compute Joany

A complete SSG - written in bash

My OpenIndiana router

Published on: by Anonymous

3 min read

I am the cool kid now with a illumos based homenetwork router

It all began when OpenSens died on me and the forums as always filled with "helpful" pepole

bye

I wanted

  • OpenSolaris and Sun history
  • Multiple lans
  • Firewall
  • Routing (duh)
  • Containers

My initial pick was TRIBBLIX But, my hardware and Tribblix KVM did not play well Peter is doing great job with his project, so check it out!

OpenIndiana had everything i needed for my non UEFI computer

If you have UEFI disregard KVM and use bhyve instead

ZONES:

First quest was to find out how to create kvm based Zone (a zone is like container and or VM, no flaming :D). Hard to find manual This man page was my AHA moment

I wanted a VM or ZONE that i can run PiHole in I started with creation of a ZFS volym

zfs create -p -V 30G rpool1/zone/nix

Then i started qemu-kvm alone to install nixos, when i was done i created my KVM branded Zone

note: My zone contains a img file of a side project win2k also

create -b
set zonepath=/zone/nix0
set brand=kvm
set autoboot=false
set ip-type=exclusive
add net
set physical="nic2"
end
add device
set match="/dev/zvol/rdsk/rpool1/zone/nix"
end
add device
set match="/dev/zvol/rdsk/rpool1/zone/win2k"
end
add attr
set name="vcpus"
set type="string"
set value="4"
end
add attr
set name="ram"
set type="string"
set value="4G"
end
add attr
set name="vnc"
set type="string"
set value="on"
end
add attr
set name="bootdisk"
set type="string"
set value="rpool1/zone/nix"
end
add attr
set name="disk1"
set type="string"
set value="rpool1/zone/win2k"
end

In order to make NixOS to boot, i had to edit the /usr/lib/brand/kvm/init

the section args.extend remove the -no-hpet line like this

args.extend([
'-enable-kvm',
'-m', opts['ram'],
'-smp', opts['vcpus'],
'-cpu', opts['cpu'],
'-rtc', opts['rtc'],
'-pidfile', '/tmp/vm.pid',
'-monitor', 'unix:/tmp/vm.monitor,server,nowait,nodelay',
'-vga', 'std',
'-chardev', opts['console'],
'-serial', 'chardev:console0',
'-boot', 'order={0}'.format(opts['bootorder']),
])

connect to it using VNC you can use SOCAT (look at Tribblix page for explanation) or zadm

NETWORK:

My first try i used the manual way to create interfaces and ip adresses.
But i never got it to work, maybe same hardware issue as my opensens install.

OpenIndiana and all other Illumos based has NWAM.

NetWork Auto Magic

Its controlled by nwamadm and nwamcfg

files are located /etc/nwam

In short, its like a machine for controlling all LAN interfaces on your machine so instead of using IPADM and DLADM you can use the nwam tools

Be carful, many bad man pages (thx Mr. Tribble)

I found this NWAM from internet archive So my interfaces was set up

here is an example of my setup

I create a NCP called static first

create ncp "static"
create ncu phys "bge0"
set activation-mode=manual
set enabled=true
end
create ncu ip "bge0"
set enabled=true
set ip-version=ipv4
set ipv4-addrsrc=dhcp
set ipv6-addrsrc=dhcp,autoconf
set ip-primary=true
end
create ncu phys "nxge3"
set activation-mode=manual
set enabled=true
end
create ncu ip "nxge3"
set enabled=true
set ip-version=ipv4
set ipv4-addrsrc=static
set ipv4-addr="10.10.10.1/24"
set ipv6-addrsrc=dhcp,autoconf
set ip-primary=true
end

bge0 WAN
nxge3 one of my LAN

Next step was to create a location in nwamcfg aswell

I think of a location like a "mode" switc

i created this lococation

create loc "router"
set activation-mode=manual
set enabled=true
set nameservices=dns
set nameservices-config-file="/etc/nsswitch.dns"
set dns-nameservice-configsrc=dhcp
set ipfilter-config-file="/etc/ipf/ipf.conf"
set ipnat-config-file="/etc/ipf/ipnat.conf"
set ippool-config-file="/etc/ipf/ippool.conf"
end

i put the ipnat.conf and ipf.conf conf in /etc/ipf

Use the nsswitch.dns, not rename :D

After completion i disabled the stock setting "Automatic" with nwamadm and enable my ncp static and loc router sometimes all you need is to restart nwam with svcadm

But reboot works too :D

If you create like i did a vnic connected to an etherstub as a viritual gateway to your zones you can ofc configure that in nwamcfg too

nic1 is the gateway configured in nwamcfg connected to my etherstub inner0

nic2 vnic for zone

inner0 is my etherstub

dladm shows nic1 vnic 9000 up -- inner0 nic2 vnic 9000 up -- inner0

ipadm shows nic1/_a static ok 10.10.20.1/24

create ncu phys "nic1"
set activation-mode=manual
set enabled=true
end
create ncu ip "nic1"
set enabled=true
set ip-version=ipv4
set ipv4-addrsrc=static
set ipv4-addr="10.10.20.1/24"
set ipv6-addrsrc=dhcp,autoconf
end

All the files and setting are in /etc/nwam folder

Like so /etc/nwam/ncp-static.conf

IF YOU EDIT, USE TAB, DO NOT USE SPACE

interface looks like this

link:nxge3 type=uint64,0;class=uint64,0;parent=string,static;enabled=boolean,true;activation-mode=uint64,0;

ip information for that interface look like this

interface:nxge3 type=uint64,1;class=uint64,1;parent=string,static;enabled=boolean,true;ipv6-addrsrc=uint64,0,1;ip-version=uint64,4;ipv4-addrsrc=uint64,2;ipv4-addr=string,10.10.10.1/24;ip-primary=boolean,true;

IF YOU EDIT DO NOT USE SPACE, USE TAB

DHCP server in OpenIndiana, you can use dnsmasq or isc-dhcpd

I followed the OmniOS guide OmniOS DHCP server guide

FIREWALL and NAT:

I visit frequently the awseome ppl on UnitedBSD, user majekla made this with NAT example Router/Firewall with PPPOE I have a DHCP enabled WAN so i had to open up the firewall for DHCP traffic OMNIOS has a fantastic guide on ipf and NAT also HERE

Are we done? No! :D