CryptedNets

I started writing an OpenBSD how-to regarding an all-in-one appliance solution some time ago.. (around the 3.4-RELEASE)
It started to seem really redundant, as OpenBSD is so thoroughly documented.
Is there any interest in seeing something like that?
I was thinking of something that could be used as your firewall, mail server, web server, as well as a VPN/DNS/DHCP/SSH/SFTP/FTP server.
We’ll set it up wiki-style, allowing edits.
So, any takers? Those asking questions and offering feedback will be encouraged to post…

Background
In a typical home network, a NAT device hides a number of internal devices behind a single globally addressable IP address within the network provider’s IP space. While VOIP is readily available to end consumers via the SIP protocol, SIP isn’t directly usable behind a NAT device.

Most VOIP providers utilize what is called a “media proxy”, a set of servers that exist to assist with this issue by redirecting media streams from consumers to the VOIP provider’s SIP servers. This workaround introduces two problems: The media proxies need to have ample bandwidth and low latency, but also end up disallowing more than one SIP device per customer IP address.

To allow for a home network based multi-line multi-device SIP setup, media proxy use is not possible. Instead, the home network NAT device should be configured to redirect SIP control and media streams to the appropriate IP phones within the home network. Packet filter from OpenBSD can fulfill that role. You could also run a local PBX or SIP router, but that solution adds moving parts and is beyond the scope of this note.

Phone configuration
This configuration has been tested with the Cisco 7960 phone.

Do not use NAT proxy or outbound_proxy. Define each call appearance with its distinct SIP proxy information, and the same control port of 5060/udp can be used for all. The STUN phone feature should be enabled, although some commercial SIP proxies can function without it.
pf Configuration
pf(4) uses /etc/pf.conf as its configuration file. Here is a basic subset of a ruleset that also uses ALTQ to guarantee bandwidth to the voice uplink, since upload bandwidth is usually restricted.

While packet queueing is not always necessary, the occasional voice quality degradation associated with link bandwidth being unavailable is undesirable. It is a very useful capability to have at your disposal and allows for reliable, superior to PSTN voice quality.

# Return error codes for ports that are blocked. Allows faster error recovery
set block-policy return

block in log all

Troubleshooting and verification
To verify that the implementation works as expected, a media stream should be setup from the internal network, NATted and forwarded to the external SIP gateway. Source and destination ports for control traffic (destination port 5060) and media traffic (varies) should remain unchanged by the gateway. Now, your phones should work

To verify correct packet prioritization, saturate the uplink with a large upload and attempt to use the IP phone at the same time. The IP phone traffic should get mapped to the high priority queue and voice quality should be good at the remote end. Because of ample download bandwidth, queueing is usually not needed and regular packet forwarding is sufficient.

• Check status of queues: pfctl -s queue -v
• Flush state table: pfctl -F state (queue tagging persists with state entries)
• Check firewall rule hit count: pfctl -s rules -v

Convert a certificate from PEM format (.pem) to PKCS12 format (.p12)

To use a certificate for authentication or for encryption/decryption, you have to import it into your program’s certificate manager. The program could be a web browser, email client, or even something like a hard-coded encryption/decryption routine run from a script. Different programs, browsers, and mail clients require this certificate in differing formats. At some point, you will need to convert a certificate, unles you *love* spending all of your extra cash on commercial certificates.
Here’s the openssl command to convert your certificate from a PEM format to a PKCS12 format:

$ openssl pkcs12 -export \
-out file_name.p12 \
-name "My certificate" \
-inkey ~/.ssl/userkey.pem \
-in ~/.ssl/usercert.pem

## Options Explanation ##
-out : The filename of your new certificate file in PKCS12 format.
-name : An arbitrary text name to differentiate this certificate from others.
-inkey : The path and the name of the file containing your private key
-in : The path and the name of the file containing your certificate.

Convert a certificate from PKCS12 format (.p12) to PEM format (.pem)

• To export just your private key to ~/.ssl/userkey.pem…

  $ openssl pkcs12 -nocerts -in cert.p12 -out ~/.ssl/userkey.pem

• To export only your certificate to ~/.ssl/usercert.pem…

  $ openssl pkcs12 -clcerts -nokeys -in cert.p12 -out ~/.ssl/usercert.pem

-in cert.p12 : the path and filename of your certificate in PKCS12 format.

Change the passphrase of the private key

$ openssl rsa -in ~/.ssl/userkey.pem -des3

Where ~/.ssl/userkey.pem is your private key
The openssl command will prompt for:
1. your old password
2. your new password
3. verification of your new password

The following directions are for OpenBSD and Virtual PC on the Macintosh, and assume familiarity with the installation and use of both. Note that if you have OpenBSD CDs, you may boot off the i386 CD to perform the installation. Please refer to either the OpenBSD/i386 installation documentation or the Virtual PC documentation in case of questions, as documenting the installation of either is beyond the scope of this document.

1. Grab(buy) the latest OpenBSD release. (there’s a link on the Links page)
2. Create a Virtual PC hard disk image file of the size you want your OpenBSD hard disk to be, at least a gigabyte if you want to unpack the source tree and have a usable system. However, you can get away with a hard disk as small as 300MB or so for a complete installation.
3. Change the VirtualPC partition to use a fixed file size on your local disk. You *CANNOT* use a dynamically re-sizable partition. The only drawback to this is that a 10gb partition takes up 10gb, even if most of it is empty space. OpenBSD does not like dynamically resizing partitions, and installing OpenBSD on one of these will hang while extracting base3x.tgz. (or it will hang on misc3x.tgz if it makes it through base3x.tgz)
4. Capture your OpenBSD CD or the cd38.iso image to the VirtualPC’s cdrom drive.
5. Start up the VirtualPC, and boot to the captured CD image.
6. Perform OpenBSD install as usual.
7. Shut down the virtual machine with halt… Welcome to OpenBSD: The proactively secure Unix-like operating system.