First, get yourself a 2x4 to beat yourself with when you are frustrated.
Sunday, June 25th, 2000: My net connection is down. Life sucks. I could be playing a game of Network Settlers right now, but I'm working on this doc instead.
Next, read this doc.
Since each individual requirement can differ greatly, I'll first describe my scenario, then get into the nitty gritty of the solution.
I currently have DSL line with 4 fixed ip addresses. Three of which are already in use, one for the site you are reading now. Those three are assigned currently to one machine yet different web sites that live on that machine. The fourth is assigned to another machine which I use on a day to day basis.
My requirements then were as follows:
The router is set up with two network cards, the first net card (eth0) is connected to the wonderful world of the internet (or it will be once I'm done configuring it). It has all four of the ip addresses that I want it to receive on. The second network card (eth1) runs my internal network and has the address 192.168.0.1, with a netmask of 255.255.255.0. More on how I set up the network cards below.
I installed the RedHat 6.2 distribution of linux (I tried Debian, but it failed to work with my net cards (NetGear--using the tulip drivers)). I then retrieved the most recent kernel version at the time (2.3.99-rev8), as well as the iptables source. Note that when getting the new kernel, put the .tar.gz file in /usr/src, delete the link from linux to what the current kernel version is, then extract the data as follows:
This will create a new linux directory (it would have overwritten what you already had, and we don't want that). Rename the directory to linux-<kernel version> and recreate the linux link by using the commands:
This maintains consistency if you want to upgrade later.
I built the kernel with the following settings:
Then lilo needs to be configured to recognize the new kernel. Edit the /etc/lilo.conf file and add the following:
You can do this linuxconf in RedHat, just be careful, since the wrong key will kill linuxconf. Here are copies of my eth0 and eth1 configuration. In RedHat these belong in /etc/sysconfig/network-scripts. If you look in ifcfg-eth0, (the link for eth0), you'll notice there isn't any specification for the additional ip addresses above. To configure those, the files ifcfg-eth0:0, ifcfg-eth0:1, and ifcfg-eth0:2 are needed in the same location. They contain the following lines:
All other properties it inherits from ifcfg-eth0. Note that this doesn't (shouldn't) work if your primary device is a DHCP client (your IP address is automatically assigned to you provider, not fixed IP addresses in my case).
Make sure the dhcpd daemon is running on the ethernet adapter for the internal network (such as dhcpd eth1 in my configuration).
The various entries in the dhcpd.conf are briefly described here:
| Line | Description |
|---|---|
| subnet 192.168.0.0 netmask 255.255.255.0 { | This defines what network the dhcp daemon will manage, in this case, 192.168.0.0 with a network mask of 255.255.255.0. The brace indicates a beginning of scope for this subnet. You can actually set up multiple subnets on the same network adapter, or for different network adapters. This allows setting specific configurations for each. |
| range 192.168.0.64 192.168.0.127; | This specifies the range for the above subnet. It has to fit within the subnet specified. I'll explain why I chose this range later. |
| default-lease-time 43200; max-lease-time 604800; | This specifies how long a lease will live for when it is provided to a client computer. A client computer then is required to renew their lease after it has expired. |
| option routers 192.168.0.1; | This tells where the client computers receiving IP addresses to go when they don't know where to send packets. For example, if I want to hit linuxrouter.org, I would find out its IP address. Since that IP address isn't in my subnet, the request for linuxrouter.org would be sent to the router for it to forward on. |
| option broadcast-address 192.168.0.255; | I don't know much about this option, other than it makes it work <grin> |
| option domain-name-servers 192.168.0.1; | This will automatically configure the clients to use the router as a DNS server, too. |
| option subnet-mask 255.255.255.0; | Tells the client the scope of the subnet it lives on. |
| } | The end brace ends the scope for this subnet. |
DNS uses the BIND package, you will want to make sure you have it installed. In particular, make sure you have a very recent version. There is a bug in older versions that will allow people to gain control of your machine from outside through DNS.
By default, starting DNS ('ndc start') will cause it to listen on all available IP addresses on all devices. This is really convenient. You can use linuxconf to add domain names to the names you control. These will be names you have registered that are set up to point at your machine for resolving names for your domain.
You will also probably want your ISP to host your secondary. If your connection to the ISP fails for some reason, at least people will still get the correct IP address, and, since they control the reverse lookup table for your IP address, they can set up the reverse lookup to correctly point to your domain instead of something meaningless.
Then you will want to set up your DNS to propagate to your secondary. I haven't done this yet, but speculation would suggest just indicating the IP address in linuxconf.
Finally, you will want to set up forwarder addresses in DNS. These are addresses of other DNS servers 'close' to you that might be faster to query for the IP address desired than necessarily going to one of the top level domain servers and working down to the desired name server for the domain being queried.
Some other notes:
A 'sample' /etc/named.conf can be looked at here. For more info, you should look at the HOWTO for DNS (link above).
You need to download the source for this from The Net Filter homepage at Penguin Computing or from Rusty's Remarkably Unreliable Guides. Please keep in mind the minimum requirements for building IP Tables. This will do alot of the magic we need. There are a couple of other utilities of note, too: ip, tulip-diag, and mii-diag. The last two are net card diagnostic utilities which are primarily useful if you are using the Tulip drivers (which is what the NetGear FA310TX uses). The first (ip) expands upon what is possible to route in the routing tables, going much farther than 'route' does. Hopefully I'll have links to these sometime soon. My net connection (see notes above) is currently down, so I'm flying blind at this point for resource links (not that I have many).
I've created a number of quick scripts to make my life easier. All they do is take some arguments and use them with commonly used settings for NAT (network address translation). They were created as separate scripts so I could adjust them on the fly, rerun them, and have the new settings take effect immediately. The paths specified are where I decided to place these commands.
This setup allows me to access my web servers from anywhere on my internal net using their "outside" address. So if I query www.oneoddsock.com from inside my network, I will get to it properly. However, this does not work from the firewall box itself. Take note of this when testing your configuration.
Finally, you need to run all these handy commands from somewhere, such as /etc/rc.d/rc.local. You will notice it adds hosts for dhcp, as well as my other 'domains', not that I really use them. I call the filtering rules first to prevent an attack happening during boot getting in, then I set up NAT, then I set up IP forwarding, which is CRUCIAL if you want this to work. This is the last line in the file.
This was put together as a quick guide as well as a store of information if I ever had my linux box compromised and had to rebuild it. It was also intended for anyone who was trying to do something similar. Why didn't I use Win2K or NT? I needed NAT, and I needed to run it on a machine that is a P133 with 32MB of RAM. WinNT and Win2K have lots of cool features, but they are both pigs. I am not responsible for the design decisions that put them in that state, though I sorely wish to do something about it. So many possibilities there...
You can email me at my SpeakEasy address if you are having problems, and if I can't solve it, consider subscribing to the netfilter listserv at netfilter@lists.samba.org (assuming I have that right). The process is described on the NetFilter page (somewhere).
If you have comments, suggestions or questions, mail me at:
bscriver@speakeasy.org