> I realize this will not help you with your specific problem, but I could
> not get wide-dhcp to work at all (sigh...).
> I installed isc-dhcp (/usr/ports/net/ (I think;-)) and it works great. The
> only problem is that you have to compile the Berkley Packet Filter option
> into your kernel. Checkout bpf in /usr/src/sys/i386/conf/LINT if you have
> need to know how to install bpf. Or send me an email and I will try to
> assist. Other info. can be found at http://www.isc.org. Good Luck!
Congratulations!
I've looked at the "other info" and it seemed a bit brief. I've
inherited a mixed environment (Windows desktops, a Novell LAN, a Web
server on a DEC Alpha running an antique version of DEC Unix, a new
Alpha-based system running Redhat 5.1 and a FreeBSD machine running
2.2-Stable.)
I've been given the task of building a firewall. Ours went away when the
Ascend Pipeline (ISDN) which included software firewall was replaced
with a DSL modem -- which doesn't include anything.
The Web server hosts about half a dozen "sites" and the various servers
require static IP addresses (we run our own DNS). When I enabled
IPFORWARD and IPFIREWALL I broke DHCP. The topology isn't quite clear
because some of the wiring disappears under partitions (arrghhh!!! I did
get both NICs installed and recognized by the system at boot -- an ISA
SMC and PCI 3Com.) I'm not even sure what DHCP server is running in
FreeBSD (but the BPF kernel change has been made along with the
necessary entries in /dev/ )
Anyone who can offer any insights into untangling the mess and making it
ALL work would be a hero to me. I am not confident that my bumbling
about is really productive. I've been trying to integrate it into the
existing strurcture. I'm thinking that the "easiest" solution is to put
together another FreeBSD box just to run the Firewall, but -- having the
current machine positioned topologically between the DSL modem/router
the rest of our network -- and acting as NS1/mailserver/firewall --
seems like the more elegant solution.
I need to enable DHCP with the firewall (natd) and a reserved block of
IP addresses. I expect that leasing non-routable IP numbers would be the
best way to go -- and it preserves our genuine IP numbers for necessary
assignation.
Thanks in advance,
Craig Burgess
APOLOGY to those who don't like munged return addresses, but I don't
like spam. Remove "_nospam" to reply by E-mail to: