setting up a firewall/router

ka0ttic · Posted: Sun Feb 01, 2004 9:15 pm Post subject: setting up a firewall/router

I've been using Linux for about 7 years now (since Debian 0.99), but I've never attempted to setup any kind of firewall or router using it. I'm basically looking for some tips and links to any resources.

I am trying to configure a firewall/router for my home LAN. I have installed Gentoo on a P233 MMX with a vanilla 2.6.1 kernel and NPTL.

I have two NIC's configured:

eth0 is a 3com 3c900 which will be connected to a cable modem and assigned an IP address via DHCP (do I just put iface_eth0="dhcp" in /etc/conf.d/net?)

eth1 is a Linksys 10/100 (tulip) that has a static IP for the LAN

I've emerged iptables and portfw already. Any other software I should put on here? Maybe dns cacheing or somethig?

I've enabled IP fowarding via sysctrl interface, and have compiled netfilter support into the kernel.

Am I missing anything here? Anything else I need to do?
Also, if there any way I can test it once it's setup w/o actually having it hooked up to the cable modem?

Thanks,
Aaron

jcosters · Posted: Sun Feb 01, 2004 9:37 pm Post subject:

You should create some rules with iptables. Check the iptables man pages.
After creating the rules, use the iptables init script to save your rules (/etc/init.d/iptables save) and start the packet filter (/etc/init.d/iptables start).
Also, the iptables init script should be started in the default runlevel (rc-update add iptables default).
As for testing, you can hook up another PC to the NIC where your cable modem is normally connected to.

boroshan · l33t Joined: 16 Apr 2003 Posts: 730 Location: upside down

There are a pile of iptables front ends in emerge, but in the end I was happiest going with the scripts from the howto on the netfilter site http://www.netfilter.org/documentation/

I never got around to using DHCP (well I did briefly, but then my hard drive exploded and I never gor around to doing it again). In any event, it's not needed - assign your work machine a local IP like 10.0.0.1 and eth1 on the gateway as 10.0.0.2 (say) eth0 stays set up for your ISP.

Make sure you have NAT/Masquerade enabled and possibly nat of local connections in the kernel.

For testing - the one I can remember off hand is the shields up page at http://www.grc.com or the firewall checker at http://www.auditmypc.com/freescan/prefcan.asp

have fun

_________________
Don't let THEM immanentize the Eschaton!