I just found out that my ppp link via my T-Mobile
phone doesn't work. Of course I found this out while
being outside without any other net connection.
I haven't changed anything other than compiling
stuff. This is a -current system on a Thinkpad W500
compiled on June 26th. This has worked for years.
What happens is that upon firing ppp up manually
I get the message "Working in interactive mode" which
I have never gotten before. So far I haven't been able
to do anything with it other than a ^C. I tried an
identical phone with my SIM; same results.
Any ideas?
Thanks, STeve Andre'
Dmesg, copy of ppp.conf and usbdevs output below.
[dmesg]
OpenBSD 4.6-beta (GENERIC.MP) #22: Fri Jun 26 11:05:25 EDT 2009
r...@paladin.pls.msu.edu:/usr/src/sys/arch/i386/compile/GENERIC.MP
cpu0: Intel(R) Core(TM)2 Duo CPU T9600 @ 2.80GHz ("GenuineIntel" 686-class)
2.80 GHz
cpu0:
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,SSE3,MWAIT,DS-CPL,VMX,SMX,EST,TM2,CX16,xTPR
real mem = 2123657216 (2025MB)
avail mem = 2044616704 (1949MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 09/24/08, BIOS32 rev. 0 @ 0xfdc80,
SMBIOS rev. 2.4 @ 0xe0010 (74 entries)
bios0: vendor LENOVO version "6FET46WW (1.16 )" date 09/24/2008
bios0: LENOVO 4061CTO
acpi0 at bios0: rev 2
acpi0: tables DSDT FACP SSDT ECDT APIC MCFG HPET SLIC BOOT ASF! SSDT SSDT SSDT
SSDT
acpi0: wakeup devices LID_(S3) SLPB(S3) UART(S3) IGBE(S4) EXP0(S4) EXP1(S4)
EXP2(S4) EXP3(S4) EXP4(S4) PCI1(S4) USB0(S3) USB1(S3) USB2(S3) USB3(S3) USB4
(S3) USB5(S3) EHC0(S3) EHC1(S3) HDEF(S4)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee00000: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: apic clock running at 266MHz
cpu1 at mainbus0: apid 1 (application processor)
cpu1: Intel(R) Core(TM)2 Duo CPU T9600 @ 2.80GHz ("GenuineIntel" 686-class)
2.80 GHz
cpu1:
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,SSE3,MWAIT,DS-CPL,VMX,SMX,EST,TM2,CX16,xTPR
ioapic0 at mainbus0: apid 1 pa 0xfec00000, version 20, 24 pins
ioapic0: misconfigured as apic 2, remapped to apid 1
acpihpet0 at acpi0: 14318179 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 1 (AGP_)
acpiprt2 at acpi0: bus 2 (EXP0)
acpiprt3 at acpi0: bus 3 (EXP1)
acpiprt4 at acpi0: bus -1 (EXP2)
acpiprt5 at acpi0: bus 5 (EXP3)
acpiprt6 at acpi0: bus 13 (EXP4)
acpiprt7 at acpi0: bus 21 (PCI1)
acpiec0 at acpi0
acpicpu0 at acpi0: C3, C2, C1, PSS
acpicpu1 at acpi0: C3, C2, C1, PSS
acpipwrres0 at acpi0: PUBS
acpitz0 at acpi0: critical temperature 127 degC
acpitz1 at acpi0: critical temperature 100 degC
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
acpibat0 at acpi0: BAT0 model "42T4619" serial 30781 type LION oem "SANYO"
acpibat1 at acpi0: BAT1 not present
acpiac0 at acpi0: AC unit online
acpithinkpad0 at acpi0
acpidock0 at acpi0: GDCK not docked (0)
bios0: ROM list: 0xc0000/0xfc00 0xd0000/0x1000 0xd1000/0x1000 0xd2000/0x1000
0xde000/0x1800! 0xe0000/0x10000
cpu0: Enhanced SpeedStep 2794 MHz: speeds: 2801, 2800, 2133, 1600, 800 MHz
pci0 at mainbus0 bus 0: configuration mode 1 (bios)
pchb0 at pci0 dev 0 function 0 "Intel GM45 Host" rev 0x07
ppb0 at pci0 dev 1 function 0 "Intel GM45 PCIE" rev 0x07: apic 1 int 16 (irq
11)
pci1 at ppb0 bus 1
vga1 at pci1 dev 0 function 0 "ATI Mobility Radeon HD 3650" rev 0x00
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
"Intel GM45 HECI" rev 0x07 at pci0 dev 3 function 0 not configured
pciide0 at pci0 dev 3 function 2 "Intel GM45 PT IDER" rev 0x07: DMA
(unsupported), channel 0 wired to native-PCI, channel 1 wired to native-PCI
pciide0: using apic 1 int 18 (irq 11) for native-PCI interrupt
pciide0: channel 0 ignored (not responding; disabled or no drives?)
