Home » Issues » Issue 16

Configuring a Linux home internet gateway

How to justify to your spouse adding another Linux box to your home network

Short URL: http://fsmsh.com/1804

Write a full post in response to this!

My family is hooked on Windows. I’ve thought about trying to coerce them into switching to GNU/Linux, but the very thought of what I’d have to put up with for the next year just makes my head ache. I’m not talking about software maintenance issues. I’m talking about trying to defend my position time and time again as they complain that they can’t run their favorite games or applications. Telling them to change their favorites is like spitting into the wind—it’s sort of masochistic.

I love Linux though, and so this opposition doesn’t stop me from wanting to setup a Linux machine at home. I upgrade my wife’s computer in the study about once every couple of years, and often my kids’ machines get a parts upgrade from the old machine at the same time. Recently, however, I found I had enough spare parts to put together an entire machine, so I took the opportunity to replace my LinkSys router with a custom Linux router. In this article, I’d like to describe this process because it was more difficult for me than it probably should have been—mostly for lack of clear instructions.

Internet packet routing basics

Routers are to computer networks as local post offices are to the mail system. Your local post office accepts mail destined for your entire city or region in large bundles. Postal workers sort letters and packages in those bundles into smaller bundles by neighborhood. Post men and women deliver those smaller bundles to individual homes. At the same time, they pick up outgoing mail from mail boxes and deliver it back to the local post office where it’s sorted into large bundles destined for specific regions. These bundles are sent to regional distribution centers where they’re divided up into smaller bundles and forwarded to local post offices. The entire process starts over again. This system is very efficient, and works equally well with routers on the internet.

Much like letters routed through local and regional post offices, at the lowest level, all internet traffic takes the form of data packets routed from one machine to another through local and central internet packet routers. Like letters and packages, each packet has a single source address and an ultimate destination address. Along the route from source to destination, packets also pick up intermediate router addresses. Router software uses complex algorithms that analyze final destination addresses to determine the next router on the shortest path from source to destination. Each router adds a new address to the packet, and then forwards it to the next router along the path.

At the lowest level, all internet traffic takes the form of data packets routed from one machine to another

Want to try an interesting experiment? Open a terminal window and type this command (you may need to change to super-user mode with the “su” command on some GNU/Linux distributions):

$ traceroute www.freesoftwaremagazine.com

If you’re on a Windows machine you can type this command for a similar result:

c:\> tracert www.freesoftwaremagazine.com

On my Linux box at home, the output looks something like this (I’ve removed the DNS names and the usual third try timing column to make it fit the column width):

traceroute to 209.249.12.148, 30 hops, 40 bytes
 1  66.119.135.193   11.132 ms   12.877 ms
 2  66.119.143.201   12.666 ms   22.760 ms
 3  66.119.143.254   35.802 ms   35.900 ms
 4  66.119.143.250   43.826 ms   42.775 ms
 5  66.119.132.129   43.261 ms   40.864 ms
 6  64.213.22.185    54.872 ms   52.741 ms
 7  67.17.67.154     62.346 ms   60.723 ms
 8  64.125.12.85     66.086 ms   94.429 ms
 9  64.125.30.169    63.305 ms   60.672 ms
10  64.125.30.178    82.155 ms   77.522 ms
11  64.125.29.46     99.565 ms   97.170 ms
12  64.125.29.190    92.608 ms   90.122 ms
13  64.125.28.69    114.682 ms  119.342 ms
14  64.125.28.130   126.578 ms  127.490 ms
15  209.249.9.126   124.585 ms  125.836 ms
16  209.249.12.148  122.755 ms  119.974 ms

The traceroute (or tracert) command causes each router in a complete path from source (your machine) to destination (the address you specified on the command line) to return a message to your machine, which is then interpreted and displayed. The millisecond values in the two columns following the router address are the round-trip timing values for each of two trips to that router. On Linux, a -n option will remove the DNS names, and a -q option allows you to specify a number of trips (the default is usually three). Using -q1, for instance will show only the DNS name, IP address and one round-trip timing value.

The traceroute command makes use of a routing protocol referred to as ICMP, which is an acronym that stands for Internet Control Message Protocol. It’s interesting to note that ICMP doesn’t provide direct support for this sort of trace functionality. Years ago, inventive network programmers, in an attempt to create debugging tools for IP networks, made use of ICMP error responses to essentially trick routers into returning enough information to the sender to learn the path taken from the local host to the specified destination, as well as the round trip time required for each router to return the test message.

