OpenBSD – BGP Basic Configuration

Step 1 – Create inteface vlan

# vi /etc/hostname.re1
descr "ANDIRA_BGP"
up

# vi /etc/hostname.vlan3529
vlan 3529 vlandev re1 
descr "ANDIRA_IIX"
inet 42.62.176.194/30 
up

# vi /etc/hostname.vlan3528
vlan 3528 vlandev re1 
descr "ANDIRA_INTL"
inet 42.62.176.190/30 
up

# vi /etc/hostname.re2
descr "MWP_CORE" 
inet 103.15.143.1/29
up

# vi /etc/hostname.lo0
descr "Loopback" 
inet 127.0.0.1/8
inet alias 103.15.143.249 255.255.255.255 NONE
up
!route add default -interface 103.15.143.249

# vi /etc/hostname.lo1
descr "Lubang_Kematian" 
inet 127.0.0.2/8
up

Step 2 – sysctl. conf

# vi /etc/sysctl.conf
net.inet.ip.forwarding=1 # 1=Permit forwarding (routing) of IPv4 packets
net.inet.ip.mforwarding=1 # 1=Permit forwarding (routing) of IPv4 multicast packets
net.inet.ip.multipath=1 # 1=Enable IP multipath routing

net.inet6.ip6.forwarding=1 # 1=Permit forwarding (routing) of IPv6 packets
net.inet6.ip6.mforwarding=1 # 1=Permit forwarding (routing) of IPv6 multicast packets
net.inet6.ip6.multipath=1 # 1=Enable IPv6 multipath routing

net.inet.etherip.allow=1 # 1=Enable the Ethernet-over-IP protocol
net.inet.tcp.ecn=1 # 1=Enable the TCP ECN extension
net.inet.carp.preempt=1 # 1=Enable carp(4) preemption
net.inet.carp.log=1 # log level of carp(4) info, default 2

kern.splassert=2 # 2=Enable with verbose error messages
kern.nosuidcoredump=2 # 2=Put suid coredumps in /var/crash

kern.bufcachepercent=50
kern.maxclusters=128000

Step 3 – resolv.conf

# vi /etc/resolv.conf
lookup file bind
nameserver 8.8.8.8
nameserver 8.8.4.4

Step 4 – rc.conf.local

# vi /etc/rc.conf.local
ntpd_flags= # enabled during install
bgpd_flags=""
#ldpd_flags=""
#ospfd_flags=""
snmpd_flags=""
#pkg_scripts="symon"
#symon_flags="-u"

Step 5 – snmpd.conf

# vi /etc/snmpd.conf
# $OpenBSD: snmpd.conf,v 1.3 2012/09/18 09:57:49 reyk Exp $

listen_addr="127.0.0.1"

# Restrict daemon to listen on localhost only
listen on $listen_addr
listen on 10.10.10.1

# Specify a number of trap receivers
#trap receiver 10.10.10.13

# Adjust the local system information
system contact "[email protected]"
system description "Grahawave Router"
system location "Garut, Bandung, Indonesia"
system services 74
read-only community monitor

# Provide static user-defined SNMP OIDs
oid 1.3.6.1.4.1.30155.42.3.1 name testStringValue read-only string "Test"
oid 1.3.6.1.4.1.30155.42.3.4 name testIntValue read-write integer 1

# Enable SNMPv3 USM with authentication, encryption and two defined users
#seclevel enc
#user "user1" authkey "password123" enc aes enckey "321drowssap"
#user "user2" authkey "password456" enckey "654drowssap"

Step 6 – bgpd.conf

# vi /etc/bgpd.conf
#====================================================================
# Title: Router Core 
# Location: Grahawave Garut
# Date: 14 Januari 2014
# Filename: /etc/bgpd.conf
# Author: Aditya Maulana 
# Company: aaGINK 
#====================================================================

#--- macros
andira_int ="43.62.176.189"
andira_iix ="43.63.176.193"

ASANDIRA ="55690"
ASMWP ="131733"
ASNICE ="7717"
ASIIX ="7597"

AS $ASANDIRA
router-id 103.15.143.249
listen on 127.0.0.1
listen on 103.15.143.1
listen on 103.15.143.249

fib-update yes
nexthop qualify via bgp
log updates

network 103.15.143.249/32 set localpref 1000 # SELF/LOOPBACK
network 0.0.0.0/0
network 103.15.143.0/24 #set localpref 500
network 103.15.143.0/29 #set localpref 500

group "ANDIRA" {
remote-as $ASANDIRA
descr ANDIRA_BGP
announce all
announce capabilities yes
softreconfig in yes
softreconfig out yes
multihop 2
neighbor $andira_int {
descr "ANDIRA_INT"
}
neighbor $andira_iix{
descr "ANDIRA_IIX"
}
}