pciide0: channel 1 ignored (not responding; disabled or no drives?)
"Intel GM45 AMT SOL" rev 0x07 at pci0 dev 3 function 3 not configured
em0 at pci0 dev 25 function 0 "Intel ICH9 IGP M AMT" rev 0x03: apic 1 int 20
(irq 11), address 00:1c:25:99:d7:77
uhci0 at pci0 dev 26 function 0 "Intel 82801I USB" rev 0x03: apic 1 int 20
(irq 11)
uhci1 at pci0 dev 26 function 1 "Intel 82801I USB" rev 0x03: apic 1 int 21
(irq 11)
uhci2 at pci0 dev 26 function 2 "Intel 82801I USB" rev 0x03: apic 1 int 22
(irq 11)
ehci0 at pci0 dev 26 function 7 "Intel 82801I USB" rev 0x03: apic 1 int 23
(irq 11)
usb0 at ehci0: USB revision 2.0
uhub0 at usb0 "Intel EHCI root hub" rev 2.00/1.00 addr 1
azalia0 at pci0 dev 27 function 0 "Intel 82801I HD Audio" rev 0x03: apic 1 int
17 (irq 11)
azalia0: RIRB time out
azalia0: codecs: Conexant CX20561, Conexant/0x2c06, using Conexant CX20561
audio0 at azalia0
ppb1 at pci0 dev 28 function 0 "Intel 82801I PCIE" rev 0x03: apic 1 int 20
(irq 11)
pci2 at ppb1 bus 2
ppb2 at pci0 dev 28 function 1 "Intel 82801I PCIE" rev 0x03: apic 1 int 21
(irq 11)
pci3 at ppb2 bus 3
iwn0 at pci3 dev 0 function 0 "Intel WiFi Link 5300" rev 0x00: apic 1 int 17
(irq 11), MIMO 3T3R, MoW, address 00:21:6a:01:d0:b6
ppb3 at pci0 dev 28 function 3 "Intel 82801I PCIE" rev 0x03: apic 1 int 23
(irq 11)
pci4 at ppb3 bus 5
ppb4 at pci0 dev 28 function 4 "Intel 82801I PCIE" rev 0x03: apic 1 int 20
(irq 11)
pci5 at ppb4 bus 13
uhci3 at pci0 dev 29 function 0 "Intel 82801I USB" rev 0x03: apic 1 int 16
(irq 11)
uhci4 at pci0 dev 29 function 1 "Intel 82801I USB" rev 0x03: apic 1 int 17
(irq 11)
uhci5 at pci0 dev 29 function 2 "Intel 82801I USB" rev 0x03: apic 1 int 18
(irq 11)
ehci1 at pci0 dev 29 function 7 "Intel 82801I USB" rev 0x03: apic 1 int 19
(irq 11)
usb1 at ehci1: USB revision 2.0
uhub1 at usb1 "Intel EHCI root hub" rev 2.00/1.00 addr 1
ppb5 at pci0 dev 30 function 0 "Intel 82801BAM Hub-to-PCI" rev 0x93
pci6 at ppb5 bus 21
cbb0 at pci6 dev 0 function 0 "Ricoh 5C476 CardBus" rev 0xba: apic 1 int 16
(irq 11)
"Ricoh 5C832 Firewire" rev 0x04 at pci6 dev 0 function 1 not configured
sdhc0 at pci6 dev 0 function 2 "Ricoh 5C822 SD/MMC" rev 0x21: apic 1 int 18
(irq 11)
sdmmc0 at sdhc0
"Ricoh 5C843 MMC" rev 0x11 at pci6 dev 0 function 3 not configured
"Ricoh 5C592 Memory Stick" rev 0x11 at pci6 dev 0 function 4 not configured
"Ricoh 5C852 xD" rev 0x11 at pci6 dev 0 function 5 not configured
cardslot0 at cbb0 slot 0 flags 0
