``Diskless booting'' means that the FreeBSD box is booted over a network, and reads the necessary files from a server instead of its hard disk. For full details, please read Can a FreeBSD box be used as a dedicated network router?

Internet standards and good engineering practice prohibit us from providing packet forwarding by default in FreeBSD. You can however enable this feature by changing the following variable to : gateway_enable=YES # Set to YES if this host will be a gateway

This option will put the variable In most cases, you will also need to run a routing process to tell other systems on your network about your router; FreeBSD comes with the standard BSD routing daemon , or for more complex situations you may want to try It is our duty to warn you that, even when FreeBSD is configured in this way, it does not completely comply with the Internet standard requirements for routers; however, it comes close enough for ordinary usage. Can I connect my Win95 box to the Internet via FreeBSD?

Typically, people who ask this question have two PC's at home, one with FreeBSD and one with Win95; the idea is to use the FreeBSD box to connect to the Internet and then be able to access the Internet from the Windows95 box through the FreeBSD box. This is really just a special case of the previous question.

There's a useful document available which explains how to set FreeBSD up as a

and on your FreeBSD box.

See also the section on . Why does recompiling the latest BIND from ISC fail?

There is a conflict between the ``compat/include/sys/cdefs.h. Does FreeBSD support SLIP and PPP?

Yes. See the man pages for , , and . deals exclusively with incoming connections and deals exclusively with outgoing connections.

These programs are described in the following sections of the :

If you only have access to the Internet through a "shell account", you may want to have a look at the package. It can provide you with (limited) access to services such as ftp and http direct from your local machine. Does FreeBSD support NAT or Masquerading

If you have a local subnet (one or more local machines), but have been allocated only a single IP number from your Internet provider (or even if you receive a dynamic IP number), you may want to look at the program. The program has similar functionality built in via the is used in both cases. I can't make ppp work. What am I doing wrong ?

You should first read the and the . Enable logging with the command set log Phase Chat Connect Carrier lcp ipcp ccp command

This command may be typed at the /etc/ppp/ppp.conf configuration file (the start of the default section is the best place to put it). Make sure that contains the lines !ppp *.* /var/log/ppp.log

and that the file /var/log/ppp.log exists. You can now find out a lot about what's going on from the log file. Don't worry if it doesn't all make sense. If you need to get help from someone, it may make sense to them.

If your version of ppp doesn't understand the "set log" command, you should download the . It will build on FreeBSD version 2.1.5 and higher. Ppp just hangs when I run it

This is usually because your hostname won't resolve. The best way to fix this is to make sure that /etc/hosts is consoluted by your resolver first by editing /etc/host.conf and putting the hosts line first. Then, simply put an entry in /etc/hosts for your local machine. If you have no local network, change your localhost line: 127.0.0.1 foo.bar.com foo localhost Otherwise, simply add another entry for your host. Consult the relevant man pages for more details.

You should be able to successfully ping -c1 `hostname` when you're done. Ppp won't dial in -auto mode

First, check that you've got a default route. By running name="netstat -rn">, you should see two entries like this: Destination Gateway Flags Refs Use Netif Expire default 10.0.0.2 UGSc 0 0 tun0 10.0.0.2 10.0.0.1 UH 0 0 tun0

This is assuming that you've used the addresses from the handbook, the man page or from the ppp.conf.sample file. If you haven't got a default route, it may be because you're running an old version of that doesn't understand the word add 0 0 HISADDR

line to one saying add 0 0 10.0.0.2

Another reason for the default route line being missing is that you have mistakenly set up a default router in your file (this file was called /etc/sysconfig prior to release 2.2.2), and you have omitted the line saying delete ALL

from ppp.conf. If this is the case, go back to the section of the handbook. What does "No route to host" mean

This error is usually due to a missing MYADDR: delete ALL add 0 0 HISADDR

section in your /etc/ppp/ppp.linkup file. This is only necessary if you have a dynamic IP address or don't know the address of your gateway. If you're using interactive mode, you can type the following after entering delete ALL add 0 0 HISADDR

Refer to the section of the handbook for further details. My connection drops after about 3 minutes

The default ppp timeout is 3 minutes. This can be adjusted with the line set timeout NNN

where ppp.conf file, or to type it at the prompt in interactive mode. It is also possible to adjust it on the fly while the line is active by connecting to or . Refer to the man page for further details. My connection drops under heavy load

If you have Link Quality Reporting (LQR) configured, it is possible that too many LQR packets are lost between your machine and the peer. Ppp deduces that the line must therefore be bad, and disconnects. Prior to FreeBSD version 2.2.5, LQR was enabled by default. It is now disabled by default. LQR can be disabled with the line disable lqr My connection drops after a random amount of time

Sometimes, on a noisy phone line or even on a line with call waiting enabled, your modem may hang up because it thinks (incorrectly) that it lost carrier.

There's a setting on most modems for determining how tolerant it should be to temporary losses of carrier. On a USR Sportster for example, this is measured by the S10 register in tenths of a second. To make your modem more forgiving, you could add the following send-expect sequence to your dial string: set dial "...... ATS10=10 OK ......"

Refer to your modem manual for details. Nothing happens after the Login OK! message

Prior to FreeBSD version 2.2.5, once the link was established, would wait for the peer to initiate the Line Control Protocol (LCP). Many ISPs will not initiate negotiations and expect the client to do so. To force set openmode active

I keep seeing errors about magic being the same

Occasionally, just after connecting, you may see messages in the log that say "magic is the same". Sometimes, these messages are harmless, and sometimes one side or the other exits. Most ppp implementations cannot survive this problem, and even if the link seems to come up, you'll see repeated configure requests and configure acknowledgements in the log file until ppp eventually gives up and closes the connection.

This normally happens on server machines with slow disks that are spawning a getty on the port, and executing ppp from a login script or program after login. I've also heard reports of it happening consistently when using slirp. The reason is that in the time taken between getty exiting and ppp starting, the client-side ppp starts sending Line Control Protocol (LCP) packets. Because ECHO is still switched on for the port on the server, the client ppp sees these packets "reflect" back.

One part of the LCP negotiation is to establish a magic number for each side of the link so that "reflections" can be detected. The protocol says that when the peer tries to negotiate the same magic number, a NAK should be sent and a new magic number should be chosen. During the period that the server port has ECHO turned on, the client ppp sends LCP packets, sees the same magic in the reflected packet and NAKs it. It also sees the NAK reflect (which also means ppp must change its magic). This produces a potentially enormous number of magic number changes, all of which are happily piling into the server's tty buffer. As soon as ppp starts on the server, it's flooded with magic number changes and almost immediately decides it's tried enough to negotiate LCP and gives up. Meanwhile, the client, who no longer sees the reflections, becomes happy just in time to see a hangup from the server.

This can be avoided by allowing the peer to start negotiating with the following line in your ppp.conf file: set openmode passive

This tells ppp to wait for the server to initiate LCP negotiations. Some servers however may never initiate negotiations. If this is the case, you can do something like: set openmode active 3

This tells ppp to be passive for 3 seconds, and then to start sending LCP requests. If the peer starts sending requests during this period, ppp will immediately respond rather than waiting for the full 3 second period. LCP negotiations continue 'till the connection is closed

There is currently an implementation mis-feature in This goes on 'till one side figures out that they're getting nowhere and gives up.

The best way to avoid this is to configure one side to be set openmode passive command. Care should be taken with this option. You should also use the set stopped N command to limit the amount of time that set openmode active N command (where Ppp locks up shortly after connecting

Prior to version 2.2.5 of FreeBSD, it was possible that your link was disabled shortly after connection due to disable pred1 Ppp locks up when I shell out to test it

When you execute the If you wish to execute commands like this, use the Ppp over a null-modem cable never exits

There is no way for enable lqr

LQR is accepted by default if negotiated by the peer. Why does ppp dial for no reason in -auto mode

If To determine the cause, use the following line: set log +tcp/ip

This will log all traffic through the connection. The next time the line comes up unexpectedly, you will see the reason logged with a convenient timestamp next to it.

You can now disable dialing under these circumstances. Usually, this sort of problem arises due to DNS lookups. To prevent DNS lookups from establishing a connection (this will set dfilter 1 deny udp src eq 53 set dfilter 2 deny udp dst eq 53 set dfilter 3 permit 0/0 0/0

This is not always suitable, as it will effectively break your demand-dial capabilities - most programs will need a DNS lookup before doing any other network related things.

