###############################################################################
# Brief instructions for this file
###############################################################################
#
# VERBOSE=(YES/NO)			Default: Yes
# Be verbose about settings.
#
# MAX_LOOP=(int)			Default: 10
# Maximum number of incrementable entries to search for.
# IE: If you create a DNS7=, and MAX_LOOP=7, it will not be reached.
# (DNS0 - DNS7 == 8 entires)
# Setting this value too high will decrease the speed of the configuation
# system.
#
# IPFWDING_KERNEL=(YES/NO/FILTER_ON)	Default: NO
# Enable IP forwarding in the kernel.  FILTER_ON means forwarding will
# only happen when IP filtering rules are loaded
#
# IPALWAYSDEFRAG_KERNEL=(YES/NO)	Default: NO
# Enable IP Global defragmentation in the kernel.  
#
# **WARNING** - If this was turned on everywhere in a network of routers,
# it can result in TCP connections failing and TCP connection resets. 
#
# ONLY turn this on if the box is a firewall or the single point of
# entry for a network, or an endpoint for port forwarding or a load
# balancer for a WWW server farm.  DO NOT turn this on if the box is a
# conventional router as it breaks the TCP/IP RFCes.  This option is
# needed when using IP NAT, IP masquerading, IP autofw, IP portfw,
# transperent proxying or other kernel operations that intercept a
# packet flow and redirect it.
#
# It is a usful tool when using a packet filtering router to protect
# directly attached ethernet networks of servers as it stops fragment
# attacks on the servers in behind the router. Another use is packet
# filtering router to protect dial-in Internet users on NASes
# (Portmasters, TC racks etc) from various SMB and fragment attacks
# and to redirect all WWW connections into a WWW proxy-caching server.
#
# CONFIG_HOSTNAME=(YES/NO)		Default: NO
# Create /etc/hostname file using HOSTNAME entry.
# Any current hostname file will be **OVERWRITTEN**
#
# CONFIG_HOSTSFILE=(YES/NO)		Default: NO
# Create /etc/hosts file using HOSTSx entries.
# Any current hosts file will be **OVERWRITTEN**
#
# CONFIG_DNS=(YES/NO)			Default: NO
# Create /etc/resolv.conf file using DOMAINS and DNSx entries.
# Any current resolv.conf file will be **OVERWRITTEN**
#
# IF_LIST                       	Default: "$IF_AUTO"
# A space seperated list of interfaces that can be ACTIVE on this machine
# This controls which interfaces can be brought up and down manually.
#
# IF_AUTO                       	Default: "eth0"
# A space seperated list of interfaces that get started on boot. Tunneling
# interfaces like CIPE should be after the raw  interfaces they depend on.
# The interfaces are started in the order they occur on the list, and are 
# shutdown in the reverse order of IF_LIST.
#
# IPFILTER_SWITCH=(none|router|firewall)	Default: "none"
# Selects the basic IP filtering/firewalling setup of the router.  "None" 
# is used for a straight through router, "router" for a filtering router with
# IP spoof protection and Martian protection and "firewall" for a basic IP 
# masquerading/NAT firewall.  The basic filter types are provided in 
# /etc/ipfilter.conf.  If you want more than what is provided read the man 
# pages for ipchains or ipfwadm and BE CAREFUL when you edit this!
#
###############################################################################
# General Settings
###############################################################################

VERBOSE=YES
MAX_LOOP=10

IPFWDING_KERNEL=YES

IPALWAYSDEFRAG_KERNEL=YES

CONFIG_HOSTNAME=NO

CONFIG_HOSTSFILE=NO

CONFIG_DNS=NO

###############################################################################
# Interfaces
###############################################################################

# Start pppd PPP interfaces first as pppd's use of DNS can delay startup.
#
# Interfaces to start on boot go here - ie "ppp0 eth0"
IF_AUTO="eth0 eth1"
# List of all configured interfaces, manual start and boot start 
IF_LIST="$IF_AUTO" 	

# Accept ICMP Redirects on ALL interfaces, also depends on /proc 
# per interface IP forwarding flag. - YES/NO 
ALLIF_ACCEPT_REDIRECTS=NO

