Wired Networking and VPNs

Wired Networking and VPNs

Ethernet is normally configured through /etc/rc.conf. Replace every sample interface, address, key, and hostname with values supplied for your network. Do not apply a static or VPN configuration unless you know the required addressing, gateway, and credentials.

Identify the Ethernet interface

Interface names combine a driver and unit number, such as em0 or re0. Find the interface and its link state:

ifconfig -l
ifconfig
pciconf -lv | less
dmesg | tail -100

For an active wired connection, ifconfig normally reports status: active. If no suitable interface appears, the driver may not be attached or the adapter may need a driver from mports.

DHCP and static IPv4

Most home and office networks use DHCP. Add this to /etc/rc.conf, substituting the detected interface:

ifconfig_em0="DHCP"

For a static address, use the values assigned by the network administrator:

ifconfig_em0="inet 192.0.2.10 netmask 255.255.255.0"
defaultrouter="192.0.2.1"

The example addresses are reserved for documentation and will not work on a real network. After changing the configuration, apply it locally or reboot when convenient:

doas service netif restart
doas service routing restart

Restarting networking ends SSH and other active connections. Use console access or a maintenance window when changing a remote system.

IPv6 and adapters

For networks that provide IPv6 router advertisements, add:

ipv6_enable="YES"
ifconfig_em0_ipv6="inet6 accept_rtadv"
rtsold_enable="YES"

For static IPv6, use the allocated prefix and router, for example ifconfig_em0_ipv6="inet6 2001:db8:1::10 prefixlen 64" and ipv6_defaultrouter="2001:db8:1::1".

The MidnightBSD wiki lists optional drivers for some hardware: net/aquantia-atlantic-kmod, net/realtek-re-kmod, net/intel-ixl-kmod, net/intel-ix-kmod, and net/intel-em-kmod. Identify the chipset with pciconf -lv first; many adapters already have a base-system driver.

If a working link drops or transfers fail, test another cable and switch port before changing settings. The wiki notes that some adapters are more stable with hardware offloads disabled; test only when diagnosing a real fault:

ifconfig_em0="DHCP -lro -tso -rxcsum -txcsum -txcsum6"

WireGuard

MidnightBSD provides the wg utility and, on releases with it, the wg(4) interface driver. Confirm the driver is available, then create a tunnel interface:

man 4 wg
doas kldload if_wg
doas ifconfig wg0 create
wg show interfaces

Generate and protect a private key. The provider or peer administrator supplies the tunnel address, peer public key, endpoint, and allowed IP ranges:

umask 077
wg genkey > ~/wg-private.key
wg pubkey < ~/wg-private.key > ~/wg-public.key
doas wg set wg0 private-key ~/wg-private.key peer provider-public-key endpoint vpn.example:51820 allowed-ips 10.8.0.0/24
doas ifconfig wg0 inet 10.8.0.2/24 up
wg show wg0

Whether allowed IPs include only private networks or all traffic is a policy choice. To load the driver at boot, add if_wg_load="YES" to /boot/loader.conf. Never publish private keys or put them in shell history.

OpenVPN

For a provider or organization that supplies an .ovpn profile, install the OpenVPN client from mports and test it interactively:

doas mport install openvpn
doas openvpn-client /path/to/provider.ovpn

The helper includes the client up/down scripts supplied by the mport. Treat the profile and its certificates as credentials, obtain them only from the provider or administrator, and review them before use. Configure a long-lived OpenVPN service only after the interactive connection works.

Troubleshooting

See Desktop Troubleshooting for diagnostic guidance and Wi-Fi Setup for wireless interfaces.

Further reading