#--- DEFAULT BLOCK
deny to any
deny from any

#--- INTERNAL
deny to {group "ANDIRA"} inet prefixlen > 24

#--- TERIMA PREFIX FROM UPSTREAM
allow from {group "ANDIRA"} inet prefixlen 8 - 24

#--- do not accept a default route
deny from any prefix 0.0.0.0/0

#--- filter bogus networks
deny from any prefix 10.0.0.0/8 prefixlen >= 8
deny from any prefix 172.16.0.0/12 prefixlen >= 12
deny from any prefix 192.168.0.0/16 prefixlen >= 16
deny from any prefix 169.254.0.0/16 prefixlen >= 16
deny from any prefix 192.0.2.0/24 prefixlen >= 24
deny from any prefix 224.0.0.0/4 prefixlen >= 4
deny from any prefix 240.0.0.0/4 prefixlen >= 4

# filter bogus IPv6 networks according to IANA
deny from any prefix ::/8 prefixlen >= 8
deny from any prefix 2001:2::/48 prefixlen >= 48 # BMWG [RFC5180]
deny from any prefix 2001:10::/28 prefixlen >= 28 # ORCHID [RFC4843]
deny from any prefix 2001:db8::/32 prefixlen >= 32 # docu range [RFC3849]
deny from any prefix 3ffe::/16 prefixlen >= 16 # old 6bone
deny from any prefix fc00::/7 prefixlen >= 7 # unique local unicast
deny from any prefix fe80::/10 prefixlen >= 10 # link local unicast
deny from any prefix fec0::/10 prefixlen >= 10 # old site local unicast
deny from any prefix ff00::/8 prefixlen >= 8 # multicast

#--- KIRIM PREFIX KE ANDIRA
allow to {group "ANDIRA"} inet prefix {103.15.143.0/24} prefixlen = 24 set {localpref 1000}

#--- PREFIX FILTER IIX agar tidak bocor ke International
match from $andira_iix\
transit-as {$ASNICE $ASIIX}\
inet prefixlen 8 - 24\
set {rtlabel iix pftable "local" localpref 650 nexthop $andira_iix}

#--- MULTI ROUTING TABLE 
match from {group "ANDIRA"} transit-as {$ASANDIRA} inet prefixlen 8 - 24 set {rtlabel internet pftable "internet" localpref 500}
match from {group "ANDIRA"} transit-as {$ASNICE $ASIIX} inet prefixlen 8 - 24 set {rtlabel iix pftable "local" localpref 650}

# vi /etc/bgppeers.table
42.62.176.189 # ANDIRA INTL
42.62.176.193 # ANDIRA IIX

Step 7 – rfc1918.table

# vi /etc/rfc1918.table
#---- http://www.team-cymru.org/Services/Bogons/bogon-bn-agg.txt
0.0.0.0/8
10.0.0.0/8
100.64.0.0/10
127.0.0.0/8
169.254.0.0/16
172.16.0.0/12
192.0.0.0/24
192.0.2.0/24
192.168.0.0/16
198.18.0.0/15
198.51.100.0/24
203.0.113.0/24
224.0.0.0/3

Step 8 – pf.conf

# vi /etc/pf.conf
#====================================================================
# Title: Router Core 
# Location: Grahawave Garut
# Date: 14 Januari 2014
# Filename: /etc/pf.conf
# Author: Aditya Maulana 
# Company: aaGINK 
#====================================================================

iix_if ="vlan3529" # ANDIRA IIX
int_if ="vlan3528" # ANDIRA INTERNATIONAL
core_if ="re2"
core_ip ="103.15.143.1"
#icmp_types = "{ echoreq, unreach }"
SloppyState = "keep state (sloppy source-track global) flags any"
LocalContent = "{<graha_public> <local> route iix}"

table <local> counters persist
table <internet> counters persist
table <graha_public> counters const {103.15.143.0/24}
table <bruteforce> persist
table <bgppeers> counters persist file "/etc/bgppeers.table"
table <rfc1918> counters persist file "/etc/rfc1918.table"

set skip on {lo pfsync enc0}
set ruleset-optimization basic
set optimization aggressive
set block-policy drop
set limit {states 1000000, src-nodes 800000, table-entries 1500000}
set reassemble yes no-df

#--- Bandwidth Manager
include "/etc/queue.conf"

#-----------------------------------------------------
match in on {$iix_if $int_if} scrub (no-df max-mss 1440)

#--- Flooding...Pergi ke lubang kematian 
#match in log quick on $core_if inet proto udp from 210.23.68.7 to any port 6667 rdr-to lo1:0