# Need these both for interfaces run by daemons - ie PPP, CIPE, some
#	  WAN interfaces
# IP spoofing protection by default for interfaces - YES/NO
DEF_IP_SPOOF=YES
# Kernel logging of spoofed packets by default for interfaces - YES/NO
DEF_IP_KRNL_LOGMARTIANS=YES

eth0_IPADDR=192.168.1.254
eth0_MASKLEN=24
eth0_BROADCAST=192.168.1.255
# Use this to set the default route if required - ONLY one to be set.
# routed or gated could be used to set this so only use if not running these.
#eth0_DEFAULT_GW=192.168.1.254
# IP spoofing protection on this interface - YES/NO
eth0_IP_SPOOF=YES
# Kernel logging of spoofed packets on this interface - YES/NO
eth0_IP_KRNL_LOGMARTIANS=YES
# This setting affects the processing of ICMP redirects. Setting it to NO 
# makes this more secure. Don't turn this off if you have two IP 
# networks/subnets on the same media - YES/NO
eth0_IP_SHARED_MEDIA=NO
# Simple QoS/fair queueing support
# Turn on Stochastic Fair Queueing - useful on busy DDS links - YES/NO
eth0_FAIRQ=NO
# Ethernet Transmit Queue Length
# eth0_TXQLEN=100
# Complex QoS - Enable all of these + above to turn it on
#eth0_BNDWIDTH=10Mbit   # Device bandwidth
#eth0_HNDL=2            # Queue Handle - must be unique
#eth0_IABURST=100       # Interactive Burst
#eth0_IARATE=1Mbit      # Interactive Rate
#eth0_PXMTU=1514        # Physical MTU - includes Link Layer header

# Sangoma FR example
#fr498_IPADDR=10.0.10.1
#fr498_PTPADDR=10.0.10.2
#fr498_IP_SPOOF=YES
#fr498_IP_KRNL_LOGMARTIANS=YES
# Simple QoS support
#fr498_FAIRQ=YES
#fr498_TXQLEN=50
# Complex FR QoS - Enable ALL of these + above to turn it on
#fr498_FRBURST=960Kbit	# FR Burst capacity (a rate)
#fr498_BULKRATE=320Kbit	# Usually you set this to the CIR
#fr498_BULKBURST=50	# Number of packets that can burst in bulk class
#fr498_BNDWIDTH=1920Kbit # The bandwidth of the interface
#fr498_IABURST=512	# No of Interactive Burst packets
#fr498_IARATE=640Kbit 	# Burst capicity bandwith between 
			# BURST and CIR
#fr498_HNDL=2		# The queue handle - must be unique Dialup PPP is 1000+
#fr498_PXMTU=1508	# The Physical MTU of the interface (data + MAC header)

# PPP interface stuff - these apply to all ASYNC ppp interfaces, options
# same as ethernet above.
ppp_BNDWIDTH=30Kbit
ppp_FAIRQ=YES
ppp_TXQLEN=30
ppp_IABURST=20
ppp_IARATE=10Kbit
ppp_PXMTU=1500

###############################################################################
# IP Filter setup - can pull in settings from above
###############################################################################

# Set up the basic type of filtering. Can be one of (none|router|firewall)
# You must load the ip_masq_* modules to enable full IP masquerading, and
# ip_masq_portfw if you want to forward external ports pop-3, mtp, www 
# to internal machines below.
IPFILTER_SWITCH=firewall

# This set of variables is used with both sets of filters
SNMP_BLOCK=YES                  # Block all SNMP (YES/NO)
                                # List of IP  Nos used for SNMP management
SNMP_MANAGER_IPS="10.100.1.2"
# Fair Queuing support 		
# List of Mark values
MRK_CRIT=1			# Critical traffic, routing, DNS
MRK_IA=2			# Interactive traffic - telnet, ssh, IRC
				# List of traffic types and maps to mark values
				# Setting this variable turns on the 
				# fairq chain
CLS_FAIRQ="${MRK_CRIT}_89_0/0 ${MRK_CRIT}_udp_0/0_route ${MRK_CRIT}_tcp_0/0_bgp ${MRK_CRIT}_tcp_0/0_domain ${MRK_CRIT}_udp_0/0_domain ${MRK_IA}_tcp_0/0_telnet ${MRK_IA}_tcp_0/0_ssh"

