Firewall and mail server questions

lotas

Ok. i can put this simply. I need to replace a box, currenty running clarkconnect (www.clarkconnect.org) with gentoo. Clarkconnect is an out of the box solution. It has squid, firewall, web server, mysql server, FTP, SSHD, mail server (smtp, Imap, pop3 and webmail) and various other things, including webmin. I already have apache, sshd, squid, mysql, and webmin installed, but is there a quick and easy to use app for Firewall configuration? I have no X windows installed on said box, but my workstation is running gentoo too. It has X windows. I would like a web based option if posible (ssl would be a must!) and id also like to be able to have internal ports open only for inside. EG on the clarkconnect box i can gain access to port 10000 (webmin) from inside but not outsite, and same with port 81. If theres an option for port forwarding that would be nice, but not 100 % necessart ATM.
Thanks in Advance for any tips, apps, etc.
_________________
Lotas T Smartman
www.lotas-smartman.net
www.the-hairy-one.com
www.lsn-blog.tk
Dual Athlon 2Gz, 1Gb ram, 120Gb hdd, GeForce FX5200, DVD+R/-R/+RW/-RW, CDR/RW

klieber

lotas · Posted: Tue Oct 29, 2002 6:42 pm Post subject:

Kool, thanks! Im reading the thing now and im going to start looking at some stuff in a while. I thank you for your responce!
_________________
Lotas T Smartman
www.lotas-smartman.net
www.the-hairy-one.com
www.lsn-blog.tk
Dual Athlon 2Gz, 1Gb ram, 120Gb hdd, GeForce FX5200, DVD+R/-R/+RW/-RW, CDR/RW

lotas · Posted: Wed Oct 30, 2002 12:48 am Post subject:

Ok. I have just taken the advice from that link and this is what im getting now.

Expiscor · n00b Joined: 30 Oct 2002 Posts: 2

GPL-veriosn of smoothwall... I like it... Just FYI!...

www.smoothwall.org

bluesky · Apprentice Joined: 14 Aug 2002 Posts: 230 Location: USA

There is a tutorial of stateful firewall by D. Robbins also quite good. Sorry I can't recall the exact URL but it is published as a ibm developper's works . Gentoo's moderators will surely know about it. It is a very good start for newbies.

_________________
bluesky

"free as the wind"

lotas · Posted: Wed Oct 30, 2002 6:45 pm Post subject:

tried that smoothwall, but i dont want to have a box just dedicated to being a firewall. Well i dident at the time. things may change soon. I like the all in one box approach. anyway, ill also look at the IBM developer works thingy. Thanks for the replys. now working on getting this all up and running by about friday or saturday. back in college after mid terms on tuesday, and want to have it all working by then.
_________________
Lotas T Smartman
www.lotas-smartman.net
www.the-hairy-one.com
www.lsn-blog.tk
Dual Athlon 2Gz, 1Gb ram, 120Gb hdd, GeForce FX5200, DVD+R/-R/+RW/-RW, CDR/RW

klieber · Posted: Wed Oct 30, 2002 7:09 pm Post subject:

lotas · Posted: Wed Oct 30, 2002 7:53 pm Post subject:

yep. i found that actually. :oops:

So im now wainting on the compile to finish. Im using the vinalla sources, so no patches. Strangly enough, i found out something. It takes 27min to do the make bzImage on my K6-2 450 and 7 minutes to do it on my Athlon 1.0Gz. Its mad. the athlon is only 2.2 times faster in Mhz, but because the memory is 2X faster (66mhz in the k6, 133 in the athlon) and the hdd is faster by about 33% in RPM and a futher 33% in transfer speed, i makes the whole thing about 4X faster! anyone else getting speed increeses like this? Sorry for the off topic thing.
_________________
Lotas T Smartman
www.lotas-smartman.net
www.the-hairy-one.com
www.lsn-blog.tk
Dual Athlon 2Gz, 1Gb ram, 120Gb hdd, GeForce FX5200, DVD+R/-R/+RW/-RW, CDR/RW

bluesky · Apprentice Joined: 14 Aug 2002 Posts: 230 Location: USA

>A great, great tutorial for rolling your own iptables script is here.

