Stuart Bird wrote: > Yes, I think that this is the main problem area. I am using a DLink > G604T modem router that has a wifi access point as well. I will leave > wifi out of the equation at the moment. I obviously have my inbound > internet connection set with the details provided by my isp so that > bit is okay. I suppose the next question is do I have to give the > router an IP address or will the inbound internet simply pass through > to the server if I don't? I think for this setup it would be better to > just use the modem function and leave all of the routing to the > server. Would that be correct ?
What *should* happen is: 1. Router gets IP address from ADSL provider. (I assume this is ADSL not cable? If cable you can lose the router) 2. Mepis PC connects to router and has IP address on same subnet as the internal IP from the router. One way to do this is leave router on default settings (which will include running DHCP server) and let Mepis box get IP via DHCP from router. This only applies to one of the Ethernet ports (say eth0). 3. Mepis PC acts as DHCP server on the other Ethernet port (eth1), and also as defaut gateway and DNS. This must be a different subnet from used by the router. The Ethernet port will be connected to a separate hub/switch (ie not to the router) and from there to other LAN PCs. (The Mepis PC will be "between" the LAN and the router.) An alternative, which is potentially better but possibly harder to set up and depends on the router: 1. Router gets IP from ADSL provider and passes this straight through to the Mepis box, ie the Mepis box has the external IP address and not an internal one on its eth0. 2. As 3 above. This means that the router just handles the connection and does not act as a NAT router or firewall; your Mepis box is put straight onto the Internet. This is less hassle from the point of view of managing port forwarding but you do have to make sure your Mepis box is secure. >> Or better yet, put >> everything on the same network address scheme (much easier). Ideally, >> your internet and external nics on the firewall want to be static ip's. I disagree with Ben on this. Doing this means that your LAN will access the Internet directly via the router and not through the Mepis box. Its simpler, sure, but it means your idea of learning how to set up the box as a firewall is redundant as nothing goes through it. There's no reason not to have dynamic IP on the eth0 side; indeed if you were connecting directly to (eg) a cable box on eth0 then you'd have to do it this way. >> Now, as for your Natting. As you want to use your firewall as a general >> all-purpose firewall/router/etc box, then the answer is yes. You could >> turn off Natting on your router so your firewall can handle the Natting >> for you. It would also be advisable to turn off DHCP on your router and >> only have this on your firwall box (but it sounds like you have done >> this already). Unless I'm misunderstanding something, NAT usually translates a single address on one subnet to multiple address on a DIFFERENT subnet. either the router can do this (mapping your external IP address from your ISP to the 192.168.79.* range) or your PC can do it, but not to the same subnet. Otherwise you'll have a hell of a job getting things to route properly. <Grandma lesson="sucking eggs"> Each PC on the LAN has an IP, a subnet mask, and a gateway. The subnet mask tells it which addresses are local to it, so if you have 192.168.79.3/255.255.255.0 then anything beginning 192.168.79. is local, anything else must go via the gateway. Obviously the gateway must be on the same subnet, otherwise it can't be reached except by going through the gateway, which can't be reached except by.... In essence, any traffic from the PC with address 192.168.79.3 and directed to 192.168.79.3 would not be put on the network because it matches its own address (it'll just be handled internally bypassing the network hardware). Anything else starting with 192.168.79., eg 192.16879.4, will be put onto the LAN addressed to that IP (eg 192.168.79.4). Anything else will be sent to 192.168.79.1 (the gateway) but will include the intended address so that the gateway can send it on. Usually the gateway has two network interfaces, one onto one network (your LAN) and the other onto another network (eg the Internet or another LAN). In practise this can be done over the same cable and a single network interface but you'll have problems keeping DHCP servers separate and there are security implications since the gateway (which is usually the firewall) can easily be bypassed. </Grandma> > I have now turned off DHCP and NAT at the router. I have a DHCP server > on the Mepis server that I have configured for the range 192.168.79.* > and this seems to be working okay as it is assigning the correct IP > range to machines that I connect to the switch (although no internet > under the configuration outlined in my original post). Do I have to do > anything extra to run NAT from the Mepis server or is that all handled > by the DHCP server ? What you currently have is your DHCP server dishing out addresses on the same subnet as the router, which just means everything can talk to each other. Once a PC has an IP address there's no need to go through your Mepis box, although you could force it with the right gateway settings (still each to bypass though). Check what your default gateway is on each LAN PC - is it the IP of the server or the router? > So eth1 in Bind should be set to 192.168.79.2 and I then use my ISP > provided DNS addresses for eth0 ? Your server should be a DNS server (you shouldn't need to worry about which interface it is running on; although only on eth1 is safest). It should have your ISP's DNS set as forwarders, but again don't worry about which interface it uses for this, as the routing will take care of it (the PC already knows that an IP address off the LAN goes via eth0). Actually, since the router will be acting as a DNS forwarder you can set the DNS forwarding to the router instead, which guards against ISP changes. >> Your DHCP configuration for the DNS server should be the IP address >> of your firewall. In that >> way, all DNS resolution will be handled by the firewall box only and >> none of your clients. > > I am a bit confused by this bit. As the Mepis server is also going to > be the firewall should this setting be 192.168.79.2 (eth1) ? or should > I be setting the firewall to operate on 192.168.79.1(eth0) I think the confusion stems from putting both interfaces on the same subnet. As far as your LAN is concerned, all services are provided by your firewall PC. It will be their gateway, their DNS, their DHCP server, probably their time server, etc. As far as your firewall is concerned it will get most of these services itself from the Internet via eth0; ie it'll forward DNS queries to its (external) DNS server, unless it can answer the query itself (from a cache or because the request is for a host on the LAN that your server has records for). It'll get its time from an external time server, but other LAN clients will get their time from it and not need to go external. (Of-course the LAN clients can still go externally if they wish to; if they try to access an external IP they'll just get to it via the firewall but the request will still go to the external time server. Unless you use your firewall to block such requests and force the clients to get the time from your firewall instead. The firewall might even capture the requests headed to an external time server and transparently redirect them to its own time server, thus saving external bandwidth. Because everything is going through the box it can do all sorts of things with the traffic other than just passing it through!) > So basically I should set the gateway address on all the clients as > 192.168.79.1 (eth0) ? See above: it depends whether you go Ben's route and keep everything one one subnet or not, but by doing so if this is the IP address of your router then you're bypassing the firewall. The way Ben is suggesting is the "normal" way to get everything working but does not take into account that you are wanting to use the Mepis box as your router/firewall, and simply lets the router do all this for you. Almost no traffic will actually go through your "firewall" with this setup. -- Mark Rogers More Solutions Ltd :: 0845 45 89 555 _______________________________________________ Peterboro mailing list [email protected] https://mailman.lug.org.uk/mailman/listinfo/peterboro
