Okay, Mike, here goes...
For the gentoo box to act as the router/gateway/hub, you need more than one
ethernet card in the box.
Typically eth0 will be the outward facing card (towards the net), and
eth{1,2,...} will be inward facing cards.
Just having the cards installed in the box is not enough; you need to
configure them and start them just as eth0 is handled (create the soft link
to net.lo in /etc/init.d and edit /etc/conf.d/net to identify ip address
and/or dhcp info, do the rc-update add net.eth1 default, etc.).
That takes care of your routing questions (I hope).
As for the firewall questions, your rules are going to fall into a couple of
different flavors:
a) desktop only: For this setup you're basically going to block all incoming
traffic, allow all outbound traffic and existing traffic. Forwarding is not
an issue.
b) server: For this setup it's pretty much like the desktop except you'll
allow incoming traffic on the ports that you wish to serve, i.e. mail, pop3,
etc. Again forwarding is not needed in this scenario.
c) gateway: For the pure gateway system, this one is a little trickyer. All
outbound and established traffic should be allowed, and incoming traffic is
only allowed for the services you're going to provide. The tricky part is
that now your rules need to operate on the FORWARD chain and manage the
snat/dnat/masquerade stuff.
d) combination: The combo system wraps service providing and gateway (and
possibly desktop) into one box. This setup is similar to the server
scenario, except it also must include the gateway type rules to ensure that
internal entities can get to the outside & back.
Regardless of the scenario that you choose to pursue, the rule sets will
remain the same for dialup vs adsl; in either case the box is exposed to the
network and you'll want to block unauthorized incoming traffic to the box.
Granted being on dialup means that a remote attacker is less likely to hit
upon your box on a regular basis (as your ip address will vary on each
connection), but it is still a 'better safe than sorry' position to leave
the firewall in place even for the dialup session.
As in the other iptables threads going on now, I would suggest a tool like
shorewall. I haven't heard anything bad about fwbuilder, but I can affirm
that the documentation provided with shorewall is top-notch and pretty easy
to get your brain around. I can even help define the config for shorewall
if you need it.
Hope this helps!
Dave
--
[email protected] mailing list