cardbus0 at cardslot0: bus 22 device 0 cacheline 0x0, lattimer 0xb0
pcmcia0 at cardslot0
pcib0 at pci0 dev 31 function 0 "Intel 82801IEM LPC" rev 0x03
ahci0 at pci0 dev 31 function 2 "Intel 82801I AHCI" rev 0x03: apic 1 int 16
(irq 11), AHCI 1.2
scsibus0 at ahci0: 32 targets
sd0 at scsibus0 targ 0 lun 0: <ATA, WDC WD3200BEKT-2, 11.0> SCSI3 0/direct
fixed
sd0: 305245MB, 512 bytes/sec, 625142448 sec total
sd1 at scsibus0 targ 1 lun 0: <ATA, ST9500325AS, 0001> SCSI3 0/direct fixed
sd1: 476940MB, 512 bytes/sec, 976773168 sec total
ichiic0 at pci0 dev 31 function 3 "Intel 82801I SMBus" rev 0x03: apic 1 int 23
(irq 11)
iic0 at ichiic0
usb2 at uhci0: USB revision 1.0
uhub2 at usb2 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb3 at uhci1: USB revision 1.0
uhub3 at usb3 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb4 at uhci2: USB revision 1.0
uhub4 at usb4 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb5 at uhci3: USB revision 1.0
uhub5 at usb5 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb6 at uhci4: USB revision 1.0
uhub6 at usb6 "Intel UHCI root hub" rev 1.00/1.00 addr 1
usb7 at uhci5: USB revision 1.0
uhub7 at usb7 "Intel UHCI root hub" rev 1.00/1.00 addr 1
isa0 at pcib0
isadma0 at isa0
pckbc0 at isa0 port 0x60/5
pckbd0 at pckbc0 (kbd slot)
pckbc0: using irq 1 for kbd slot
wskbd0 at pckbd0: console keyboard, using wsdisplay0
pms0 at pckbc0 (aux slot)
pckbc0: using irq 12 for aux slot
wsmouse0 at pms0 mux 0
pcppi0 at isa0 port 0x61
midi0 at pcppi0: <PC speaker>
spkr0 at pcppi0
aps0 at isa0 port 0x1600/31
npx0 at isa0 port 0xf0/16: reported by CPUID; using exception 16
mtrr: Pentium Pro MTRR support
com3 at pcmcia0 function 0 "U.S. Robotics, XJ/CC1560, Megahertz 56kbps Modem"
port 0x53f8/8: ns16550a, 16 byte fifo
scsibus1 at sdmmc0: 2 targets, initiator 0
sd2 at scsibus1 targ 1 lun 0: <SD/MMC, Drive #01, > SCSI2 0/direct fixed
sd2: 15534MB, 512 bytes/sec, 31813632 sec total
ubt0 at uhub3 port 2 "Lenovo Computer Corp ThinkPad Bluetooth with Enhanced
Data Rate II" rev 2.00/3.52 addr 2
umodem0 at uhub5 port 1 configuration 1 interface 0 "Motorola Inc. Motorola
Phone (V195)" rev 1.10/0.01 addr 2
umodem0: data interface 1, has CM over data, has no break
umodem0: status change notification available
ucom0 at umodem0
softraid0 at root
root on sd0a swap on sd0b dump on sd0b
----------------------------------------------------------
[/etc/ppp/ppp.conf]
