This document no longer reflects my configuration, but rather than delete possibly useful information, I've made notes of my changes on a new errata page.

# Introduction

Typically there are two choices when setting up a small network: buy consumer grade commercial hardware, or find an old machine and install unix. A small wireless router and firewall from NetGear or Linksys could hardly be easier to install and has many pretty blinken lights. It isn't very flexible though, often two or more different boxes are needed, upgrading means buying another one, and some "enterprise" features are plain not available at the low end. On the other hand, a full fledged computer makes a lot of noise and has many moving parts to fail.

The solution: create a custom network device running on silent hardware designed for embedded systems. Select the best hardware and software available to create a device unparalleled by anything in the commercial marketplace.

1. Stateful packet filtering with NAT
2. High power 802.11b wireless access point
3. Routing
4. Network services (DHCP, NTP, SSH, caching DNS)
5. IPsec endpoint
6. Upgradable (802.11g, IPv6, etc)

The real selling point however is that this network device will be running a full unix operating system, which provides nearly infinite flexibility. All aspects of operation can be fine tuned, comprehensive monitoring is possible, and arbitrary programs may be installed.

# The Platform

Soekris Engineering produces an excellent line of tiny, x86 compatible, embedded computers complete with cases. So first on the list, one net4521 which has the following key specifications:

- AMD Elan SC520 486 class 133mhz CPU, 64 megs of RAM
- Two 10/100 megabit ethernet ports
- Two PCMCIA/PCCard/CardBus slots
- One Mini-PCI slot, filled with a vpn1211 hardware crypto board
- A CompactFlash card slot for permanent storage of the system software

The Soekris boards support all the free *BSD variants, Linux, and probably anything else that runs on standard PC compatible hardware. Soekris has quite a following amongst the wireless networking community, and so has a lively mailing list with volumes of information about how to get everything working.

# The Wireless Card

Next is an 802.11b wireless card. Many aren't capable of acting as an access point, and some aren't even supported under open source operating systems. Fortunately there is a wonderful chipset called Prism from Intersil that is very well supported under *BSD and Linux, and it supports an access point mode.

One of the people on the Soekris mailing list happens to have a company named NetGate, and this company just happens to ship a 802.11b PC-Card based on the Prism 2.5 chipset which puts out 200mw with excellent sensitivity ratings. Not only that but they sell kits which include:

- The card itself
- A "pigtail" which connects the card to a connector on the outside of the Soekris case
- An antenna which greatly increases the range

Great stuff!

# The Operating System

Choosing the right network operating system may be the toughest task. Linux and the *BSDs (FreeBSD, NetBSD, OpenBSD) will all run on this hardware, as will other non-free operating systems which I gave no thought to. The HostAP driver and software are what allow a Prism based 802.11b card to act as an access point. Apparently this was written for Linux but it is available on BSD too.

OpenBSD has a hard won reputation for security, stability, and everything else I am looking for. It was the natural choice, and many other people on the Soekris mailing list have discovered the same thing. There is even a project called OpenSoekris which will help set up a Soekris based system from an existing OpenBSD install.

Some of the key features of OpenBSD are:

- A great packet filter with which to make a firewall and NAT engine
- An IPsec engine
- Plus hardened services like a DNS server

# Security

Sure WEP can be cracked, so can a copper cable network, it just requires more intrusive physical access. Even more intrusive is tapping into fiberoptic cables, but that too is possible. Real security requires top strength crypto and a great solution is IPsec.

IPsec, via the ISAKMP protocol, can handle client authentication via passphrases or x.509 certificates. No need to worry about 802.1x or proprietary enhancements to WEP. IPsec is extremely strong and isn't tied to wireless networks. So, the security portion of the plan is:

1. Deny all access from the internet interface
2. Allow all local clients access to DHCP and ISAKMP
3. Deny all other unencrypted communications to wireless clients
4. Allow IPsec traffic from authenticated wireless clients
5. Allow local administration via SSH

# Sections

The project is divided into the following sections:

1. Introduction
2. OpenBSD Configuration
3. Diskless Booting
4. CompactFlash Installation

There are also client configuration how-tos:

1. Mac OS X IPSec

Next: OpenBSD Configuration >>