pre-requisites

 ____  ____  _____      ____  _____ ___  _   _ ___ ____ ___ _____ _____ ____
|  _ \|  _ \| ____|    |  _ \| ____/ _ \| | | |_ _/ ___|_ _|_   _| ____/ ___|
| |_) | |_) |  _| _____| |_) |  _|| | | | | | || |\___ \| |  | | |  _| \___ \
|  __/|  _ <| |__|_____|  _ <| |__| |_| | |_| || | ___) | |  | | | |___ ___) |
|_|   |_| \_\_____|    |_| \_\_____\__\_\\___/|___|____/___| |_| |_____|____/ #1

-----------------------------------------------------------------------------------
                    		FreeBSD 13.0-RELEASE
                       [ by: ARI3L | y2k ] #IRCAyuda STAFF
-----------------------------------------------------------------------------------

#1 - Update OS and change Host.  (root) 

	 NOTE: After change Hostname need to reboot the machine.
	 NOTE: Need to set a subdomain on the server for make it work well.
	 NOTE: Need a Static local IPV4 Need to check: (/etc/rc.conf)
	 NOTE: This Config is only on IPv4 if you dont have a IPV6 Tunnel config.
	 NOTE: Need to set hostname first! and went you reboot your system set IPV4 Static IP.

	root@ircd:~ # pkg updade
	root@ircd:~ # pkg upgrade
	
	NOTE: In FreeBSD you can use editor ( ee ) but in this case we going to use nano.
	NOTE: If you are familiar with ( ee ) just jump this step.
	NOTE: ( ee ) Save File: Press: ESC + a + a
	NOTE: ( ee ) PRESS : ESC to see Menu.
	
	root@ircd:~ # pkg install -y nano
	
	root@ircd:~ # grep hostname /etc/rc.conf
	
	NOTE: Need to use a subdomain like the one in the example.
	NOTE: You can edite this file in line 1. hostname="ircd.undernet.org"
	
	root@ircd:~ #  nano /etc/rc.conf
	
	NOTE: This show you the hostname you got.
	
	root@ircd:~ # hostname
	
	NOTE: This is how you can set the subdomain
	
	root@ircd:~ # hostname ircd.undernet.org
		
	NOTE: If you want to work with a user like a root with (sudo) privilegie.
	NOTE: If you got all set with root + user. Jump this step.
	
	root@ircd:~ # pw usermod YOUR-Username -G wheel
	
	NOTE: If you change your hostname correctly! you need to reboot your system for take all change.
	
	root@ircd:~ # reboot
	
	NOTE: Now we can edit rc.conf for set Static IPV4.
	NOTE: Remember! you can use ( ee ) for edite files.
	NOTE: We install nano because we like it! :)

	NOTE: You need to edit again /etc/rc.conf this time for set static IP.
	
	root@ircd:~ # nano /etc/rc.conf
	
	NOTE: EXAMPLE File!
	NOTE: Edit your file how you need it and save it. (CTRL + X + Intro)
	
		hostname="ircd.undernet.org"
		ifconfig_em0="inet 192.168.1.137 netmask 255.255.255.0" defaultrouter="192.168.1.1"
		ifconfig_em0_ipv6="inet6 accept_rtadv"
		sshd_enable="YES"
		# Set dumpdev to "AUTO" to enable crash dumps, "NO" to disable
		dumpdev="AUTO"
		
	NOTE: Now you can see the info with ifconfig
	
	root@ircd:~ # ifconfig em0
		em0: flags=8843 metric 0 mtu 1500
		options=81009b
		ether 08:00:27:32:00:0a
		inet6 fe80::a00:27ff:fe32:a%em0 prefixlen 64 scopeid 0x1
		inet6 2607:fea8:4de0:b900:a00:27ff:fe32:a prefixlen 64 autoconf
		inet 192.168.1.137 netmask 0xffffff00 broadcast 10.0.0.255
		media: Ethernet autoselect (1000baseT )
		status: active
		nd6 options=23
	root@ircd:~ #
	
	root@ircd:~# ifconfig | grep inet
		inet 192.168.1.137 netmask 0xffffff00 broadcast 192.168.1.255
		inet6 ::1 prefixlen 128
		inet6 fe80::1%lo0 prefixlen 64 scopeid 0x2
		inet 127.0.0.1 netmask 0xff000000
	root@ircd:~#

	root@ircd:~# ifconfig | grep ether
		ether 08:00:27:80:b9:d2
	root@ircd:~#
	
	NOTE: If the dhclient is used to set the hostname via DHCP, the hostname variable should be set to an empty string
	NOTE: Apply your new network settings.
	
	root@ircd:~ # /etc/netstart
	root@ircd:~ # /etc/rc.d/netif restart && /etc/rc.d/routing restart
	
