Date: Sat, 29 May 2010 02:40:40 +0300 From: Nikos Vassiliadis <nvass9573@gmx.com> To: "Svein Skogen (Listmail Account)" <svein-listmail@stillbilde.net> Cc: freebsd-questions@freebsd.org Subject: Re: FreeBSD router - large scale Message-ID: <4C005478.1070008@gmx.com> In-Reply-To: <4BFFA988.7020807@stillbilde.net> References: <AANLkTinvU5tOZyzzeJmVU1mlXGXMIEEOXWEv5GGArSCl@mail.gmail.com> <4BFFA988.7020807@stillbilde.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Svein Skogen (Listmail Account) wrote: > Actually, I'd find an answer from the FreeBSD Networking gurus useful as > well. My trusted Cisco 3640 is getting old (had it's > ten-years-of-service birthday a little while ago), so I guess I must be > prepared to replace it with something new. Preferrably something that > can do proper NAT port mapping to the inside servers in an > RFC1918-adressed DMZ, proper NAT mapping for the client net, incoming > VPDN (virtual private dialin network, such as PPTP+MPE and L2TP+IPSEC > tunelling), sane IDS in the border-gateway, GRE or IPinIP tunelling with > crypto for remote-sites, etc > > If somebody has a good starting-point for documentation on these > features, I'm more than willing to "do a procject on it" to create a > mini-howto/handbook-section on "setting up FreeBSD as your border > gateway", provided I have someone to ask when the documentation is ... > flaky. ;) Although I feel that you'll have to write book to cover all the things mentioned above, I'll try to reply to your question... These is just pointers... Several forms of NAT are supported with the following tools: ipfw pf ipf ng_nat I doubt there is some form of NAT you will miss. the net/mpd5 port can do PPTP, the MPPE part is blurry to me. L2TP is supported for LNS/LAC scenarios. I don't know "if you can"/"how difficult is to" combine IPSEC with L2TP. The most famous open source IDS is snort, you'll find it in the ports. For GRE and IPIP read gre and gif manual pages. Again, IPSEC is not integrated to these, yet there is IKE support via ipsec-tools port. You'll have to check for yourself the documentation. Though I can say that all the FreeBSD stuff mentioned above are well documented as usual and there is always this list if you have questions. Good luck replacing the aging Cisco... Nikos
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?4C005478.1070008>