In the DNS case, you should try to determine what is actually trying to resolve a host name. A lot of the time, is the culprit. You should make sure that you tell sendmail not to do any DNS lookups in its configuration file. See the section on for details on how to create your own configuration file and what should go into it. You may also want to add the following line to your define(`confDELIVERY_MODE', `d')dnl

This will make sendmail queue everything until the queue is run (usually, sendmail is invoked with ``-bd -q30m'', telling it to run the queue every 30 minutes) or until a ``sendmail -q'' is done (perhaps from your ppp.linkup file). What do these CCP errors mean

I keep seeing the following errors in my log file: CCP: CcpSendConfigReq CCP: Received Terminate Ack (1) state = Req-Sent (6)

This is because ppp is trying to negotiate Predictor1 compression, and the peer does not want to negotiate any compression at all. The messages are harmless, but if you wish to remove them, you can disable Predictor1 compression locally too: disable pred1 Ppp locks up during file transfers with IO errors

Under FreeBSD 2.2.2 and before, there was a bug in the tun driver that prevents incoming packets of a size larger than the tun interface's MTU size. Receipt of a packet greater than the MTU size results in an IO error being logged via syslogd.

The ppp specification says that an MRU of 1500 should always be accepted as a minimum, despite any LCP negotiations, therefore it is possible that should you decrease the MTU to less than 1500, your ISP will transmit packets of 1500 regardless, and you will tickle this non-feature - locking up your link.

The problem can be circumvented by never setting an MTU of less than 1500 under FreeBSD 2.2.2 or before. Why doesn't ppp log my connection speed?

In order to log all lines of your modem ``conversation'', you must enable the following: set log +connect

This will make log everything up until the last requested "expect" string.

If you wish to see your connect speed and are using PAP or CHAP (and therefore don't have anything to "chat" after the CONNECT in the dial script - no "set login" script), you must make sure that you instruct ppp to "expect" the whole CONNECT line, something like this: set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 4 \"\" ATZ OK-ATZ-OK ATDT\\T TIMEOUT 60 CONNECT \\c \\n"

Here, we get our CONNECT, send nothing, then expect a line-feed, forcing Ppp ignores the `\' character in my chat script

Ppp parses each line in your config files so that it can interpret strings such as When the chat interpreter parses each argument, it re-interprets the argument in order to find any special escape sequences such as ``\P'' or ``\T'' (see the man page). As a result of this double-parsing, you must remember to use the correct number of escapes.

If you wish to actually send a ``\'' character to (say) your modem, you'd need something like: set dial "\"\" ATZ OK-ATZ-OK AT\\\\X OK"

resulting in the following sequence: ATZ OK AT\X OK

or set phone 1234567 set dial "\"\" ATZ OK ATDT\\T"

resulting in the following sequence: ATZ OK ATDT1234567 Ppp gets a seg-fault, but I see no

Ppp (or any other program for that matter) should never dump core. Because ppp runs with an effective user id of 0, the operating system will not write ppps core image to disk before terminating it. If, however ppp $ tar xfz ppp-*.src.tar.gz $ cd ppp*/ppp $ echo STRIP= >>Makefile $ echo CFLAGS+=-g >>Makefile $ make clean all $ su # make install # chmod 555 /usr/sbin/ppp

You will now have a debuggable version of ppp installed. You will have to be root to run ppp as all of its privileges have been revoked. When you start ppp, take a careful note of what your current directory was at the time.

Now, if and when ppp receives the segmentation violation, it will dump a core file called ppp.core. You should then do the following: $ su # gdb /usr/sbin/ppp ppp.core (gdb) bt ..... (gdb) f 0 ..... (gdb) i args ..... (gdb) l .....

All of this information should be given alongside your question, making it possible to diagnose the problem.

If you're familiar with gdb, you may wish to find out some other bits and pieces such as what actually caused the dump and the addresses & values of the relevant variables. The process that forces a dial in auto mode never connects

This was a known problem with The problem was that when that initial program calls , the IP number of the tun interface is assigned to the socket endpoint. The kernel creates the first outgoing packet and writes it to the tun device. There are several theoretical ways to approach this problem. It would be nicest if the peer would re-assign the same IP number if possible The easiest method from our side would be to never change the tun interface IP number, but instead to change all outgoing packets so that the source IP number is changed from the interface IP to the negotiated IP on the fly. This is essentially what the and ppp's Another alternative (and probably the most reliable) would be to implement a system call that changes all bound sockets from one IP to another. Yet another possibility is to allow an interface to be brought up without an IP number. Outgoing packets would be given an IP number of 255.255.255.255 up until the first SIOCAIFADDR ioctl is done. This would result in fully binding the socket. It would be up to Why don't most games work with the -alias switch

The reason games and the like don't work when libalias is in use is that the machine on the outside will try to open a connection or send (unsolicited) UDP packets to the machine on the inside. The packet alias software doesn't know that it should send these packets to the interior machine.

