Thanks for the replies (Ben and Mark)
I think things are getting a bit clearer now. I was tempted to go back
to my old setup but this has now become a bit of personal challenge as
well as a good learning experience so I will carry on for now !
Your basic problem is your router is
issuing 192.168.1.x addresses and your firewall is using a 192.168.79.x
address scheme (different network).
Yes, I think that this is the main problem area. I am using a DLink
G604T modem router that has a wifi access point as well. I will leave
wifi out of the equation at the moment. I obviously have my inbound
internet connection set with the details provided by my isp so that bit
is okay. I suppose the next question is do I have to give the router an
IP address or will the inbound internet simply pass through to the
server if I don't? I think for this setup it would be better to just use
the modem function and leave all of the routing to the server. Would
that be correct ?
Or better yet, put
everything on the same network address scheme (much easier). Ideally,
your internet and external nics on the firewall want to be static ip's.
So my two nics should be setup as follows:
eth0 = (inbound from modem) on static IP 192.168.79.1
eth1 = (to 8 port switch) on static IP 192.168.79.2
Now, as for your Natting. As you want to use your firewall as a general
all-purpose firewall/router/etc box, then the answer is yes. You could
turn off Natting on your router so your firewall can handle the Natting
for you. It would also be advisable to turn off DHCP on your router and
only have this on your firwall box (but it sounds like you have done
this already).
I have now turned off DHCP and NAT at the router. I have a DHCP server
on the Mepis server that I have configured for the range 192.168.79.*
and this seems to be working okay as it is assigning the correct IP
range to machines that I connect to the switch (although no internet
under the configuration outlined in my original post). Do I have to do
anything extra to run NAT from the Mepis server or is that all handled
by the DHCP server ?
DNS - This is advisable. Basically, install BIND (DNS server on your
firewall box). On your inside nic, your DNS IP address should point to
itself, not the outside world. From your DNS server, put the external
DNS server addresses for your ISP (forwarders).
So eth1 in Bind should be set to 192.168.79.2 and I then use my ISP
provided DNS addresses for eth0 ?
Your DHCP configuration for the DNS server should be the IP address of your
firewall. In that
way, all DNS resolution will be handled by the firewall box only and
none of your clients.
I am a bit confused by this bit. As the Mepis server is also going to be the
firewall should this setting be 192.168.79.2 (eth1) ? or should I be setting
the firewall to operate on 192.168.79.1(eth0)
Gateway - As you want all traffic to go through your firewall, the
gateway address in your DHCP stack for your clients should point to the
firewall. The external nic of your firewall will point to the outside
world (your router modem box) to allow traffic to go out to the internet
and your router/modem box will point to the external nic of your
firewall to allow traffic to be filter to the internal network.
So basically I should set the gateway address on all the clients as
192.168.79.1 (eth0) ?
Thanks again for the advice.
Stu
Ben Hayes wrote:
Stu
Ok, your set-up should be simple and straight forward. The two nic
approach is good as you have an inside and outside nic. Your post said
that you wanted to use the Mepis box as a router/firewall/etc box but
you are still using a router. Your basic problem is your router is
issuing 192.168.1.x addresses and your firewall is using a 192.168.79.x
address scheme (different network). Basically, your network doesn't
know how to route traffic out to the internet. The simplest way to
resolve this is to put a route on your firewall box that defines the
route from your .79.x network to your .1.x network. Or better yet, put
everything on the same network address scheme (much easier). Ideally,
your internet and external nics on the firewall want to be static ip's.
Don't use Dynamic. You'll thank yourself in the long run for this.
Now, as for your Natting. As you want to use your firewall as a general
all-purpose firewall/router/etc box, then the answer is yes. You could
turn off Natting on your router so your firewall can handle the Natting
for you. It would also be advisable to turn off DHCP on your router and
only have this on your firwall box (but it sounds like you have done
this already).
DNS - This is advisable. Basically, install BIND (DNS server on your
firewall box). On your inside nic, your DNS IP address should point to
itself, not the outside world. From your DNS server, put the external
DNS server addresses for your ISP (forwarders). Your DHCP configuration
for the DNS server should be the IP address of your firewall. In that
way, all DNS resolution will be handled by the firewall box only and
none of your clients.
Gateway - As you want all traffic to go through your firewall, the
gateway address in your DHCP stack for your clients should point to the
firewall. The external nic of your firewall will point to the outside
world (your router modem box) to allow traffic to go out to the internet
and your router/modem box will point to the external nic of your
firewall to allow traffic to be filter to the internal network.
Hope this helps. I'm sorry if any of this isn't too clear. It's very
early in the morning and my brain isn't working 100%.
Ben
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Stuart Bird
Sent: 03 May 2006 14:28
To: Peterborough LUG - No commercial posts
Subject: [Peterboro] Linux Router not Routing
Hi All
I am in the process of setting up a general purpose (file,web,mail,ftp
etc) server using the latest testing version of Mepis SoHo. To save on
space I thought it would be a good idea to let the box act as a
router/firewall as well so that I can remove my Smoothwall box and have
everything in one.
The basic set up that I am after is:
<internet> --> <modem/router/wifi AP> --> <server>
The first problem I came across is that I have a dynamic IP assigned by
my isp. I have a dyndns account and under the old setup could handle
this from within Smoothwall as there was a module for it, but now I
have no way to track the domain name against the dynamic IP. I have read
that a utility called "ddclient" can be installed to do this and just
wondered if anyone has any experience of this program before I install
it. I'm just looking for any tips or pitfalls or even suggestions for
better apps to use.
Now for the routing bit. I have managed to get myself in a right mucking
fuddle with this and as a consequence have no internet at all at the
moment apart from wireless access through the router.
I have configured two nic's in the server as follows:
eth0 = currently assigned by DHCP from the router on 192.168.1.* range.
(I wasn't sure about this bit, would it be better to disable DHCP and
NAT on the router and just use the modem side of it. If so, will that
affect the wifi setup?
eth1 = statically assigned 192.168.79.100. (Is this now my default
gateway)?
I have the DHCP server working on the server, and all machines within
the lan are being assigned IP's in the correct range (192.168.79.*)
however I cannot access the internet on any of them including the server
itself. I can ping the router (currently 192.168.1.1) and I can ping all
machines on the lan in all directions (ie server to client, client to
server etc). But still no internet.
DNS I am very unsure about. Do I need to run a DNS server for my lan? If
so, what sort of settings do I need to get it running.
Apologies for the ramble, I thought this was going be a quick bank
holiday project. How wrong you can be sometime : )
Any advice greatly appreciated.
Stu
_______________________________________________
Peterboro mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/peterboro
_______________________________________________
Peterboro mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/peterboro
_______________________________________________
Peterboro mailing list
[email protected]
https://mailman.lug.org.uk/mailman/listinfo/peterboro
