The NetBSD Network FAQ

This page is developing, and we welcome any comments or suggestions.

Networking FAQ

• Getting started
• Network configuration files
• Network configuration programs
• Adding a new host to the network
• Naming a new host on the network
• Inter-networking
• Inter-networking with PPP
• Setting up pppd to use a leased line
• Making a PPP connection from WinCE to NetBSD
• How to use a ISDN modem (terminal adapter, TA)?
• Inter-networking with ISDN cards
• Inter-networking with DSL / PPPoE
• Inter-networking with GPRS / CDPD
• A simple NAT ("IP Masquerading") setup
• Maintenance
• Security
• Running Appletalk
• Kerberos
• Authentication for Windows 2000

Network problems

• Unable to ping other hostnames
• Connections seem to have a 30 second delay

Other links

• Miscellaneous links

Networking FAQ

Getting started (top)

The NetBSD install process includes basic network configuration, which implements a standard workstation setup. This configuration can be extended to take advantage of NetBSD's many networking features.

Network configuration files (top)

The network configuration is defined in a set of text configuration files.

Network configuration programs (top)

Two important network configuration programs are used in the network startup script (/etc/rc.d/network), and can be used to manually configure an active network.

Adding a new host to the network (top)

If your network is setup to use DHCP, all you need to do is set dhclient=yes in /etc/rc.conf, and the DHCP client will be started at boot time to automatically configure your machine's IP address, hostname, default router, nameservers and domainname used. See here for more information on DHCP.

If no DHCP is available, the minimum software requirement for a host to be added to a network is a configured interface with an address on the local network. If you provide network information during the NetBSD installation process, the new host can be immediately connected to the network and accessed by its IP number.

The following is a simple example of how to configure networking, assuming that you have one ex network interface and want your IP to be 192.168.253.2, using a default route of 192.168.253.1:

  # ifconfig lo0 127.0.0.1
  # ifconfig ex0 192.168.253.2 netmask 255.255.255.0
  # route add default 192.168.253.1

Naming a new host on the network (top)

To allow access by hostname as well as by IP number, the new hostname and its IP number are added to the network configuration files. There are a number of ways to manage this;

Inter-networking (top)

Connecting your network (which may consist of a single host) to another network requires that at least one host acts as a gateway between the two networks. The gateway host has two network interfaces - one configured for each network.

Inter-networking with PPP (top)

A special type of network interface can be created on a serial port (with or without a modem attached) using pppd(8).

There are many ways to setup PPP. One simple method, suitable for connecting to your ISP is:

Unlike an ethernet interface, you do not need to create a /etc/ifconfig.{interface} file for a PPP interface.

If you are using demand dial ppp and do not wish certain traffic to bring up the link (for example xntpd(8) ntp traffic), you can use active-filter in your ppd.conf file:

	active-filter   'not udp port ntp'

Setting up pppd to use a leased line (top)

A leased line is a fixed point-to-point link. Setting this up under NetBSD is a very simple process. On the server build an /etc/ppp/options like this:

     /dev/tty00
     57600
     noauth
     crtscts
     passive
     <local_IP_address>:<remote_IP_address>
     debug
     netmask 255.255.255.255
     proxyarp
     

You need to change <local_IP_address> and <remote_IP_address> to the appropriate values for your network (<local_IP_address> can be the same as your ethernet, <remote_IP_address> must be one valid addr for your ethernet segment).

On the client build an /etc/ppp/options with:

     /dev/tty00
     57600
     noauth
     crtscts
     defaultroute
     debug
     

Making a PPP connection from WinCE to NetBSD (top)

When Windows CE makes a connection, it sends the word "CLIENT" and waits for the response "CLIENTSERVER", without any CR at the end. Configure pppd as described above and add this line to your options:

connect "chat 'CLIENT' 'CLIENTSERVER\\c'"

How to use a ISDN modem (terminal adapter, TA)? (top)

To NetBSD, the TA will look like a normal modem, and it will speak asynchronous PPP if you switch it to the right mode. Depending on your ISP, you may can choose from the following modes:

You set the TA's mode with some Hayes AT modem commands, please consult your manual for the exact commands. You can then add these AT commands to your chat script used for your usual PPP dialing, as you do with a "normal" (analog) modem.

Inter-networking with ISDN cards (top)

Please see here.

