freebsd pf & server mode config

samples/pf.conf

@@ -0,0 +1,11 @@
+
+int_if = "em0"
+tun_if = "tun99"
+nat on $int_if inet from { $tun_if/24 } to any -> ($int_if)
+pass in log on $tun_if proto icmp from any to any keep state
+
+
+#nat on tun0 from 172.16.1.0/24 to any -> tun0
+#pass out log on $vpn_if inet proto { $protos } from $lan_net to any flags S/SA modulate state nat-to ($vpn_if) round-robin
+#pass in log quick on $dmz_if route-to (tun0 <anonine_gateway>) inet proto icmp from $dmz_network to any icmp-type echoreq tag VPN_TRAFFIC
+#pass out log quick on tun0 inet proto icmp from tun0 to any icmp-type echoreq tagged VPN_TRAFFIC

samples/server.conf

@@ -18,20 +18,20 @@ mode=server
 
 # the MTU of VPN device
 # 1492(Ethernet) - 20(IPv4, or 40 for IPv6) - 8(UDP) - 24(ShadowVPN)
-mtu=1440
+mtu=1240
 
 # tunnel device name
-intf=tun0
+intf=tun99
 
 # the script to run after VPN is created
 # use this script to set up routes, NAT, etc
 # configuration in this file will be set as environment variables
-up=/etc/shadowvpn/server_up.sh
+up=samples/server_up.sh
 
 # the script to run before stopping VPN
 # use this script to restore routes, NAT, etc
 # configuration in this file will be set as environment variables
-down=/etc/shadowvpn/server_down.sh
+down=samples/server_down.sh
 
 # PID file path
 pidfile=/var/run/shadowvpn.pid

samples/server_up.sh

@@ -1,27 +1,28 @@
 #!/bin/sh
 
+set -x
 # example server up script
 # will be executed when server is up
 
 # all key value pairs in ShadowVPN config file will be passed to this script
 # as environment variables, except password
 
 # turn on IP forwarding
-sysctl -w net.ipv4.ip_forward=1
+sysctl -w net.inet.ip.forwarding=1
 
 # configure IP address and MTU of VPN interface
-ifconfig $intf 10.7.0.1 netmask 255.255.255.0
-ifconfig $intf mtu $mtu
+ifconfig $intf 10.7.0.1 10.7.0.1 netmask 255.255.255.0 mtu $mtu up
+#ifconfig $intf mtu $mtu
 
 # turn on NAT over eth0 and VPN
 # if you use other interface name that eth0, replace eth0 with it
-iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-iptables -A FORWARD -i eth0 -o $intf -m state --state RELATED,ESTABLISHED -j ACCEPT
-iptables -A FORWARD -i $intf -o eth0 -j ACCEPT
+#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+#iptables -A FORWARD -i eth0 -o $intf -m state --state RELATED,ESTABLISHED -j ACCEPT
+#iptables -A FORWARD -i $intf -o eth0 -j ACCEPT
 
 # turn on MSS fix
 # MSS = MTU - TCP header - IP header
-mss=$(($mtu - 40))
-iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss $mss
+#mss=$(($mtu - 40))
+#iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss $mss
 
 echo $0 done