# This set of variables is used with the basic routing filter setup

# This set of variables is used with a basic IP masquerading firewall setup 
#Notation - IP addresses/masklen
# 
# NOTE: Do NOT turn on the DMZ network or ANY external port masquerading/
#	port forwarding when EXTERN_DYNADDR is on because some security
#	leaks will result.  You may also want to limit the external open
#	ports to domain (UDP) for DNS. Anyhow, these features are not that 
#	usable unless you have a static external address 
#
eth1_IPADDR=10.0.0.1
eth1_MASKLEN=24
eth1_BROADCAST=10.0.0.255
eth1_DEFAULT_GW=10.0.0.254
eth1_IP_SPOOF=YES
eth1_IP_KRNL_LOGMARTIANS=YES
eth1_IP_SHARED_MEDIA=NO
eth1_FAIRQ=NO
EXTERN_IF="eth1"		# External Interface
      				# External Address dynamically assigned
EXTERN_DYNADDR=NO		# - YES/NO
				#  -- OR --
EXTERN_IP=10.0.0.1		# External Interface IP number
EXTERN_UDP_PORTS="domain ntp"	# UDP Services open to outside world
EXTERN_TCP_PORTS="ssh smtp"	# TCP services open to outside world
# Internal interface
INTERN_IF="eth0"		# Internal Interface
INTERN_NET=192.168.1.0/24	# Internal network (to be masqueraded)
INTERN_IP=192.168.1.1		# IP number of Internal Interface
				# (to allow forwarding to external IP)
# These services are not masqueraded from inside to outside.  proto_port
# Allows the firewall to be trusted for ssh access to routers...
#NOMASQ_PORTS="tcp_ssh"
# Uncomment following for internal services
#INTERN_FTP_SERVER=192.168.1.1	# Internal FTP server to make available
INTERN_WWW_SERVER=192.168.1.1	# Internal WWW server to make available
#INTERN_SMTP_SERVER=192.168.1.1	# Internal SMTP server to make available
#INTERN_POP3_SERVER=192.168.1.1	# Internal POP3 server to make available
#INTERN_IMAP_SERVER=192.168.1.1	# Internal IMAP server to make available
#INTERN_SSH_SERVER=192.168.1.1   # Internal SSH server to make available
#EXTERN_SSH_PORT=24		# External port to use for internal SSH access

###############################################################################
# Interface activation/deactivation functions
#  Here so that special interface commands can be called and daemons started
#  
#  Arps can be set up here, network/host routes and so forth.
#
#  This appears to be a little messy but is needed to achieve maximum 
#  functionality and flexibility.
#
###############################################################################

if_up () {

	# sort out a few things to make life easier - here so that you
	# can see what is done and so that you can add anything if needed
	eval local IPADDR=\${"$1"_IPADDR:-""}     # I am also a good genius
	eval local MASKLEN=\${"$1"_MASKLEN:-""}
	eval local BROADCAST=\${"$1"_BROADCAST:-""}
	eval local PTPADDR=\${"$1"_PTPADDR:-""}
	eval local DEFAULT_GW=\${"$1"_DEFAULT_GW:-""}
	eval local FAIRQ=\${"$1"_FAIRQ:-""}
	eval local TXQLEN=\${"$1"_TXQLEN:-""}
	eval local IP_SPOOF=\${"$1"_IP_SPOOF:-""}
	eval local IP_KRNL_LOGMARTIANS=\${"$1"_IP_KRNL_LOGMARTIANS:-""}
        eval local IP_SHARED_MEDIA=\${"$1"_IP_SHARED_MEDIA:-""}
	if [ -n "$BROADCAST" ] ; then
		IFCFG_BROADCAST="broadcast $BROADCAST"
	fi

	# Set default interface flags here - used for PPP and WAN interfaces
	if_setproc default rp_filter $DEF_IP_SPOOF
	if_setproc default log_martians $DEF_IP_KRNL_LOGMARTIANS
	if_setproc all accept_redirects $ALLIF_ACCEPT_REDIRECTS

	# Set up each interface
	case $1 in
	ppp0)
		pppd call provider
		;;
	fr*)
		ip addr add $IPADDR peer $PTPADDR dev $1 		
		ip link set $1 arp off multicast on
		ip link set $1 up
		# Fair queuing - this can be selected for any interface
		ip_frQoS $1
		;;
	*)      # default interface startup
		ip addr add $IPADDR/$MASKLEN $IFCFG_BROADCAST dev $1
		ip link set $1 up
		# Fair queuing - this can be selected for any interface
		ip_QoS $1
		;;
	esac
	