Inter-networking with DSL / PPPoE (top)

Please see here for general instructions on DSL / PPPoE. There's also some more help for users of the german ISP T-Online.

Inter-networking with GPRS / CDPD (top)

Please see here.

A simple NAT ("IP Masquerading") setup (top)

To allow hosts that you have on a local private network (say: 10.0.0.0/24) use your NetBSD machine as router, and setup Network Address Translation (NAT, also called "IP Masquerading" in another universe), do the following:

If you want to use NAT on a PPPoE link (as usually used on DSL links), then you may want to enable MSS clamping too.

Maintenance (top)

Security (top)

Running Appletalk (top)

NetBSD supports 'net/netatalk', which enables unix machines to communicate with appletalk machines over ethernet (but not localtalk). This allows MacOS machines to read filesystems and print to printers via a NetBSD machine, and for the NetBSD machine to print to AppleTalk printers. The necessary source is available via the NetBSD Packages Collection.

Kerberos (top)

Kerberos is a network authentication system designed to provide strong authentication for client/server applications by using secret-key cryptography. NetBSD ships with the KTH Heimdal Kerberos 5 implementation.

This section provides some simple instructions to get your NetBSD systems configured to use Kerberos. For those not familiar with Kerberos, this serves as a basic how-to. For those of you familiar with Kerberos, it may document some differences between NetBSD's Kerberos and the Kerberos on other systems you may have used in the past.

For the purpose of these instructions, let's assume your DNS domain name is "foo.com". Let's also assume that there are two machines in the foo.com domain, called mach1.foo.com and mach2.foo.com.

A Kerberos administrative domain is called a realm. A realm can be named anything you like, although the convention is to use the organization's DNS domain name in upper-case letters. So, for your example domain of "foo.com", the Kerberos realm would be called "FOO.COM".

An identity in Kerberos is called a principal. Users, hosts, and even individual services on hosts are all principals. Principal names have the form "name@REALM". If the "@REALM" portion is omitted, the default realm is assumed. Service principal names have the form "service/hostname@REALM". The hostname should be the fully-qualified name of the host. All hosts have a "host/..." service principal. The "host/..." principal is generally used by login programs (e.g. telnetd(8), sshd(8)) and other things that want to authenticate the host to another principal (e.g. certain IPsec key management protocols).

An instance of a Kerberos credential is called a ticket. There is a special kind of ticked called a ticket granting ticket, or TGT. The TGT is your initial set of credentials, acquired for you when you log in using the login(1) program, or by running kinit(1). The TGT is used to acquire service tickets that allow you to use services that use Kerberos for authentication. Tickets are stored in a special database called a credential cache. For login sessions, the credential cache is generally stored in a file in /tmp. The credential cache should be destroyed when you log out by the kdestroy(1) command.

It is important to keep your credential cache safe!

If you don't someone else could use your credentials to gain access to services they might not otherwise have.

Credentials are centrally managed by the Key Distribution Center, or KDC. A user authenticates with the KDC by providing a password when acquiring a TGT. Services authenticate with the KDC using a similar mechanism, although the service's "password" comes from a key table, or keytab, stored on the host.

Note that Kerberos requires that all hosts within a realm have synchronized time. The best way to achieve this is to use NTP on your network.

The following is a step-by-step description of how to get your network configured to use Kerberos.

Congratulations! You now have a working Kerberos realm!

Authentication for Windows 2000 (top)

For those of you using Windows 2000, it is also possible to use your NetBSD KDC as an authentication server for your Windows 2000 hosts. Windows 2000 uses Kerberos to authenticate Windows Domain logins. NetBSD cannot act as a Windows 2000 Domain Controller, but using Samba, it can act as a Workgroup server.

For the purpose of these instructions, we assume you have already configured Samba on your server, and configured your Windows 2000 hosts to use it.

Using these steps, you will now be able to select to log into a Kerberos realm when logging into your Windows 2000 system. Note that for the most seamless user experience, the Samba password should be kept in-sync with the user's Kerberos password.

For more information about Kerberos, refer to these links:

Network problems

Unable to ping other hostnames (top)

If you can ping(8) another machine by IP address ("ping -n W.X.Y.Z"), but not by hostname, then there is probably a problem with your resolv.conf(5) file. Check your nameservers are set correctly and responding.

Connections seem to have a 30 second delay (top)

This is usually either:

Other links

Miscellaneous links (top)

---

Home page

---