This is an old revision of the document!
Due to the wholesome failure of my ISP to do things in a nice way my ADSL router was rendered useless and I was forced to either setup my own router or be content with a single PC on the internet in a house of 6 computers… I chose to setup my own gateway.
See also Traffic Shaping
Notes to self on how I setup my home network.
Device | Notes |
---|---|
modem | ADSL modem with 1x phone line socket and 1x ethernet socket. Tends to get clogged for some reason (high latency, but connection stays up) |
gateway | Fast desktop PC with two network adaptors, loads of RAM and nothing much to do |
LAN | 4 or so PCs, Wii, Xbox, couple of Nintendo DS consoles, etc |
Here's how it works in practice when a PC is connected up:
It's a ZyXEL P-660R-D1 ADSL Modem.
The web interface is fairly limited, so enable the Telnet interface (Advanced → Remote MGMT → Telnet).
$ telnet 192.168.1.1 Trying 192.168.1.1... Connected to 192.168.1.1. Escape character is '^]'. Password: ****** Copyright (c) 1994 - 2007 ZyXEL Communications Corp. P-660R-D1> lan index 1 # Select LAN port 1 (of 1) enif0 is selected P-660R-D1> lan dhcp server gateway 192.168.1.2 P-660R-D1> lan save lan: save ok P-660R-D1> ip dhcp enif0 status DHCP on iface enif0 is server Start assigned IP address: 192.168.1.2/24 Number of IP addresses reserved: 192 Hostname prefix: dhcppc DNS server: 192.168.1.2 212.159.13.49 WINS server: 0.0.0.0 0.0.0.0 Domain Name : Default gateway: 192.168.1.2 Lease time: 259200 seconds Renewal time: 129600 seconds Rebind time: 226800 seconds Probing count: 4 slot state timer type hardware address hostname 0 UNCERTAIN 0 0 00 1 UNCERTAIN 0 0 00 2 UNCERTAIN 0 0 00 3 UNCERTAIN 0 0 00 ... Status: Packet InCount: 0, OutCount: 0, DiscardCount: 0 P-660R-D1> exit Connection closed by foreign host.
Changes are immediate, and persistent. Renew your DHCP lease to get the updated setting, and run route -n
to check the routing table, which should look like this:
$ route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth0 0.0.0.0 192.168.1.2 0.0.0.0 UG 0 0 0 eth0
Important feature:
Desired routing table:
Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.1.1 0.0.0.0 255.255.255.255 UH 0 0 0 eth0 192.168.1.0 0.0.0.0 255.255.255.0 U 1 0 0 eth1 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
Important features:
eth0
eth1
Desired DNS server list:
# Generated by NetworkManager nameserver 127.0.0.1 nameserver 192.168.1.1
On-the-fly:
Taken from http://www.technize.com/2007/05/03/configuring-a-nat-gateway-in-linux/
# Unnessary? #iptables –flush #iptables –table nat –flush #iptables –delete-chain #iptables –table nat –delete-chain # ##Setup IP forwarding and masquerating.. #iptables –table nat –append POSTROUTING –out-interface eth0 -j MASQUERADE #iptables –append FORWARD –in-interface eth0 -j ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward
Persistent:
Edit /etc/sysctl.conf:
# Uncomment the next line to enable packet forwarding for IPv4 net.ipv4.ip_forward=1
sudo aptitude install bind9
sudoedit /etc/bind/named.conf.options
forwarder
section and add ISP DNS server IPs: forwarders { 212.159.13.49; 212.159.13.50; };
sudo service bind9 restart
ikari.robmeerman.co.uk
(real public domain name) to a private IP.sudoedit /etc/bind/named.conf.local
// LAN hosts zone "ikari.robmeerman.co.uk" { type master; file "/etc/bind/db.lan.ikari"; };
sudoedit /etc/bind/db.lan.ikari
; ; BIND data file for local area network (LAN) ; $TTL 604800 @ IN SOA ns.localhost. root.localhost. ( 1 ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Negative Cache TTL ; @ IN NS ns.localhost. @ IN A 192.168.1.2 ; Zone's address * IN A 192.168.1.2 ; Wildcard (all sub-domains)
sudo aptitude install wondershaper # Assuming downlink == 3712 kbps / uplink == 448 kbps sudo wondershaper eth0 $((3712*1000)) $((448*1000))
At first I didn't have a PC with two network cards, so I found a way to do it with one network card and a lot of ugly hacks and tricks. Sadly I did this long before I wrote this page, so I can't recall the details. But for those having similar problems here was my solution.
I use WinXP on my laptop, and happened to have a copy of VMware1) installed so I setup a new virtual machine with two NICs and inserted my trusty Knoppix Linux LiveCD2). Once booted I used the Linux IP Masquerade HOWTO to get things going.
Amazingly, this worked! I had 3 IPs on one NIC: 2 for the virtual machine running Knoppix, and 1 for Windows itself. Actually, IIRC, all 3 actually had seperate MAC addresses too.
I didn't keep this setup for long, as my laptop is portable and I didn't want it tied to the house.
The famous (perhaps even “standard”) way of making a Linux platform into a NAT router is to use a script called rc.firewall-iptables
from the Linux IP Masquerade HOWTO. While this definately works, it's a bit tricky to use, especially adding new port-forwarding rules which is something I do fairly regularly.
So I spent an afternoon doing a bit of BASH scripting and, based on the original script, produced the script below, which I hope some will find useful.
Download rc.firewall (14kB)
Well, it has a very nice block where you can set up portforwarding via simple lists using the Windows computer names, which means that if your network using DHCP and the IP addresses of your computers change sometimes, you'll have no problem if you simply schedule the script to run periodically. It also is nice in that it closes ports when the computer they are being forwarded to is offline.
Example of configuration block of script:
EXTIP=`ifconfig eth0 | egrep -o '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -n1` echo " External IP detected as $EXTIP"; # Local services exposed LOCALTCPPORTS="22" LOCALUDPPORTS="" # PCs to forward connections to, using names in /etc/hosts or NetBIOS PORTFWPC[0]="Ikari" TCPPORTS[0]="80 26346 113 4899 1024 5190" UDPPORTS[0]="26346" PORTFWPC[1]="Kirara" TCPPORTS[1]="5443 2902 56881" UDPPORTS[1]="2902 56881" PORTFWPC[2]="Mum" TCPPORTS[2]="4662 26346" UDPPORTS[2]="4672 26346"
Notes
eth0
, my first network interface card (NIC), and the IP address changes when we have a power-cut or my ISP decides to cut us due to bad managment and faulty hardware Running the script will produce output like so:
Loading simple rc.firewall version 0.78.. External Interface: eth0 Internal Interface: eth1 loading modules: ---------------------------------------------------------------------- ip_tables, ip_conntrack, ip_conntrack_ftp, ip_conntrack_irc, iptable_nat, ip_nat_ftp, ---------------------------------------------------------------------- Done loading modules. Enabling forwarding.. Clearing any existing rules and setting default policy.. External IP detected as 10.150.47.24 Closing all external ports but allowing ICMP... - TCP 22 reopened Allowing existing and related connections to local servives, rejecting all other non-ICMP traffic Ikari found in /etc/hosts Forwarding incoming connections to Ikari (192.168.0.4) by port... - TCP 80 - TCP 26346 - TCP 113 - TCP 4899 - TCP 1024 - TCP 5190 - UDP 26346 Using NetBIOS to ask for Kirara Forwarding incoming connections to Kirara (192.168.0.12) by port... - TCP 5443 - TCP 2902 - TCP 56881 - UDP 2902 - UDP 56881 Using NetBIOS to ask for Mum Unable to obtain valid IP address, skipping Mum FWD: Allow all connections OUT and only existing and related ones IN Enabling SNAT (MASQUERADE) functionality on eth0 rc.firewall-iptables v0.78 done.
Notice that it skips “Mum” as it (the computer) is not on at the moment.
In case you're thinking “External IP of 10.x.x.x??”, you're quite right. But that's the IP my ADSL provider gives me, so for all intents and purposes, it's my external IP, even if it isn't what the rest of the net sees.
==
«< Request for Feedback ::: Feel free to contact me about this script, or anything else mentioned/implied by this page. »>