| 1 | # Stolen from /sbin/dhclient-script using using no /usr based binaries.
|
|---|
| 2 | # Converts an commented list into a SEP (default space) seperated list.
|
|---|
| 3 | make_list() {
|
|---|
| 4 | SEP=${2:-' '}
|
|---|
| 5 | oldifs="$IFS"
|
|---|
| 6 | IFS="
|
|---|
| 7 | "
|
|---|
| 8 | list=""
|
|---|
| 9 | for line in $1; do
|
|---|
| 10 | line=${line%%[ \t#]*}
|
|---|
| 11 | [ -n "$line" ] && list="$list$SEP$line"
|
|---|
| 12 | done
|
|---|
| 13 | IFS=${oldifs}
|
|---|
| 14 | echo ${list##$SEP}
|
|---|
| 15 | }
|
|---|
| 16 |
|
|---|
| 17 | # No kernel dumps as we don't have a place to store them
|
|---|
| 18 | dumpdev="NO"
|
|---|
| 19 |
|
|---|
| 20 | # We are an router/gateway (wireless to be precise) running the lvrouted
|
|---|
| 21 | # routing daemon.
|
|---|
| 22 | gateway_enable="YES"
|
|---|
| 23 | lvrouted_enable="YES"
|
|---|
| 24 | lvrouted_flags="-u -s s00p3rs3kr3t -m 28"
|
|---|
| 25 |
|
|---|
| 26 | # Takes lvrouted an small while to create reachable network nodes, make sure to
|
|---|
| 27 | # wait on it,to saves some bootup warnings.
|
|---|
| 28 | netwait_enable="YES"
|
|---|
| 29 | netwait_timeout="20"
|
|---|
| 30 | netwait_ip="8.8.8.8 172.16.4.46 172.27.129.1 172.17.14.1"
|
|---|
| 31 |
|
|---|
| 32 | # Block the full range as smaller subnets are used for allowances, this avoids
|
|---|
| 33 | # traffic going out (due to the default route) to unreachable parts to the
|
|---|
| 34 | # 172.16.0.0/12 network.
|
|---|
| 35 | static_routes="quickstop"
|
|---|
| 36 | route_quickstop="-net 172.16.0.0/12 127.0.0.1 -reject"
|
|---|
| 37 |
|
|---|
| 38 | # NTP server needs working config with WL network or internet on boot
|
|---|
| 39 | # so some warnings might pop up, but no harm
|
|---|
| 40 | ntpdate_enable="YES"
|
|---|
| 41 | ntpdate_flags="-b -s"
|
|---|
| 42 | ntpd_enable="YES"
|
|---|
| 43 | ntpd_sync_on_start="YES"
|
|---|
| 44 | ntpd_flags="-p /var/run/ntpd.pid -f /var/db/ntp.drift"
|
|---|
| 45 |
|
|---|
| 46 | # We need no running mail server
|
|---|
| 47 | sendmail_enable="NONE"
|
|---|
| 48 |
|
|---|
| 49 | # Don't let syslog accept input from other remote hosts
|
|---|
| 50 | syslogd_enable="YES"
|
|---|
| 51 | syslogd_flags="-s -N -A -c"
|
|---|
| 52 |
|
|---|
| 53 | # Remote login without DNS checking as it might not also be functionable
|
|---|
| 54 | # -u0 prevent sshd from making DNS requests unless the authentication mechanism
|
|---|
| 55 | # or configuration requires it.
|
|---|
| 56 | sshd_enable="YES"
|
|---|
| 57 | sshd_flags="-u0"
|
|---|
| 58 |
|
|---|
| 59 | # Watchdogd: avoid visits because of unit not reachable. If sshd is not running
|
|---|
| 60 | # for -t seconds than reboot. This is checked evert -s seconds.
|
|---|
| 61 | watchdogd_enable="YES"
|
|---|
| 62 | watchdogd_flags="-t 300 -s 60 -e '/etc/rc.d/sshd status'"
|
|---|
| 63 |
|
|---|
| 64 | # Monitoring deamons
|
|---|
| 65 | snmpd_enable="YES"
|
|---|
| 66 | snmpd_flags="-Ls 1"
|
|---|
| 67 |
|
|---|
| 68 | # Performance profiling
|
|---|
| 69 | iperf_enable="YES"
|
|---|
| 70 |
|
|---|
| 71 | # HTTP(S) proxy server
|
|---|
| 72 | tinyproxy_enable="NO"
|
|---|
| 73 |
|
|---|
| 74 | # Make sure generated ssh keys are saved
|
|---|
| 75 | nanobsd_save_sshkeys_enable="YES"
|
|---|
| 76 |
|
|---|
| 77 | # low-memory footprint DHCP and non-authorative recursive forwarding DNS resolver
|
|---|
| 78 | dnsmasq_enable="NO"
|
|---|
| 79 | local_unbound_enable="NO"
|
|---|
| 80 | unbound_enable="NO"
|
|---|
| 81 | unbound_anchorflags="-a /tmp/unbound.root.key"
|
|---|
| 82 |
|
|---|
| 83 | # Explicitly disable the memory-hungry alternatives
|
|---|
| 84 | dhcpd_enable="NO"
|
|---|
| 85 | dhcpd_flags="-q"
|
|---|
| 86 |
|
|---|
| 87 | # WL Captive Portal and WL Web Config Overview
|
|---|
| 88 | apache24_enable="YES"
|
|---|
| 89 | http302_enable="YES"
|
|---|
| 90 |
|
|---|
| 91 | # Hybrid setup, requires outgoing VPN Server
|
|---|
| 92 | openvpn_enable="NO"
|
|---|
| 93 | openvpn_if="tap"
|
|---|
| 94 | openvpn_configfile="/usr/local/etc/openvpn/client.conf"
|
|---|
| 95 |
|
|---|
| 96 | # Enable the firewall by default
|
|---|
| 97 | # Firewall needed for port redirection (captive portal, splash screen), use ipfw not pf
|
|---|
| 98 | firewall_enable="YES"
|
|---|
| 99 | firewall_script="/etc/ipfw.sh"
|
|---|
| 100 |
|
|---|
| 101 | # Autogenerated flags are used during runtime
|
|---|
| 102 | rc_conf_running='/etc/rc.conf.running'
|
|---|
| 103 | if [ -r $rc_conf_running ]; then
|
|---|
| 104 | . $rc_conf_running
|
|---|
| 105 | else
|
|---|
| 106 | : > $rc_conf_running
|
|---|
| 107 | fi
|
|---|
