IPSec VPNs with pfsense

I've been trying forever to get a mobile IPSec connection up between my OS X laptop and pfsense.   Finally, thanks to this outstanding blog post, it works.  I'm especially excited that it works with the default OS X and Android VPN clients.

My pfsense config closely mirrors the one specified by Mike Murray

pfsense

Phase 1

Key Exchange version: Auto
Internet Protocol: V4
Interface: <my ISP>

Authentication Method: Mutual PSK + Xauth
Negotiation Mode: Aggressive
My identifier: My IP Address
Peer identifier Distinguished Name: <my vpn name>
Pre-Shared Key: <my key>

Encryption Algorithm: AES 256
Hash Algorithm: SHA1
DH Group: 2
Lifetime (Seconds): 28800

Disable rekey: unchecked
Responder Only: checked
NAT Traversal: Forced
Dead Peer Detection: checked
Delay: 10
Max failures: 5

Phase 2

Mode Tunnel: IPv4
Local Network Network: 0.0.0.0/0
NAT/BINAT translation: None

Protocol: ESP
Encryption Algorithms: AES Auto
Hash Algorithms: SHA1
PFS key: group off
Lifetime: 3600

Mobile Cilents

IKE Extensions: checked
User Authentication: Local Database
Group Authentication: system

Virtual Address Pool: checked.  192.168.76.0 / 27

Virtual IPv6 Address Pool: unchecked
Network List: unchecked
Save Xauth Password checked
DNS Default Domain: checked  khubla.local

Split DNS unchecked
DNS Servers checked
192.168.75.1
8.8.8.8.

WINS Servers: unchecked
Phase2 PFS Group: unchecked
Login Banner unchecked

OS X

Add VPN and choose VPN Type "Cisco IPSEC".  Use the Group Name specified in Phase 1 "Peer identifier Distinguished Name"

Android

Add VPN and choose "IPSec VPN with pre-shared keys and XAuth authentication".     Use the IPSEC Identifier specified in Phase 1 "Peer identifier Distinguished Name"

Configuring the FreeBSD automounter

I have a number of disks in my FreeBSD box which exist only as backups of data.  I prefer that they not be mounted all the time, but instead mounted on use.  They are 2x internal SATA disks and an external USB3 disk.   This blog post explains how they are set up to auto-mount.

Firstly, my /etc/fstab entry for these disks looks like this:

/dev/ada5p1     /mnt/backup1    ufs     rw,noauto,noexec,nosuid,late            0       0
/dev/ada6p1     /mnt/backup2    ufs     rw,noauto,noexec,nosuid,late            0       0
/dev/da0p1      /mnt/usb1       ufs     rw,noauto,noexec,nosuid,late            0       0

All three disks are ufs, and noauto.

Next, my /etc/amd.conf

[ global ]
restart_mounts =   yes
unmount_on_exit=  yes

and my amd.map

# $FreeBSD: releng/10.3/etc/amd.map 164015 2006-11-06 01:42:11Z obrien $
#
*               opts:=rw,grpid,resvport,vers=3,proto=tcp,nosuid,nodev
localhost            type:=auto;fs:=${map};pref:=${key}/
localhost/backup1      type:=program;fs:=/mnt/backup1;\
                        mount:="/sbin/mount mount /mnt/backup1";\
                        unmount:="/sbin/umount umount /mnt/backup1"
localhost/backup2      type:=program;fs:=/mnt/backup2;\
                        mount:="/sbin/mount mount /mnt/backup2";\
                        unmount:="/sbin/umount umount /mnt/backup2"
localhost/usb1      type:=program;fs:=/mnt/usb1;\
                        mount:="/sbin/mount mount /mnt/usb1";\
                        unmount:="/sbin/umount umount /mnt/usb1"

In /etc/rc.conf, we need to start amd, and the portmapper:

portmap_enable="YES"
portmap_flags="-h 127.0.0.1"
amd_enable="YES"
amd_flags="-a /.amd_mnt -l /var/log/amd /host /etc/amd.map"

Print-to-Folder on FreeBSD

Some printers, like the one I have (HP 8600 Pro), have "Print-to-Folder" capability.   Unfortunately, I have no Windows server, only a FreeBSD box to print to.  I can mount folders from the FreeBSD box on my MacBook.. if I can get files to scan there.   So, to do that, I need a Samba on my FreeBSD box.  To install SMB on FreeBSD:

pkg install samba36

Then, I need a smb.conf in /usr/local/etc, that exports a folder, like this:

[global]

workgroup = khubla.local
server string = Samba Server
security = user

hosts allow = 192.168.77.
max log size = 50

passdb backend = smbpasswd

domain master = yes

; wins support = yes

[public]
 comment = Public
 path = /tank/home/public/public/
 public = yes
 writable = yes
 printable = no

So, this will expose a SMB share at smb://bernice/public.  Next I need a user account.  Firstly, a FreeBSD account:

pw useradd -n hpprinter -s /bin/csh -m
passwd hpprinter

Then the samba account

smbpasswd -a hpprinter

Finally, start samba

service samba onestart

 I can now configure the share in the printer.  The UNC path is:

\\bernice.khubla.local\public

Outlook for Mac Archives

I recently had a reason to parse a large data set, for another project.  I decided that an ideal "large data set" would be my Outlook mail saved archives.  Sadly, Outlook for Mac doesn't output PST files, it outputs OLM archives, which are, essentially, giant zip files full of XML.  I was coding this all in Java, so I needed a Java library to parse OLM files.

The resulting source code is here.  Schema for OLM XML is here.

 

 

AGC Grammar

Every IT geek is, to some degree, fascinated with the Apollo program which put a human on the moon for the first time.  Naturally, there is also curiosity about the computers on the Apollo moon lander, and the software that ran on them.  The source code that went to the moon is available now, and you can take a look at it here.

I'm interested in the Apollo program, but I'm also interested in formal grammars, and a committer to the Antlr project.  So, I spent some time building an Antlr4 grammar for the Apollo source code.  You can take a look at it here.  The grammar can parse a number of files from the Solarium55 source code, which is the source code that flew Apollo4.  If you're keen you could try it on the Apollo13 source code, called Artemis072, but you'd have to key in the source from jpg images of the form-feed printouts (here).

It's natural to ask why a Antlr4 grammar for AGC source code would be useful.  In addition to the obvious "because that goal will serve to organize and measure the best of our energies and skills", it's the first step in building a simulator.  There is already an excellent C simulator here, and there are numerous JS ones on the web, but I thought it might be helpful to have an Antlr4 grammar that can output parser-lexers for new simulators in other languages.  Also, it was very interesting to learn about the AGC computer and to see how software development has progressed since the 1960's.

 

 

A simple modelling language

Recently I had reason to get interested in process modelling.  Ultimately I ended up writing an Antlr4 grammar for Modelica (here), but in the mean time I came up with SML (Simple Modeling Language).  The Antlr4 grammar is sml.g4.

The characteristics I wanted in my own modeling languages were:

  • Ability to define models as text files
  • Models should be as Object Oriented as possible
  • Ability to compose models.  That is; ability to have models that include models.
  • Ability to define variables that are internal to models and variables that are exposed by models (i.e. "ports")
  • Ability to put models in namespaces
  • Ability to define equations in models that related the variables.  The equations should be expressed in standard form.
  • Support for differential equations is essential

SML accomplishes these goals.  An example SML model is a standard spring from 1st year Engineering, here.  The model file is:

model tge.spring;
#
# vars
# 
variables:
    # spring constant
    public k;
    # force difference
    public df;
    # distance difference
    public x;
#
# Equations
#
equations:
	df:= k*x;

This model is in the namespace "tge.string".  It exposes three public variables "k", "df" and "x".  The relationship b/t the variables is "df=k*x".  There is a simple example, of a standard pendulum here.

More complex examples are here.  One such example is a classic RC circuit.  This model defines the structure of the circuit itself, and references the resistor, capacitor and source via includes of those models from their own SML model files

model tge.rc1;
#
# A simple RC model 
#
#
#      ------- R1 ---- C2 --
#      |                   |
#      V                   |
#      |-------------------|
#
#
imports:
	tge.resistor;
	tge.capacitor;
	tge.vsource;
variables:
	# declare a resistor instance called "R1"
	component tge.resistor R1;
	# declare a capacitor instance called "C1"
	component tge.capacitor C1;
	# declare a vsource instance called "V"
	component tge.vsource V;
equations:
	# set dV of tge.vsource to 5V
	voltage:=D.dV-5;
	# set R of tge.resistor to 10 ohms
	resistance:=R1.R-10;
	# set C of tge.capacitor to 100 F
	resistance:=C1.C-100;
	# connect the +ve end of V to R1
	positiveConnection:= V.v1-R1.v1;
        # connect the resistor to the capacitor
        resistors:=R1.v2-C1.v1;
	# connect the -ve end of V
	groundConnection:= V.v2-R2.v2;

Ultimately, with Antlr4 it should be possible to generate model parsers in Java, C# and potentially C++, that can consume SML files, ensure that the model composition is reasonable, and generate input files for mathematical solvers.  The work of producing solver input files from SML models is essentially the work of collapsing an object tree to a flat model.

 

pdp-7 Unix

Unix version 0 was written in 1963 by Ken Thompson, on a PDP-7.  Recently, the source code code Unix V0 has been discovered, and you can read it here, as pdf scans of printouts.  You can read about the discovery, and the effort to boot Unix V0 on a real PDP-7 here.  The project home page is here.

I got interested in PDP-7 unix, and then in PDP-7 assembler.  Eventually, I wrote an Antlr4 grammar to parse PDP-7 assembler files in the original as format that Thompson wrote them here.  The resulting grammar is here.