I'm using [PORT]net/zerotier[/PORT] for quite some time as a way of getting to my systems from other networks very happily. It works in airports, cafes, and all the usual hostile places we travel to.
It provides a L2 encrypted mesh (a bit like VXLAN I suppose) via a tap interface.
What I'd like to do is to use the ZT network as a VPN - routing all traffic from my FreeBSD laptop and phone through the zerotier layer out to my appointed ZT "VPN Gateway". Basically, translating the linux doc here: https://support.zerotier.com/knowledgebase.php?entry=show&search-for=full&article=ZWFhNWMyMTZjODY1ODcwNmFhZmJjYmRhN2I5MjRhOGQ_ -- into FreeBSD config. BTW https://www.zerotier.com/manual.shtml has a lot of background detail if you're interested.I can get the iphone working, but not the laptop.
What works after configuring zerotier to provide the "default route" is different on each device:
- the iphone works
- an apple imac works
- freebsd laptop drops off the network entirely, presumably some missing route settings
root@continuity:~ # ifconfig
vtnet0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
options=6c07bb<RXCSUM,TXCSUM,VLAN_MTU,VLAN_HWTAGGING,JUMBO_MTU,VLAN_HWCSUM,TSO4,TSO6,LRO,VLAN_HWTSO,LINKSTATE,RXCSUM_IPV6,TXCSUM_IPV6>
ether 82:87:41:12:8d:32
hwaddr 82:87:41:12:8d:32
inet6 fe80::8087:41ff:fe12:8d32%vtnet0 prefixlen 64 scopeid 0x1
inet6 1:2:3:4::51db:d001 prefixlen 64
inet 1.2.3.4 netmask 0xfffff000 broadcast 1.2.3.255
inet 10.19.0.5 netmask 0xffff0000 broadcast 10.19.255.255
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet 10Gbase-T <full-duplex>
status: active
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> metric 0 mtu 16384
options=600003<RXCSUM,TXCSUM,RXCSUM_IPV6,TXCSUM_IPV6>
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
inet 127.0.0.1 netmask 0xff000000
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
groups: lo
zt1flo98dm17np8: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 5000 mtu 2800
options=80000<LINKSTATE>
ether 2a:33:91:24:38:8e
hwaddr 00:bd:07:f6:f6:09
inet6 fe80::2bd:7ff:fef6:f609%zt1flo98dm17np8 prefixlen 64 scopeid 0x4
inet6 fc7b:c4d6:6bec:8248:7b87::1 prefixlen 40
inet 10.144.0.1 netmask 0xffff0000 broadcast 10.144.255.255
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
media: Ethernet autoselect
status: active
groups: tap
Opened by PID 661
# /etc/pf.conf
# macros
protocols = "{ tcp, udp, icmp }"
# interfaces
extl_if = "vtnet0"
intl_if = "lo0"
zero_if = "zt1flo98dm17np8"
# networks
intl_net = $intl_if:network
internet = $extl_if:network
zero_net = $zero_if:network
# limits
set limit { states 80000, frags 20000, src-nodes 20000 }
set timeout { adaptive.start 60000, adaptive.end 78000 }
# clean packets are happy packets
scrub in all
# jails are allowed outbound connections but not inbound
nat on !$zero_if inet from $zero_net to any -> ($extl_if)
nat on !$zero_if inet6 from $zero_net to any -> ($extl_if)
# o ye of little faith
pass in all
pass out all
root@akai /u/h/dch# route -n show 10.144.0.0/16
route to: 10.144.0.0
destination: 10.144.0.0
mask: 255.255.0.0
fib: 0
interface: zt1flo98dm17np8
flags: <UP,DONE,PINNED>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 2800 1 0
root@akai /u/h/dch# route -n show default
route to: 0.0.0.0
destination: 0.0.0.0
mask: 0.0.0.0
gateway: 172.16.2.1
fib: 0
interface: wlan0
flags: <UP,GATEWAY,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 1500 1 0
root@akai /u/h/dch#
root@akai /u/h/dch# zerotier-cli set 17d709436c13df28 allowDefault=1
{
"allowDefault": true,
"allowGlobal": false,
"allowManaged": true,
"assignedAddresses": [
"fc7b:c4d6:6b9b:bbdb:fdd2:0000:0000:0001/40",
"10.144.49.109/16"
],
"bridge": false,
"broadcastEnabled": true,
"dhcp": false,
"id": "17d709436c13df28",
"mac": "2a:44:a8:b7:be:db",
"mtu": 2800,
"name": "skunkwerks",
"netconfRevision": 8,
"nwid": "17d709436c13df28",
"portDeviceName": "zt1flo98dm17np8",
"portError": 0,
"routes": [
{
"flags": 0,
"metric": 0,
"target": "0.0.0.0/0",
"via": "10.144.0.1"
},
{
"flags": 0,
"metric": 0,
"target": "10.144.0.0/16",
"via": null
}
],
"status": "OK",
"type": "PRIVATE"
root@akai /u/h/dch# route -n show default
route to: 0.0.0.0
destination: 0.0.0.0
mask: 0.0.0.0
gateway: 172.16.2.1
fib: 0
interface: wlan0
flags: <UP,GATEWAY,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 1500 1 0
root@akai /u/h/dch# route -n show 10.144.0.0/16
route to: 10.144.0.0
destination: 10.144.0.0
mask: 255.255.0.0
fib: 0
interface: zt1flo98dm17np8
flags: <UP,DONE,PINNED>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 2800 1 0
root@akai /u/h/dch# route -n show 8.8.8.8
route to: 8.8.8.8
destination: 0.0.0.0
mask: 128.0.0.0
gateway: 10.144.0.1
fib: 0
interface: zt1flo98dm17np8
flags: <UP,GATEWAY,DONE,STATIC>
recvpipe sendpipe ssthresh rtt,msec mtu weight expire
0 0 0 0 2800 1 0
root@akai /u/h/dch# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
ping: sendto: No route to host
ping: sendto: No route to host
^C
--- 8.8.8.8 ping statistics ---
2 packets transmitted, 0 packets received, 100.0% packet loss
root@akai /u/h/dch# curl http://8.8.8.8/
curl: (7) Couldn't connect to server
root@continuity:~ # ngrep -tixd zt1flo98dm17np8 ifconfig.io
interface: zt1flo98dm17np8 (10.144.0.0/255.255.0.0)
match: ifconfig.io
########################
U 2017/09/08 10:33:31.510220 10.144.196.52:49721 -> 8.8.8.8:53
8e 7c 01 00 00 01 00 00 00 00 00 00 08 69 66 63 .|...........ifc
6f 6e 66 69 67 02 69 6f 00 00 1c 00 01 onfig.io.....
#
U 2017/09/08 10:33:31.511119 10.144.196.52:59756 -> 8.8.8.8:53
ea 69 01 00 00 01 00 00 00 00 00 00 08 69 66 63 .i...........ifc
6f 6e 66 69 67 02 69 6f 00 00 01 00 01 onfig.io.....
#
How to config NAT using ipfw??