m0n0wall - Soekris Platform Quick Start Guide

m0n0wall is a project aimed at creating a complete, embedded firewall software package that, when used together with an embedded computer platform like a Soekris device, provides all the important features of commercial firewall boxes (including ease of use) at a fraction of the price (free software). m0n0wall is based on a bare-bones version of FreeBSD, along with a web server, PHP and a few other utilities. The entire system configuration is stored in one single XML text file to keep things transparent.

m0n0wall is probably the first UNIX system that has its boot-time configuration done with PHP, rather than the usual shell scripts, and that has the entire system configuration stored in XML format.

m0n0wall already provides many of the features of expensive commercial firewalls, including:

The m0n0wall Quick Start Guide is intended to get m0n0wall up and running on a Soekris embedded computer system. There will be descriptions on configuring two interfaces (LAN and WAN) setup. The m0n0wall Handbook contains the information you need to further configure your m0n0wall installation after completing this guide.

This version of the Quick Start Guide is specifically tailored to the Soekris platforms. If you are using WRAP or the newer ALIX hardware from PC Engines, please see the WRAP/ALIX Quick Start Guide and for PC hardware, please see the PC Quick Start Guide.

There are a number of example configurations in Chapter 9 of the m0n0wall Handbook. These configurations describe how to configure several things such as multiple LAN interfaces, setting up DMZ interfaces, wireless interfaces, etc. The base for adding those additional features will be the basic LAN/WAN setup this guide describes.

This section will go through the hardware and network information you need to gather to proceed through in this guide.

The Soekris hardware you choose will depend on what features you will use, how much bandwidth you have, and any add on devices that you wish to use. Since m0n0wall is based on FreeBSD 4, most hardware that works with FreeBSD also works with m0n0wall. See the FreeBSD/i386 Hardware Notes for a detailed listing of supported hardware.

Below is a list of some common Soerkis versions:

Some add on devices for Soekris hardware might be:

Processor

For most broadband connections, any 100MHz or faster processor will be sufficient. For example, if you have less than 10 Mb of Internet bandwidth (combined upload and download speed), an embedded device like the WRAP or Soekris platforms will suffice. For 10 Mb up to a full T3 or more, a 500MHz system like the newer Soekris, ALIX, or embedded device like a NexCom is more appropriate. See Chapter 2 of the Users Guide for further details on compatible hardware.

For connections faster than a T3 using many VPN sessions, you will likely want to use a customized version of m0n0wall specifically built for your requirements, and high end Pentium 4, Xeon, or similar hardware. This is beyond the scope of this document.

RAM

We recommend an embedded system with at least 64 MB of RAM. More memory is particularly useful for VPN connections. Hard drive or CF installs are not recommended with less than 64 MB RAM because you will probably run out of RAM during upgrades and m0n0wall has no swap, so the upgrade will fail.

Hardware Sizing

Keep in mind there is no standard "if you have X Internet connection and Y number of machines on your network, then you need Z hardware". It varies depending on what services you will use, and your Internet traffic characteristics. The one thing that will require significantly more CPU, and/or a VPN accelerator card, is if you'll require more than a couple Mbps of VPN traffic for extended periods.

Some examples of non-encrypted network throughput can be found below, when using the default configuration. Please note that some of these results were reported by users and not officially tested by a developer of the m0n0wall code. Additional information can be found on this FAQ entry.

Some encryption speeds are shown below. Please note that speed will change based on the number of concurrent connections and the type of encryption being used.

Network Cards

You will need at least two network interfaces in the hardware you are using. If the Soekris system that you have selected has a PCI interface you can add an additional PCI based ethernet card. Most any PCI based cards are compatible with m0n0wall but be sure that whatever card you use has been tested with the Soekris system, check the Users Guide for further details.

For this document, we will assume there are two Ethernet interfaces. You can have additional interfaces installed in the system, but do not configure them during these quick installation procedures. Documentation in the Users Guide will soon be available to assist you in setting up additional LAN interfaces, DMZ interfaces, wireless setups, etc.

m0n0wall uses a subnet mask format that you may not be familiar with. Rather than the common 255.x.x.x, it uses CIDR (Classless InterDomain Routing) notation.

To download a Soekris image file, point your web browser to http://www.m0n0.ch/wall/downloads.php and select the net45xx or net48xx download link from that page, depending on the model of your board. Download the file to the machine from which you will be writing to the CompactFlash card.

physdiskwrite net45xx-xxx.img

physdiskwrite v0.5 by Manuel Kasper <mk@neon1.net>

Searching for physical drives...

