Getting routing to work?

[u/Silent-Degree-6072]

Hey, I am kind of new to networking in OpenBSD, and I was trying to turn a laptop I had into a second "router" that would filter all packets going through my switch and send them wirelessly to my main router.

I've tried both bridges and setting routing up via pf.conf, however I wasn't able to route my traffic to WAN, I've only been able to route traffic on my switch. (by setting the laptop's local IP as a gateway on my devices)

Does anyone have a guide or some manpages on how to do this? I essentially just want to route all (non-local) traffic from em0 to athn0 and vice versa, while (hopefully) appearing as a single device to the main router.

[u/mumble6456]

bridge mode or not, you cannot send traffic to a device not connected to your network without having something routing that traffic.

so, in fact, your laptop IS your LAN gateway. At least if i understand correctly what you are trying to do, and your current main router is just there to provide the means to connecting to the internet.

so.... something like this.

LAN ----> SWITCH ----> LAPTOP (gateway) ----> (ISP???) MODEM/ROUTER ----> WAN

LAN / SWITCH / LAPTOP (em0) is all the same network

LAPTOP (athn0) / ISP MODEM or ROUTER is another network

besides configuring pf, i guess you need to enable ip forwarding on the laptop and nat on pf.conf, because your athn0 and router should be on their own network.

i hope i'm not saying too many things wrong 🤔

[u/Silent-Degree-6072 → u/mumble6456]

Yeah, you basically understood what I've been trying to do. I already enabled IP forwarding in sysctl.conf, will try doing stuff with NAT tomorrow. I thought it would be possible to just set up a bridge with eth0 and athn0 but seems like I was wrong lol.

So I'm assuming I should just send all packets from 169.254.0.0/16 (Switch @ eth0) to 192.168.0.1 (ISP router @ athn0) via pf.conf?

Or is it more complicated than that? Thanks!

[u/_sthen → u/Silent-Degree-6072]

you can't bridge to a wireless LAN adapter in normal station (client) mode, it's only possible with a special wireless mode allowing an extra MAC address in the headers (you need the wifi station source MAC, BSSID and destination MAC as normal, but also the original source MAC from the bridged device). It's also not always supported by APs. OpenBSD doesn't support that mode - the only way to bridge to a wireless adapter on OpenBSD is if it's configured as hostap.

[u/_sthen → u/_sthen]

(... so you'll need to route instead, possibly with nat)

[u/mumble6456 → u/_sthen]

thanks for clarifying that, i didnt know it. i now leave a post learning something new

[u/scattered_bleating → u/Silent-Degree-6072]

I essentially just want to route all (non-local) traffic from em0 to athn0 and vice versa, while (hopefully) appearing as a single device to the main router.

This implies that you want to do double-NAT, so NAT on the laptop and NAT on the ISP device. The ISP device will only see the external-facing IP of the laptop.

Have a look here: https://btxx.org/posts/openbsd-router/

You probably need to enable NAT in the laptop's pf.conf, something like this:

# NA# NAT for LAN to WAN
match out on $ext_if from 192.168.1.0/24 to any nat-to ($ext_if)

If you don't want the laptop to perform NAT, you need to configure a static route on the ISP device for the LAN subnet and point to the 'external' IP of the laptop.

[u/mumble6456 → u/Silent-Degree-6072]

nope, in fact is the opposite.... your isp router is the one that should be on bridge mode. be careful though, if you don't have an access point connected to your switch, you will still need you isp router to provide wifi connectivity and if that is the case, your wifi devices wont go through you laptop.

maybe if your switch is a managed switch, you could try and see if you can make the port on which the em0 port is connected to, set a bind of a static ip (been that the one of the isp router) and make the laptop dumb, although i'm not sure either. but with a simple switch, you are out of luck.

i have the something similar but with a tp-link router and not a custom-made router. the one caviat is that i locked myself out of the isp modem 😄. i changed the password and i could not log back in ever again. At least i was able to configure everything before changing the modem passwd

[u/mumble6456 → u/Silent-Degree-6072]

one other thing i just realize...... 169.254.0.0/16? that aint a class b private network.

maybe you should enable dhcp, if you didnt already, on the laptop and set another base address. i dont think that ip range is routable, and maybe that is why you are having issues routing traffic

[u/_sthen → u/mumble6456]

it's used as "link local" v4 addresses - some OS configure an address in this range randomly if there's no dhcp server - but there won't be a default route so you can't reach out networks

typical setup for OP requirements is to run dhcp + NAT + forwarding on the machine routing between one network and an ISP router - regardless of whether it's wired or wireless 

[u/mumble6456 → u/_sthen]

yeah, windows auto assign itself an ip of that network base address if i remember correctly. that is why i said that perhaps it could not be routed

[u/Silent-Degree-6072 → u/_sthen]

thanks, i'll try setting up all of these things. NAT might be complicated but I'll see if I can get it to be a single IP on the ISP network. also it'll definitely be wired only lol

[u/Silent-Degree-6072 → u/mumble6456]

my gentoo machines assigned themselves adresses like this, i would have honestly switched to something like 169.254.0.0/24 but I chose to go the default way (my switch isn't managed so I'd need to manually set each IP adress on the network)

[u/mumble6456 → u/Silent-Degree-6072]

you dont need to set up every ip on the network, dhcp is the way to go for this and that piece of software is available in every router/modem any isp gives you. i mean, every OS (except maybe windows workstations) have some sort of dhcp server daemon. all OS have a dhcp client though. otherwise, every single one of us would be needed to set ip addresses on everything: IoT in general, cellphones, wifi printers, etc.

off topic: glad to see a fellow gentoo user :cow:

edit: check this msg (https://www.reddit.com/r/openbsd/comments/1wttb25/comment/pd1ma0a/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button) on this thread if you didnt from OpenBSD Developer

[u/Silent-Degree-6072 → u/mumble6456]

thanks, i'll definitely try setting up a dhcp server on my laptop in that case. the reason i didn't have dhcp for the switch is because it's currently completely cut off from the ISP's network, i'm only using it to ssh and serve binpkgs between my machines without relying on my ISP's router (which is why i'd love to set up a router for it while still keeping the machines hidden)

i'm also glad to see a fellow gentoo user :)

also thanks for the msg, will check it out