| 1 |
<?xml version='1.0' encoding='UTF-8'?> |
| 2 |
<!-- $Header: /var/cvsroot/gentoo/xml/htdocs/doc/en/qmail-howto.xml,v 1.26 2004/06/25 22:28:55 vapier Exp $ --> |
| 3 |
<!DOCTYPE guide SYSTEM "/dtd/guide.dtd"> |
| 4 |
|
| 5 |
<guide link="/doc/en/home-router-howto.xml"> |
| 6 |
|
| 7 |
<title>Home Router Guide</title> |
| 8 |
|
| 9 |
<author title="Author"> |
| 10 |
<mail link="vapier@gentoo.org">Mike Frysinger</mail> |
| 11 |
</author> |
| 12 |
|
| 13 |
<abstract> |
| 14 |
This document details how to turn an old Gentoo machine into a router |
| 15 |
for connecting your home network to the internet. |
| 16 |
</abstract> |
| 17 |
|
| 18 |
<version>1.1</version> |
| 19 |
<date>July 21, 2004</date> |
| 20 |
|
| 21 |
<chapter> |
| 22 |
<title>Introduction</title> |
| 23 |
<section> |
| 24 |
<body> |
| 25 |
|
| 26 |
<p> |
| 27 |
Building your own router out of old spare parts has many advantages |
| 28 |
over buying a pre-made canned router by say Linksys. The biggest one by |
| 29 |
far is control over the connection. The other advantages are left up to |
| 30 |
your imagination; just about anything can be done in this scenario, |
| 31 |
it's just a matter of needing it. |
| 32 |
</p> |
| 33 |
|
| 34 |
<p> |
| 35 |
This guide will show you how to setup Network Address Translation (NAT) |
| 36 |
on the router (kernel and iptables), add and configure common services |
| 37 |
(DNS via dnsmasq, dhcp via dhcpcd, ADSL via rp-pppoe), and conclude |
| 38 |
with more elaborate and fun things that can be done (mail caching, port |
| 39 |
forwarding, traffic shaping, http/ftp hosting). |
| 40 |
</p> |
| 41 |
|
| 42 |
<p> |
| 43 |
Before getting started, there's a few basic requirements you must meet. |
| 44 |
First, you'll need a computer that has at least 2 Network Interface |
| 45 |
Cards (NICs) in it. Next, you'll need the configuration settings for |
| 46 |
your internet connection (may include things like |
| 47 |
IP/DNS/Gateway/username/password). Finally, you'll need a bit of spare |
| 48 |
time and some Gentoo loving. |
| 49 |
</p> |
| 50 |
|
| 51 |
<p> |
| 52 |
The conventions used in this guide are: |
| 53 |
</p> |
| 54 |
<ul> |
| 55 |
<li>eth0 - NIC connected to the Local Area Network (LAN)</li> |
| 56 |
<li>eth1 - NIC connected to the Wide Area Network (WAN)</li> |
| 57 |
<li>LAN utilizes the private 192.168.0.xxx network</li> |
| 58 |
<li>router is hardcoded to the standard 192.168.0.1 IP</li> |
| 59 |
</ul> |
| 60 |
|
| 61 |
<impo> |
| 62 |
Due to security precautions, I would highly suggest you shut down any |
| 63 |
unneeded services on the router until we have a chance to get the |
| 64 |
firewall up and rolling. To view the currently running services, just |
| 65 |
run <c>rc-status</c>. |
| 66 |
</impo> |
| 67 |
|
| 68 |
</body> |
| 69 |
</section> |
| 70 |
</chapter> |
| 71 |
|
| 72 |
<chapter> |
| 73 |
<title>Kernel setup (know thyself first)</title> |
| 74 |
<section> |
| 75 |
<body> |
| 76 |
|
| 77 |
<p> |
| 78 |
Your kernel needs to have the drivers running for both your NICs. To |
| 79 |
see if your cards are already setup, just run <c>ifconfig</c>. Your |
| 80 |
output may differ slightly from the following, that's fine. What |
| 81 |
matters is that the interface shows up at all. |
| 82 |
</p> |
| 83 |
<pre caption="Checking NICs"> |
| 84 |
# <i>ifconfig -a</i> |
| 85 |
eth0 Link encap:Ethernet HWaddr 00:60:F5:07:07:B8 |
| 86 |
BROADCAST MULTICAST MTU:1500 Metric:1 |
| 87 |
RX packets:0 errors:0 dropped:0 overruns:0 frame:0 |
| 88 |
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 |
| 89 |
collisions:0 txqueuelen:1000 |
| 90 |
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) |
| 91 |
Interrupt:11 Base address:0x9800 |
| 92 |
|
| 93 |
eth1 Link encap:Ethernet HWaddr 00:60:F5:07:07:B9 |
| 94 |
BROADCAST MULTICAST MTU:1500 Metric:1 |
| 95 |
RX packets:0 errors:0 dropped:0 overruns:0 frame:0 |
| 96 |
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 |
| 97 |
collisions:0 txqueuelen:1000 |
| 98 |
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) |
| 99 |
Interrupt:10 Base address:0x9400 |
| 100 |
</pre> |
| 101 |
<p> |
| 102 |
If you do not see your two cards showing up and you're not sure what |
| 103 |
kind of cards you have, try running <c>lspci</c>. You can get that from |
| 104 |
<c>emerge sys-apps/pciutils</c>. Look for "Ethernet controller" in the |
| 105 |
output. Once you have this information, go into your kernel and add |
| 106 |
support for the correct drivers. |
| 107 |
</p> |
| 108 |
|
| 109 |
<p> |
| 110 |
The next thing you'll need is support for iptables and NAT (and packet |
| 111 |
shaping if you want). The following list is split up into required |
| 112 |
(*), suggested (x), and shaper (s) features. It does not matter whether |
| 113 |
you build the features into the kernel or as a module so long as when |
| 114 |
the feature is need, the correct module(s) are loaded (module loading |
| 115 |
is left to the reader as a fun exercise however). |
| 116 |
</p> |
| 117 |
<pre caption="Network Options"> |
| 118 |
<i>Networking options ---></i> |
| 119 |
<i> [*] TCP/IP networking</i> |
| 120 |
<i> [*] IP: advanced router</i> |
| 121 |
<i> [*] Network packet filtering (replaces ipchains)</i> |
| 122 |
|
| 123 |
<i> IP: Netfilter Configuration ---></i> |
| 124 |
<i> [*] Connection tracking (required for masq/NAT)</i> |
| 125 |
<i> [x] FTP protocol support</i> |
| 126 |
<i> [x] IRC protocol support</i> |
| 127 |
<i> [*] IP tables support (required for filtering/masq/NAT)</i> |
| 128 |
<i> [*] IP range match support</i> |
| 129 |
<i> [x] MAC address match support</i> |
| 130 |
<i> [*] Multiple port match support</i> |
| 131 |
<i> [*] Packet filtering</i> |
| 132 |
<i> [*] REJECT target support</i> |
| 133 |
<i> [x] REDIRECT target support</i> |
| 134 |
<i> [*] Full NAT</i> |
| 135 |
<i> [*] MASQUERADE target support</i> |
| 136 |
<i> [s] Packet mangling</i> |
| 137 |
<i> [s] MARK target support</i> |
| 138 |
<i> [x] LOG target support</i> |
| 139 |
|
| 140 |
<i> QoS and/or fair queueing ---></i> |
| 141 |
<i> [s] QoS and/or fair queueing</i> |
| 142 |
<i> [s] HTB packet scheduler</i> |
| 143 |
<i> [s] Ingress Qdisc</i> |
| 144 |
</pre> |
| 145 |
<note> |
| 146 |
Somethings may be slightly different in a 2.4 vs 2.6 kernel, but you |
| 147 |
should be able to figure it out :). 2.2 + ipchains is not covered here. |
| 148 |
</note> |
| 149 |
|
| 150 |
</body> |
| 151 |
</section> |
| 152 |
</chapter> |
| 153 |
|
| 154 |
<chapter> |
| 155 |
<title>Hug the WAN (a.k.a. The Internet)</title> |
| 156 |
|
| 157 |
<section> |
| 158 |
<title>Intro</title> |
| 159 |
<body> |
| 160 |
<p> |
| 161 |
