Re: No

On 12 Dec 2022, at 2:31, Zé Loff wrote:

> On Sun, Dec 11, 2022 at 04:20:53PM -0800, Randall Gellens wrote:
>> I have a Protectli box that is the router for my home network. The
>> home
>> network uses U-Verse to connect to the outside, and has separate
>> Ethernet
>> networks for servers, wired clients, and Wi-Fi IoT clients. U-Verse
>> supplies
>> their own box (a "Residential Gateway" or RG) that sits at the
>> connection
>> points. The RG throws a tantrum if it detects an internal router or
>> multi-homed devices, so the OpenBSD box is set up as a transparent
>> filtering
>> bridge so the RG thinks all the devices are connected directly to it.
>> The
>> OpenBSD box has Ethernet ports for the U-Verse RG and one for the
>> three
>> internal networks, with pf filtering the packets. The
>> /etc/hostname.if files
>> provide an IP address for the interface for the server network and
>> one for
>> the Wi-Fi interface (these are on different networks). The
>> /etc/hostname.if
>> files for the U-Verse and wired client Ethernet ports have just a
>> description.
>>
>> The Protectli was running (I think) OpenBSD 6.2, but suffered a disk
>> failure
>> and I couldn't find my backup, so I installed a fresh OpenBSD 7.2 on
>> it and
>> added the users and config files (I had current versions of those).
>> The
>> config files are pretty minimal: /etc/hostname.if files for the four
>> Ethernet ports and the bridge, /etc/sysctl.conf to set
>> net.inet.ip.forwarding=1, pf.conf for the rules. There aren't any
>> other
>> services running on the box (other boxes are used for DHCP, DNS,
>> etc.).
>>
>> Initially, the server and Wi-Fi Ethernet ports had traffic and
>> packets were
>> routed between them, but there was no traffic on the wired clients
>> nor
>> U-Verse Ethernet ports, and no packets got between them. A client on
>> Wi-Fi
>> could ping a server and vice versa, and other servers could reach the
>> OpenBSD box. But clients couldn't reach servers, and nothing could
>> get
>> outside. All interfaces looked right when viewed using ifconfig, and
>> the
>> bridge looked right (it was up and had the four interfaces). There
>> were no
>> errors during startup, nor when running netstart.
>>
>> Changing the /etc/hostname.if files for the U-Verse and client ports
>> to add
>> an 'inet' line with a dummy IP address made it all start working.
>> Before,
>> they just had a line with "description" and text.
>>
>> Questions:
>>
>> (1) I'd like to understand the interfaces worked without having IP
>> addresses
>> in OpenBSD 6 but not in OpenBSD 7. They showed as up and as part of
>> the
>> bridge, but no traffic.
>
> Without *at least* the applicable /etc/hostname.* files its hard to
> help
> you with this. FWIW, I have a 7.1 box with a similar setup that
> forwards packets adequately (bridging two vlan interfaces, with no IP
> addresses on the parent interfaces, the vlan interfaces or the
> bridge).


Below are the /etc/hostname.* files as they are now (working).
Originally, /etc/hostname.em1 and /etc/hostname.3 were:

/etc/hostname.em1 (originally)

description "U-Verse DSL"

/etc/hostname.em3 (originally):

description "Switch for clients"

/etc/hostname.em0 and /etc/hostname.em2 did not need changes.

Here are the files as they are now:

/etc/hostname.em0

inet 192.168.98.1 255.255.255.0 NONE description "to talk to AP"
inet alias 192.168.0.210 255.255.255.0 NONE description "factory
fallback wireless AP"

/etc/hostname.em1

inet 192.168.98.2 255.255.255.0 NONE description "U-Verse DSL"

/etc/hostname.em2

inet 99.111.97.160 255.255.255.240 NONE description "Switch for servers"

/etc/hostname.em3

inet 192.168.98.3 255.255.255.0 NONE description "Switch for clients"

/etc/hostname.em3

inet 192.168.98.3 255.255.255.0 NONE description "Switch for clients"

-bash-5.1$ more /etc/hostname.bridge0

add em0
add em1
add em2
add em3
timeout 0
rule pass in on em1 src ac:5d:10:80:7d:11 tag outside
# pass on em0
# pass on em1
# pass on em2
# pass on em3
up


The "rule pass in" line in the bridge is to add a tag to packets from
the outside, because (at least in OpenBSD 6.2) the pf.conf rules saw the
packets as coming from a different interface, so they weren't treated as
coming from the outside.


>> (2) Also, I have several old machines that can no longer SSH into the
>> OpenBSD 7 box. They get an error "no hostkey alg". Is there an easy
>> way to
>> get the OpenBSD box to accept connections from older clients?
>> Presumably I
>> need to enable older key algorithms, but after hunting through the
>> OpenSSH
>> manual I can't see what I need to do. The packet rules block access
>> to the
>> OpenBSD box from outside.
>
> RSA was deprecated some time ago. Add
>
> HostKeyAlgorithms=+ssh-rsa
> PubkeyAcceptedAlgorithms=+ssh-rsa
>
> to /etc/ssh/sshd_config, or, better yet, change the clients' config to
> bring them up to speed (I understand it might not be feasible).

Thank you, that worked, I appreciate it. (I know I need to update
openssh on the old machines, but that's a big project, and the protectli
box isn't accessible from the outside.)


--Randall