Networking Forums

Networking Forums > Computer Networking > Linux Networking > Confusing gateway/FW project - need help bad!

Reply
Thread Tools Display Modes

Confusing gateway/FW project - need help bad!

 
 
Jay \Boogieman\ Edwards
Guest
Posts: n/a

 
      09-28-2003, 07:32 PM
hello all...

I presently have my cable modem shared through an SMC Barricade 7004BR
NAT router/firewall. I have the DHCP server in the router disabled as I
like each machine to have a static IP.

I have one machine on the LAN that is a dedicated Quake 3 server, and it
is in the router's DMZ because some people had problems staying connected
to it. All is well with this setup... sort of... the Q3 machine in the
DMZ snagged a worm (w2kServ) which totalled out my w9x install on my main
machine (left 2kPro intact though).

What I want to do is take the machine that the Quake server runs on and
set it up as a Linux gateway/firewall between the internet and my SMC
router. I can then run the Q3 server on that machine too and have it
completely out of the LAN. This is proving far more difficult than it
sounds. I could have had it set up and running with Windoze, but I want
Linux instead. It's been fighting me for 3 weeks now.

The more I research it, the more confusing it's getting. I think I've
narrowed it down to ClarkConnect or SmoothWall for this box, but I don't
know if I can install Quake 3 on the machine because I believe it needs
an Xfree86 window manager of some type to install and these are
completely console/terminal based... I could be wrong though... I guess I
can just try it and see what it tells me.

Now, then... I assuming that the following is correct for what I'm trying
to do here. Please let me know if something's amiss...

- eth0 should be assigned 192.168.0.1 static
- eth0 connects to the cable modem's 10BaseT port
- eth0's "gateway" should point to my ISP's gateway IP addy
- eth0's DNS server points to ISP's DNS server IP addy

- eth1 can be assigned 192.168.0.2 static
- eth1 connects to the SMC's 10BaseT WAN port

- eth1 looks to 192.168.0.1 as it's gateway??
- eth1 should point *where* for DNS server???

- SMC WAN port now looks at 192.168.0.2 as it's gateway IP/DNS??
- SMC DHCP server is disabled (I want static IP's on the LAN)
- SMC should point where for DNS server??

- PC's on the LAN still look at the SMC's IP (192.168.2.1) as their
gateway and DNS servers?

Now, onto the question of NAT routing. Currently, the SMC handles that
fine. But, if there is now a gateway/FW between it and the internet, will
this break the router's NAT? Will I have to set up IP forwarding/NAT for
each internal IP on the LAN? I've done some studying on IPtables and Masq
and it just seems totally Geek to me.

Am I perhaps better off not putting a gateway/FW before the router and
just install Linux with a firewall on the Q3 server box? I'd *really*
prefer it if I could get that server *outside* my LAN though. I don't
want to run Windows on it regardless for evident security reasons.

Any help or advice would be greatly appreciated...
 
Reply With Quote
 
 
 
 
Jay \Boogieman\ Edwards
Guest
Posts: n/a

 
      09-28-2003, 08:00 PM
"Jay \"Boogieman\" Edwards" <(E-Mail Removed)> wrote in
news:Xns94049EA08385Bboogie350NOSPAMyahoo@216.168. 3.44:

And here's probably a dumb question, but would I use a standard CAT 5 cable
between the router's WAN port and the gateway/FW, or do I need a crossover,
such as is needed when connecting 2 routers/hubs???
 
Reply With Quote
 
David Efflandt
Guest
Posts: n/a

 
      09-29-2003, 07:45 PM
On Sun, 28 Sep 2003, Jay \"Boogieman\" Edwards <(E-Mail Removed)>
wrote:
> I presently have my cable modem shared through an SMC Barricade 7004BR
> NAT router/firewall. I have the DHCP server in the router disabled as I
> like each machine to have a static IP.
>
> I have one machine on the LAN that is a dedicated Quake 3 server, and it
> is in the router's DMZ because some people had problems staying connected
> to it. All is well with this setup... sort of... the Q3 machine in the
> DMZ snagged a worm (w2kServ) which totalled out my w9x install on my main
> machine (left 2kPro intact though).
>
> What I want to do is take the machine that the Quake server runs on and
> set it up as a Linux gateway/firewall between the internet and my SMC
> router. I can then run the Q3 server on that machine too and have it
> completely out of the LAN. This is proving far more difficult than it
> sounds. I could have had it set up and running with Windoze, but I want
> Linux instead. It's been fighting me for 3 weeks now.
>
> Now, then... I assuming that the following is correct for what I'm trying
> to do here. Please let me know if something's amiss...
>
> - eth0 should be assigned 192.168.0.1 static
> - eth0 connects to the cable modem's 10BaseT port
> - eth0's "gateway" should point to my ISP's gateway IP addy
> - eth0's DNS server points to ISP's DNS server IP addy


Is your cable modem just a modem or modem/router? In other words, if you
do the above, can you get on the internet, or do you have to use dhcp?
The best answers depend upon that and whether more than 1 private IP can
connect through it.