To make things work, make sure that the only thing running is the software that you're having problems with, then either run tcpdump on the tun interface of the gateway or enable ppp tcp/ip logging (``set log +tcp/ip'') on the gateway.

When you start the offending software, you should see packets passing through the gateway machine. When something comes back from the outside, it'll be dropped (that's the problem). Note the port number of these packets then shut down the offending software. Do this a few times to see if the port numbers are consistent. If they are, then the following line in the relevant section of /etc/ppp/ppp.conf will make the software functional: alias port proto internalmachine:port port

where ``proto'' is either ``tcp'' or ``udp'', ``internalmachine'' is the machine that you want the packets to be sent to and ``port'' is the destination port number of the packets.

You won't be able to use the software on other machines without changing the above command, and running the software on two internal machines at the same time is out of the question - after all, the outside world is seeing your entire internal network as being just a single machine.

If the port numbers aren't consistent, there are three more options:

1) Submit support in libalias. Examples of ``special cases'' can be found in /usr/src/lib/libalias/alias_*.c (alias_ftp.c is a good prototype). This usually involves reading certain recognised outgoing packets, identifying the instruction that tells the outside machine to initiate a connection back to the internal machine on a specific (random) port and setting up a ``route'' in the alias table so that the subsequent packets know where to go.

This is the most difficult solution, but it is the best and will make the software work with multiple machines.

2) Use a proxy. The application may support socks5 for example, or (as in the ``cvsup'' case) may have a ``passive'' option that avoids ever requesting that the peer open connections back to the local machine.

3) Redirect everything to the internal machine using ``alias addr''. This is the sledge-hammer approach. What are FCS errors ?

FCS stands for show hdlc command.

If your link is bad (or if your serial driver is dropping packets), you will see the occasional FCS error. This is not usually worth worrying about although it does slow down the compression protocols substantially. If you have an external modem, make sure your cable is properly shielded from interference - this may eradicate the problem.

If your link freezes as soon as you've connected and you see a large number of FCS errors, this may be because your link is not 8 bit clean. Make sure your modem is not using software flow control (XON/XOFF). If your datalink must use software flow control, use the command set accmap 0x000a0000 to tell ppp to escape the ^Q and ^S characters.

Another reason for seeing too many FCS errors may be that the remote end has stopped talking close lcp command (a following term command will reconnect you to the shell on the remote machine.

If nothing in your log file indicates why the link might have been terminated, you should ask the remote administrator (your ISP?) why the session was terminated. None of this helps - I'm desperate !

If all else fails, send as much information as you can, including your config files, how you're starting command (before and after connecting) to the mailing list or the news group, and someone should point you in the right direction. I can't create a /dev/ed0 device!

In the Berkeley networking framework, network interfaces are only directly accessible by kernel code. Please see the /etc/rc.network file and the manual pages for the various network programs mentioned there for more information. If this leaves you totally confused, then you should pick up a book describing network administration on another BSD-related operating system; with few significant exceptions, administering networking on FreeBSD is basically the same as on SunOS 4.0 or Ultrix. How can I setup Ethernet aliases?

Add `` command-line like the following: ifconfig ed0 alias 204.141.95.2 netmask 0xffffffff How do I get my 3C503 to use the other network port?

If you want to use the other ports, you'll have to specify an additional parameter on the command line. The default port is ``. I'm having problems with NFS to/from FreeBSD.

Certain PC network cards are better than others (to put it mildly) and can sometimes cause problems with network intensive applications like NFS.

See for more information on this topic. Why can't I NFS-mount from a Linux box?

Some versions of the Linux NFS code only accept mount requests from a privileged port; try mount -o -P linuxbox:/blah /mnt Why can't I NFS-mount from a Sun box?

Sun workstations running SunOS 4.X only accept mount requests from a privileged port; try mount -o -P sunbox:/blah /mnt I'm having problems talking PPP to NeXTStep machines.

Try disabling the TCP extensions in by changing the following variable to NO: tcp_extensions=NO

Xylogic's Annex boxes are also broken in this regard and you must use the above change to connect thru them. How do I enable IP multicast support?

Multicast host operations are fully supported in FreeBSD 2.0 and later by default. If you want your box to run as a multicast router, you will need to recompile your kernel with the MROUTING option and run /etc/rc.conf.