Information for \\.\PhysicalDrive0:
   Windows:       cyl: 14593
                  tpc: 255
                  spt: 63
   C/H/S:         16383/16/63
   Model:         ST3120026A
   Serial number: 3JT1V2FS
   Firmware rev.: 3.06

Information for \\.\PhysicalDrive1:
   Windows:       cyl: 1
                  tpc: 255
                  spt: 63

myHome-Computer:Downloads myhome$ diskutil list
/dev/disk0
   #:      TYPE NAME                    SIZE       IDENTIFIER
   0:      GUID_partition_scheme        *74.5 Gi    disk0
   1:      EFI                           200.0 Mi   disk0s1
   2:      Apple_HFS Macintosh HD        74.2 Gi    disk0s2
/dev/disk1
   #:      TYPE NAME                    SIZE       IDENTIFIER
   0:                                   *61.2 Mi    disk1            

myHome-Computer:Downloads myhome$ diskutil info disk1
   Device Identifier:        disk1
   Device Node:              /dev/disk1
   Part Of Whole:            disk1
   Device / Media Name:      Honestar USB Storage-CFC Media

   Volume Name:              
   Mount Point:              

   Partition Type:           
   Bootable:                 Not bootable
   Media Type:               Generic
   Protocol:                 USB
   SMART Status:             Not Supported

   Total Size:               61.2 Mi (64225280 B) (125440 512-byte blocks)
   Free Space:               0.0 B (0 B) (0 512-byte blocks)

   Read Only:                No
   Ejectable:                Yes
   Whole:                    Yes
   Internal:                 No
   OS 9 Drivers:             No
   Low Level Format:         Not Supported

sudo gunzip net45xx-xxx.img | dd of=/dev/diskX bs=16k

myHome-Computer:Downloads myhome$ sudo dd if=net45xx-xxx.img of=/dev/disk1 bs=16k
Password:
435+1 records in
435+1 records out
7139303 bytes transferred in 8.071781 secs (884477 bytes/sec)         

gunzip -c net45xx-xxx.img | dd of=/dev/hdX bs=16k

Now put your written CF card into your Soekris board, and put it in its case.

2.2.1. Plugging in the Network Interfaces

The LAN and WAN interfaces are pre-assigned on the Soekris images. See below for photos of these pre-assigned board configurations.

Plug the LAN interface into the hub or switch that is connected to your LAN. Plug the WAN interface into your Internet connection (DSL or cable modem, router, etc.) Additional Network interfaces can optionally be connected to other routers, hubs or an Ethernet capable device.

Tip

If your Ethernet devices have built-in LEDs to show connectivity, verify that connected links are showing a green LED when the devices are physically powered on. If it is not showing green then there may be a problem with the cable (damaged or incorrect wiring) or with one of the Ethernet interfaces.

2.2.1.1. net4501

On the net4501, the LAN port is the port closest to where the power adapter plugs in, and the WAN is the middle port.

2.2.1.2. net4521

On the net4521, the LAN port is the port closest to where the power adapter plugs in, and the WAN is the remaining port.

2.2.1.3. net4801

On the net4801, the LAN port is the port closest to where the power adapter plugs in, and the WAN port is the middle port.

2.2.1.4. Five and Seven Port net4801

Some people run the net4801 with a Soekris lan1621 or lan1641 Ethernet PCI card. The LAN and WAN ports remain the same as a 4801 without the extra NIC's and the additional ports need to be configured in the webGUI after completing this guide.

By default, m0n0wall enables its DHCP server on its LAN interface, and configures the LAN interface with IP address 192.168.1.1. If you have an existing DHCP server, and/or wish to use a different IP subnet on your LAN, you will need to first connect via the Soekris serial console interface.

If you do not need to change the interface assignments, LAN IP address, or DHCP server settings, you can skip ahead to the next chapter. Otherwise, below are steps to make changes to the default configuration using your m0n0wall system's serial console interface.

To recap from earlier, your system is now ready to be configured. You are able to view the console at 19200 bps and have the media you loaded with m0n0wall earlier installed in your Soekris.

When your system finishes booting, you will see the m0n0wall console.

*** This is m0n0wall, version 1.2
    built on Sun Aug 22 11:41:15 CEST 2004 for Soekris
    Copyright (C) 2002-2005 by Manuel Kasper. All rights reserved.
    Visit http://m0n0.ch/wall for updates.
    
    
    LAN IP address: 192.168.1.1
    
    Port configuration:
    
    LAN  -> sis0
    WAN  -> sis1


m0n0wall console setup
**********************
1) Interfaces: assign network ports
2) Set up LAN IP address
3) Reset webGUI password
4) Reset to factory defaults
5) Reboot system

Although this example shows sis0 and sis1 as the two Ethernet interfaces these names depend on the Ethernet cards that are installed. These 4 characters simply identify the driver used to access the Ethernet card and the number of cards that are using the same driver. Other possible Ethernet interface names include, but are not limited to: bge, em, gx, nge, ti, txp, dc, fxp, sis, ste, tl, tx, xl.

Press 1 at the console setup screen if you wish to reassign your network interfaces.

On a three Ethernet port Soekris, sis0 is the NIC closest to the power adapter connector, sis1 is the middle Ethernet port, and sis2 is the Ethernet port furthest from the power adapter connector.

On a two Ethernet port Soekris, sis0 is the NIC closest to the power adapter connector, and sis1 is the remaining NIC.

Enter a number: 1

Valid interfaces are:

sis0    00:0c:29:96:5e:de
sis1    00:0c:29:96:53:e8

Do you want to set up VLANs first?
If you're not going to use VLANs, or only for optional interfaes, you
should say no here and use the webGUI to configure VLANs later, if required.

