If you’re trying to set up a home network, you
probably want to set up a permiter facing computer connected to your DSL/Cable
modem, and then put all of your computers behind that firewall box to keep them
safe. This tutorialwill show you how to use a single external connection
on the gateway computer (using Iptables firewall), and a second internal
connection on the same box so you can connect the computers on
the inside of your home/office to it, and automatically give them IP’s
when you hook them up (using DHCP server). Iptables can be very complicated, we
will only configure a basic firewall, you can add more security later without
breaking things. In Linux there are many ways to do this, this one is hopefully
simple enough and will teach you the basics. I did this on a CentOS 6 box,
though it would work on Debian variants with only slight modifications. During
this tutorial I’m logged in as root, which you should generally NOT
do, but it makes the tutorial simpler, but if you prefer to do it
more securely, add “sudo” before each command and it will work.
The computers on the inside of your
office will also be able to talk to each other, so you can hook up printers,
computers and share network connections through the switch as well. You can
also set up things on your Gateway server box later like a network backup
drive for all your computers using Samba relatively simply. There’s a lot
of expandability in this setup, but we’ll keep it simple for now.
The first thing to do on your Gateway server
is configure and enable Iptables, the default firewall that comes with CentOS.
We will tell it to allow outbound traffic from your eth1 interface to the
internet. You have to add an Iptables entry, save it and restart Iptables.
Step 1. Add 2 Network cards to the
Linux box
Step 2. Verify the Network cards, check
if they installed properly or not
Step 3. Configure eth0 for Internet with a
Public (External network or Internet)
|
# vi
/etc/sysconfig/network-scripts/ifcfg-eth0
|
|
DEVICE=eth0
BOOTPROTO=static
HWADDR=00:0c:29:d2:c2:75
IPADDR=192.168.1.10
BROADCAST=192.168.1.255
NETMASK=255.255.255.0
NETWORK=192.168.1.0
GATEWAY=192.168.1.1
DNS1=8.8.8.8
DNS2=8.8.4.4
ONBOOT=yes
TYPE=Ethernet
USERCTL=no
IPV6INIT=no
PEERDNS=yes
|
Step 4. Configure eth1 for LAN with a Private
IP (Internal private network)
|
# vi
/etc/sysconfig/network-scripts/ifcfg-eth1
|
|
DEVICE=eth1
BOOTPROTO=static
HWADDR=00:0c:29:d2:c2:7f
IPADDR=192.168.10.1
BROADCAST=192.168.10.255
NETMASK=255.255.255.0
NETWORK=192.168.10.0
GATEWAY=192.168.1.10 # Enter Ip of eth0
ONBOOT=yes
TYPE=Ethernet
USERCTL=no
IPV6INIT=no
PEERDNS=yes
|
If you get error can’t bringing up interface eth1, and type:
|
# service
NetworkManager stop
# chkconfig
NetworkManager off
# service network
start
# chkconfig network
on
|
Step 5. Host Configuration (Optional)
|
# vi /etc/hosts
127.0.0.1 nat
localhost.localdomain localhost
|
Step 6. Gateway Configuration
|
# vi
/etc/sysconfig/network
|
|
NETWORKING=yes
HOSTNAME=nat
GATEWAY=192.168.1.1 # Internet Gateway,
provided by the ISP
|
Step 7. DNS Configuration
|
# vi
/etc/resolv.conf
|
|
nameserver 8.8.8.8 # Primary DNS
Server provided by the ISP
nameserver 8.8.4.4 # Secondary DNS
Server provided by the ISP
|
Step 8. Configure DHCP server to give out the
IP’s to the computers on the inside of the LAN
We do that by installing the DHCP server like
this:
|
# yum install dhcp
|
Configure a DHCP Server:
|
# vi
/etc/dhcp/dhcpd.conf
|
|
option domain-name "vjetnamnet.com";
option
domain-name-servers 8.8.8.8, 8.8.4.4;
default-lease-time 600;
max-lease-time 7200;
ddns-update-style
none;
authoritative;
subnet 192.168.10.0 netmask 255.255.255.0 {
range
dynamic-bootp 192.168.10.10 192.168.10.20;
option
broadcast-address 192.168.10.255;
option
routers 192.168.10.1;
}
|
Step 9. NAT configuration with IP Tables
First of all you have to flush and delete
existing firewall rules. So flush rules by typing in terminal:
|
# iptables -F
# iptables -t nat
-F
# iptables -t
mangle -F
|
Now delete these chains:
|
# iptables -X
# iptables -t nat
-X
# iptables -t
mangle -X
|
Set up IP FORWARDing and Masquerading
|
# iptables -t nat
-A POSTROUTING -o eth0 -j MASQUERADE
# iptables -A
FORWARD -i eth1 -j ACCEPT
|
Enables packet forwarding by kernel (save this
setting in /etc/sysctl.conf file)
|
# echo 1 >
/proc/sys/net/ipv4/ip_forward
|
and edit to make the change permanent
|
# vi
/etc/sysctl.conf
net.ipv4.ip_forward=1
|
Apply the configuration
|
# service iptables
save
# service iptables
restart
|
Check if iptables is set to
start during boot up
|
# chkconfig --list
iptables
|
Step 10. Testing
Ping the Gateway of the network
from client system:
|
# ping 192.168.10.1
|
Try it on your client systems:
|
# ping google.com
|
Configuring PCs on the network (Clients)
All PC’s on the private office network should
set their “gateway” to be the local private network IP address of the Linux
gateway computer.
The DNS should be set to that of the ISP on
the internet.
