2

I have an OpenBSD firewall where I have to change the IP on the admin interface (including changing subnet/gateway) and I'm looking for how to do this remotely without losing my SSH (so I can fix things if there are problems).

Here is how I imaging being able to do it:

  1. Add the new IP as an alias to my network interface. (Question: How do I properly add an IP on a different subnet than the orignal IP? http://www.openbsd.org/faq/faq6.html#Setup.aliases is unclear on whether there is anything special to do for a different subnet besides specify the netmask)

  2. Add the new gateway with route. (Question: Should I add it as a 'default' gateway or just for the new subnet?)

  3. SSH to the new IP.

  4. Write a script to if down both the old and new IPs and up the new IP as the main interface IP, At this point I most definitely need to add the new gateway as a default gw right? Run it from within screen so it keeps going if network temporarily drops. (Question: Should this do the job? Are there any special gotchas I should keep my eye out for? Any tips on what commands to run to do this properly?)

thelsdj
  • 830
  • 1
  • 11
  • 25

3 Answers3

3

Using tmux or screen open a shell session for sleep NSECS && reboot (NSECS 300 is often quite ok but YMMV) — this would allow re-gain access with previous settings if re-configuring went wrong. Yeah, that's an outage but better one. You can use shutdown -r +min if you like reboot alarming on the console :-)

In other shell session assign alias to the interface. Nothing special if the networks aren't overlapping, just use proper mask (not /32). Then use route change default (see manual). Actually, you can use a shell script pinging some remote host and making route change default old-gw in case there were no echoes). This would save you rebooting in case new gateway settings aren't working.

Basically that's it.

P. S. Don't forget canceling rebooting if mission succeeded. ;-) Don't forget saving new settings in configs as well.

poige
  • 9,171
  • 2
  • 24
  • 50
0

I would configure the serial port for a terminal and have it hooked up to a laptop or something else out of band. Make all your changes from this entry point.

jftuga
  • 5,572
  • 4
  • 39
  • 50
  • This is a production firewall at a remote colo. So that isn't really an option, and my budget doesn't allow for KVM over IP or something similar. – thelsdj Sep 16 '11 at 18:11
0

Use your redundancy

If you're so concerned about outage, I assume you have at least two firewalls running CARP and related services.

If you don't have two, you're going to have an outage whenever a disk or a PSU dies or when you upgrade to OpenBSD 5.0 in a few months.

Edit the relevant /etc/hostname.if(5) and /etc/mygate on box1 with the new IP address. Reboot box1. When it comes back up, ensure everything works.

When you're sure it's ok, edit /etc/hostname.if(5) and /etc/mygate on box2 with the new IP address. Reboot box2 and ensure everything works when it comes back up.

SPoF

If you really only have one box, edit hostname.if and mygate with the new IP address and reboot when there are fewest users on.

You'll want to reboot the system anyway to ensure the right IP is configured. If you wait 6 months and your change is broken, you won't remember why and you might spend hours on the problem instead of just fixing the problem right away.

Alex Holst
  • 2,200
  • 1
  • 14
  • 13
  • Good suggestion. Without having redundancy in place I say (if possible) schedule a window of downtime in the middle of the night and do it. – Safado Sep 16 '11 at 19:03