Vedetta
OpenBSD Router Boilerplate
Install / Use
/learn @vedetta-com/VedettaREADME
vedetta (alpha)
OpenBSD Router Boilerplate
About
an opinionated, best practice, vanilla OpenBSD base configuration for bare-metal, or cloud routers
What would an OpenBSD router configured using examples from the OpenBSD FAQ and Manual pages look like?
Features
Share what you've got, keep what you need:
- acme-client - Automatic Certificate Management Environment (ACME) client
- Configure:
- Usage:
pfctl-f /etc/pf.confacme-client-vAD freedns.afraid.orgocspcheck-vNo /etc/ssl/acme/freedns.afraid.org.ocsp.resp.der /etc/ssl/acme/freedns.afraid.org.fullchain.pem
- authpf - authenticating gateway user shell
- Configure:
- Usage:
- autoinstall - unattended OpenBSD installation and upgrade (pxeboot and mirror example)
- Configure:
etc/dhcpd.confetc/httpd.confetc/pf.conftftpbootvar/www/htdocs/boot.vedetta.lanmount host:/path/name /var/www/pub
- Usage:
mkdir -p /tftpboot/etccd /tftpboot && ftp https://ftp.openbsd.org/pub/OpenBSD/snapshots/amd64/bsd.rdcp /usr/mdec/pxeboot /tftpboot/chmod 555 -R /tftpbootcd /tftpboot && ln -s pxeboot auto_installecho "boot bsd.rd" > /tftpboot/etc/boot.conf && chmod 444 /tftpboot/etc/boot.confpfctl-f /etc/pf.confrcctlset tftpd flags -l boot.vedetta.lan -v /tftpbootrcctlset tftpproxy flags -vrcctlrestart dhcpd httpdtftpdtftpproxy
- Configure:
- dhclient - Dynamic Host Configuration Protocol (DHCP) client
- Configure:
- Usage:
- dhcpd - Dynamic Host Configuration Protocol (DHCP) server
- Configure:
- Usage:
- (optional) wide-dhcpv6 - client and server for the WIDE DHCPv6 protocol
- Configure:
etc/dhcp6s.confetc/dhcp6c.confetc/pf.confetc/rc.d/dhcp6cetc/rc.d/dhcp6setc/rad.conf
- Usage:
- Configure:
- ftp-proxy - Internet File Transfer Protocol proxy daemon
- Configure:
- Usage:
- hostname.if - interface-specific configuration files with Dual IP stack implementation
- hotplugd - devices hot plugging monitor daemon
- Configure:
etc/hotplug/attachetc/hotplug/detachchmod 750 /etc/hotplug/{attach,detach}
- Usage:
- Configure:
- httpd - HTTP daemon as primary, fallback, and autoinstall
- Configure:
- Usage:
- ifstated - Interface State daemon to reconnect, update IP, and log
- Configure:
- Usage:
- IKEv2 VPN (IPv4 and IPv6)
- Configure:
etc/ikedetc/iked.confetc/iked-vedetta.confetc/ipsec.confetc/pf.confetc/ssl/ikeca.cnfetc/ssl/vedetta
- Usage:
ikectlca vedetta createikectlca vedetta installikectlca vedetta certificate freedns.afraid.org createikectlca vedetta certificate freedns.afraid.org installikectlca vedetta certificate mobile.vedetta.lan createcd /etc/iked/exportikectlca vedetta certificate mobile.vedetta.lan exporttar -C /etc/iked/export -xzpf mobile.vedetta.lan.tgzikectlca vedetta certificate mobile.vedetta.lan revokeikectlca vedetta key mobile.vedetta.lan deletepfctl-f /etc/pf.confrcctlenable ipsecrcctlset iked flags -6rcctlstart iked
- Configure:
- IKEv1 VPN (IPv4)
- Configure:
etc/isakmpdetc/ipsec.confetc/ipsec-vedetta.confetc/npppdetc/pf.confetc/ssl/ikeca.cnfetc/ssl/vedetta
- Usage:
ikectlca vedetta createikectlca vedetta install /etc/isakmpdikectlca vedetta certificate freedns.afraid.org createikectlca vedetta certificate freedns.afraid.org install /etc/isakmpdikectlca vedetta certificate mobile.vedetta.lan createcd /etc/isakmpd/exportikectlca vedetta certificate mobile.vedetta.lan exporttar -C /etc/isakmpd/export -xzpf mobile.vedetta.lan.tgzikectlca vedetta certificate mobile.vedetta.lan revokeikectlca vedetta key mobile.vedetta.lan deletepfctl-f /etc/pf.conf- [
rcctl](https
- Configure:
