Re: Router / Firewall / Gateway
Adam Lydick wrote:
[a better place for this is probably debian-security]
Ah, ok will take the next there then, thanks! :-)
For a simple network topology, you can just turn on ip_forward to become
a gateway. Adding NAT will require a little bit more setup.
Really? Wow, why is everything not that easy huh?
For the rest, what do you need that iptables doesn't provide? Or are you
just looking for an easier way to configure the rules? (which I can
certainly understand)
Well I search around for tools, but nothing really popped out, so
now i'm learning iptables.
It not easy stuff, but hey, it's also no rocket science so I should
be able to figure it out...
For my setup (same scenario as your own) I just:
(1) turned on forwarding (/proc/sys/net/ipv4/ip_forward)
(2) added a NAT rule for each of my internal network cards when routing
to external networks.
(3) added forwarding rules for incoming bittorrent and SMTP traffic
(4) set up flow control with tc to cap non-interactive bandwidth usage
(this was not fun)
You had me with you up until number four here... "What's flow
control" for?
(5) added default deny for incoming traffic except for "established
connections" and a small set of allowed ports (http, ssh, etc).
I just learned about established, related etc, rules!
I tried a lot of different tools to see if there was anything better
than just using iptables directly. While there is a lot of fairly good
work, I was annoyed at the interface to most of them. One very common
problem is that they all seemed designed to run on the gateway (GUI and
all). This is not so good, as my gateway/server is a headless machine
with a very minimal set of packages installed.
Ditto, It will even be a VERY simple install. The only thing
different about it is that I recompiled the kernel to include MPPE
encryption for MS type vpn connections for my road warriors.
Yet more routing difficulties there...
All in all, I guess I really need to learn iptables before
continuing. But hey, everyone starts out that way right?
Thanks all,
Mark
Reply to: