{"id":1059,"date":"2022-08-27T14:27:35","date_gmt":"2022-08-27T12:27:35","guid":{"rendered":"https:\/\/www.elwix.org\/site\/?page_id=1059"},"modified":"2022-08-28T00:18:04","modified_gmt":"2022-08-27T22:18:04","slug":"fwsync-document","status":"publish","type":"page","link":"http:\/\/www.elwix.org\/site\/documentation\/fwsync-document\/","title":{"rendered":"FWSync document"},"content":{"rendered":"\n

FWSYNC driver<\/strong> installation and configuration<\/strong><\/p>\n\n\n\n

Currently the driver is not included in the kernel and we have to patch, compile and install according to the following procedure:<\/p>\n\n\n\n

#Prepare work directory, checkout project, create the symlinks<\/em><\/strong><\/p>\n\n\n\n

cd ~<\/p>\n\n\n\n

mkdir work<\/p>\n\n\n\n

cd work<\/p>\n\n\n\n

cvs -d anoncvs@cvs.elwix.org:\/cvs checkout fwsync<\/p>\n\n\n\n

cd \/usr\/src <\/p>\n\n\n\n

sudo ln -s ~\/work\/fwsync\/patches\/sync.c \/usr\/src\/sbin\/ipfw<\/p>\n\n\n\n

#Patches for \/usr\/src\/sbin\/ipfw tool<\/em><\/strong><\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ipfw_Makefile.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ipfw_main.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ipfw_ipfw2_h.patch<\/p>\n\n\n\n

#Patches for the ipfw filter driver<\/em><\/strong><\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/alias_db_h.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/alias_db.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ip_fw2.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ip_fw_private_h.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ip_fw_nat.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ip_fw_h.patch<\/p>\n\n\n\n

sudo patch < ~\/work\/fwsync\/patches\/ip_fw_dynamic.patch<\/p>\n\n\n\n

#Build and install the kernel<\/em><\/strong><\/p>\n\n\n\n

sudo make buildkernel<\/p>\n\n\n\n

sudo make installkernel<\/p>\n\n\n\n

reboot<\/p>\n\n\n\n

#In case. If you aren\u2019t built Userland of the OS<\/em><\/strong><\/p>\n\n\n\n

cp \/usr\/src\/sys\/netinet\/ip_fw.h \/usr\/include\/netinet<\/p>\n\n\n\n

#ipfw installation<\/em><\/strong><\/p>\n\n\n\n

cd \/usr\/src\/sbin\/ipfw<\/p>\n\n\n\n

sudo make obj<\/p>\n\n\n\n

sudo make depend<\/p>\n\n\n\n

sudo make<\/p>\n\n\n\n

sudo make install<\/p>\n\n\n\n

#Driver installation<\/em><\/strong><\/p>\n\n\n\n

cd ~\/work\/fwsync\/driver<\/p>\n\n\n\n

make obj<\/p>\n\n\n\n

make depend<\/p>\n\n\n\n

make<\/p>\n\n\n\n

sudo make install<\/p>\n\n\n\n

#RECHECK THE IPFW RULE SET ON BOTH DEVICES, IT SHOULD BE UNIFIED!<\/strong><\/p>\n\n\n\n

#Driver load<\/em><\/strong><\/p>\n\n\n\n

kldload fwsync.ko<\/p>\n\n\n\n

vim \/boot\/loader.conf<\/p>\n\n\n\n

fwsync_load=”YES”<\/p>\n\n\n\n

#Configuration:<\/em><\/strong><\/p>\n\n\n\n

#Activate the listen state<\/em><\/strong><\/p>\n\n\n\n

sudo ipfw sync config edge 20611<\/p>\n\n\n\n

or<\/em><\/p>\n\n\n\n

sudo ipfw sync config edge port 20611<\/p>\n\n\n\n

*Remark1 – when we have only one option for the following word it can be skipped<\/em><\/p>\n\n\n\n

#Configure the peer device as a collector<\/em><\/strong><\/p>\n\n\n\n

sudo ipfw sync config collector 172.17.0.254<\/p>\n\n\n\n

or<\/em><\/p>\n\n\n\n

sudo ipfw sync config collector 172.17.0.253 172.17.0.251,10000<\/p>\n\n\n\n

*Remark2 – If there is no specified port comma separated after the IP, the default port 20611 will be used. We can configure two collectors max per device<\/em><\/p>\n\n\n\n