MBONE tools are available in their own ports category, mbone. If you are looking for the conference tools For more information, see the . Which network cards are based on the DEC PCI chipset?

Here is a list compiled by , with some more modern additions: Vendor Model ---------------------------------------------- ASUS PCI-L101-TB Accton ENI1203 Cogent EM960PCI Compex ENET32-PCI D-Link DE-530 Dayna DP1203, DP2100 DEC DE435 Danpex EN-9400P3 JCIS Condor JC1260 Linksys EtherPCI Mylex LNP101 SMC EtherPower 10/100 (Model 9332) SMC EtherPower (Model 8432) TopWare TE-3500P Zynx ZX342 Why do I have to use the FQDN for hosts on my site?

You will probably find that the host is actually in a different domain; for example, if you are in foo.bar.edu and you wish to reach a host called ``mumble'' in the bar.edu domain, you will have to refer to it by the fully-qualified domain name, ``mumble.bar.edu'', instead of just ``mumble''.

Traditionally, this was allowed by BSD BIND resolvers. However the current version of that ships with FreeBSD no longer provides default abbreviations for non-fully qualified domain names other than the domain you are in. So an unqualified host mumble must either be found as mumble.foo.bar.edu, or it will be searched for in the root domain.

This is different from the previous behavior, where the search continued across mumble.bar.edu, and mumble.edu. Have a look at RFC 1535 for why this was considered bad practice, or even a security hole.

As a good workaround, you can place the line search foo.bar.edu bar.edu

instead of the previous domain foo.bar.edu

into your file. However, make sure that the search order does not go beyond the ``boundary between local and public administration'', as RFC 1535 calls it. ``Permission denied'' for all networking operations.

If you have compiled your kernel with the If you had unintentionally misconfigured your system for firewalling, you can restore network operability by typing the following while logged in as root: ipfw add 65534 allow all from any to any

You can also set "firewall_type='open'" in /etc/rc.conf.

For further information on configuring a FreeBSD firewall, see the . How much overhead does IPFW incur?

The answer to this depends mostly on your rule set and processor speed. For most applications dealing with ethernet and small rule sets, the answer is, negligible. For those of you that need actual measurements to satisfy your curiosity, read on.

The following measurements were made using 2.2.5-STABLE on a 486-66. IPFW was modified to measure the time spent within the Two rule sets, each with 1000 rules were tested. The first set was designed to demonstrate a worst case scenario by repeating the rule: ipfw add deny tcp from any to any 55555

This demonstrates worst case by causing most of IPFW's packet check routine to be executed before finally deciding that the packet does not match the rule (by virtue of the port number). Following the 999th iteration of this rule was an allow ip from any to any.

The second set of rules were designed to abort the rule check quickly: ipfw add deny ip from 1.2.3.4 to 1.2.3.4

The nonmatching source IP address for the above rule causes these rules to be skipped very quickly. As before, the 1000th rule was an allow ip from any to any.

The per-packet processing overhead in the former case was approximately 2.703ms/packet, or roughly 2.7 microseconds per rule. Thus the theoretical packet processing limit with these rules is around 370 packets per second. Assuming 10Mbps ethernet and a ~1500 byte packet size, we would only be able to achieve a 55.5% bandwidth utilization.

For the latter case each packet was processed in approximately 1.172ms, or roughly 1.2 microseconds per rule. The theoretical packet processing limit here would be about 853 packets per second, which could consume 10Mbps ethernet bandwidth.

The excessive number of rules tested and the nature of those rules do not provide a real-world scenario -- they were used only to generate the timing information presented here. Here are a few things to keep in mind when building an efficient rule set: Place an `established' rule early on to handle the majority of TCP traffic. Don't put any allow tcp statements before this rule. Place heavily triggered rules earlier in the rule set than those rarely used (without changing the permissiveness of the firewall, of course). You can see which rules are used most often by examining the packet counting statistics with ipfw -a l. How can I redirect service requests from one machine to another?

You can redirect FTP (and other service) request with the 'socket' package, available in the ports tree in category 'sysutils'. Simply replace the service's commandline to call socket instead, like so: ftp stream tcp nowait nobody /usr/local/bin/socket socket ftp.foo.com ftp

where 'ftp.foo.com' and 'ftp' are the host and port to redirect to, respectively. Where can I get a bandwidth management tool?

There are two bandwidth management tools available for FreeBSD. is available for free; Bandwidth Manager from is a commercial product.