#2 - Install ( git wget flex byacc screen zip gcc oidentd automake tcllib postgresql-libpqxx gmake )
	 NOTE: Now we going to install few packets we need.
	
	root@ircd:~ # pkg install -y git wget flex byacc screen zip gcc oidentd automake tcllib postgresql-libpqxx gmake
	
	| NOTE: If you are familiar with ports in FreeBSD do this step. This take some minutes...
	| NOTE: You never use FreeBSD Ports before? Make sure you know what to do here!
	| NOTE: How to install a port: cd /usr/ports/NAMEPort/program ; make install clean
	| NOTE: Example: root@ircd:~ # cd /usr/ports/devel/subversion | root@ircd:/usr/ports/devel/subversion # make install clean
	| NOTE: If the ports tree is not available, or pkg is being used to manage packages, Subversion can be installed as a package: 
	| NOTE:	pkg install subversion
	| 
	| ---> NOTE: To download a compressed snapshot of the Ports Collection into /var/db/portsnap
	| root@ircd:~ # portsnap fetch
	| 
	| ---> NOTE: When running Portsnap for the first time, extract the snapshot into /usr/ports
	| root@ircd:~ # portsnap extract
	| 
	| ---> NOTE: After the first use of Portsnap has been completed as shown above, /usr/ports can be updated as needed by running
	| root@ircd:~ # portsnap fetch
	| root@ircd:~ # portsnap update
	| 
	| ---> NOTE: When using fetch, the extract or the update operation may be run consecutively, like so.
	| root@ircd:~ # portsnap fetch update
	  
#3 - How To Configure Firewall

     NOTE: FreeBSD 12.1 Got diferent firewall (IPFW - PF - IPF)
	 NOTE: FreeBSD can work with IPTables too. We going to work with PF. Port Filter.
	 NOTE: If you got configure other firewall for your server! you need to open ports. You can have only one firewall running.
	 NOTE: FIRST NEED TO CONFIGURE PF AND OPEN PORTS. NO ACTIVATE THE FIREWALL.
	 NOTE: Port need: 6667 to 7000 , 4400 , 113 , 53 , 443 , 80 , 22 , 25 , 110	 
	
	 NOTE: Create your /etc/pf.conf file 
	 NOTE: Use (nano) or (ee) 
	 
	 root@ircd:~ # nano /etc/pf.conf
	 
	 NOTE: EXAMPLE FILE LOOKS LIKE:
	
	 NOTE: SIMPLE Rules 
	 
	 
			set skip on lo0
			block all
			pass in proto tcp to port { 22 }
			pass out proto { tcp udp } to port { 6667 6668 6669 7000 4400 113 53 443 80 22 25 110 }
			pass out inet proto icmp icmp-type { echoreq }




	NOTE: FULL BASE Ruleset
	
			vtnet0 = "vtnet0"
			icmp_types = "{ echoreq unreach }"
			table <bruteforce> persist
			table <rfc6890> { 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16          \
							  172.16.0.0/12 192.0.0.0/24 192.0.0.0/29 192.0.2.0/24 192.88.99.0/24    \
							  192.168.0.0/16 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24            \
							  240.0.0.0/4 255.255.255.255/32 }

			set skip on lo0
			scrub in all fragment reassemble max-mss 1440
			antispoof quick for $vtnet0
			block in quick on $vtnet0 from <rfc6890>
			block return out quick on egress to <rfc6890>
			block all
			pass in on $vtnet0 proto tcp to port { 22 } \
				keep state (max-src-conn 15, max-src-conn-rate 3/1, \
					overload <bruteforce> flush global)
			pass out proto { tcp udp } to port { 6667 6668 6669 7000 4400 113 53 443 80 22 25 110 }
			pass inet proto icmp icmp-type $icmp_types
			
     
	 NOTE: Save file went you finish edition.
	 
	 NOTE: Testing Your Preliminary Ruleset
	 
	 root@ircd:~ # sysrc pf_enable="YES"
	 root@ircd:~ # sysrc pflog_enable="YES"
	 
	 NOTE: Verify these changes by printing the contents of your /etc/rc.conf
	 
	 root@ircd:~ # cat /etc/rc.conf
	 NOTE: You going to see pf_enable="YES" pflog_enable="YES" at the bottom of this file config.
	 
