CentOS - Jun 2015 - Using a CentOS 6 Machine as a gateway/router/home server

Greetings,

I'm rebuilding a machine to function as a gateway/router to Verizon DSL.

It has two NICs eth0 and eth1 (static set to 192.168.1.1).

eth0 connects to the DSL modem.

I've setup Verizon DSL usine pppoe-setup, and it works.


I can connect from home machines to the server (192.168.1.1); while logged 
in to the server, I can connect to both the internet, and the home 
machines.

But ...

I can't connect from the home machines directly to the Internet.

I have set
net.ipv4.ip_forward = 1
in /etc/sysctl.conf

I haven't setup the firewall yet (dangerous, I know) until I get the 
connectivity working.

I'm obviously overlooking some other configuration settings required for 
machines inside the network being able to connect through the 
gateway/router.

Thanks for any advice in advance.


Max Pyziur
pyz at brama.com

You need NAT setup on the server.


ZK

> On Jun 28, 2015, at 2:50 PM, Max Pyziur <pyz at brama.com> wrote:
> 
> 
> Greetings,
> 
> I'm rebuilding a machine to function as a gateway/router to Verizon
DSL.
> 
> It has two NICs eth0 and eth1 (static set to 192.168.1.1).
> 
> eth0 connects to the DSL modem.
> 
> I've setup Verizon DSL usine pppoe-setup, and it works.
> 
> 
> I can connect from home machines to the server (192.168.1.1); while logged
in to the server, I can connect to both the internet, and the home machines.
> 
> But ...
> 
> I can't connect from the home machines directly to the Internet.
> 
> I have set
> net.ipv4.ip_forward = 1
> in /etc/sysctl.conf
> 
> I haven't setup the firewall yet (dangerous, I know) until I get the
connectivity working.
> 
> I'm obviously overlooking some other configuration settings required
for machines inside the network being able to connect through the
gateway/router.
> 
> Thanks for any advice in advance.
> 
> 
> Max Pyziur
> pyz at brama.com
> _______________________________________________
> CentOS mailing list
> CentOS at centos.org
> http://lists.centos.org/mailman/listinfo/centos

Am 28.06.2015 um 20:50 schrieb Max Pyziur:

[ ... ]
> I can't connect from the home machines directly to the Internet.
>
> I have set
> net.ipv4.ip_forward = 1
> in /etc/sysctl.conf
>
> I haven't setup the firewall yet (dangerous, I know) until I get the
> connectivity working.
Part of the firewall setup (iptables) is to configure masquerading. 
That's you issue, the missing masquerading of the traffic from the LAN 
hosts through the gateway.
> I'm obviously overlooking some other configuration settings required
for
> machines inside the network being able to connect through the
> gateway/router.
>
> Thanks for any advice in advance.
>
>
> Max Pyziur
> pyz at brama.com
Alexander

On Sun, 2015-06-28 at 14:50 -0400, Max Pyziur wrote:
> I haven't setup the firewall yet (dangerous, I know) until I get the 
> connectivity working.
> 
> I'm obviously overlooking some other configuration settings required
for
> machines inside the network being able to connect through the 
> gateway/router.
As others have pointed out, you're either missing a NAT layer or you got
a large enough IP allocation to subnet and you haven't set up routing.
Probably safe to assume it's NAT.

I'd suggest at a minimum you install something like shorewall to assist
in managing your firewall and IP masquerading tasks.  It's available in
EPEL, is very well documented, and provides enough built in sanity
checks to protect you against making some silly (and some not so silly)
mistakes in your firewall management.

On Sun, 28 Jun 2015, Brian Miller wrote:
> On Sun, 2015-06-28 at 14:50 -0400, Max Pyziur wrote:
>
>> I haven't setup the firewall yet (dangerous, I know) until I get
the
>> connectivity working.
>>
>> I'm obviously overlooking some other configuration settings
required for
>> machines inside the network being able to connect through the
>> gateway/router.
>
> As others have pointed out, you're either missing a NAT layer or you
got
> a large enough IP allocation to subnet and you haven't set up routing.
> Probably safe to assume it's NAT.
>
> I'd suggest at a minimum you install something like shorewall to assist
> in managing your firewall and IP masquerading tasks.  It's available in
> EPEL, is very well documented, and provides enough built in sanity
> checks to protect you against making some silly (and some not so silly)
> mistakes in your firewall management.
Thanks to all for pointing me in the direction of iptables and IP 
masquerading.
>From several sources, code, the stock CentOS iptables I've cobbled the 
following 
/etc/sysconfig/iptables; while it works, I suspect that there are holes:
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A POSTROUTING  -j MASQUERADE
COMMIT
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT
COMMIT

I also seem to need to load
iptable_nat
nf_nat_ftp

via rc.local

Is this correct?

Thank you again,

Max

On 06/28/2015 03:20 PM, Alexander Dalloz wrote:
> Am 28.06.2015 um 20:50 schrieb Max Pyziur:
>
>
> Part of the firewall setup (iptables) is to configure masquerading.
> That's you issue, the missing masquerading of the traffic from the LAN
> hosts through the gateway.
>
>> I'm obviously overlooking some other configuration settings
required for
>> machines inside the network being able to connect through the
>> gateway/router.
>>
>> Thanks for any advice in advance
as others have stated, you need to use nating; you won't actually be
routing traffic (unless you've been allocated a routable network.  
which is possible, but pretty unlikely).   the script I use (stolen from
some google search, I'm sure.   I can't give proper attribution if
pressed):

iptables --flush            # Flush all the rules in filter and nat tables
iptables --table nat --flush
iptables --delete-chain
# Delete all chains that are not in default filter and nat table
iptables --table nat --delete-chain
# Set up IP FORWARDing and Masquerading
iptables --table nat --append POSTROUTING --out-interface eth2 -j MASQUERADE
iptables --append FORWARD --in-interface eth3 -j ACCEPT
# Enables packet forwarding by kernel
echo 1 > /proc/sys/net/ipv4/ip_forward

in this case eth3 would be your local, non-routed network (e.g. 10.* or
192.168.*) and eth2 would be your regular network interface (like the
one plugged into your cable modem or DSL connection)
it'd likely need to be customized for your environment and running it
would likely destroy any firewall rules you have setup, fair warning.

-- 
public gpg key id: AE60F64C

> -----Original Message-----
> From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On
> Behalf Of Max Pyziur
> Sent: den 28 juni 2015 20:50
> To: centos at centos.org
> Subject: [CentOS] Using a CentOS 6 Machine as a gateway/router/home
> server
> 
> I'm rebuilding a machine to function as a gateway/router to Verizon
DSL.
Hi,

May I ask why you don't just use a made-for-the-purpose-distro like
Smoothwall to do this?
I takes (almost) all of the pain out of configuring stuff, and is quite
secure due to not having as much "junk" pre-installed as CentOS 6?

-- 
//Sorin

> -----Original Message-----
> From: centos-bounces at centos.org [mailto:centos-bounces at centos.org] On
> Behalf Of Sorin Srbu
> Sent: den 29 juni 2015 08:11
> To: CentOS mailing list
> Subject: Re: [CentOS] Using a CentOS 6 Machine as a gateway/router/home
> server
> 
> > -----Original Message-----
> > From: centos-bounces at centos.org [mailto:centos-bounces at
centos.org]
> On
> > Behalf Of Max Pyziur
> > Sent: den 28 juni 2015 20:50
> > To: centos at centos.org
> > Subject: [CentOS] Using a CentOS 6 Machine as a gateway/router/home
> > server
> >
> > I'm rebuilding a machine to function as a gateway/router to
Verizon DSL.
> 
> May I ask why you don't just use a made-for-the-purpose-distro like
> Smoothwall to do this?
> I takes (almost) all of the pain out of configuring stuff, and is quite
secure due
> to not having as much "junk" pre-installed as CentOS 6?
Please note: I'm not criticizing, just curious about the argument behind
using a regular OS to do firewall-stuff.

-- 
//Sorin

On 6/28/2015 11:11 PM, Sorin Srbu wrote:
> May I ask why you don't just use a made-for-the-purpose-distro like
> Smoothwall to do this?
indeed, I use pfSense, running on a APU1D4 [1] router board as my 
firewall, and a separate home server on a HP Microserver [2]. IMHO, 
keeping the firewall function completely separate simplifies security.

that router board can handle 300 Mbit/sec of NAT firewall rules, since I 
only have 30Mbit internet, thats plenty of headroom.    the Microserver 
has 4x3 TB SATA drives in a raidZ (ZFS) for 7.5 TiB usable.

I can muck about with the server at my leisure, and reboot it, and not 
affect internet routing to my wife.   the firewall doesn't need mucking 
about with and has uptimes measured in months (time between pfSense 
upgrades).    pfSense provides the DHCP and DNS and NTP services for the 
LAN.

[1]  http://store.netgate.com/kit-APU1C4.aspx
[2] http://www8.hp.com/h20195/v2/GetPDF.aspx/c04111079.pdf


-- 
john r pierce, recycling bits in santa cruz