Printable View
Hi,
I have a cable modem, dedicated linux server and a home LAN. I want to use NAT and I need to have a firewall on the server. I want FTP and HTTP servers on the server.
I know I need to use iptables, but I don't know how to write the script. Any resources I could look at? Would a kind soul send me theirs so I can try and create my own?
Thanks,
Keymoo
--
[email protected]
replace 0 with o
Right on! Dedicated linux server, woo!
Anyways, to make life easier, it might be better for you to get a DSL/Cable router (4 port) so that you'll have the hardware firewall and it does internal nat for you. IPChains is great, but you really have to know the internals of how it works and if your linux box is doing all the work, including the server side (web/ftp/mail/etc) then you might have more problems on your hands in configuring everything, and you also have to have two nic cards in it, one for the cable modem and one for the link to the hub where all your other traffic goes.
I can give you the setup for the Dlink/Linksys router (4 port) which might be the best way to go:
1: connect your cable modem to the WAN port of the 4 port router.
2: connect all pcs and your linux servers to the individual ports to the router (you can daisychain hubs off a port btw)
3: on a windows pc, set your TCP/IP to obtain automatically, with the gateway set for 192.168.1.1 (default for the router) and reboot.
4: still on this pc, open your browser to http://192.168.1.1 and log in (they supply the user/pass). From there, put in all your information for your ISP on the main page (there's plenty of onscreen help) and have your router set for static IP handouts. When this is done, it'll say to reboot the router. When you do, go ahead and reset your TCP/IP to an individual IP like 192.168.1.100(101,102,etc) and assign each machine internally an IP address like that, with the gateway on each machine pointing to 192.168.1.1 and all DNS information entered in the DNS page (enable DNS for windows).
That should take care of your windows machines.
Now, for your linux machine, whatever distro you're using, make sure the gateway is listed as the router, and all dns information is put in resolv.conf. If you need more help on this, pm me with your hardware/linux setup and I can help out more.
Now, to configure all services on linux to be accessible outside, (with example IP of 192.168.1.102 for the linux server), go back into the web page for the router (mentioned above) and in the advanced page, you'll find something that allows port forwarding. Ports 21 for ftp, 22 for ssh (I don't recommend leaving 23 open), and 80 for web traffic should be put in the boxes with it pointing to your linux server IP.
With these being allowed, you'll be able to run services behind a hardware firewall without too much worry of DDoS or other things.
Hope this helps and if I missed something, I apologize, as I'm in a hurry right now.
Thanks for the help - but that's not what I really want. I need the routing/firewall done on the linux box - I don't want to buy a hardware router.
I know it's gonna take me a while to get it all set up - perhaps months, but I don't mind cos it's all a learning experience for me. I currently have a Win2000 server box which is doing this stuff for me at the mo and it does it very well, but I want to move it all over to Linux and perhaps use a linux workstation too instead of WinXP.
If anyone else could help, that would be appreciated.
Thanks,
Keymoo
It took me about an hour to set this up last night, and that is with little linux administration experience. I followed the steps in this article:
http://www.unixgeeks.org/security/ne...sc/ipmasq.html
In addition, it is also beneficial to consult the NET3-HOWTO, the IP-MASQUERADING-HOWTO and the IPCHAINS-HOWTO, which can all be obtained at
http://www.linux.org
good luck PAL
Autumn Regret,Quote:
Originally posted by autumn regret
It took me about an hour to set this up last night, and that is with little linux administration experience. I followed the steps in this article:
http://www.unixgeeks.org/security/ne...sc/ipmasq.html
In addition, it is also beneficial to consult the NET3-HOWTO, the IP-MASQUERADING-HOWTO and the IPCHAINS-HOWTO, which can all be obtained at
http://www.linux.org
good luck PAL
The link you provided above shows you only how to do IP MASQUERADING, not NAT (Network Address Translation). There is a very fundamental difference in that with NAT, you can forward say, HTTP requests coming into your IP to another computer on your lan, and then back again.
As for the original query by keymoo, check out the following url:
http://netfilter.samba.org/unreliabl....linuxdoc.html
It's the NAT-HOWTO directly from the netfilter team, so it should be pretty accurate. This sounds more along the lines of what you're looking for.
Keymoo, I would also be interested in how everything turns out, as I'm about to do this myself. If you could email me some tips/tricks/things to watch for at [email protected], I would greatly appreciate it.
directly from the http://www.unixgeeks.org site:
and:Quote:
4.5.1 What Is A Masquerading Firewall Anyway?
A masquerading firewall is simply an application/kernel modification that acts as a go-between for the masqueraded machines (the winbox in our case) and the internet. It receives requests from the masqueraded client(s) and forwards those requests on to the internet address of the target machine. In this way, a masquerading firewall is a packet filter - it filters network traffic based on information contained in the headers of network packets.
As you can see, ipchains has the ability to forward packets to and from various network interfaces. Coupled with the IP masquerading, would you not say that this is a NAT solution?Quote:
'ipchains' is initialized with just three rules or 'chains', input, output
and forward. When a packet arrives at a network interface it's fate is
determined by the input chain; if the packet is accepted by the input
chain, the kernel forwards the packet according to the destination address.
Maybe this tutorial can be of any help?
Quote:
As VictorKaum would say, get BBIagent (www.bbiagent.com). It's a floppy disk oriented program that does it all for you. And it's great for that machine sitting in the corner collecting dust. That is, if you have another machine to run in front.
Yep, thx Vorlin,
If you don't want to spend time (more or less depends on your Linux and protocols knowledge) configuring iptables, ipmasquerading,... use that BBIagent on a cheap box.
after installation you can even remove the keyboard and the monitor from the box without a prob...so the only thing you need is a computercase, an old motherboard, ram, FDD, 2 NIC's and 1 floppy...
I did not say that ipchains wasn't a NAT solution. IP Masquerading is different from NAT in that IP Masquerading takes one public IP address and allows several PCs on the same LAN to share it and access the internet at once, while NAT is a straight translation of public IP's port into a LAN IP's port and vice versa.Quote:
Originally posted by autumn regret
directly from the http://www.unixgeeks.org site:
As you can see, ipchains has the ability to forward packets to and from various network interfaces. Coupled with the IP masquerading, would you not say that this is a NAT solution?
NAT is far more complicated than Masquerading.
Thanks for all your replies - I have a ton of material to read through - I'll let you know around Easter time how I get on! :eek:
Not sure whether I need NAT or Masquerade now - here's my setup:
Internet --> [Cable Modem] --> [eth0|Linux box|eth1]-->[Hub]-->LAN
Make sense? Pretty common setup, I think. I need all LAN machines to access internet resources, and I would like most server software on the Linux box - I want the ability to have certain server stuff in the LAN for testing purposes so would need NAT for that (masquerade?).
Thanks - please clear up my confusion.
Keymoo.
To do port forwarding in ipchains is not that hard. Do a search for ipmasqadm. I have an http/mysql server setup running behind a dialup firewall that forwards port 80 to my web server.
OK, I've got my firewall running well at the moment. Find attached my script (completely stolen from another website). I need to tweak the script to do the following:
1) Cope with dynamic IP - I've set the $INET_IP variable to my current DHCP assignment. How can I change this script to cope with dynamic IP? eth0 is my dynamically assigned internet-facing network card.
2) Block all outgoing traffic except ports 21,53,80,110,119,123,443,3389,6667-6670,8080
Thanks,
Keymoo
I'm also going to take a look at this
http://muse.linuxmafia.org/gshield.html
to see if it will make my life any easier.