#################################################################
#
# PPP Sample Configuration File
#
# Originally written by Toshiharu OHNO
#
# $OpenBSD: ppp.conf.sample,v 1.24 2006/07/30 18:02:01 david Exp $
#
#################################################################
# This file is separated into sections. Each section is named with
# a label starting in column 0 and followed directly by a ``:''. The
# section continues until the next section. Blank lines and lines
# beginning with ``#'' are ignored.
#
# Lines beginning with "!include" will ``include'' another file. You
# may want to ``!include ~/.ppp.conf'' for backwards compatibility.
#
# Default setup. Always executed when PPP is invoked.
# This section is *not* loaded by the ``load'' or ``dial'' commands.
#
# This is the best place to specify your modem device, its DTR rate,
# and any logging specification. Logging specs should be done first
# so that subsequent commands are logged.
#
default:
set log Phase Chat LCP IPCP CCP tun command
set device /dev/cua01
set speed 115200
set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" AT OK-AT-OK ATE1Q0 OK
\\dATDT\\T TIMEOUT 40 CONNECT"
# Client side PPP
#
# Although the PPP protocol is a peer to peer protocol, we normally
# consider the side that makes the connection as the client and the
# side that receives the connection as the server. Authentication
# is required by the server either using a unix-style login procedure
# or by demanding PAP or CHAP authentication from the client.
#
# An on demand example where we have dynamic IP addresses:
# If the peer assigns us an arbitrary IP (most ISPs do this) and we
# can't predict what their IP will be either, take a wild guess at
# some IPs that you can't currently route to.
#
# The /0 bit in "set ifaddr" says that we insist on 0 bits of the
# specified IP actually being correct, therefore, the other side can assign
# any IP numbers.
#
# The fourth arg to "set ifaddr" makes us send "0.0.0.0" as our requested
# IP number, forcing the peer to make the decision.
#
# This entry also works with static IP numbers or when not in -auto mode.
# The ``add'' line adds a `sticky' default route that will be updated if
# and when any of the IP numbers are changed in IPCP negotiations.
# The "set ifaddr" is required in -auto mode.
#
# Finally, the ``enable dns'' bit tells ppp to ask the peer for the
# nameserver addresses that should be used. This isn't always supported
# by the other side, but if it is, /etc/resolv.conf will automatically be
# updated.
#
pmdemand:
set phone 1234567
set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp"
set timeout 120
set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0
add default HISADDR
enable dns
# When we want to use PAP or CHAP instead of using a unix-style login
# procedure, we do the following. Note, the peer suggests whether we
# should send PAP or CHAP. By default, we send whatever we're asked for.
#
PAPorCHAPpmdemand:
set phone 1234567
set login
set authname MyName
set authkey MyKey
set timeout 120
set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0
add default HISADDR
enable dns
# On demand dialup example with static IP addresses:
# Here, the local side uses 192.244.185.226 and the remote side
# uses 192.244.176.44.
#
# # ppp -auto ondemand
#
# With static IP numbers, our setup is similar to dynamic:
# Remember, ppp.linkup is searched for a "192.244.176.44" label, then
# a "ondemand" label, and finally the "MYADDR" label.
#
ondemand:
set phone 1234567
set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp"