	 NOTE: Now you need to reboot your system.
	 NOTE: After reboot you need to load the ruleset with pfctl.
	 NOTE: If there are no errors or messages, it means your ruleset has no errors and the firewall is active.
	 
	 root@ircd:~ # reboot
	 root@ircd:~ # pfctl -f /etc/pf.conf
	 
	 NOTE: After reboot we going to check firewall (PF)
	 NOTE: PF is now your acting firewall. You can ensure that it is running by accessing some data with the pfctl utility.
	 NOTE: Let’s view some statistics and counters with pfctl -si
	 
	 NOTE: You pass the -si flags, which stand for show info. 
	 NOTE: This is one of the many filter parameter combinations you can use with pfctl to parse data about your firewall activity.
	 NOTE: You will see the following tabular data (the values will vary from machine-to-machine)
	 NOTE: This is a basic config for (PF) if you want some in particular make sure you know how to!
	 
	 root@ircd:~ # pfctl -si
		Status: Enabled for 0 days 00:05:05           Debug: Urgent

		State Table                          Total             Rate
		  current entries                        1
		  searches                             455            1.5/s
		  inserts                               56            0.2/s
		  removals                              55            0.2/s
		Counters
		  match                                162            0.5/s
		  bad-offset                             0            0.0/s
		  fragment                               0            0.0/s
		  short                                  0            0.0/s
		  normalize                              0            0.0/s
		  memory                                 0            0.0/s
		  bad-timestamp                          0            0.0/s
		  congestion                             0            0.0/s
		  ip-option                              0            0.0/s
		  proto-cksum                            0            0.0/s
		  state-mismatch                         0            0.0/s
		  state-insert                           0            0.0/s
		  state-limit                            0            0.0/s
		  src-limit                              0            0.0/s
		  synproxy                               0            0.0/s
		  map-failed                             0            0.0/s
	 root@ircd:~ #
	 
	 NOTE: Make sure you can access PKG repo.
	 
	 root@ircd:~ # pkg upgrade
	 Updating FreeBSD repository catalogue...
	 FreeBSD repository is up to date.
	 All repositories are up to date.
	 Checking for upgrades (1 candidates): 100%
	 Processing candidates (1 candidates): 100%
	 Checking integrity... done (0 conflicting)
	 Your packages are up to date.
	 root@ircd:~ #
	 
#4 - Running oidentd
		NOTE: Enable oidentd on you rc.conf file. The file is locate in: /etc/rc.conf (oidentd_enable="YES")
		NOTE: Enable: oidentd_enable="YES" Disable: oidentd_enable="NO" Disable: this line is not add on the file!
		NOTE: You can install oidentd with ports: /usr/ports/security/oidentd 
		NOTE: We install it with PKG so oidentd is ready and running only need to activate!
		NOTE: The file URL need to be in: /usr/local/etc/oidentd.conf | YOU can find a sample file:   /usr/local/etc/oidentd.conf.sample
										
	 
	 root@ircd:~ # sysrc oidentd_enable="YES"
	 root@ircd:~ # cp /usr/local/etc/oidentd.conf.sample /usr/local/etc/oidentd.conf
	 NOTE: We CP the file! So you can have a backup copy! is not the same for MV command.
	 
	 
	 NOTE: This add at the end of the file the line command we need to add.
	 NOTE: Now we need to add oidentd.conf file on the system.
	 
	 EXAMPLE FILE: 

			default {
					default {
							allow spoof
							deny spoof_all
							deny spoof_privport
							allow random_numeric
							allow numeric
							allow hide
					}
			}

			user root {
					default {
							force reply "UNKNOWN"
					}
			}

			#user eggdrop {
			#       default {
			#               allow spoof
			#               allow spoof_all
			#               allow spoof_privport
			#       }
			#}

	 
		NOTE: Now we going to create the config file.
		
		root@ircd:~ # nano /usr/local/etc/oidentd.conf
		NOTE: After we create all the stuff we need in the .conf file! we need to saved it!
		NOTE: Now we going to add the url file on the /etc/rc.conf 
		
		root@ircd:~ # sysrc oidentd_conf="/usr/local/etc/oidentd.conf"
		NOTE: This going to add on the rc.conf file what we need!
		NOTE: Now you can check the file with a simple cat /etc/rc.conf
		NOTE: The port 113 need to be open or oidentd not going to work well!
		
		root@ircd:~ # cat /etc/rc.conf
		...
		...
		...
		oidentd_enable="YES"
        oidentd_conf="/usr/local/etc/oidentd.conf"
		
		
		NOTE: Check if oidentd is ok.
		
		root@ircd:~ # /usr/local/etc/rc.d/oidentd rcvar
		# oidentd
		#
		oidentd_enable="YES"
		#   (default: "")


    	NOTE: How to start oidentd 
		
		root@ircd:~ # /usr/local/etc/rc.d/oidentd start
		
		NOTE: You can check ports with TCPDUMP
		
		root@ircd:~ # tcpdump -Xn port 113
		
		NOTE: Cgheck if oidentd is running.
		
		root@ircd:~ # ps aux | grep oidentd
                root    659   0.0  0.0 11048 2336  -  Is   13:07   0:00.00 /usr/local/sbin/oidentd -C /usr/local/etc/oidentd.conf
                root    836   0.0  0.0 11276 2576  0  S+   13:11   0:00.00 grep oidentd
		root@ircd:~ #