Making a Gentoo gateway box

[jtmace]

I have a gentoo box i am trying to make a gateway machine for the local computers to be able to access the internet through it.

I have read the howtos and even bought a book on linux firewalls with iptables, but i can get this darn thing up for nothing.. I know its on the server side (my client machines are properly configured).

Can anyone give me a quick and dirty overview of the setup. I'm not worried bout security or any advanced iptables funtions right now i just want to get ti up and running so clients will quit complaining

Can anyone please help??

Thanks
jtmace

[delta407]

Do you have a 'real' IP block? Do you want a router with packet filters? Would it be easier to use an HTTP proxy?

[pjp]

I've been toying with this idea. Haven't done much research yet (mainly cause the machine isn't
operational right now). Would be a P90 with small HD (or 2) and non bootable CD drive. It would
replace or assist my Linksys router (Firewall/dhcp server maybe other related functions, not sure
what else to include.). Was thinking about making a CD/bootdisk to install from, or do it via
network. Not sure which would be easier. In any case, I would want to compile stuff on my faster
machine. So, questions (opinions & recomendations wanted):

1) Install via network (from my main machine, not internet) or via CD containing all or most
necessary files?
2) Is it a viable option to mv all binaries of what I've already compiled. Change my CFLAGS to
work with a P90 and recompile for the P90. Then, return CFLAGS and original binaries to normal?

Hope that is clear enough. Also, I hope this is related enough to what jtmace was asking about.
Not trying to steal your thread.
_________________
Quis separabit? Quo animo?

[delta407]

Read my thing in this thread to get an idea of what I did to build my system on a faster box and move it onto a slower one, but yeah, Gentoo works fine as a gateway. (Experience, here... hee hee .)

[pjp]

[pmj]

/sbin/iptables -t filter -A FORWARD -i eth1 -o eth0 -s 192.168.0.0/24 -d ! 192.168.0.0/24 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -i eth0 -o eth1 -s ! 192.168.0.0/24 -d 192.168.0.0/24 -j ACCEPT
/sbin/iptables -t filter -A FORWARD -j DROP
/sbin/iptables -A POSTROUTING -t nat -s 192.168.0.0/24 -d ! 192.168.0.0/24 -j SNAT --to-source your.gateway.ip.address
echo 1 >/proc/sys/net/ipv4/ip_forward

change your.gateway.ip.address to whatever your ip addy is for the outside world, and that should work. [I can't remember where I found this, but I've been using it for ages, and has always worked for me!]

hope that helps, cheers.
_________________
pmj / [a]orange

[hamletmun]

HOWTO - Make your Internet Connection Sharing to work

From ISP to GENTOO - (eth0:DHCP or STATIC IP)
From GENTOO to WINDOWS - (eth1:192.168.0.1)

1.
insmod your.nic.module (i.e. "insmod 3c59x") for both nics if differ

2.
if your ISP uses DHCP, "dhcpcd eth0"
if static, "ifconfig eth0 your.static.ip netmask 255.255.255.0 gateway your.isp.gateway"



Now is time to configure the connection sharing
this is just for kenels greater than 2.4.x with iptables

1.
insmod iptables_nat

2.
echo 1 >/proc/sys/net/ipv4/ip_forward

3.
iptables -F
iptables -t nat -F
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
(if your linux uses eth0 to connect your isp)

4.
In the Windows Machine:

192.168.0.1 in the gateway
numbers from your /etc/resolv.conf in DNS server

[jtmace]

thanks for all the help people.. i havent tried it yet, but that was exactly what i needed.. I scoured the internet for days if not weeks looking for just a quick and dirty setup of a gateway and never could find anything that would take a rocket scientist to figure out..

once again thanks
_________________
er..

[fmalabre]

I use pointclark for my gateway.
www.pointclark.net (i think...)

[WarMachine]

I'm on the same project

here's the 'quick and dirty' description of my setup:
Gentoo 2.4.18 kernel machine as gateway, 2 NIC's; 1 to get the PPPoE connection from the ADSL, one to put it out to a 4-8 ethernet port hub or switch (not yet decided which exactly). Behind this will be 2 XP machines (definitely) possibly 1 or 2 more, but they would also be on the NT kernel (no 9x in this house! ) I'd like to keep XP's networking crap out of the way (ie. accept what the linux box gives it). I'd also like to set off 2 IP's to be assigned to the MAC addresses of each of the cards in the XP machine, and have any 'unlisted' MAC address start on a certain IP (probably 192.168.0.5)

I hope this isn't a dream :\

I'd be willing to help you along your project with whatever I can, I've already collected a nice number of good links for documentation, which I'll give to you if you want.

[fmalabre]

This is not a dream. It's the configuration I have at home now, except I don't have gentoo on my gateway because I use another distrib which offer me a free dynamic name. So, from the outside, I talk to my box with its name instead of an IP which keep changing when the connection changes anyway.
I have several clients, Gentoo, WinXP, Win2000.
It's completly transparent for the clients. All kind of software, chat, messenger, streaming, ... And everything is protected behind the gateway firewall.
By the way, when you do that, don't forget to disable telnet on your gateway in favor of ssh. As soon as you are plugged on the internet, use only known secure protocols.

Good luck for your project man!
Fred.

[insomniac]

[rizzo]