set timeout 120
set ifaddr 192.244.185.226 192.244.176.44
add default HISADDR
enable dns
# To connect via a GPRS or UMTS device (e.g. a mobile phone or a PC Card),
# it's often necessary to set the access-point name (in this case 'internet')
# which requires quotes in the dial string. This section shows the escaping
# required. Devices that have not already authenticated the SIM card (like a
# PC Card) need to issue the "AT+CPIN=xxxx" (xxxx being the PIN for the SIM
# card) first.
# For certain devices it is necessary to adjust the baud rate (speed setting)
# and/or change the dial string to "*99***1#".
# UMTS devices often allow control of the connect mode (UMTS only, GPRS only
# or default to which is available); this can be controlled with the number
# passed to the AT+CGDCONT command and is device dependant.
# Some ISPs do special things in their IPCP session in order to negotiate
# the IP addresses; in this case it may be necessary to play with the ifaddr
# setting.
# See also: com(4), ubsa(4), ucom(4) and umodem(4)
#
mobile:
set device /dev/ttyU0
set dial "ABORT ERROR ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \
\"\" ATZ OK-ATZ-OK AT+CGDCONT=1,\\\"IP\\\",
\\\"internet2.voicestream.com\\\" OK \\dATD\\T TIMEOUT 40 CONNECT"
set phone "*99#"
set speed 115200
set login
set timeout 0
set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0
add default HISADDR
enable dns
# Example segments
#
# The following lines may be included as part of your configuration
# section and aren't themselves complete. They're provided as examples
# of how to achieve different things.
examples:
# Multi-phone example. Numbers separated by a : are used sequentially.
# Numbers separated by a | are used if the previous dial or login script
# failed. Usually, you will prefer to use only one of | or :, but both
# are allowed.
#
set phone 12345678|12345679:12345670|12345671
#
# Ppp can accept control instructions from the ``pppctl'' program.
# First, you must set up your control socket. It's safest to use
# a UNIX domain socket, and watch the permissions:
#
set server /var/tmp/internet MySecretPassword 0177
#
# Although a TCP port may be used if you want to allow control
# connections from other machines:
#
set server 6670 MySecretpassword
#
# If you don't like ppp's builtin chat, use an external one:
#
set login "\"!chat \\\\-f /etc/ppp/ppp.dev.chat\""
#
# If we have a ``strange'' modem that must be re-initialized when we
# hangup:
#
set hangup "\"\" AT OK-AT-OK ATZ OK"
#
# To adjust logging withouth blasting the setting in default:
#
set log -command +tcp/ip
#
# To see log messages on the screen in interactive mode:
#
set log local LCP IPCP CCP
#
# If you're seeing a lot of magic number problems and failed connections,
# try this (see the man page):
#
set openmode active 5
#
# For noisy lines, we may want to reconnect (up to 20 times) after loss
# of carrier, with 3 second delays between each attempt:
#
set reconnect 3 20
#
# When playing server for M$ clients, tell them who our NetBIOS name
# servers are:
#
set nbns 10.0.0.1 10.0.0.2
#
# Inform the client if they ask for our DNS IP numbers:
#
enable dns
#
# If you don't want to tell them what's in your /etc/resolv.conf file
# with `enable dns', override the values:
#
set dns 10.0.0.1 10.0.0.2
#
# If we're using the -alias switch, redirect ftp and http to an internal
# machine:
#
alias port 10.0.0.2:ftp ftp
alias port 10.0.0.2:http http
#
# or don't trust the outside at all
#
alias deny_incoming yes
#
# I trust user brian to run ppp, so this goes in the `default' section:
#
allow user brian
#
# But label `internet' contains passwords that even brian can't have, so
# I empty out the user access list in that section so that only root can
# have access:
#
allow users
#
# I also may wish to set up my ppp login script so that it asks the client
# for the label they wish to use. I may only want user ``dodgy'' to access
# their own label in direct mode:
#
dodgy:
