Firewall Wizards mailing list archives
Re: Firewall question
From: Carric Dooley <carric () com2usa com>
Date: Wed, 14 Jul 1999 10:03:17 -0400 (EDT)
Well, first of all (and I'm sure you have heard this) use RH 6.0. The 2.2 kernel is much faster. I could not believe the latency I got rid of when I upgraded my 5.2 gateway at home to 6.0. This would require you to use ipchains for packet filtering, but if you are not familiar with ipfwadm, what difference does it make? If you are, ipchains is better, and since it is written by the same guy, the learning curve is not all that steep. I would definately use SSH as you state, but bear in mind this eliminates the need for some additional "sftp" or "stelnet" or whatever you were talking about. You can use an ssh encrypted tunnel for all your off-site traffic (mail, ftp, www, news, etc., you just redirect it through ssh.. There are how-to's on how to do it). Another reason for 6.0 is that you can install all the latest apps without having to upgrade your glibc and other libraries. I limped along, clinging to 5.2 for a little while on the "ain't broke, don't fix it" premise, but it gets harder and harder to keep daemons with security problems up to date when you have to install 10 other packages that the upgraded code depends on. As far as logging, you have the ability to do that via ipchains if that's all you want. If you want authentication for something other than http, take a look at TIS fwtk. If you want to keep it simple, authenticate for http, and just log all other protocols, you get the ability through squid (which is a much nicer implementation than the version that ships with 5.2... I had a hell of a time with squid on 5.2, but it out of the box it works like a champ on 6.0) to do user authentication. As far as VPN, ssh should give you what you need. I'm assuming the vnc is to administer things like NT beasties behind the firewall, since one certainly doesn't need a gui to manage a *nix machine. =) I am not positive you will not have problems with VNC over SSH. It should work, but I have not personally tested it. Sorry. Carric Dooley COM2:Interactive Media http://www.com2usa.com On Tue, 13 Jul 1999, Carl Swanson wrote:
I had a firewall question that I hoped the wizard might be able to help me with ;-) I want to set up a firewall on a Linux RedHat 5.2 machine with 2 NICs protecting a little network from the internet (connected using ISDN or DSL to an ISP connection). There will eventually be several of these little isolated networks. I need to have static IP addresses and will have a block of 16 or 32 address per network, so total static ip addressing. I need to need able to connect to the little network via the internet to do admin work, etc, but obviously I don't want anyone else in, just me from a static IP address or two. And I of course want to allow the little network users full access to the internet, including web, telnet, ftp, etc. It has been suggested that I set things up thusly: I want to set up both a firewall and a proxy server. Each machine in the local net will have its own IP address, and my firewall in the linux machine will only let certain internet IP addresses to connect (mine). All other ip address that try a direct connection will be denied (except machines that are responding to a telnet initiation, etc, from the local net) I'll also install a proxy server so I can control what users use what services through the gateway machine and onto the internet. I want to be able to control who has access and log where they go. I'll also disable telnet and ftp into the gateway machine, and use ssh, and the secure telnet and sftp versions (but I do need telnet and ftp access) Since I'll be using RedHat 5.2 (kernel 2.0.36) I should use ipfwadm for the firewall. Here are some questions I have: - First of all how does the above sound - What proxy software should I use? - Will I then need VPN at all between two linux machines over the internet? Or is the ssh and secure telnet and ftp enough? (I also want to do VNC remote control sessions, so that might be an issue). Any tips, hints, pointers, etc, would be MUCH appreciated. Thanks much, Carl cswanson () tivoli com
Current thread:
- Firewall question Carl Swanson (Jul 13)
- Re: Firewall question Carric Dooley (Jul 14)
- Re: Firewall question dreamwvr (Jul 14)