Packetfence

Packetfence is open source NAC software.

LetsEncrypt with DNS Challenge

Packetfence does support lets encrypt for it's certificates, but it does only support a http challenge. The following script also provides DNS challenge support for cloudflare: https://github.com/rqi14/PacketFence-Cert-DNS-Challenge/blob/main/cloudflare/letsencrypt-renew.sh

Opening up firewall rules

The Packetfence ZEN distribution manages it's own firewall rules, so some ports are by default blocked. For example the snmpd port is by default not allowed, this might cause issues when monitoring the setup with SNMP when using software like LibreNMS.

To open these ports edit the following file "/usr/local/pf/conf/iptables-input-management.conf.inc", it accepts iptables arguments as lines. E.g.

-A input-management-if --protocol udp --match udp --dport 161  --jump ACCEPT

NOTE: This behaviour has changed in packetfence 15. You know have to put this data in a json file called /usr/local/pf/conf/iptables-custom.conf.inc, like this:

{
   "filter" : {
      "FORWARD" : [],
      "INPUT" :   [
        "# allow snmp access for management",
         "--protocol udp -m udp --dport 161 --jump ACCEPT"
      ],
      "OUTPUT" :  []
   },
   "mangle" : {
      "PREROUTING" : [],
      "INPUT" : [],
      "FORWARD" : [],
      "OUTPUT" : [],
      "POSTROUTING" : []
   },
   "nat" : {
      "POSTROUTING" : [],
      "OUTPUT" : [],
      "PREROUTING" : []
   }
}

Then issue a 'systemctl restart packetfence-iptables.service'