Firewall

Tron · Posted: Tue Oct 08, 2002 11:47 am Post subject: Firewall

I have a network of 40+ computers with two servers a Win2k and a Gentoo linux box. They are on a T1 line and I have a 6Mb DSL line I want to network using port forwarding or something to route all web traffic to the DSL. I want to use the linux box as a firewall for the whole network using iptables and squid to route to the dsl (which I understand to be correct). I would also possibly run DHCP, DNS, and a web server on the main linux server and then move the firewall and proxy to one of my extra 450MHz sitting around. Is this at all possible and will it work like I think it will? If you need any extra info like network set up and exact hardware I will be using just ask. My isp is offering a firewall box which is $500 that I wont spend and I think this would be a better learning experience and more fun. All the user computers are running XP by the way and I doubt that would effect anything.

I have no problems setting up anything web related which I have done before. I am just new to firewalls on networks with a T1 line.

Thanks,
Tron

btg308 · Posted: Tue Oct 08, 2002 12:33 pm Post subject:

I've set up several P133-class boxes with Gentoo as firewalls, no sweat. Most of them are just one LAN, one Internet setup but one of them have three NICs; one LAN, one 256kbit DSL leased line and a DHCP Breezenet radio link. This one does NAT and routes traffic from both external interfaces into the main web and mail server and routes traffic from 10+ workstations out to the Internet. What I did was find a good sample firewall script and then I hit the manpages and howtos until I had a working setup.

I'm not sure how you want the T1 and DSL lines setup in your case - do you want to use load-balancing for outgoing traffic or route everything to one of them until it goes down and fail-over to the other, or just lock everything to one and use the other for something else?
_________________
Gentoo Linux - Feel the speed.
Kawasaki GPZ 1100 - The need for speed.

Tron · Posted: Tue Oct 08, 2002 8:10 pm Post subject:

ok I dont want NAT it has trouble with games like starcraft. Right now everything is connected to two cisco switches and the router is connected to the switches. I would want to keep everything like that and the router just to do packet inspection and I guess I could use snort to do intrusion detection. I dont wan the router connected to the firewall then connected out to the switches where it shares everything. I know with squid this won't be a problem because the computers will have to connect to linux box to work. So will the fact they have to connect for squid take care of the firewall wall part to? Well I would want all port 80,21,25 and so on routed to the 6Mb DSL while things like games are routed to the T1 line. I know all the ports for all my software so that wont be a problem.

Thanks,
Tron
p.s. I just woke up so if its unclear I will try and clear everything up. =)

Tron · Posted: Wed Oct 09, 2002 11:03 pm Post subject:

Please can anyone help?

Thanks,
Tron

carlivar · Posted: Thu Oct 10, 2002 3:55 am Post subject:

Using two different internet connections for the same LAN can be very complicated. Problem is, your Linux firewall can only have one default gateway. So which Internet connection will the default gateway go to? You can get around this with policy routing (source routing) on a decent Cisco router, which might be an option depending on what model you have. Maybe Linux can do this sort of advanced routing too; I'm not sure. I should check... anyway you might want to describe clearer exactly what you're looking for... your posts were a bit hard to follow!

Carl
_________________
"It is difficult to make our material condition better by the best law, but it is easy enough to ruin it by bad laws." - Theodore Roosevelt

Tron · Posted: Thu Oct 10, 2002 7:54 am Post subject:

ok I have two servers a Dual P3 1GHz running Gentoo and a Dual 2200+ running Win2k. I have them connceted to a couple of cisco switches as well as 40+ other computers for employees and customers. I also have a T1 line and a 6Mb DSL line.

I want to install linux on an extra computer I have there 450MHz and whatever else I need to buy. I might even buy a 1GHz Athlon and use it. I want to make this computer a firewall and proxy server using squid. I was wondering if squid would be able to route all web traffic and ports like 21, 25, etc. through the ADSL line. And all game traffic will be routed through the T1 line. If I understand correctly it might work with out doing to much since I will be using the proxy servers ip in my proxy settings in internet explorer's options.

I also don't want to have the router->firewall computer->switch->network. I would rather it just do packet inspection or something so I could keep using DHCP and not use NAT since a lot of game's don't like it.

I wouldn't mind the above situation if I could use something other then NAT for security.

Thanks,
Tron

de4d · Posted: Thu Oct 10, 2002 8:56 am Post subject:

ive tested equal cost multipath with 2 nat'ed DSL lines, which worked fine.

if u dont like NAT (which i would prefer for internal networks...), why dont you just replace your (main) router by a linux box? then u will have no problems about firewalling, routing, balancing and you wont have to relayout/change your subnets.

Tron · Posted: Thu Oct 10, 2002 9:21 am Post subject:

Well the T1 line routes through the cisco router and the dsl is on the cayman. The Cisco has another module slot for DSL but I am not sure it will work together. My isp is not very helpful with anything since it is thier router. I managed to change the password to the router and I was cut off the net till I gave it back to them. They wont even enable the routers built in firewall or DHCP.

I will do some more research on squid and either iptables or ipchains I dont know which one is the new one I forgot. Like I said I dont mind the nat situation where the computer routes but I dont like nat it breaks a lot of games and that is what we need.

Thanks,
Tron

de4d · Posted: Thu Oct 10, 2002 10:24 am Post subject:

i could think of a linux box with all your client ips 'simulated' to your hardware router and the router ip 'simulated' to your client in between (i.e. 2 network interfaces).
maybe this is nothing new, or a general workaround to misconfigured routers, but it *may* solve your problem ;)
_________________
void main(){fork();main();}

btg308 · Posted: Fri Oct 11, 2002 11:54 am Post subject:

Tron · Posted: Fri Oct 11, 2002 7:59 pm Post subject:

Thx I will check those out for sure. And yes if you have more then one person playing starcraft, quake2, etc. on the same server it will lag big time or not even work.

-Tron

btg308 · Posted: Mon Oct 14, 2002 6:09 am Post subject:

Tron · Posted: Mon Oct 14, 2002 6:24 am Post subject:

I have 70 ips. And starcraft doesnt work blizzard admitted to this.

-Tron

btg308 · Posted: Mon Oct 14, 2002 5:43 pm Post subject: