ADSL Router - Linux Firewall Setup

[Angry Geek]

Hi,

Planning on putting to use some old hardware acting as a Linux IPtables based firewall behind a Zyxel router. I have a dynamic address assigned by the ISP and the router currently does NAT and DHCP. It also acts as a *very* basic firewall.

I'd like to have a setup similar to this basic design.

ISP
|
|
Router
|
|
(eth0: 192.168.1.*)
Linux Firewall/Gateway
(eth1: 10.10.10.*)
|
|
Clients (DHCP?)

I'm bit confused at to whether or not to turn off NAT and the ACLs on the router completely and let the Linux box to all the NAT or just leave as is. Pros and cons?

Any issues with clients picking up DHCP from the firewall or best left as static?

Ideally I'd like to turn the firewall into a fully functional gateway, perhaps doing spam filtering and even virus content scanning. Suggestions, good bad past experiences?

One of the reasons for doing this, according to Zyxel, becuase of all the Viruses on the net, the NAT table on the router gets filled up quickly. Causes it to crash and reboot. Known issue - apparently! I'd also like to have somethign a little more secure than a router with a few control lists.

Never really touched IPtables as such before, used smoothwall before, but this time I'd like to get my hands dirty!!!

Absolutely any advice would be cool.

TIA.
_________________
Linux user 327411. Go get counted!

[ckdake]

I woudl stick with just using one firewall because multiple firewalls sometimes just act pretty strange. let the linux box do all of the NAT. I am working on a setup similar to what you are trying to do however I am not using the router at all:

DSL modem has an ethernet port, that goes to eth0 on the linux firewall box (which also acts as a router)

eth1 on the linux firewall box goes to a switch which everything else is plugged into and the linux firewall box takes care of the dhcp/nat thing.


You could have eth1 go to the router and dhcp that way, but i wouldn't put the router between the firewall an the internet.
_________________
http://ckdake.com/