	# Do universal interface config items here 
	# Default route support
	[ -n "$DEFAULT_GW" ] \
		&& ip route replace default nexthop via $DEFAULT_GW dev $1
	# Set the TX Queue Length
	[ -n "$TXQLEN" ] \
		&& ip link set $1 txqlen $TXQLEN 
	# Spoof protection
	if_setproc $1 rp_filter $IP_SPOOF
	# Kernel logging of martians on this interface
	if_setproc $1 log_martians $IP_KRNL_LOGMARTIANS
	# Shared Media stuff
	if_setproc $1 shared_media $IP_SHARED_MEDIA

	# JTS 12/4/1999 quick hack to enable traffic via 10.0.0.1 eth1
	if [ "$1" = "eth1" -a "$eth1_IPADDR" = "10.0.0.1" ] ; then
		/sbin/ipchains -I output 1 -j ACCEPT -p all -s 10.0.0.1/32 -d 0/0 -i eth1
		/sbin/ipchains -I input 1 -j ACCEPT -p all -s 0/0 -d 10.0.0.1/32 -i eth1
	fi

	return 0
}

if_down () {

	case $1 in 
	ppp*)
		kill `cat /var/run/$1.pid`
		sleep 5        # Wait for pppd to die 
		;;
	fr*)
		ip link set $1 down
		qt ip addr flush dev $1 
		;;
	*)	# default action
		ip link set $1 down    # This also kills any routes 
		qt ip addr flush dev $1
		;;
	esac

	# Clean up any QoS/fair queuing stuff
	ip_QoSclear $1

	true

}	#END if_down

###############################################################################
# Hostname					Requires: CONFIG_HOSTNAME=YES
###############################################################################
HOSTNAME=myrouter

###############################################################################
# Hosts file (Static domainname entires)	Requires: CONFIG_HOSTSFILE=YES
###############################################################################
#	IP		FQDN				hostname alias1 alias2..
HOSTS0="$eth0_IPADDR	$HOSTNAME.somewhere.net		$HOSTNAME mr rtr"
HOSTS1="192.168.1.22	host2.somewhere.net		host2 h2"

###############################################################################
# Domain Search Order and Name Servers		Requires: CONFIG_DNS=YES
###############################################################################

DOMAINS="somewhere.net domain2.net"

DNS0=192.168.1.1
DNS1=192.168.1.2

###############################################################################
# QoS/Fariqueing functions
###############################################################################

ip_QoSclear () {
	[ -x /sbin/tc ] \
		&& qt tc qdisc del dev $1 root
	return 0
}

ip_frQoS () {

	# Set some vaiables 
	eval local FAIRQ=\${"$1"_FAIRQ:-""}
	eval local BULKRATE=\${"$1"_BULKRATE:-""}
	eval local BULKBURST=\${"$1"_BULKBURST:-""}
	eval local FRBURST=\${"$1"_FRBURST:-""}
	eval local HNDL=\${"$1"_HNDL:-""}
	eval local BNDWIDTH=\${"$1"_BNDWIDTH:-""}
	eval local IARATE=\${"$1"_IARATE:-""}
	eval local IABURST=\${"$1"_IABURST:-""}
	eval local PXMTU=\${"$1"_PXMTU:-""}


	if [ ! -x /sbin/tc ]; then
		return 1
	fi	

	if [ "$FAIRQ" != "YES" -a "$FAIRQ" != "Yes" -a "$FAIRQ" != "yes" ]
	then
		return 1
	fi 

	if [ -z "$BULKRATE" -o -z "$FRBURST" -o -z "$HNDL" -o -z "$PXMTU" \
		-o -z "$BNDWIDTH" -o -z "$IARATE" -o -z "$IABURST" \
		-o -z "$BULKBURST" ]; then
		tc qdisc replace dev $1 root sfq
		return 0
	fi
	