#-- RDR SNMP
pass in quick log on $core_if inet proto udp from <graha_public> to $core_ip port 161 rdr-to 127.0.0.1 port 161
pass in quick log on $core_if inet proto {tcp udp} from <graha_public> to $core_ip port 2100 rdr-to 127.0.0.1 port 2100

#--- WAJIB ADA
antispoof for {$iix_if $int_if $core_if}
block in log all
block inet6 all
block quick inet from <bruteforce>
pass from self

#--- PASS NECESSARY PROTOCOL
pass quick on {lo} all
#pass quick on {$core_if} from <graha_public>
#pass quick on {$core_if} to <graha_public>

#--- DNS Query
pass quick log on\
{$core_if $iix_if int_if}\
inet proto {tcp udp} to any port domain

#--- SSH
pass inet proto tcp to any port ssh\
keep state (max-src-conn 15, max-src-conn-rate 5/3, overload <bruteforce> flush global)

#--- WEB
#pass in quick log on $core_if inet proto tcp from any to $core_ip port {http, https}

#--- BGP PEERING
pass in quick on $core_if proto tcp from\
<bgppeers> to ($core_if:0) port bgp set queue (core_hipri core_ack)
pass in quick on $core_if proto tcp from\
<bgppeers> port bgp to ($core_if:0) set queue (core_hipri core_ack)

pass in quick on $iix_if proto tcp from\
<bgppeers> to ($iix_if:0) port bgp set queue (iix_hipri iix_ack)
pass in quick on $iix_if proto tcp from\
<bgppeers> port bgp to ($iix_if:0) set queue (iix_hipri iix_ack)

pass in quick on $int_if proto tcp from\
<bgppeers> to ($int_if:0) port bgp set queue (int_hipri iix_ack)
pass in quick on $int_if proto tcp from\
<bgppeers> port bgp to ($int_if:0) set queue (int_hipri int_ack)

pass out quick on $core_if proto tcp from\
($core_if:0) to any port bgp set queue (core_hipri core_ack) 
pass out quick on $core_if proto tcp from\
($core_if:0) port bgp set queue (core_hipri core_ack)

pass out quick on $iix_if proto tcp from\
($iix_if:0) to any port bgp set queue (iix_hipri iix_ack)
pass out quick on $iix_if proto tcp from\
($iix_if:0) port bgp set queue (iix_hipri iix_ack)

pass out quick on $int_if proto tcp from\
($int_if:0) to any port bgp set queue (int_hipri int_ack)
pass out quick on $int_if proto tcp from\
($int_if:0) port bgp set queue (int_hipri int_ack)

#--- REDIRECT TO NIRVANA
pass in quick log on {$core_if $iix_if $int_if} to <rfc1918> rdr-to lo1:0

#--- ICMP
pass in quick log on $core_if\
inet proto icmp tag ICMP $SloppyState set queue core_icmp
pass in quick log on $core_if\
inet proto udp from any to port 33433 >< 33626 tag ICMP\
$SloppyState set queue core_icmp
pass in quick log on $iix_if\
inet proto icmp tag ICMP $SloppyState set queue iix_icmp
pass in quick log on $iix_if\
inet proto udp from any to port 33433 >< 33626 tag ICMP\
$SloppyState set queue iix_icmp
pass in quick log on $int_if\
inet proto icmp tag ICMP $SloppyState set queue int_icmp
pass in quick log on $int_if\
inet proto udp from any to port 33433 >< 33626 tag ICMP\
$SloppyState set queue int_icmp
pass out quick log on $core_if\
inet tagged ICMP $SloppyState set queue core_icmp
pass out quick log on $core_if\
inet proto icmp from self $SloppyState set queue core_icmp
pass out quick log on $core_if\
inet proto udp from self to port 33433 >< 33626\
$SloppyState set queue core_icmp
pass out quick log on $iix_if\
inet tagged ICMP $SloppyState set queue iix_icmp
pass out quick log on $iix_if\
inet proto icmp from self $SloppyState set queue iix_icmp
pass out quick log on $iix_if\
inet proto udp from self to port 33433 >< 33626\
$SloppyState set queue iix_icmp
pass out quick log on $int_if\
inet tagged ICMP $SloppyState set queue int_icmp
pass out quick log on $int_if\
inet proto icmp from self $SloppyState set queue int_icmp
pass out quick log on $int_if\
inet proto udp from self to port 33433 >< 33626\
$SloppyState set queue int_icmp