Do you want to set up VLANs now? (y/n) 
    

As this guide only leads you through a simple two interface configuration, we will press n and hit enter here to skip VLAN configuration. If you need VLAN support, configure it in the webGUI after this initial configuration is complete. You can use the Valid interfaces list to see how your installed Ethernet cards are identified by the m0n0wall operating system.

If you don't know the names of your interfaces, you may choose to use
auto-detection.  In that case, disconnect all interfaces before you begin,
and reconnect each one when prompted to do so.

Enter the LAN interface name or 'a' for auto-detection:
    

Enter the name of the desired LAN interface (sis0 or sis1 on a two port Soekris, sis0, sis1, or sis2 on a three port Soekris) and press Enter.

Enter the WAN interface name or 'a' for auto-detection
(or nothing if finished):

Enter one of the remaining available interfaces and press Enter.

Next you will be prompted for assigning optional interfaces. You can do this later through the webGUI if need be. Without entering anything, hit ENTER at this prompt.

Enter the Optional 1 interface name or 'a' for auto-detection
(or nothing if finished):

You will now see how your interfaces have been configured.

The interfaces will be assigned as follows:

LAN  -> sis1
WAN  -> sis0

The firewall will reboot after saving the changes.

Do you want to proceed? (y/n)
    

This confirms how the interfaces will be assigned. Press y and hit enter here to restart the firewall for the changes to take effect. To discard your changes, enter n and press Enter. If all of your hardware and cables are correctly installed you should be able to reach the m0n0wall at the 192.168.1.1 IP address from a client computer.

View this tutorial for a how to on changing your LAN IP address and/or DHCP server settings.

If you aren't familiar with networking, the easiest thing to do is set all your client machines to obtain their IP address from DHCP. m0n0wall enables its DHCP server on the LAN interface by default.

If you want to use a static IP address on your client machines, be sure to configure them in the same subnet as your m0n0wall LAN interface, using the appropriate DNS servers and the m0n0wall LAN IP address as the default gateway.

We recommend you stick with DHCP at least initially to reduce the likelihood of problems.

Open your web browser and go to http://192.168.1.1 (if you changed your LAN IP address in the console setup, replace 192.168.1.1 with your LAN IP throughout the remainder of this documentation).

You will be prompted for a username and password. Enter username admin and password mono. You are now logged into the webGUI.

First click "General Setup".

Hostname and Domain

If you wish to change the hostname and domain of your m0n0wall, you can do so in the first two boxes on this screen. If you use m0n0wall as your DNS server, this name will resolve to your LAN IP address. i.e. you can access your webGUI using http://m0n0wall.local or whatever you set the hostname and domain to be.

DNS Servers

If you have a static IP from your ISP, you need to enter the IP addresses of your ISP's DNS servers in these two boxes. Use one IP address per box. If you get your IP address from your ISP via DHCP, leave these boxes blank. If you want to use DNS servers on your LAN, enter their IP addresses here. You can only use one DNS server by filling in the top box and leaving the bottom one blank.

If your ISP uses DHCP and you wish to use the DNS servers the ISP's DHCP server provides, leave the "Allow DNS server list to be overridden by DHCP/PPP on WAN" box checked. If you are using DHCP on the WAN and wish to use DNS servers other than the ones provided by your ISP, uncheck this box.

Username and Password

If you wish to change the username from the default "admin", change the username box appropriately.

It is important that you change your password from the default "mono" by typing in a password of your choosing in the password field and typing it again to confirm in the second field.

webGUI protocol and port

Here you should change the protocol from HTTP to HTTPS so your username and password and configuration details are encrypted while in transit over your LAN.

If you want to make it a little more difficult to find your webGUI logon page, change the port number here. Just remember you will have to put that port number in the URL when logging into the webGUI. For example, if you set this port to 5555, and switch to HTTPS, you will have to use https://192.168.1.1:5555 to access the webGUI.

Time Zone

Select your time zone from this drop down box. This includes all of the time zones from FreeBSD. I am in Louisville, Kentucky, USA, which has its own entry under America/Louisville that I will select. You can likely find a city in the same time zone, or at least find the name of your time zone.

Time Update Interval

m0n0wall has a NTP client built in that by default will synchronize its time to a NTP server every 300 minutes (5 hours). To change the frequency of this update, change this box. Enter 0 to disable NTP clock synchronization (not recommended).

NTP Time Server

This specifies which NTP server m0n0wall will use to synchronize its time. You can leave it at pool.ntp.org unless you have a reason to change it. You might want to change this, for example, to synchronize to a central NTP server on your LAN.

Now review all of your changes on this screen, and when you are satisfied with them, click Save. You'll see notification that the changes were applied successfully.

Now we will configure your WAN interface. At this point, you will need some information from your ISP. The WAN connection types available are DHCP, static IP, PPPoE, PPTP, and BigPond. Chances are you will be using DHCP, static IP, or PPPoE.

5.3.1. WAN configuration screen

So you now have m0n0wall configured and working - now what next?