allow user dodgy
allow mode direct
#
# If we don't want ICMP and DNS packets to keep the connection alive:
#
set filter alive 0 deny icmp
set filter alive 1 deny udp src eq 53
set filter alive 2 deny udp dst eq 53
set filter alive 3 permit 0 0
#
# And we don't want ICMPs to cause a dialup:
#
set filter dial 0 deny icmp
set filter dial 1 permit 0 0
#
# or any TCP SYN or RST packets (badly closed TCP channels):
#
set filter dial 2 deny 0 0 tcp syn finrst
#
# Once the line's up, allow connections for ident (113), telnet (23),
# ftp (20 & 21), DNS (53), my place of work (192.244.191.0/24),
# ICMP (ping) and traceroute (>33433).
#
# Anything else is blocked by default
#
set filter in 0 permit tcp dst eq 113
set filter out 0 permit tcp src eq 113
set filter in 1 permit tcp src eq 23 estab
set filter out 1 permit tcp dst eq 23
set filter in 2 permit tcp src eq 21 estab
set filter out 2 permit tcp dst eq 21
set filter in 3 permit tcp src eq 20 dst gt 1023
set filter out 3 permit tcp dst eq 20
set filter in 4 permit udp src eq 53
set filter out 4 permit udp dst eq 53
set filter in 5 permit 192.244.191.0/24 0/0
set filter out 5 permit 0/0 192.244.191.0/24
set filter in 6 permit icmp
set filter out 6 permit icmp
set filter in 7 permit udp dst gt 33433
set filter out 7 permit udp dst gt 33433
#
# ``dodgynet'' is an example intended for an autodial configuration which
# is connecting a local network to a host on an untrusted network.
dodgynet:
# Log link uptime
set log Phase
# For autoconnect only
allow modes auto
# Define modem device and speed
set device /dev/cua01
set speed 115200
# Don't support LQR
deny lqr
# Remote system phone number, login and password
set phone 0W1194
set authname pppLogin
set authkey MyPassword
# Chat script to dial remote system
set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATZ OK-ATZ-OK \
ATE1Q0M0 OK \\dATDT\\T TIMEOUT 40 CONNECT"
# Chat script to login to remote Unix system
set login "TIMEOUT 10 \"\" \"\" gin:--gin: \\U word: \\P"