#--- GRAHAWAVE CORE - ANDIRA_IIX
pass in quick log on {$core_if}\
inet from <graha_public> to $LocalContent tag GWCORE_IIX_OUT $SloppyState set queue (core_gw core_ack)
pass out quick log on {$iix_if}\
tagged GWCORE_IIX_OUT $SloppyState set queue (iix_def iix_ack)

pass in quick log on {$iix_if}\
inet from $LocalContent to <graha_public> tag GWCORE_IIX_IN $SloppyState set queue (iix_def iix_ack)
pass out quick log on {$core_if}\
tagged GWCORE_IIX_IN $SloppyState set queue (core_gw core_ack)

#--- GRAHAWAVE CORE - ANDIRA_INT
pass in quick log on {$core_if}\
inet from <graha_public> tag GWCORE_INT_OUT $SloppyState set queue (core_gw core_ack)
pass out quick log on {$int_if}\
tagged GWCORE_INT_OUT $SloppyState set queue (int_def int_ack)

pass in quick log on {$int_if}\
inet to <graha_public> tag GWCORE_INT_IN $SloppyState set queue (int_def int_ack)
pass out quick log on {$core_if}\
tagged GWCORE_INT_IN $SloppyState set queue (core_gw core_ack)

pass out log from self

#--- ON NET
pass in log on $core_if keep state (sloppy source-track global)
pass in log on $iix_if keep state (sloppy source-track global)
pass in log on $int_if keep state (sloppy source-track global)

pass out on $core_if keep state (sloppy source-track global)
pass out on $iix_if keep state (sloppy source-track global)
pass out on $int_if keep state (sloppy source-track global)

#-------------------------------------- END ---------------------------------------------#

Step 9 – queue.conf

# vi /etc/queue.conf
#====================================================================
# Title: Router Core 
# Location: Grahawave Garut
# Date: 14 Januari 2014
# Filename: /etc/queue.conf
# Author: Aditya Maulana 
# Company: aaGINK 
#====================================================================
iix_if ="vlan3529" # ANDIRA IIX
int_if ="vlan3528" # ANDIRA INTERNATIONAL
core_if ="re2" # LAN

##### ------ IIX ------- ##### 
altq on $iix_if bandwidth 20Mb qlimit 500 hfsc queue {iix_attacker iix_hipri iix_def iix_icmp iix_ack}
queue iix_def bandwidth 19Mb priority 5 qlimit 500 hfsc (realtime 19Mb upperlimit 19Mb default ecn)
queue iix_icmp bandwidth 128Kb priority 7 qlimit 200 hfsc (realtime 128Kb upperlimit 512Kb ecn)
queue iix_ack bandwidth 128Kb priority 6 qlimit 200 hfsc (realtime 128Kb upperlimit 1Mb ecn)
queue iix_hipri bandwidth 128Kb priority 7 hfsc (realtime 128Kb upperlimit 256Kb ecn)
queue iix_attacker bandwidth 64Kb priority 7 hfsc (realtime 64Kb upperlimit 128Kb ecn)

##### ------ INT ------- #####
altq on $int_if bandwidth 10Mb qlimit 500 hfsc queue {int_attacker int_hipri int_def int_icmp int_ack}
queue int_def bandwidth 8Mb priority 5 qlimit 500 hfsc (realtime 8Mb upperlimit 9Mb default ecn)
queue int_icmp bandwidth 128Kb priority 7 qlimit 200 hfsc (realtime 128Kb upperlimit 512Kb ecn)
queue int_ack bandwidth 128Kb priority 6 qlimit 200 hfsc (realtime 128Kb upperlimit 1Mb ecn)
queue int_hipri bandwidth 128Kb priority 7 hfsc (realtime 128Kb upperlimit 256Kb ecn)
queue int_attacker bandwidth 64Kb priority 7 hfsc (realtime 64Kb upperlimit 128Kb ecn)

##### ------ CORE ------- #####
altq on $core_if bandwidth 99Mb qlimit 500 hfsc queue {core_attacker core_def core_hipri core_gw core_icmp core_ack}
queue core_def bandwidth 1Mb priority 5 hfsc (realtime 1Mb upperlimit 1Mb default ecn)
queue core_icmp bandwidth 128Kb priority 7 qlimit 200 hfsc (realtime 128Kb upperlimit 1Mb ecn)
queue core_ack bandwidth 128Kb priority 6 qlimit 200 hfsc (realtime 128Kb upperlimit 1Mb ecn)
queue core_hipri bandwidth 128Kb priority 7 hfsc (realtime 128Kb upperlimit 256Kb ecn)
queue core_gw bandwidth 95Mb priority 5 hfsc (realtime 95Mb upperlimit 96Mb ecn)
queue core_attacker bandwidth 64Kb priority 7 hfsc (realtime 64Kb upperlimit 128Kb ecn)

Step – end