There are many ways to connect to the internet so I'll just cover the |
| 162 |
ones I'm familiar with. That leaves us with ADSL (PPPoE) and cable |
| 163 |
modems (static/dynamic). If there are other methods out there, feel |
| 164 |
free to write up a little blurb and e-mail me. Feel free to skip any of |
| 165 |
the following sections in this chapter that don't apply to you. This |
| 166 |
chapter is just about getting the router connected to the internet via |
| 167 |
eth1. |
| 168 |
</p> |
| 169 |
</body> |
| 170 |
</section> |
| 171 |
|
| 172 |
<section> |
| 173 |
<title>ADSL and PPPoE</title> |
| 174 |
<body> |
| 175 |
|
| 176 |
<p> |
| 177 |
All the fancy PPPoE software has been bundled up into one little nice |
| 178 |
package nowadays called <uri link="http://www.roaringpenguin.com/">Roaring Penguin</uri>. |
| 179 |
Simply <c>emerge rp-pppoe</c> and you'll be on your way. Remember how |
| 180 |
I said you'll need username/password information? Well I wasn't lying |
| 181 |
so I hope you have it now! Load up <path>/etc/ppp/pppoe.conf</path> in |
| 182 |
your favorite editor and set it up. |
| 183 |
</p> |
| 184 |
|
| 185 |
<pre caption="Setting up eth1"> |
| 186 |
<comment>(Replace 'vla9h924' with your username and 'password' with your password)</comment> |
| 187 |
|
| 188 |
# <i>nano /etc/ppp/pppoe.conf</i> |
| 189 |
<comment># Ethernet card connected to ADSL modem |
| 190 |
ETH=eth1 |
| 191 |
# ADSL user name. |
| 192 |
USER=vla9h924</comment> |
| 193 |
# <i>nano /etc/ppp/pap-secrets</i> |
| 194 |
<comment># client server secret |
| 195 |
"vla9h924" * "password"</comment> |
| 196 |
# <i>nano /etc/conf.d/net</i> |
| 197 |
<comment>Add an entry for ifconfig_eth1 and set it to adsl: |
| 198 |
ifconfig_eth1=( "adsl" )</comment> |
| 199 |
# <i>ln -s net.eth0 /etc/init.d/net.eth1</i> |
| 200 |
# <i>rc-update add net.eth1 default</i> |
| 201 |
# <i>/etc/init.d/net.eth1 start</i> |
| 202 |
</pre> |
| 203 |
|
| 204 |
<p> |
| 205 |
You should be all set to go now. |
| 206 |
</p> |
| 207 |
|
| 208 |
</body> |
| 209 |
</section> |
| 210 |
|
| 211 |
<section> |
| 212 |
<title>Cable and/or dynamic/static IP</title> |
| 213 |
<body> |
| 214 |
|
| 215 |
<p> |
| 216 |
If you have a static IP then you will need the few more details than if |
| 217 |
you have a dynamic IP. For static users, you will need your IP, |
| 218 |
gateway, and DNS servers. |
| 219 |
</p> |
| 220 |
|
| 221 |
<pre caption="Setting up eth1"> |
| 222 |
<comment>Dynamic IP Users:</comment> |
| 223 |
# <i>emerge dhcpcd</i> |
| 224 |
# <i>nano /etc/conf.d/net</i> |
| 225 |
<comment>You'll need an entry like so: |
| 226 |
ifconfig_eth1=( "dhcp" )</comment> |
| 227 |
|
| 228 |
<comment>Static IP Users:</comment> |
| 229 |
# <i>nano /etc/conf.d/net</i> |
| 230 |
<comment>You'll need entries like so: |
| 231 |
ifconfig_eth1=( "66.92.78.102 broadcast 66.92.78.255 netmask 255.255.255.0" ) |
| 232 |
routes_eth1=( "default gw 66.92.78.1" )</comment> |
| 233 |
# <i>nano /etc/resolv.conf</i> |
| 234 |
<comment>Add one line per DNS server: |
| 235 |
nameserver 123.123.123.123</comment> |
| 236 |
|
| 237 |
<comment>Dynamic and Static Setup:</comment> |
| 238 |
# <i>ln -s net.eth0 /etc/init.d/net.eth1</i> |
| 239 |
# <i>rc-update add net.eth1 default</i> |
| 240 |
# <i>/etc/init.d/net.eth1 start</i> |
| 241 |
</pre> |
| 242 |
|
| 243 |
<p> |
| 244 |
You should be all set to go now. |
| 245 |
</p> |
| 246 |
|
| 247 |
</body> |
| 248 |
</section> |
| 249 |
</chapter> |
| 250 |
|
| 251 |
<chapter> |
| 252 |
<title>Hug the LAN (bring along some friends)</title> |
| 253 |
<section> |
| 254 |
<body> |
| 255 |
|
| 256 |
<p> |
| 257 |
This step is a breeze compared to the previous one. |
| 258 |
</p> |
| 259 |
|
| 260 |
<pre caption="Setting up eth0"> |
| 261 |
# <i>nano /etc/conf.d/net</i> |
| 262 |
<comment>Add a line like the following: |
| 263 |
ifconfig_eth0=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.255.0" )</comment> |
| 264 |
# <i>rc-update add net.eth0 default</i> |
| 265 |
# <i>/etc/init.d/net.eth0 start</i> |
| 266 |
</pre> |
| 267 |
|
| 268 |
</body> |
| 269 |
</section> |
| 270 |
</chapter> |
| 271 |
|
| 272 |
<chapter> |
| 273 |
<title>LAN Services (because we're nice people)</title> |
| 274 |
|
| 275 |
<section> |
| 276 |
<title>DHCP Server</title> |
| 277 |
<body> |
| 278 |
<p> |
| 279 |
I bet it'd be nice if everyone else in your house could just plug |
| 280 |
their computers into the network and things would just work. No need to |
| 281 |
remember mind-numbing details or make them stare at confusing |
| 282 |
configuration screens! Life would be grand eh? Introducing the Dynamic |
| 283 |
Host Configuration Protocol (DHCP) and why you should care. |
| 284 |
</p> |
| 285 |
|
| 286 |
<pre caption="Setting up dhcpd"> |
| 287 |
# <i>emerge dhcp</i> |
| 288 |
# <i>nano /etc/dhcp/dhcpd.conf</i> |
| 289 |
<comment>Here is a sample configuration file: |
| 290 |
authoritative; |
| 291 |
subnet 192.168.0.0 netmask 255.255.255.0 { |
| 292 |
range 192.168.0.100 192.168.0.250; |
| 293 |
default-lease-time 259200; |
| 294 |
max-lease-time 518400; |
| 295 |
option subnet-mask 255.255.255.0; |
| 296 |
option broadcast-address 192.168.0.255; |
| 297 |
option routers 192.168.0.1; |
| 298 |
option domain-name-servers 192.168.0.1; |
| 299 |
} |
| 300 |
</comment> |
| 301 |
# <i>nano /etc/conf.d/dhcp</i> |
| 302 |
<comment>Set IFACE="eth0"</comment> |
| 303 |
# <i>rc-update add dhcp default</i> |
| 304 |
# <i>/etc/init.d/dhcp start</i> |
| 305 |
</pre> |
| 306 |
|
| 307 |
<p> |
| 308 |
Now your little router is a bona-fide DHCP server! Plugin those |
| 309 |
computers and watch them work! With Windows systems you should go into |
| 310 |
the TCP/IP Properties and select the 'Obtain an IP address |
| 311 |
automatically' and 'Obtain DNS server address automatically' options. |
| 312 |
Sometimes the changes aren't instantaneous, so you may have to run a |
| 313 |
command prompt and run <c>ipconfig /release</c> and <c>ipconfig |
| 314 |
/renew</c>. But enough about Windows, let's get back to our favorite |
| 315 |
penguin. |
| 316 |
</p> |
| 317 |
</body> |
| 318 |
</section> |
| 319 |
|
| 320 |
<section> |
| 321 |
<title>DNS Server</title> |
| 322 |
<body> |
| 323 |
|
| 324 |
<p> |
| 325 |
You may have noticed in the previous section that we told the DHCP |
| 326 |
clients we have a DNS server at 192.168.0.1. You may also remember that |
| 327 |
192.168.0.1 is our little router that we're making. I don't remember |
| 328 |
setting up a DNS server ... so let's do so now! |
| 329 |
</p> |
| 330 |
|
| 331 |
<pre caption="Setting up dnsmasq"> |
| 332 |
# <i>emerge dnsmasq</i> |
| 333 |
# <i>nano /etc/conf.d/dnsmasq</i> |
| 334 |
<comment>Add "-i eth1" to DNSMASQ_OPTS</comment> |
| 335 |
# <i>rc-update add dnsmasq</i> |
| 336 |
# <i>/etc/init.d/dnsmasq start</i> |
| 337 |
</pre> |
| 338 |
|
| 339 |
<p> |
| 340 |
Well that was quick, but what did we do? The great thing is, we didn't |
| 341 |
have to do very much! You're welcome to choose other DNS servers if |
| 342 |
you're more comfortable with them, but the reason dnsmasq is great is |
| 343 |
because it was designed to do exactly what we want it for. It's a |
| 344 |
little DNS caching/forwarding server for local networks. We're not |
| 345 |
looking to provide our own DNS server here, just offer simple DNS |
| 346 |
services to everyone else on our LAN. |
| 347 |
</p> |
| 348 |
|
| 349 |
</body> |
| 350 |
</section> |
| 351 |
|
| 352 |
<section> |
| 353 |
<title>NAT</title> |
| 354 |
<body> |
| 355 |
|
| 356 |
<p> |
| 357 |
At this point, people on your network can talk to each other and they |
| 358 |
can look up hostnames via DNS, but they still can't actually connect to |
| 359 |
the internet. While you may think that's great (more bandwidth for |
| 360 |
you!), I bet they're not too happy just yet. |
| 361 |
</p> |
| 362 |
|
| 363 |
<pre caption="Setting up iptables"> |
| 364 |
<comment>First we flush our current rules</comment> |
| 365 |
# <i>iptables -F</i> |
| 366 |
# <i>iptables -t nat -F</i> |
| 367 |
|
| 368 |
<comment>Then we lock our services so they only work from the LAN</comment> |
| 369 |
# <i>iptables -I INPUT 1 -i eth0 -j ACCEPT</i> |
| 370 |
# <i>iptables -I INPUT 1 -i lo -j ACCEPT</i> |
| 371 |
# <i>iptables -A INPUT -p UDP --dport bootps -i ! eth0 -j REJECT</i> |
| 372 |
# <i>iptables -A INPUT -p UDP --dport dns -i ! eth0 -j REJECT</i> |
| 373 |
|
| 374 |
<comment>Drop TCP / UDP packets to privileged ports</comment> |
| 375 |
# <i>iptables -A INPUT -p TCP -i ! eth0 -d 0/0 --dport 0:1023 -j DROP</i> |
| 376 |
# <i>iptables -A INPUT -p UDP -i ! eth0 -d 0/0 --dport 0:1023 -j DROP</i> |
| 377 |
|
| 378 |
<comment>Finally we add the rules for NAT</comment> |
| 379 |
# <i>iptables -I FORWARD -i 192.168.0.0/255.255.0.0 -j DROP</i> |
| 380 |
# <i>iptables -A FORWARD -s 192.168.0.0/255.255.0.0 -j ACCEPT</i> |
| 381 |
# <i>iptables -A FORWARD -d 192.168.0.0/255.255.0.0 -j ACCEPT</i> |
| 382 |
# <i>iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE</i> |
| 383 |
<comment>Tell the kernel that ip forwarding is OK</comment> |
| 384 |
# <i>echo 1 > /proc/sys/net/ipv4/ip_forward</i> |
| 385 |
# <i>for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done</i> |
| 386 |
|
| 387 |
<comment>This is so when we boot we don't have to run the rules by hand</comment> |
| 388 |
# <i>/etc/init.d/iptables save</i> |
| 389 |
# <i>rc-update add iptables default</i> |
| 390 |
</pre> |
| 391 |
|
| 392 |
<p> |
| 393 |
Once you've typed out all of that, the rest of your network should now |
| 394 |
be able to use the internet as if they were directly connected |
| 395 |
themselves. |
| 396 |
</p> |
| 397 |
|
| 398 |
<p> |
| 399 |
Believe it or not, you're done :). The only thing left involves adding |
| 400 |
extra services to make your life (or the lives of your users) easier. |
| 401 |
</p> |
| 402 |
|
| 403 |
</body> |
| 404 |
</section> |
| 405 |
|
| 406 |
</chapter> |
| 407 |
|
| 408 |
</guide> |
Parent Directory
| 
Revision Log