This is the primary job of a router—to determine algorithmically the most efficient path to the final destination, and thus the next router or host in the path, and then address and forward data packets accordingly.

Firewalls, physical and ethereal

When I was young, my father owned a shoe store in a small town in Iowa. One year, he moved down the street to a larger building and I was given the job of remodeling the old building in preparation for selling it. As I stripped the internal walls out from the building, I found that the brick and mortar walls that stood between my father’s old building and the buildings on either side were shared walls—the same wall was used by adjacent buildings. They were fairly thick—maybe 18 to 24 inches—but more interestingly, they rose well above the roofs of either building—about 2 to 4 feet higher. The building roofs were attached to beams set deep into the sides of these walls.

I asked the old carpenter working with me why these buildings were built this way, rather than just having the roofs built on top of the walls. He told me about firewalls. A firewall is designed to protect the buildings on either side of a burning building. If a fire breaks out in a building, the fire can’t (without great difficultly) get past the firewall to the buildings on either side. The wall itself is thick enough to provide protection from structural damage that might otherwise be caused by the heat of the fire, and high enough above the roofs of the buildings on either side to keep the flames from jumping from roof to roof.

Network firewalls protect individual hosts or private networks from internet users with malicious intent

Often routers closest to individual sending or receiving hosts provide additional functionality to protect local network resources from malicious attackers on the internet. It’s a statistical truth about humanity that the larger the group of people in a community, the more probable it is that someone will attempt to hurt or steal from others for selfish reasons. Since we can’t change the basic nature of humanity (at least not overnight), we have to protect the innocent, and that’s exactly the purpose of a network firewall. Like the literal firewalls between the store buildings in my home town, network firewalls protect individual hosts or private networks from internet users with malicious intent.

Don't miss out on the other pages!
12345next ›last »

Write a full post in response to this!

Similar articles

1

Do you like this post?
Vote for it!

Copyright information

Verbatim copying and distribution of this entire article is permitted in any medium without royalty provided this notice is preserved.

Biography

John Calcote: John Calcote has worked in the software industry for over 25 years, the last 17 of which were at Novell. He's currently a Sr. Software Engineer with the LDS Church working on open source projects. He's the project maintainer of the openslp project, the openxdas project, and the dnx project on sourceforge.net. He blogs on open source, programming and software engineering issues in general at http://jcalcote.wordpress.com.

tinker's picture

Interesting

Submitted by tinker on Mon, 2007-02-05 14:45.

Vote!
0

A very interesting article, and usefull if you have a sensible broadband connection which I unfortunatley dont have. I am stuck with DSL via satelite which greatly confuses the building of a Linux router.

First of all the satelite card I have does not have Linux drivers which is a great start, the upstream is via ISDN and downstream is via Sat link in another country, oh joy! The router also needs to be a proxy server to differentiate between the 2 sorts of connection and to provide ports for all the different web services. I am at the point of abandoning the project.

btw YAST is Yet Another Setup Tool.

Anonymous visitor's picture

To put up a linux router fast easy and cheap.

Submitted by Anonymous visitor on Mon, 2007-02-05 18:21.

Vote!
0

Use IPCop. You can get a linux router up and running in about 20 minutes.

Anonymous visitor's picture

A surprising guide

Submitted by Anonymous visitor on Tue, 2007-02-06 12:31.

Vote!
0

As the Anonymous coward above pointed out there are alternative options for setting up a *nix router. Distro's such as IPCop, Smoothwall or M0n0wall are all designed from the ground up to be routers, and will probably be easier for someone who is new to linux to setup! I do admire the author tho for doing it this was as it allows for a much greater control over the final appliance! I'm quite happy (atm!) with my Linksys WRT54G running the custom DD-WRT firmware, one of the one's released under the GNU/GPL license that adds features to the original linksys firmware, for the moment! I've often been tempted by having a linux router but can't quite justify the effort to myself yet!

Al Kelly's picture

Recycling older equipment and SOHO routers/firewalls

Submitted by Al Kelly on Wed, 2007-02-07 20:05.

