. All access to all my boxes should be blocked from those IP addresses. This isn't set up yet, but the table is there.
 
-This page is a work in progress. I'll be adding comments.
 ##rc.conf
 	gif_interfaces="gif0"
 	ifconfig_em0="DHCP"
@@ -19,15 +27,15 @@ This page is a work in progress. I'll be adding comments.
 	pf=YES	# rcrun enable pf
 	isc_dhcpd=YES	# rcrun enable isc_dhcpd
 
-The tunnel setup should be done with an rc.d script, since the IP address isn't known until dhcpcd gets it. I haven't written it yet.
+The tunnel setup should be done with an rc.d script, since the IP address isn't known until dhcpcd gets it. I have written it, and it works when run after booting, but I haven't booted it yet. It does not delete the tunnel device because doing so would crash the machine (http://bugs.dragonflybsd.org/issues/2425).
 ##pf.conf
 	ext_if="em0"
 	ext_if6="gif0"
 	int_if="em1"
 	int_if6="em1"
-	fwd_darner="{ 14159, 9030 }" # tahoe, tordir
+	fwd_darner="{ 14159, 9030 }"
 	fwd_chausie="{ ftp, http, smtp, ssh }"
-	fwd_leopard="{ rsync, ntp, 8333 }" # bitcoin
+	fwd_leopard="{ rsync, ntp, 8333 }"
 	forwarded_ports="{ 110, 2222 }"
 	allow_all6="{ http ssh }"
 	darner="192.168.7.5"
@@ -54,7 +62,7 @@ The tunnel setup should be done with an rc.d script, since the IP address isn't
 	rdr inet proto {tcp udp} from !($ext_if) to ($ext_if) port $fwd_darner -> $darner
 	rdr inet proto {tcp udp} from !($ext_if) to ($ext_if) port $fwd_chausie -> $chausie
 	rdr inet proto {tcp udp} from !($ext_if) to ($ext_if) port $fwd_leopard -> $leopard
-	rdr on $ext_if inet proto {tcp udp} from !($ext_if) to ($ext_if) port 110 -> $darner port 6561 # tor
+	rdr on $ext_if inet proto {tcp udp} from !($ext_if) to ($ext_if) port 110 -> $darner port 6561
 	rdr on $ext_if inet proto {tcp udp} from !($ext_if) to ($ext_if) port 2222 -> $darner port ssh
 	nat on $int_if inet proto {tcp udp} from $int_if:network to $darner port $fwd_darner -> $int_if
 	nat on $int_if inet proto {tcp udp} from $int_if:network to $chausie port $fwd_chausie -> $int_if