# Drop the link after 15 minutes of inactivity
# Inactivity is defined by the `set filter alive' line below
set timeout 900
# Hard-code remote system to appear within local subnet and use proxy arp
# to make this system the gateway
set ifaddr 172.17.20.247 172.17.20.248 255.255.240.0
enable proxy
# Allow any TCP packet to keep the link alive
set filter alive 0 permit tcp
# Only allow dialup to be triggered by http, rlogin, rsh, telnet, ftp or
# private TCP ports 24 and 4000
set filter dial 0 7 0 0 tcp dst eq http
set filter dial 1 7 0 0 tcp dst eq login
set filter dial 2 7 0 0 tcp dst eq shell
set filter dial 3 7 0 0 tcp dst eq telnet
set filter dial 4 7 0 0 tcp dst eq ftp
set filter dial 5 7 0 0 tcp dst eq 24
set filter dial 6 deny ! 0 0 tcp dst eq 4000
# From hosts on a couple of local subnets to the remote peer
# If the remote host allowed IP forwarding and we wanted to use it, the
# following rules could be split into two groups to separately validate
# the source and destination addresses.
set filter dial 7 permit 172.17.16.0/20 172.17.20.248
set filter dial 8 permit 172.17.36.0/22 172.17.20.248
set filter dial 9 permit 172.17.118.0/26 172.17.20.248
set filter dial 10 permit 10.123.5.0/24 172.17.20.248
# Once the link's up, limit outgoing access to the specified hosts
set filter out 0 4 172.17.16.0/20 172.17.20.248
set filter out 1 4 172.17.36.0/22 172.17.20.248
set filter out 2 4 172.17.118.0/26 172.17.20.248
set filter out 3 deny ! 10.123.5.0/24 172.17.20.248
# Allow established TCP connections
set filter out 4 permit 0 0 tcp estab
# And new connections to http, rlogin, rsh, telnet, ftp and ports
# 24 and 4000
set filter out 5 permit 0 0 tcp dst eq http
set filter out 6 permit 0 0 tcp dst eq login
set filter out 7 permit 0 0 tcp dst eq shell
set filter out 8 permit 0 0 tcp dst eq telnet
set filter out 9 permit 0 0 tcp dst eq ftp
set filter out 10 permit 0 0 tcp dst eq 24
set filter out 11 permit 0 0 tcp dst eq 4000
# And outgoing icmp
set filter out 12 permit 0 0 icmp
# Once the link's up, limit incoming access to the specified hosts
set filter in 0 4 172.17.20.248 172.17.16.0/20
set filter in 1 4 172.17.20.248 172.17.36.0/22
set filter in 2 4 172.17.20.248 172.17.118.0/26
set filter in 3 deny ! 172.17.20.248 10.123.5.0/24
# Established TCP connections and non-PASV FTP
set filter in 4 permit 0/0 0/0 tcp estab
set filter in 5 permit 0/0 0/0 tcp src eq 20
# Useful ICMP messages
set filter in 6 permit 0/0 0/0 icmp src eq 3
set filter in 7 permit 0/0 0/0 icmp src eq 4
set filter in 8 permit 0/0 0/0 icmp src eq 11
set filter in 9 permit 0/0 0/0 icmp src eq 12
# Echo reply (local systems can ping the remote host)
set filter in 10 permit 0/0 0/0 icmp src eq 0
# And the remote host can ping the local gateway (only)
set filter in 11 permit 0/0 172.17.20.247 icmp src eq 8
# Server side PPP
# If you want the remote system to authenticate itself, you insist
# that the peer uses CHAP (or PAP) with the "enable" keyword. Both CHAP and
# PAP are disabled by default (we usually only "enable" one of them if the
# other side is dialing into our server).
# When the peer authenticates itself, we use ppp.secret for verification.
#
# Ppp is launched with:
# # ppp -direct CHAPserver
#
# Note: We can supply a third field in ppp.secret specifying the IP address
# for that user. We can even specify a fourth field to specify the
# ppp.link{up,down} label to use.
#
CHAPserver:
enable chap
enable proxy
set ifaddr 192.244.176.44 292.244.184.31
accept dns
# If we wish to act as a server, allowing PAP access according to
# accounts in /etc/passwd, we do this (Without `enable passwdauth',
# you may still enter ``*'' as the users password in ppp.secret and
# ppp will look it up in the passwd database. This is useful if you
# need to assign a special label or IP number or range):
#
PAPServerwithPASSWD:
enable pap
enable passwdauth
enable proxy
set ifaddr 192.244.176.44 292.244.184.31
accept dns
# Example to connect using a null-modem cable:
# The important thing here is to allow the lqr packets on both sides.
# Without them enabled, we can't tell if the line's dropped - there
# should always be carrier on a direct connection.
# Here, the server sends lqr's every 10 seconds and quits if five in a
# row fail.
#
# Make sure you don't have "deny lqr" in your default: on the client !
# If the peer denies LQR, we still send ECHO LQR packets at the given
# lqrperiod interval (ppp-style-pings).
#
direct-client:
set dial ""
set device /dev/cua00
set sp 115200
set timeout 900
set lqrperiod 10
set log Phase Chat LQM
set login "ABORT NO\\sCARRIER TIMEOUT 5 ogin:--ogin: ppp word: ppp HELLO"
set ifaddr 10.0.4.2 10.0.4.1
enable lqr
accept lqr
direct-server:
set timeout 0
set lqrperiod 10
set log Phase LQM
set ifaddr 10.0.4.1 10.0.4.2
enable lqr
accept lqr
# Example to connect via compuserve (who insist on 7 bits even parity
# during the chat phase).
#
compuserve:
set phone 1234567
set parity even
set login "TIMEOUT 100 \"\" \"\" Name: CIS ID: 999999,9999/go:pppconnect \
word: XXXXXXXX PPP"
set timeout 300
set ifaddr 10.0.0.1/0 10.0.0.2/0 255.255.255.0 0.0.0.0
delete ALL
add default HISADDR
# Example for PPP over TCP.
# We assume that inetd on tcpsrv.mynet has been
# configured to run "ppp -direct tcp-server" when it gets a connection on
# port 1234. Read the man page for further details
#
# Note, we assume we're using a binary-clean connection. If something
# such as `rlogin' is involved, you may need to ``set escape 0xff''
#
tcp-client:
set device tcpsrv.mynet:1234
set dial
set login
set ifaddr 10.0.5.1 10.0.4.1 255.255.255.0
tcp-server:
set ifaddr 10.0.4.1 10.0.5.1 255.255.255.0
# If you want to test ppp, do it through a loopback:
#
# Requires a line in /etc/services:
# ppploop 6671/tcp # loopback ppp daemon
#
# and a line in /etc/inetd.conf:
# ppploop stream tcp nowait root /usr/sbin/ppp ppp -direct loop-in
#
loop:
set timeout 0
set log phase chat connect lcp ipcp command
set device localhost:ppploop
set dial
set login
set ifaddr 127.0.0.2 127.0.0.3
set server /var/tmp/loop "" 0177
loop-in:
set timeout 0
set log phase lcp ipcp command
allow mode direct
# Example of a VPN.
# If you're going to create a tunnel through a public network, your VPN
# should be set up something like this:
#
# You should already have set up ssh using ssh-agent & ssh-add.
#
#
sloop:
load loop
# Passive mode allows ssh plenty of time to establish the connection
set openmode passive
set device "!ssh whatevermachine /usr/sbin/ppp -direct loop-in"
# If you wish to connect to a server that will dial back *without* using
# the ppp callback facility (rfc1570), take advantage of the fact that
# ppp doesn't look for carrier 'till `set login' is complete:
#
# Here, we expect the server to say DIALBACK then disconnect after
# we've authenticated ourselves. When this has happened, we wait
# 60 seconds for a RING.
#
dialback:
set dial "ABORT BUSY ABORT NO\\sCARRIER TIMEOUT 5 \"\" ATZ OK-ATZ-OK \
ATDT\\T TIMEOUT 60 CONNECT"
set login "TIMEOUT 5 ogin:--ogin: ppp word: ppp TIMEOUT 15 DIALBACK \
\"\" NO\\sCARRIER \"\" TIMEOUT 60 RING ATA CONNECT"
# Alternatively, if the peer is using the PPP callback protocol, use
# normal dial and login scripts and add
#
set callback auth cbcp e.164 1234567
set cbcp 1234567
# If we're running a ppp server that wants to only call back microsoft
# clients on numbers configured in /etc/ppp/ppp.secret (the 5th field):
#
set callback cbcp
set cbcp
set log +cbcp
set redial 3 1
set device /dev/cua00
set speed 115200
set dial "TIMEOUT 10 \"\" AT OK-AT-OK ATDT\\T CONNECT"
# Or if we want to allow authenticated clients to specify their own
# callback number, use this ``set cbcp'' line instead:
#
set cbcp *
# Multilink mode is available (rfc1990).
# To enable multilink capabilities, you must specify a MRRU. 1500 is
# a reasonable value. To create new links, use the ``clone'' command
# to duplicate an existing link. If you already have more than one
# link, you must specify which link you wish to run the command on via
# the ``link'' command.
#
# You can now ``dial'' specific links, or even dial all links at the
# same time. The `dial' command may also be prefixed with a specific
# link that should do the dialing.
#
mloop:
load loop
set mode interactive
set mrru 1500
set mru 1504 # Room for the MP header
clone 1 2 3
link deflink remove
# dial
# link 2 dial
# link 3 dial
mloop-in:
set timeout 0
set log tun phase
allow mode direct
set mrru 1500
set mru 1504 # Room for the MP header
# A PPPoE (PPP over Ethernet) setup may look like this:
#
pppoe:
set device "!/usr/sbin/pppoe"
set mtu max 1492
set mru max 1492
set speed sync
disable acfcomp protocomp
deny acfcomp
----------------------------------------------------------
[usbdevs -v]
Controller /dev/usb0:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000),
Intel(0x8086), rev 1.00
port 1 powered
port 2 powered
port 3 powered
port 4 powered
port 5 powered
port 6 powered
Controller /dev/usb1:
addr 1: high speed, self powered, config 1, EHCI root hub(0x0000),
Intel(0x8086), rev 1.00
port 1 powered
port 2 powered
port 3 powered
port 4 powered
port 5 powered
port 6 powered
Controller /dev/usb2:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000),
Intel(0x8086), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb3:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000),
Intel(0x8086), rev 1.00
port 1 powered
port 2 addr 2: full speed, self powered, config 1, ThinkPad Bluetooth with
Enhanced Data Rate II(0x2145), Lenovo Computer Corp(0x0a5c), rev 3.52
Controller /dev/usb4:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000),
Intel(0x8086), rev 1.00
port 1 powered
port 2 powered
Controller /dev/usb5:
addr 1: full speed, self powered, config 1, UHCI root hub(0x0000),
Intel(0x8086), rev 1.00
port 1 addr 2: full speed, self powered, config 1, Motorola Phone (V195)
(0x4902), Motorola Inc.(0x22b8), rev 0.01
port 2 powered