Vote!
0

A well written, well thought out article. However, the notion that you need a 500mhz CPU to run your router/firewall is a bit excessive. In the past I've set up and run IPCop on Pentium120s and PII-200 boxes with anywhere from 64 to 196 megs of RAM. Plus there are a lot more of those old boxen out there that can provide years of service as firewalls. Currently I'm running M0n0wall on an old Acer PII-233 with 128RAM and a "huge" 2 gb hdd. SUSE is a good distro, but there are plenty of others that can be used. Smoothwall, Redwall, IPCop, and others, or just use the distro of your choice and set up ipchains yourself. Thus the beauty of Free Software is revealed.

Cheers,
Alisdair (but you can call me Al)

apache's picture

Very well-written John!

Submitted by apache on Thu, 2007-02-08 08:29.

Vote!
0

I really enjoyed this article! But I think you are being way to hard on yourself..

I personally use IPCop for my own personal firewall/Snort IDS/Squid proxy/Gateway/Proxy/SSL etc. Its really important to have tight security if you are taking control like this.. but no sweat!

porcel's picture

How do different Router distros compare?

Submitted by porcel on Mon, 2007-02-12 20:13.

Vote!
0

Can anybody comment on the relative strengths of some of the router-specific distributions (IPCop,Smoothwall, Monowall).

I would love to hear about people's experiences as well as what the security maintenance commitment is for these projects as a router is something that you only want to touch every five years, once it has been installed.

John Calcote's picture

Thanks for the comments!

Submitted by John Calcote on Tue, 2007-02-13 15:24.

Vote!
0

I'd like to thank everyone who's commented so far on this article. I noted that many people have indicated that ipcop is a great alternative to doing it all yourself. This is very true. I looked at ipcop, as well as a couple of other alternatives such as ClarkConnect and mOnOwall. The biggest problem I had with these pre-packaged solutions is the lack of flexibility. They assume that I to do exactly what my 59 dollar appliance does. Not true. If I wanted exactly what the appliance offered, I'd have just used one to begin with (I DID use one for a long time, in fact).

I also wanted to play with iptables to try and tailor my kids' access to the internet. I supposed I could have dug into the distribution source that was legally obliged to come with these pre-packaged linux router distros, but it was simpler to access iptables and the rest of the network sub-system from a more complete Linux distro.

Another reason for my choice was that this was a learning experience/experiment which continues to this day (and into the future, I hope). I access my linux router as if it were a regular machine on my home network - I use VNC to access display session 0 on this headless box (no physical KVM). I've installed the programming packages, so I can work on Linux programming projects router.

Finally, I get to choose which network services I make available through the publicly accessible internet address on my router, such as web server, mail server, ftp server, etc. The choices are not limited to whatever I can find for the particular flavor of Linux on my router. A more popular Linux distro such as SuSE or RedHat opens the door to many already compiled binary installation packages of most free software projects. Of course, this can be done with port forwarding to another machine on my NAT, but since my router is beefy anyway, I don't see the harm in overloading it a bit.

Anonymous visitor's picture

2 Points...

Submitted by Anonymous visitor on Tue, 2007-03-06 22:46.

Vote!
0

1) No one has mentioned Endian Firewall (which comes in a Community edition) is a lovely turn-key package, along the lines of IPCop etc. I have been using at at home for a while now on a Pentium II.. Lovely machine :)

2) The author has said in a follow-up comment about offering services (web, email, ftp) to the public world FROM his router / firewall. If we want proper security, that is not a good option. It allows more opportunity for the system to be compromised, and if the router / firewall is compromised, it may as well not be there at all. The secure approach to this is to offer these services via another machine within a DMZ (Demilitarized Zone) that is on a separate netmask. Then even if THAT box is compromised, the router / firewall isn't, and the intruder is still isolated from the rest of the PC's on the LAN network.

My 2 cents (Australian residents add 10% GST please)

Anonymous visitor's picture

Router? You've actually built a Gateway/Server

Submitted by Anonymous visitor on Tue, 2007-03-06 02:17.

Vote!
0

The beauty of of a complete linux distro is its power and scalability. You have built much more than just a router. What you want to do is just a matter of how much software you want to enable and configure. Using Samba you could include windows file server functionality. Installing Squid and Dansguardian you could have a web content filter. I figure if you are using all that electricity 24/7, you might as well make it as powerful as possible.

