PPPoE client+pf+nat

Polytropon freebsd at edvax.de
Tue Oct 27 14:26:53 UTC 2009

On Tue, 27 Oct 2009 06:51:26 -0700 (PDT), Dánielisz László <laszlo_danielisz at yahoo.com> wrote:
> Hello,
> I am looking to configure my FreeBSD 8.0 machine for the purpose specified in the subject.
> Let's say I have two NICs in my PC: ext_if (for wan/pppoe connection) and int_if for my LAN.
> How would you manage to get work NAT with pf using PPPoE from my ISP; I'd like to use DHCP on my LAN.

It's quite easy, I did this in the past with FreeBSD 5.

1. PPPoE
Setup /etc/ppp/ppp.conf with the correct data for your ISP.
It woule be like this:

<pppoe provider name, arbitrary>:
        set device PPPoE:<external interface>
        set authname <username for PPPoE connection>
        set authkey <password>
        set dial
        set login
        add default HISADDR

In /etc/rc.conf, enter

	ppp_profile="<pppoe provider name as in /etc/ppp/ppp.conf>"

for the external interface, and for the internal one:

	ifconfig_<internal_interface>="inet  netmask 0xffffff00"
		(or any other subnet definition you like)

Keep in mind that you have to load


per /boot/loader.conf in order to enable the Netgraph
subsystem. I think tho

2. PF
Sorry, I'm not familiar with PF, I always used IPFW. So I
had the rule

	add divert natd ip from any to any via <external interface>

prior to the other rules that formed a setting to be
described as: "Only allow those (named) ports for connections,
disallow anything else."

Install the ISC DHCP server from ports and configure the
settings for the local network as intended. THis is usually
done in /usr/local/etc/dhcpd.conf with a content like this:

	option domain-name-servers <your ISP's name servers>;
	ddns-update-style none;
	subnet netmask {
	        option routers;

You can add "host" entries for "well-known" so they always
get the same IP according to their MAC, and "deny unknown-clients;"
to force MAC knowledge.

Since I ran this setting in v5, kernel configuration required
to have

	options         DUMMYNET
	options         IPFIREWALL
	options         IPFIREWALL_VERBOSE
	options         IPDIVERT

in the file. I'm sure this is not needed anymore, because
there are modules for this. Of course, you can include the
options for NETGRAPH here, too.

IMPORTANT NOTE: I'm not using such a setting anymore, so I'm
not sure if this is still recommended or even working on v8.

Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...

More information about the freebsd-questions mailing list