If you’re trying to set up a home network, you probably want to set up a permiter facing computer connected to your DSL/Cable modem, and then put all of your computers behind that firewall box to keep them safe. This tutorialwill show you how to use a single external connection on the gateway computer (using Iptables firewall), and a second internal connection on the same box so you can connect the computers on the inside of your home/office to it, and automatically give them IP’s when you hook them up (using DHCP server). Iptables can be very complicated, we will only configure a basic firewall, you can add more security later without breaking things. In Linux there are many ways to do this, this one is hopefully simple enough and will teach you the basics. I did this on a CentOS 6 box, though it would work on Debian variants with only slight modifications. During this tutorial I’m logged in as root, which you should generally NOT do, but it makes the tutorial simpler, but if you prefer to do it more securely, add “sudo” before each command and it will work.
The computers on the inside of your office will also be able to talk to each other, so you can hook up printers, computers and share network connections through the switch as well. You can also set up things on your Gateway server box later like a network backup drive for all your computers using Samba relatively simply. There’s a lot of expandability in this setup, but we’ll keep it simple for now.
The first thing to do on your Gateway server is configure and enable Iptables, the default firewall that comes with CentOS. We will tell it to allow outbound traffic from your eth1 interface to the internet. You have to add an Iptables entry, save it and restart Iptables.
Step 1. Add 2 Network cards to the Linux box
Step 2. Verify the Network cards, check if they installed properly or not
Step 3. Configure eth0 for Internet with a Public (External network or Internet)
# vi /etc/sysconfig/network-scripts/ifcfg-eth0 |
DEVICE=eth0BOOTPROTO=staticHWADDR=00:0c:29:d2:c2:75IPADDR=192.168.1.10BROADCAST=192.168.1.255NETMASK=255.255.255.0NETWORK=192.168.1.0GATEWAY=192.168.1.1DNS1=8.8.8.8DNS2=8.8.4.4ONBOOT=yesTYPE=EthernetUSERCTL=noIPV6INIT=noPEERDNS=yes |
Step 4. Configure eth1 for LAN with a Private IP (Internal private network)
# vi /etc/sysconfig/network-scripts/ifcfg-eth1 |
DEVICE=eth1BOOTPROTO=staticHWADDR=00:0c:29:d2:c2:7fIPADDR=192.168.10.1BROADCAST=192.168.10.255NETMASK=255.255.255.0NETWORK=192.168.10.0GATEWAY=192.168.1.10 # Enter Ip of eth0 ONBOOT=yesTYPE=EthernetUSERCTL=noIPV6INIT=noPEERDNS=yes |
If you get error can’t bringing up interface eth1, and type:
# service NetworkManager stop# chkconfig NetworkManager off# service network start# chkconfig network on |
Step 5. Host Configuration (Optional)
# vi /etc/hosts127.0.0.1 nat localhost.localdomain localhost |
Step 6. Gateway Configuration
# vi /etc/sysconfig/network |
NETWORKING=yesHOSTNAME=natGATEWAY=192.168.1.1 # Internet Gateway, provided by the ISP |
Step 7. DNS Configuration
# vi /etc/resolv.conf |
nameserver 8.8.8.8 # Primary DNS Server provided by the ISPnameserver 8.8.4.4 # Secondary DNS Server provided by the ISP |
Step 8. Configure DHCP server to give out the IP’s to the computers on the inside of the LAN
We do that by installing the DHCP server like this:
# yum install dhcp |
Configure a DHCP Server:
# vi /etc/dhcp/dhcpd.conf |
option domain-name "vjetnamnet.com";option domain-name-servers 8.8.8.8, 8.8.4.4;default-lease-time 600;max-lease-time 7200;ddns-update-style none;authoritative;subnet 192.168.10.0 netmask 255.255.255.0 { range dynamic-bootp 192.168.10.10 192.168.10.20; option broadcast-address 192.168.10.255; option routers 192.168.10.1;} |
Step 9. NAT configuration with IP Tables
First of all you have to flush and delete existing firewall rules. So flush rules by typing in terminal:
# iptables -F# iptables -t nat -F# iptables -t mangle -F |
Now delete these chains:
# iptables -X# iptables -t nat -X# iptables -t mangle -X |
Set up IP FORWARDing and Masquerading
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE# iptables -A FORWARD -i eth1 -j ACCEPT |
Enables packet forwarding by kernel (save this setting in /etc/sysctl.conf file)
# echo 1 > /proc/sys/net/ipv4/ip_forward |
and edit to make the change permanent
# vi /etc/sysctl.confnet.ipv4.ip_forward=1 |
Apply the configuration
# service iptables save# service iptables restart |
Check if iptables is set to start during boot up
# chkconfig --list iptables |
Step 10. Testing
Ping the Gateway of the network from client system:
# ping 192.168.10.1 |
Try it on your client systems:
# ping google.com |
Configuring PCs on the network (Clients)
All PC’s on the private office network should set their “gateway” to be the local private network IP address of the Linux gateway computer.
The DNS should be set to that of the ISP on the internet.