I'm using Clarkconnect on my own gateway/server and it works fantastic. You state that one is "locked-in" like an internet appliance, but this is not true. Although the server is configured via a web-based configuration (much like an embedded linux router), one can overcome the limitations of the web-configuration by editing the configuration files remotely easily using ssh. This doesn't have to be done in the command line. Use the "fish://server/" protocol on a linux client machine in KDE's Konqueror and you'll see what I mean.

Great article by the way - it just understates what you have built.

Anonymous visitor's picture

Try a real web gateway appliance!

Submitted by Anonymous visitor on Tue, 2007-03-06 14:01.

Vote!
0

You can also try “CacheGuard OS”: A Linux based Web Gateway Appliance. “CacheGuard OS” is a fully integrated solution to optimize and secure Web Traffics.

Tools and Linux distributions you are talking about are pretty good but are just an addition of multiples powerful software while CacheGuard is a highly integrated software appliance.

“CacheGuard OS” is free for a limited number of users (excellent for a family). See www.cacheguard.com.

Anonymous visitor's picture

OpenBSD is another fine choice for a firewall/gateway

Submitted by Anonymous visitor on Wed, 2007-03-07 18:12.

Vote!
0

I'm pretty good with Linux's iptables, so I decided to see if I could replicate this with OpenBSD and its included packet filtering software, PF. Turns out that PF's syntax is easier for humans to read and understand than that of iptables, though the OpenBSD install might scare off the GUI-lovers. Like with Linux's iptables, you have total flexibility. It's worth your examination.

And yes, I still like iptables and will continue to use it, too. Not bagging on it at all.

BTW, among Linux distro's, I wouldn't recommend SuSE for a firewall. It's just too fat. Same with Fedora or CentOS, much as I love them for other applications. I would, though, recommend either Slackware or Ubuntu Server Edition. They're small, easy to install, and run well on older hardware very well. I run an Ubuntu mail server on a 270MHz SPARC box, and it's not even breathing hard; took me a couple of hours, including install time, to get going.

spitz@cmosnetworks.com

Anonymous visitor's picture

Another vote for Linksys box and open firmware

Submitted by Anonymous visitor on Tue, 2007-03-13 14:17.

Vote!
0

I have a Linksys WRT45G that is setup to run OpenWRT and x-wrt[1] which gives me a really simple setup and config throught the web interface but also linux command prompt using ssh should I need it. You can pick the old linksys routers up for next to nothing on ebay upload the new firmware and off you go. As you don't really want to run any other apps on your firewall it has plenty of grunt to do the job.
It has live throughput graphs, Quality of services, and all the things you would expect from a modern router and it's no larger than a book and takes very little power compared with an old PC and makes no noise!

I'm off to get me a NSLU2 and some Debian images![2]

john
[1]http://x-wrt.org/
[2]http://www.cyrius.com/debian/nslu2/

Anonymous visitor's picture

Concentrators

Submitted by Anonymous visitor on Tue, 2007-04-03 00:50.

Vote!
0

I may just not be looking in the right place, but I'm unable to find a cheap concentrator. Could you provide a link to an actual concentrator? Many thanks.

Anonymous visitor's picture

Concentrators = Switches

Submitted by Anonymous visitor on Tue, 2007-04-03 18:00.

Vote!
0

I think anyway.

Anonymous visitor's picture

*BSD or Slackware

Submitted by Anonymous visitor (not verified) on Thu, 2007-04-12 06:41.

Vote!
0

I think spitz@cmosnetworks.com is right. For a firewall, SuSE or Redhat is too big. Slackware is more stable than those and úses less resources. *BSD is also alternative for such purpose.

Anonymous visitor's picture

Sveasoft Talisman Firmware is Free

Submitted by Anonymous visitor (not verified) on Sun, 2007-09-16 16:10.

Vote!
0

Sveasoft just released their Talisman firmware to the public. You can download it directly from their web site.

Anonymous visitor's picture

DO NOT PAY FOR IT! Sveasoft are bad!

Submitted by Anonymous visitor (not verified) on Sun, 2007-09-16 23:38.

Vote!
0

Hi,

Sveasoft is a dubious company. They took GPL code, and are actively SELLING IT.
To get their firmware, go here: http://wrt54g.cybermart.ca/
You will also see an email exchange Sveasoft's boss had with the web site owner... the level of childishness is really amazing.

Sad sad sad...

Tom



Other sites

Free Software Magazine uses Apollo project management and CRM for its everyday activities!