LRN: APRIL 11, 2024
       
       This is my first entry into a series of logs used to track progress
       towards my learning objectives. I envision these logs as a learning
       and accountability tool. I can use a log like a very neat and tidy
       notebook: summarizing and reciting knowledge gained, or documenting
       what I've done and what's standing in the way (barriers can be
       emotional, even). How logs are written may change. But the basic
       constant is they become something that is written to accompany a
       session, or written retrospectively to reflect a session.
       
       
       OpenBSD router and firewall
       ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
       I have been making attempts to replace my ISP's router and firewall
       with my own. It has been a big fucking challenge. I didn't realize
       just how little I know about the physical and data link layers of
       networking. Simultaneously gathering half-bits of information and then
       trying to apply this towards my objective has not worked
       well. Fuck. Anyways, below is a summary of what I've
       half-learned. It's probably full of mistakes.
       
       
       Configuration
       ----------------------------------------------------------------------
       Fibre comes directly into my abode through a fibre optic cable. The
       cable plugs into a transceiver that plugs into the ISP's device. The
       device runs OpenWRT. It is a router and a firewall.
       
       My OpenBSD machine is an old Acer with 4GB RAM and a Pentium 4 CPU. I added two network interface cards into its only PCIe slots: a card with two ethernet ports[1], a card with a single SPF+ port[2]. My efforts documented herein disregard the ethernet ports.
       
       The SPF+ card shows up as interface "ix0" in OpenBSD. If the ISP's
       transceiver is plugged hot into the machine, a reboot is required
       otherwise the interface will forever say "Carrier: none". I don't know
       why this is so.
       
       The ISP uses VLANs to transmit the internet and its other services
       over the fibre connection. I don't quite understand VLANs. I think
       they encapsulate certain types of traffic in a network. Like, wrap a
       tag around a frame and then move that frame around according to the
       tag. For my ISP, VLAN 35 contains the internet, VLAN 36 TV. To create
       a VLAN and "tag" it with the correct traffic segment(?) I used
       `ifconfig'. Configuration of the interfaces was persisted as
       `hostname.if' configurations.
       
       `hostname.ix0', the SPF+ card:
       
       ,----
       | inet -autoconf
       | mtu 1492
       | up
       | description "WAN"
       `----
       
       `hostname.vlan35', the VLAN:
       
       ,----
       | vnetid 35 parent ix0
       | mtu 1492
       | up
       | inet autoconf
       | description "internet" 
       `----
       
       Order of these rules can be important, especially for the VLAN. The
       VLAN's parent interface needs to be set before it begins asking for an
       IP lease.
       
       In my region, the ISP uses DHCP to assign a customer an IP. In other
       regions, it is necessary to authenticate using PPPoE. If I had to use
       PPPoE, I'd need my user/pass credentials for the ISP. I'd create a
       `pppoe' configuration file and somehow hook it into the 35 tagged VLAN
       I created.
       
       After a reboot, the `ix0' and `vlan35' interfaces were active. But no
       IP was being assigned. I made sure the firewall was turned off. I ran
       `sh /etc/netstart'. Nothing still. So I started `tcpdump' to capture
       packets. Then I tried to manually invoke DHCP with `dhcpleasectl
       vlan35' and `dhcpleasectl ix0'. (I'd not sure which interface should
       request the IP, but I suspect it's the VLAN.) Nothing still.
       
       Inspecting the captured packets was interesting. I saw that they are
       part of the BOOTP protocol, which is some old thing used before (and
       now alongside) DHCP.
       
       ,----
       | 18:30:56.707442 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 90:e2:ba:39:0f:36 (oui Unknown), length 300
       `----
       
       There's never any response. So that could mean the request is
       malformed, or the request isn't leaving the machine. I do wonder about
       the MTU attribute, and whether I have that correct. I have read some
       ISP customers using 1492 and 1472. I did try 1500, too. I read that 8
       bits need to be reserved for the tag, hense a value of 1492. But I
       actually don't know what an MTU attribute is, anyways.
       
       I wonder about the use of `dhcpleasectl' to get the client's IP. I
       also tried `!dhclient \$if' in my `hostname.vlan35' configuration, to
       no avail.
       
       I wonder if there's something wrong with routes. But I don't know much
       about routes except seeing them with `route show'.
       
       I have also tinkered with `/etc/rc.conf.local', adjusting one line to
       read `dhcpd_flags=vlan35', whereas previously it was
       `dhcpd_flags=em0'. I think this is a mistake, because `dhcpd' is the
       daemon for acting as a DHCP server.
       
       
       Learning gaps
       ----------------------------------------------------------------------
       I don't know enough about:
       
       - BOOTP/DHCP
       - VLANs
       - VLAN tagging
       - Routes
       
       
       Next steps
       ----------------------------------------------------------------------
       When I return to this endeavor I'm going to repeat all the above steps
       but in pfsense. The advantage here is that other ISP customers who
       have documented their steps removing the ISP router from their network
       do so using pfsense. I wish I could figure this out in OpenBSD but my
       skills are just not sufficient for me to troubleshoot all n factors
       contributing to my failure.
       
       
       pfsense router and firewall
       ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
       After work I installed pfsense on the Acer and configured it as per
       above. Still, the DHCPclient requests were failing to solicit a
       response. So at this point I suspect the issue is the SPF+ card. This
       means I need to swap the card for another card, or acquire a media
       converted. Alternatively, I can achieve a compromise by keeping the
       ISP device and putting the router/firewall into the device's DMZ.
       
       
       Next steps
       ----------------------------------------------------------------------
       Research how people have used the device's DMZ to build a home
       network. I must also map out what I'm trying to achieve with my
       network, roughly speaking.
       
       
       Footnotes
       ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
       
       
       
       Footnotes
       _________
       
       [1] From Amazon: "1.25G Gigabit Ethernet Converged Network Adapter (NIC) for Intel 82576 Chip, Dual RJ45 Copper Ports, PCI Express 2.0 X1, Compare to Intel E1G42ET."
       
       [2] From Amazon: "10Gb Network Card Single SFP+ Port PCIE Ethernet Server for Intel X520-DA1 82599EN Chip Support Windows 7/8/10/11/Visa,Server/Linux/VMware"