> - eth1 can be assigned 192.168.0.2 static
> - eth1 connects to the SMC's 10BaseT WAN port


You need to masquerade any traffic going out eth0 as your eth0 IP and use
a different network for eth1. Proxy arp might might be an alternative
with IPs you have, but eth0 would need different netmask/broadcast and it
depends whether your modem/router accepts multiple private IPs on its LAN
side.

> - eth1 looks to 192.168.0.1 as it's gateway??
> - eth1 should point *where* for DNS server???


eth1 should have _NO_ gateway. It should automatically get a net
route for its network if eth1 is brought up by network scripts. But you
might need to change eth1 IP to different network like 192.168.1.x if
Linux is masquerading it.

> - SMC WAN port now looks at 192.168.0.2 as it's gateway IP/DNS??
> - SMC DHCP server is disabled (I want static IP's on the LAN)
> - SMC should point where for DNS server??


Gateway is correct (or whatever eth1 ends up as), but DNS would point to
your ISP's DNS.

> - PC's on the LAN still look at the SMC's IP (192.168.2.1) as their
> gateway and DNS servers?


Yes if the SMC does DNS caching, otherwise use DNS at your ISP.

> Now, onto the question of NAT routing. Currently, the SMC handles that
> fine. But, if there is now a gateway/FW between it and the internet, will
> this break the router's NAT? Will I have to set up IP forwarding/NAT for
> each internal IP on the LAN? I've done some studying on IPtables and Masq
> and it just seems totally Geek to me.


The Linux router will not see any IPs on the LAN side of SMC, so it just
needs to NAT its eth1 network (essentially SMC WAN IP). The SMC will
still NAT everything behind it.

> Am I perhaps better off not putting a gateway/FW before the router and
> just install Linux with a firewall on the Q3 server box? I'd *really*
> prefer it if I could get that server *outside* my LAN though. I don't
> want to run Windows on it regardless for evident security reasons.


That might be easiest. If you do point the DMZ at Linux, you should still
run a firewall on it to block anything except what you need (especially
low ports < 1024).

--
David Efflandt - All spam ignored http://www.de-srv.com/
http://www.autox.chicago.il.us/ http://www.berniesfloral.net/
http://cgi-help.virtualave.net/ http://hammer.prohosting.com/~cgi-wiz/
 
Reply With Quote
 
Jay \Boogieman\ Edwards
Guest
Posts: n/a

 
      09-30-2003, 05:02 PM
(E-Mail Removed) (David Efflandt) wrote in
news:(E-Mail Removed):


-snippage-

FWIW, finally decided on Red Hat 7 for a distro... it was the only one I
had left I didn't try...

> Is your cable modem just a modem or modem/router? In other words, if
> you do the above, can you get on the internet, or do you have to use
> dhcp? The best answers depend upon that and whether more than 1
> private IP can connect through it.


No, the cable modem is just a plain modem. It normally connects to the
SMC router's WAN port with a short, CAT5 straight cable. I have DHCP
server for the LAN side disabled in the router and fixed IP's on all
boxes. When connected in this configuration:
|cable modem|-->|router|--PC's
....all boxes have internet as well as intranet access.

My ISP uses DHCP for my IP, but it rarely changes unless I disconnect the
modem for more than a couple hours. I just leave the "Dynamic IP
address" setting in the router enabled but disable DHCP on the LAN. I did
have it set up once and I didn't like having to constantly look up IP's
and there were sporadic connection losses and IP conflicts with the
windows machines. My file server still has no internet access
(WinME/2kserver) since it kindly "disabled my interface" one day when I
booted it up... I was going to change it over to Linux eventually anyhow,
I suppose this is a good enough reason, huh?

Right now, I have eth1 removed from the box as I figured I'd get eth0
working dependably and then put eth1 back in, KUDZU and then work on the
router/LAN side from there. The Linux server is presently connected to
the fourth port on the router and connecting with no problems. It'll also
connect if I reboot the cable modem and plug it straight into eth0. I
just have to change the gateway IP.

So, basically I can get internet to the RH box either straight out of the
modem or through the router if the modem feeds the SMC's WAN port. I just
can't seem to get the gateway box to pass the packets correctly in the
following configuration...

cable
modem|-->|eth0~gateway~eth1|-->|router WAN port|-->PC's


>> - eth1 can be assigned 192.168.0.2 static
>> - eth1 connects to the SMC's 10BaseT WAN port

>
> You need to masquerade any traffic going out eth0 as your eth0 IP and
> use a different network for eth1. Proxy arp might might be an
> alternative with IPs you have, but eth0 would need different
> netmask/broadcast and it depends whether your modem/router accepts
> multiple private IPs on its LAN side.


I never tried it... I've always left them at 192.168.2.x, but when I did
have DHCP enabled for awhile, there were IP's *way* different than those,
so I would be inclined to think it accepts them alright..

