Re: [SLUG] worth of firewall-in-a-box hubs?

From: Paul Braman (aeon@tampabay.rr.com)
Date: Sat Mar 30 2002 - 19:28:59 EST


On Sat, 30 Mar 2002, Paul M Foster wrote:

> Seems to me like you'd have more flexibility with a Linux box. And you
> can use a 486 for it. I've got like four of these in my garage, ready
> to go in case the one I'm using dies. ;-}

Yeah, my current setup is kinda funky, but I'm not adverse to change, I
just don't want to damage a Good Thing (tm).

My firewall (Linux box, recall) serves DNS and NTP for my internal network
as well as doing the routing. This allows me to go from machine A to
machine B without fiddling with /etc/hosts to make sure it's all there.

The NTP server running on my firewall (yes, it's a security leak, but I
don't have anything important y'all can't see [grins]) allows me to keep
all the machines on the LAN synched up properly.

I can also play games (EverQuest) through the firewall just fine.

So, I decided to do some reading on these boxes...

It seems to me that they sit just inside the cable modem and use DHCP to
obtain an IP from the ISP (same as my firewall does). Then I can connect
a few machines to the hub and they can be routed through to the ISP via
NAT.

Okay, so far so good...

One problem I can see right away is that IPs on the LAN are served via
DHCP on 198.162.1.0/24. That's not that big of a deal, except if I want
to get from machine A to machine B like I did before.

Well, you can turn that off. Okay, so I can either mess with /etc/hosts
or turn one of the internal machines into a DNS server. I'm not quite
sure if the internal DNS server will properly forward to the ISP's DNS
server for addresses outside the LAN (recall my DNS server was running on
the firewall, so it didn't need to go *through* it).

So, let's assume that it's not too hard to get two machines up and running
on the LAN. No NTP solution yet, but that's not a real big deal...I'm
sure a solution will present itself. Let's also assume I can get from
machine A to machine B without much problems. (I'd be running Samba on a
Linux box and mount the drive on a Windows box so I need to do it
effortlessly and reliably.)

Then comes online gaming. I was reading one site's documentation on their
hardware and they said I had to switch the gaming PC over to "exposed" (as
opposed to NAT'd, I guess) so it can talk directly to the internet. Right
now I can game through my Linux firewall just fine with NATing.

Ergo, once I figure out DNS, NTP and gaming with this setup I guess I'm
good to go.

[Actually, running DNS the way I am doing is prone to errors and I really
wouldn't suggest it for anyone but the die-hard. The setup I have allows
me to lookup LAN names, internal RR names, and internet names all with the
same server. The problem with this setup is that you have to know what
networks your ISP is using. In RR's case, they are 24.92.0.0/16,
24.28.0.0/16, and 65.32.0.0/16. However, if they add another network
(something they did once before which had me screwed until I figured it
out) I have to reconfigure my DNS server to do the lookup correctly.
Maybe /etc/hosts isn't such a bad thing afterall.]

Paul Braman
x5273



This archive was generated by hypermail 2.1.3 : Fri Aug 01 2014 - 18:59:18 EDT