5 Using VPP as a Home Gateway
6 ===========================
8 Vpp running on a small system (with appropriate NICs) makes a fine
9 home gateway. The resulting system performs far in excess of
10 requirements: a TAG=vpp_debug image runs at a vector size of ~1.1
11 terminating a 90-mbit down / 10-mbit up cable modem connection.
13 At a minimum, install sshd and the isc-dhcp-server. If you prefer, you
19 /etc/vpp/startup.conf::
23 log /var/log/vpp/vpp.log
25 cli-listen /run/vpp/cli.sock
26 startup-config /setup.gate
39 isc-dhcp-server configuration::
41 subnet 192.168.1.0 netmask 255.255.255.0 {
42 range 192.168.1.10 192.168.1.99;
43 option routers 192.168.1.1;
44 option domain-name-servers 8.8.8.8;
47 If you decide to enable the vpp dns name resolver, substitute
48 192.168.1.2 for 8.8.8.8 in the dhcp server configuration.
50 /etc/ssh/sshd_config::
52 # What ports, IPs and protocols we listen for
53 Port <REDACTED-high-number-port>
54 # Change to no to disable tunnelled clear text passwords
55 PasswordAuthentication no
57 For your own comfort and safety, do NOT allow password authentication
58 and do not answer ssh requests on port 22. Experience shows several
59 hack attempts per hour on port 22, but none (ever) on random
64 comment { This is the WAN interface }
65 set int state GigabitEthernet3/0/0 up
66 comment { set int mac address GigabitEthernet3/0/0 mac-to-clone-if-needed }
67 set dhcp client intfc GigabitEthernet3/0/0 hostname vppgate
69 comment { Create a BVI loopback interface}
71 set int l2 bridge loop0 1 bvi
72 set int ip address loop0 192.168.1.1/24
73 set int state loop0 up
75 comment { Add more inside interfaces as needed ... }
76 set int l2 bridge GigabitEthernet0/14/0 1
77 set int state GigabitEthernet0/14/0 up
79 comment { dhcp server and host-stack access }
80 tap connect lstack address 192.168.1.2/24
81 set int l2 bridge tapcli-0 1
82 set int state tapcli-0 up
84 comment { Configure NAT}
85 nat44 add interface address GigabitEthernet3/0/0
86 set interface nat44 in loop0 out GigabitEthernet3/0/0
88 comment { allow inbound ssh to the <REDACTED-high-number-port>
89 nat44 add static mapping local 192.168.1.2 <REDACTED> external GigabitEthernet3/0/0 <REDACTED> tcp
91 comment { if you want to use the vpp DNS server, add the following }
92 comment { Remember to adjust the isc-dhcp-server configuration appropriately }
93 comment { nat44 add identity mapping external GigabitEthernet3/0/0 udp 53053 }
94 comment { bin dns_name_server_add_del 8.8.8.8 }
95 comment { bin dns_name_server_add_del 68.87.74.166 }
96 comment { bin dns_enable_disable }
97 comment { see patch below, which adds these commands }
98 service restart isc-dhcp-server
99 add default linux route via 192.168.1.1
104 You'll need this patch to add the "service restart" and "add default
105 linux route" commands::
107 diff --git a/src/vpp/vnet/main.c b/src/vpp/vnet/main.c
108 index 6e136e19..69189c93 100644
109 --- a/src/vpp/vnet/main.c
110 +++ b/src/vpp/vnet/main.c
112 #include <vlib/unix/unix.h>
113 #include <vnet/plugin/plugin.h>
114 #include <vnet/ethernet/ethernet.h>
115 +#include <vnet/ip/ip4_packet.h>
116 +#include <vnet/ip/format.h>
117 #include <vpp/app/version.h>
118 #include <vpp/api/vpe_msg_enum.h>
120 @@ -400,6 +402,63 @@ VLIB_CLI_COMMAND (test_crash_command, static) = {
124 +static clib_error_t *
125 +restart_isc_dhcp_server_command_fn (vlib_main_t * vm,
126 + unformat_input_t * input,
127 + vlib_cli_command_t * cmd)
129 + int rv __attribute__((unused));
130 + /* Wait three seconds... */
131 + vlib_process_suspend (vm, 3.0);
133 + rv = system ("/usr/sbin/service isc-dhcp-server restart");
135 + vlib_cli_output (vm, "Restarted the isc-dhcp-server...");
140 +VLIB_CLI_COMMAND (restart_isc_dhcp_server_command, static) = {
141 + .path = "service restart isc-dhcp-server",
142 + .short_help = "restarts the isc-dhcp-server",
143 + .function = restart_isc_dhcp_server_command_fn,
147 +static clib_error_t *
148 +add_default_linux_route_command_fn (vlib_main_t * vm,
149 + unformat_input_t * input,
150 + vlib_cli_command_t * c)
152 + int rv __attribute__((unused));
153 + ip4_address_t ip4_addr;
156 + if (!unformat (input, "%U", unformat_ip4_address, &ip4_addr))
157 + return clib_error_return (0, "default gateway address required...");
159 + cmd = format (0, "/sbin/route add -net 0.0.0.0/0 gw %U",
160 + format_ip4_address, &ip4_addr);
165 + vlib_cli_output (vm, "%s", cmd);
173 +VLIB_CLI_COMMAND (add_default_linux_route_command, static) = {
174 + .path = "add default linux route via",
175 + .short_help = "Adds default linux route: 0.0.0.0/0 via <addr>",
176 + .function = add_default_linux_route_command_fn,
182 Using the temporal mac filter plugin
183 ------------------------------------
185 If you need to restrict network access for certain devices to specific
186 daily time ranges, configure the "mactime" plugin. Enable the feature
187 on the NAT "inside" interfaces::
189 bin mactime_enable_disable GigabitEthernet0/14/0
190 bin mactime_enable_disable GigabitEthernet0/14/1
193 Create the required src-mac-address rule database. There are 4 rule
196 * allow-static - pass traffic from this mac address
197 * drop-static - drop traffic from this mac address
198 * allow-range - pass traffic from this mac address at specific times
199 * drop-range - drop traffic from this mac address at specific times
201 Here are some examples::
203 bin mactime_add_del_range name alarm-system mac 00:de:ad:be:ef:00 allow-static
204 bin mactime_add_del_range name unwelcome mac 00:de:ad:be:ef:01 drop-static
205 bin mactime_add_del_range name not-during-business-hours mac <mac> drop-range Mon - Fri 7:59 - 18:01
206 bin mactime_add_del_range name monday-busines-hours mac <mac> allow-range Mon 7:59 - 18:01