> eth1 should have _NO_ gateway. It should automatically get a net
> route for its network if eth1 is brought up by network scripts. But
> you might need to change eth1 IP to different network like 192.168.1.x
> if Linux is masquerading it.


Okay... so eth0, which is 192.168.0.1, looks to my ISP's gateway IP to
get connectivity, and that's working great presently.

If I follow you correctly, I should have the following settings for eth1
in Netconf:
- NO gateway entry
- eth1's IP changes to 192.168.1.1
- 192.168.1.0 in the "network" field??
- Does my internet IP need to go anywhere?

As for the router...
- Router's gateway IP should point to eth1's IP (192.168.1.1)?
- Should I still leave the setting in the router on Dynamic IP?
- Netmask on all networks is default 255.255.255.0. Should I change that?
- eth0, eth1 and the router should ALL point to the ISP's DNS Server IP??

Dumb question, but say I want to add some maps to the Quake3 directory on
the server box, will the PC's on the LAN side be able to see/push files
to it?

>> Now, onto the question of NAT routing. Currently, the SMC handles
>> that fine. But, if there is now a gateway/FW between it and the
>> internet, will this break the router's NAT? Will I have to set up IP
>> forwarding/NAT for each internal IP on the LAN? I've done some
>> studying on IPtables and Masq and it just seems totally Geek to me.

>
> The Linux router will not see any IPs on the LAN side of SMC, so it
> just needs to NAT its eth1 network (essentially SMC WAN IP). The SMC
> will still NAT everything behind it.


So it's just forwarding through eth1, then to teh router and LAN PC's?
What files do I need edit to set up for this? I assume that the netconf
or internet config utilities will not allow me to set this up? IS there a
console/term script/front end for setting this up?


>> Am I perhaps better off not putting a gateway/FW before the router
>> and just install Linux with a firewall on the Q3 server box? I'd
>> *really* prefer it if I could get that server *outside* my LAN
>> though. I don't want to run Windows on it regardless for evident
>> security reasons.

>
> That might be easiest. If you do point the DMZ at Linux, you should
> still run a firewall on it to block anything except what you need
> (especially low ports < 1024).


I'd sure like to do it on the Red Hat box and then I could free up the
fourth port on the router (wish I'd gotten an 8-port, but for $20 I'm not
complaining!). It's become an obsession now... I will NOT be defeated or
else the box ends up dead in a field from a fatal GSW!! :-)

I'm very stubborn about some things and the fact that my Q3 server has
been down two weeks is *not* helping!

The bummer part is I had this set up and working on W2kServer, but I've
had just one worm attack too many. I'd rather go through the trouble
(investment, really) of learning Linux than dealing with the crap M$ puts
out (can you say "retail beta"?). How many times have you ever *really*
wanted to hide your file extensions??? The only reason I can figure that
M$ would leave that alone for 8 years is so the .vbs on the skript-kiddie
specials stays hidden, thus get executed! Heck, any halfway respectable
freeware programmer would have fixed a hole ("M$ feature") like *that* in
the first update! And why, Dear Lord, is it toggled like that in NT/2k??

Okay, I'm drifting away here... I think there's at least hope for me...
I am a broadcast engineer by trade, after all! A few things I've taught
myself in the past are:

-manually edit shaders and other "c" files for Quake 3 modelling
-run a DOS multinode BBS and multitask in Desqview
-install & run various operating systems, such as OS/2, BeOS and W2k
-build, repair and upgrade PC's
-set up a home LAN w/internet connection sharing
-operate, repair and maintain all kinds of new broadcast equipment
-install a 10,000 watt transmitter and related remote control gear
-wire and set radio studios
-built my own home FM stereo radio station
-operate a TV production console and Ampex digital optics
-figured out how multitower directional AM antenna systems actually work
-learned how to make a file executable with chmod -x

I'm fairly technically inclined, so I think I can get Linux down-pat
eventually. It's just that I've picked a very complicated project for a
newbie to jump into! There's a LOT to learn with Linux and one can't
expect to learn everything overnight! :-) And obviously, newbies
sometimes need some help that's in "newbie" terminology... a *lot* of man
pages I've read remind me of internet RFC docs, and yes, I've read more
than a few of those while learning about TCP/IP and UDP protocols!

And I *do* appreciate the help... :-)

 
Reply With Quote
 
 
 
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
DNS issue that is confusing me... GlenB Windows Networking 3 11-14-2006 08:34 PM
Gateways... really confusing Searclaw Linux Networking 2 08-17-2005 02:36 AM
confusing taskbar icon jesoakley@yahoo.co.uk Broadband 7 04-20-2005 08:07 PM
Confusing Lease Times Geoff Lane Home Networking 5 12-04-2004 11:11 PM
This can be very confusing to the technically disadvantaged :) =.RLM.= Wireless Internet 0 06-05-2004 01:45 AM



1 2 3 4 5 6 7 8 9 10 11