	# Attach CBQ  to device 
	tc qdisc add dev $1 root handle $HNDL: cbq \
		bandwidth $BNDWIDTH avpkt 1000
	# Set up classes
	# Bulk class
	tc class add dev $1 parent $HNDL:0 classid :1 \
		est 1sec 8sec cbq bandwidth $BNDWIDTH \
		rate $BULKRATE allot $PXMTU bounded weight 1 prio 6 \
		avpkt 1000 maxburst $BULKBURST \
		split $HNDL:0 defmap ff7f
	tc qdisc add dev $1 parent $HNDL:1 sfq perturb 15
	# Interactive Class
	tc class add dev $1 parent $HNDL:0 classid :2 \
		est 2sec 16sec cbq bandwidth $BNDWIDTH \
		rate $IARATE allot $PXMTU bounded weight 1 prio 6 \
		avpkt 1000 maxburst $IABURST \
		split $HNDL:0 defmap 80
	tc qdisc add dev $1 parent $HNDL:2 sfq perturb 15
	# Priority class
	tc class add dev $1 parent $HNDL:0 classid :3 \
		est 1sec 8sec cbq bandwidth $BNDWIDTH \
		rate $FRBURST allot $PXMTU bounded weight 1 prio 1 \
		avpkt 1000 maxburst 21
	tc qdisc add dev $1 parent $HNDL:3 pfifo
	# Add filters
	tc filter add dev $1 parent $HNDL:0 protocol ip \
		priority 50 handle $MRK_CRIT fw classid $HNDL:3
	tc filter add dev $1 parent $HNDL:0 protocol ip \
		priority 60 handle $MRK_IA fw classid $HNDL:2

	return 0
}

ip_QoS () {

	# Set some vaiables 
	eval local HNDL=\${"$1"_HNDL:-""}
	eval local FAIRQ=\${"$1"_FAIRQ:-""}
	if [ -z "$FAIRQ" -a -n "$2" ]; then
		 local FAIRQ=$2 
	fi
	eval local BNDWIDTH=\${"$1"_BNDWIDTH:-""}
	if [ -z "$BNDWIDTH" -a -n "$3" ]; then 
		 local BNDWIDTH=$3 
	fi
	eval local PXMTU=\${"$1"_PXMTU:-""}
	if [ -z "$PXMTU" -a -n "$4" ]; then 
		 local PXMTU=$4 
	fi
	eval local IARATE=\${"$1"_IARATE:-""}
	if [ -z "$IARATE" -a -n "$5" ]; then 
		local IARATE=$5 
	fi
	eval local IABURST=\${"$1"_IABURST:-""}
	if [ -z "$IABURST" -a -n "$6" ]; then 
		local IABURST=$6 
	fi

	if [ ! -x /sbin/tc ]; then
		return 1
	fi	

	if [ "$FAIRQ" != "YES" -a "$FAIRQ" != "Yes" -a "$FAIRQ" != "yes" ]
	then
		return 1
	fi 

	if [ -z "$BNDWIDTH" -o -z "$IABURST" -o -z "$IARATE" -o -z "$HNDL" \
		-o -z "$PXMTU" ]; then
		tc qdisc replace dev $1 root sfq
		return 0
	fi

	# Attach CBQ  to device 
	tc qdisc add dev $1 root handle $HNDL: cbq \
		bandwidth $BNDWIDTH \
		avpkt 1000
	# Set up classes
	# Bulk class
	tc class add dev $1 parent $HNDL:0 classid :1 est 1sec 8sec \
		cbq bandwidth $BNDWIDTH rate $BNDWIDTH \
		allot $PXMTU avpkt 1000 bounded weight 1 prio 6 \
		split $HNDL:0 defmap ff7f
	tc qdisc add dev $1 parent $HNDL:1 sfq perturb 15
	# Interactive class
	tc class add dev $1 parent $HNDL:0 classid :2 est 2sec 16sec \
		cbq bandwidth $BNDWIDTH rate $IARATE maxburst $IABURST \
		allot $PXMTU avpkt 1000 bounded isolated weight 1 \
		prio 2 split $HNDL:0 defmap 80
	tc qdisc add dev $1 parent $HNDL:2 sfq perturb 15
	# Priority class
	tc class add dev $1 parent $HNDL:0 classid :3 est 1sec 8sec \
		cbq bandwidth $BNDWIDTH rate $BNDWIDTH \
		allot $PXMTU avpkt 1000 bounded weight 1 prio 1
	tc qdisc add dev $1 parent $HNDL:3 pfifo
	# Add filters
	tc filter add dev $1 parent $HNDL:0 protocol ip \
		priority 50 handle $MRK_CRIT fw classid $HNDL:3
	tc filter add dev $1 parent $HNDL:0 protocol ip \
		priority 60 handle $MRK_IA fw classid $HNDL:2 \

	return 0
}

###############################################################################
# End
###############################################################################