#Start the synchronization<\/em><\/strong><\/p>\n\n\n\n

sudo ipfw sync start<\/p>\n\n\n\n

#Useful commands<\/em><\/strong><\/p>\n\n\n\n

#List configuration<\/em><\/strong><\/p>\n\n\n\n

sudo ipfw sync show<\/p>\n\n\n\n

#Stop the synchronization<\/strong><\/p>\n\n\n\n

sudo ipfw sync stop<\/p>\n\n\n\n

#Disable the connectivity to the device’s network stack and clear the configuration (if we need to unload the driver for example for upgrade)<\/strong><\/p>\n\n\n\n

sudo ipfw sync flush<\/p>\n\n\n\n

#Sample working setup (r1 and r2):<\/em><\/strong><\/p>\n\n\n\n

root@r1:~ # ipfw sync show<\/p>\n\n\n\n

ipfw sync config edge port 20611<\/p>\n\n\n\n

ipfw sync config collector 172.16.71.9,20611<\/p>\n\n\n\n

ipfw sync start edge<\/p>\n\n\n\n

ipfw sync start collector<\/p>\n\n\n\n

root@r2:~ # ipfw sync show<\/p>\n\n\n\n

ipfw sync config edge port 20611<\/p>\n\n\n\n

ipfw sync config collector 172.16.71.5,20611<\/p>\n\n\n\n

ipfw sync start edge<\/p>\n\n\n\n

ipfw sync start collector<\/p>\n\n\n\n

*Remark 3 – for production environments we will use the heartbeat VLAN<\/em><\/p>\n\n\n\n

#Dynamic states after sync on r1<\/em><\/strong><\/p>\n\n\n\n

ipfw -dD show<\/p>\n\n\n\n

…<\/p>\n\n\n\n

01100     244     126718 (263s) STATE tcp 172.16.71.51 58659 <-> 178.22.65.231 443 :default<\/p>\n\n\n\n

01100    1522      97910 (293s) STATE tcp 172.16.71.50 53129 <-> 74.125.143.188 5228 :default<\/p>\n\n\n\n

…<\/p>\n\n\n\n

#Socket<\/em><\/strong><\/p>\n\n\n\n

netstat<\/p>\n\n\n\n

…<\/p>\n\n\n\n

udp4       0      0 *.20611                *.*                    <\/p>\n\n\n\n

…<\/p>\n\n\n\n

#Statistics via sysctl<\/em><\/strong><\/p>\n\n\n\n

sysctl net.inet.ip.fwsync<\/p>\n\n\n\n

net.inet.ip.fwsync.acct.edge_aliases: 3<\/p>\n\n\n\n

net.inet.ip.fwsync.acct.collector_aliases: 0<\/p>\n\n\n\n

net.inet.ip.fwsync.acct.edge_states: 11<\/p>\n\n\n\n

net.inet.ip.fwsync.acct.collector_states: 5<\/p>\n\n\n\n

#Statistics via ipfw <\/em><\/strong><\/p>\n\n\n\n

sudo ipfw sync list<\/p>\n\n\n\n

sync edge states 11 aliases 3<\/p>\n\n\n\n

sync collector states 5 aliases 0<\/p>\n\n\n\n

sudo ipfw sync list edge<\/p>\n\n\n\n

sync edge states 14 aliases 3<\/p>\n\n\n\n

sudo ipfw sync list collector<\/p>\n\n\n\n

sync collector states 22 aliases 0<\/p>\n","protected":false},"excerpt":{"rendered":"

FWSYNC driver installation and configuration Currently the driver is not included in the kernel and we have to patch, compile and install according to the following procedure: #Prepare work directory, checkout project, create the symlinks cd ~ mkdir work cd … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":46,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":[],"_links":{"self":[{"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/pages\/1059"}],"collection":[{"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/comments?post=1059"}],"version-history":[{"count":8,"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/pages\/1059\/revisions"}],"predecessor-version":[{"id":1075,"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/pages\/1059\/revisions\/1075"}],"up":[{"embeddable":true,"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/pages\/46"}],"wp:attachment":[{"href":"http:\/\/www.elwix.org\/site\/wp-json\/wp\/v2\/media?parent=1059"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}