I agree, it's an excellent article. But, unfortunately, the iptables kernel terms are not the same if you use "make menuconfig" (command line) instead of "make config"(KDE). Although they are SOMEWHAT similar but FAR from similar. Is there a conversion table somewhere? :wink:

_________________
bluesky

"free as the wind"

ronmon · Posted: Tue Nov 05, 2002 12:49 am Post subject:

I use Gentoo and Shorewall on my firewall/router/WAP box. It's a text editor type setup, but pretty easy to deal with once you understand their approach. You can contol 'zones' or individual boxen and it's very flexible as to how and on what type of machine you run it (router, server, standalone or whatever). And the documentation is top notch.

It is worth looking into.

(Edit) I just noticed on their site that Shorewall is now in Gentoo. That should really make it easy :)

lotas · Posted: Tue Nov 05, 2002 12:52 am Post subject:

Ill try it out! thanks
_________________
Lotas T Smartman
www.lotas-smartman.net
www.the-hairy-one.com
www.lsn-blog.tk
Dual Athlon 2Gz, 1Gb ram, 120Gb hdd, GeForce FX5200, DVD+R/-R/+RW/-RW, CDR/RW

Naughtyus · Posted: Tue Nov 05, 2002 4:24 am Post subject:

Just curious, why are you wanting to get rid of clarkconnect if it was working fine for you?

thehyperintelligentslug · n00b Joined: 30 Jun 2002 Posts: 49 Location: Edinburgh

Hi,

I am planning on doing this too. (Moving from ClarkConnect to Gentoo).

My reason is because after being a RedHat user (BTW ClarkConnect is based on RedHat), and moving my main machine and my Laptop over to Gentoo I have 'seen the light'!

A big reason is because Gentoo is much easier to keep current.

As for firewall / forwarding scripts, why not modify the ones you have in place on Clark Connect. That is what I was intending on doing when I make 'the move'.

Cheers,

Neil...

lotas · Posted: Tue Nov 05, 2002 4:29 pm Post subject:

im moving for pertty much the same reason as thehyperintelligentslug. On clarkconnect you ware limited to RPMs and Redhat 7.1 based software. I wanted the latest copy of apache (1.3.26 just before i got my new box) and the only one i could get for clarkconnect was 1.3.23. PHP i think was version 4.1.2 and a lot of packages couldent be upgraded because they ware "needed by clarkconnect". Dont get me wrong! the distro was great! worked out of the box, no messing with config files etc, but after about 5 months, and a new server, i just wanted a change. some a bit more powerfull. something customizable. I had run gentoo on my workstation, and when i seen the 1.4 version with the prebuild parts for the K6-2 (whats in the box now) i was sold! Great distro guys!!!
_________________
Lotas T Smartman
www.lotas-smartman.net
www.the-hairy-one.com
www.lsn-blog.tk
Dual Athlon 2Gz, 1Gb ram, 120Gb hdd, GeForce FX5200, DVD+R/-R/+RW/-RW, CDR/RW

Naughtyus · Posted: Tue Nov 05, 2002 6:47 pm Post subject:

Makes sense. I've never used any of the clarkconnect-like packages before, so I wasn't sure on how well they work, etc..

I'm going to have to set up a firewall on my server in the near future - for someone who's never set up iptables (or anything like them) before, would you (anyone) reccomend something like shorewall, or going at it on an individual package basis?

What are the downfalls of using something like shorewall?

splooge · l33t Joined: 30 Aug 2002 Posts: 636

This is my favorite:

http://projectfiles.com/firewall/

Works right out of the box basically, just configure what external ports you want open to traffic and that's it.

lotas · Posted: Tue Nov 05, 2002 7:05 pm Post subject:

the one i used was this one: http://morizot.net/firewall/gen/index.php. its a script thats run on their servers, but you can download it and run it on your box if you want. It generates a firewall script, and all you have to do is download the text file, chmod it to 755 and then run it. works like a charm!!! I just opened the ports i wanted open, and then everything else is blocked. I would, how ever, like to figure out how to tell it to allow ping and traceroutes. Im having a problem with that. my firewall (running gentoo BTW!) is comming up as * * * 10.0.1.1. i know the next one is, for some reason, ment to do that (NTL's MBR for cable modem) and then everything else works grand. It does slow traceroutes down a lot with the router not working. any ideas on what ports are ment to be open?
_________________
Lotas T Smartman
www.lotas-smartman.net
www.the-hairy-one.com
www.lsn-blog.tk
Dual Athlon 2Gz, 1Gb ram, 120Gb hdd, GeForce FX5200, DVD+R/-R/+RW/-RW, CDR/RW

splooge · l33t Joined: 30 Aug 2002 Posts: 636

Sounds like your firewall script has ICMP blocked.