# setting up NAT/router

## p3nguin

Hello, im a bit of a n00b here and am interested in getting a router/NAT box setup.  Here is what i want it to do....I want to have some sort of firewall, I want to be able to throtlle traffic to specific computers.  Im just wondering both hardware and software what i need(besides iptables).  I currently have 4 computers on a LAN connected to the internet by a DSL router/cable modem.  So I want a box that all the internet traffic goes through.  Please if anyone has guides or tips/suggestions let me know what I need to do or read.  Thanks

----------

## To

Well you need one switch or router and network cables or wireless, if you have the $$.

Then you can use and old computer ( that's what I do ) has gateway. You will set up 2 network connections in there one to the DSL modem and the other to your intranet. You can set up gentoo and use something like shorewall http://www.shorewall.net/ or just use smoothwall http://www.smoothwall.org/.

Tó

----------

## kashani

Most consumer firewalls will not throttle traffic unless things have changed recently.

Your best bet to start with a Linux box with two physical interfaces one for the internal machines and one facing the Internet. Look for a guide on iptables/NAT/masq there are a ton around.

Once you've got iptables working well and doing things properly you can start looking into doing some QoS of your packets. It's complicated and a little messy, plan on getting your finger dirty mucking around with the kernel. Doing a serach on "Linux iptables QoS" should pull up some references.

kashani

----------

## UncleTom

What I use in a similar setup is floppyfw (http://www.zelow.no/floppyfw/) on an old Pentium 90 with 24 megs of RAM and no hard disk. 

Floppyfw doesn't do traffic shaping out of the box, but you might try to play around with Wonder Shaper (http://lartc.org/wondershaper/) and read the Linux Advanced Routing and Shaping HOWTO (http://lartc.org/).

----------

## taskara

anyone got a link to a good router "deny everything" sort of firewall config?

----------

## UncleTom

 *taskara wrote:*   

> anyone got a link to a good router "deny everything" sort of firewall config?

 

"ifconfig eth0 down"?   :Wink: 

Perhaps you could have a look at http://www.yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html. This has some examples and a good selection of links.

Also, you could have a look at the default rules in floppyfw (see my previous post for the link). That might be quite close to what you want.

----------

## p3nguin

ok, so as far as the setup goes, I install two nics, one of them runs to the dsl modem/router and plugs into spot 1, the other goes into a hub and plugs into uplink.  Then the other computers on my network plug into the other spots of the hub.  The cable going from one of my nics to the uplink would use crossover cable instead of regular network cable.  is this right?  Im just trying to get a visual on the physical setup.

----------

## k0nig

dont use crossover from ur eth int to the hub uplink...

----------

## taskara

 *UncleTom wrote:*   

>  *taskara wrote:*   anyone got a link to a good router "deny everything" sort of firewall config? 
> 
> "ifconfig eth0 down"?   

 

HAHA  :Wink: 

 *UncleTom wrote:*   

> Perhaps you could have a look at http://www.yolinux.com/TUTORIALS/LinuxTutorialIptablesNetworkGateway.html. This has some examples and a good selection of links.
> 
> Also, you could have a look at the default rules in floppyfw (see my previous post for the link). That might be quite close to what you want.

 

ok cool.. thanks for that!  :Very Happy: 

----------

## p3nguin

alright, got my routing box up, both nics work, it sees the internet....one problem though, when i plug my hub into eth1 and another computer into that hub, that computer cannot see any of the other computers or the internet.

doing an ifconfig shows both eth0 and eth1 working and they were both brought up when linux was booting.  I can ping eth0 from eth1 and vice versa.

do i need to change any other settings or are the setting it uses to connect to the net right now going to still connect it if it goes through the other box? thanks

UPDATE: I added net.ipv4.ip_forward = 1...I was wondering if I have to do a route add for eth1 or is it not necessary?  

```
 root@reef-freak proxy # route Kernel IP routing table

Destination Gateway Genmask Flags Metric Ref Use Iface

192.168.0.0 * 255.255.255.0 U 0 0 0 eth0

192.168.0.0 * 255.255.255.0 U 0 0 0 eth1

default 192.168.0.1 0.0.0.0 UG 1 0 0 eth0
```

----------

## UncleTom

It shouldn't be necessary to do a route add for a subnet you are directly connected to.

I take it you cannot ping your PCs from your router box or vice versa. What IP address and netmask did you give to eth1? Is this the same subnet that you use on your PCs? Use "ifconfig eth1" to test that. From your routing table it looks to me that you have a 192.168.0.1 address on eth0 and another 192.168.0.x address on eth1. It would be better to have two distinct subnets for eth0 and eth1.

Also, do your PC's get their IP address from DHCP? In that case you would need to setup a DHCP server to give them IP addresses.

----------

## p3nguin

yea, i cannot ping anything when im behind the new router on the hub!  I went ahead and put eth1 on a different subnet, still wont ping anyone or anywhere.

here is ifconfig of the router box

```
 ifconfig

eth0      Link encap:Ethernet  HWaddr 00:E0:29:35:1A:D2  

          inet addr:192.168.0.99  Bcast:192.168.0.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:59 errors:0 dropped:0 overruns:0 frame:0

          TX packets:27 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:7781 (7.5 Kb)  TX bytes:1926 (1.8 Kb)

          Interrupt:9 Base address:0xfcc0 

eth1      Link encap:Ethernet  HWaddr 00:60:B0:EC:2D:6F  

          inet addr:192.168.10.100  Bcast:192.168.10.255  Mask:255.255.255.0

          UP BROADCAST MULTICAST  MTU:1500  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

          Interrupt:3 Base address:0xfca0 

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
```

here is what my /etc/conf.d/net looks like for one of the machines that will be on the hub connected to eth1:

```
# /etc/conf.d/net:

# $Header: /home/cvsroot/gentoo-src/rc-scripts/etc/conf.d/net,v 1.7 2002/11/18 19:39$

# Global config file for net.* rc-scripts

# This is basically the ifconfig argument without the ifconfig $iface

#

iface_eth0="192.168.10.69 broadcast 192.168.10.255 netmask

255.255.255.0"

#iface_eth1="207.170.82.202 broadcast 207.0.255.255 netmask 255.255.0.0"

# For DHCP set iface_eth? to "dhcp"

# For passing options to dhcpcd use dhcpcd_eth?

#

#iface_eth0="dhcp"

#dhcpcd_eth0="..."

# For adding aliases to a interface

#

#alias_eth0="192.168.0.3 192.168.0.4"

# NB:  The next is only used for aliases.

#

# To add a custom netmask/broadcast address to created aliases,

# uncomment and change accordingly.  Leave commented to assign

# defaults for that interface.

#

#broadcast_eth0="192.168.0.255 192.168.0.255"

#netmask_eth0="255.255.255.0 255.255.255.0"

# For setting the default gateway

#

gateway="eth0/192.168.10.1"
```

----------

## think4urs11

Hi!

1) on your hub connected machines you should have 192.168.10.100 as gateway, not the .1

2) Did you enable routing on the box with the two NIC? If not, do so  :Smile: 

HTH

T.

----------

## p3nguin

ok, tried that, still doesnt work....I added net.ipv4.ip_forward = 1 but thats it, are there other things i have to do to enable routing?

Here is the current settings for my router box:

```
ifconfig

eth0      Link encap:Ethernet  HWaddr 00:E0:29:35:1A:D2  

          inet addr:192.168.0.99  Bcast:192.168.0.255  Mask:255.255.255.0

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:1738 errors:0 dropped:0 overruns:0 frame:0

          TX packets:724 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:667568 (651.9 Kb)  TX bytes:120429 (117.6 Kb)

          Interrupt:9 Base address:0xfcc0 

eth1      Link encap:Ethernet  HWaddr 00:60:B0:EC:2D:6F  

          inet addr:192.168.10.100  Bcast:192.168.10.255  Mask:255.255.255.0

          UP BROADCAST MULTICAST  MTU:1500  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

          Interrupt:3 Base address:0xfca0 

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:4 errors:0 dropped:0 overruns:0 frame:0

          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:200 (200.0 b)  TX bytes:200 (200.0 b)

root@reef-freak proxy # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.0.0     *               255.255.255.0   U     0      0        0 eth0

192.168.10.0    *               255.255.255.0   U     0      0        0 eth1

default         192.168.0.1     0.0.0.0         UG    1      0        0 eth0
```

i noticed that eth1 doesnt have the RUNNING line in it, does that matter?

and here are the current settings for my box behind the router/hub:

```
 ifconfig

eth0      Link encap:Ethernet  HWaddr 00:20:ED:8C:44:A0  

          inet addr:192.168.10.69  Bcast:192.168.10.255  Mask:255.255.255.0

          inet6 addr: fe80::220:edff:fe8c:44a0/10 Scope:Link

          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

          RX packets:0 errors:0 dropped:0 overruns:0 frame:0

          TX packets:7 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:100 

          RX bytes:2208248 (2.1 Mb)  TX bytes:16462303 (15.6 Mb)

          Interrupt:11 Base address:0x6000 

lo        Link encap:Local Loopback  

          inet addr:127.0.0.1  Mask:255.0.0.0

          inet6 addr: ::1/128 Scope:Host

          UP LOOPBACK RUNNING  MTU:16436  Metric:1

          RX packets:1192 errors:0 dropped:0 overruns:0 frame:0

          TX packets:1192 errors:0 dropped:0 overruns:0 carrier:0

          collisions:0 txqueuelen:0 

          RX bytes:797830 (779.1 Kb)  TX bytes:797830 (779.1 Kb)

root@nuronet proxy # route

Kernel IP routing table

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

192.168.10.0    *               255.255.255.0   U     0      0        0 eth0

default         192.168.10.100  0.0.0.0         UG    1      0        0 eth0
```

----------

## think4urs11

192.168.0.1 is your NAT router i presume?

did you run

```
rc-update add net.eth1 default
```

and (or reboot)

```
/etc/init.d/net.eth1 start
```

HTH

T.

----------

## p3nguin

what do you mean 192.168.0.1 is my NAT router..?  are you talking about the router box that im setting up?  becuase if you are, its ip is 0.99 if your talking about my modem/router unit then yes its ip address is 0.1.  I did try restarting eth0 and 1, im assuming that since the numbers are showing up correctly in ifconfig everything is running right

----------

## think4urs11

i'm talking of this:

 *p3nguin wrote:*   

> 
> 
> root@reef-freak proxy # route
> 
> Kernel IP routing table
> ...

 

What is 192.168.0.1? Your ISP's router?

What you should also consider...

192.168 addresses are NOT routed in the internet - never ever! Somewhere has do be some sort of NAT done - either at your side (this is what you're trying to do i think, od on yours ISP side)

----------

## p3nguin

yes, 192.168.0.1 is my router/modem that my isp gave me.  It is also the default gateway when i connect to the web without going through my new router box and hub.

since the modem that my isp gave me is a router as well, I will be running two routers once my box is up and running completley.  Unless there is some way to shut off the routing part of the router/modem that my isp gave me.

i did notice one thing, when booting the router box, it says bring eth0 up then ok then setting default gateway...then it says bringing eth1 up then ok, but then doesnt say anything about setting default gateway,.

----------

## think4urs11

mhh...

what does

```
traceroute 192.168.0.1

traceroute 'some address in internet'
```

give you when run from 192.168.10.69

so i think you have to setup NAT on your box too.

All outgoing packets should have the 192.168.0.99 as source IP.

Thereby your router doesn't see any difference if packets come from your router or from some box(es) behind.

HTH

----------

## p3nguin

```
root@nuronet proxy # traceroute 192.168.0.1

traceroute to 192.168.0.1 (192.168.0.1), 30 hops max, 40 byte packets

 1  192.168.10.69 (192.168.10.69)  2996.192 ms !H  3000.274 ms !H  2999.998 ms !H

root@nuronet proxy # traceroute 66.218.71.86

traceroute to 66.218.71.86 (66.218.71.86), 30 hops max, 40 byte packets

 1  192.168.10.69 (192.168.10.69)  2995.698 ms !H  2999.961 ms !H  2999.972 ms !H
```

 *Quote:*   

> give you when run from 192.168.10.69
> 
> so i think you have to setup NAT on your box too.
> 
> All outgoing packets should have the 192.168.0.99 as source IP.
> ...

 so what do i need to do?

----------

## think4urs11

This should be a good start

http://www.tldp.org/HOWTO/IP-Masquerade-HOWTO/

----------

## matkel

eth0 must be on the (isp's) router side with IP 192.168.0.whatever and 192.168.0.1 as default gateway.

eth1 is on the other LAN side with 192.168.10.100. Every box on this side must also have a 192.168.10.* IP number and 192.168.10.100 as its gateway.

And your router has to do masquerading:

```

iptables -t nat -I POSTROUTING -i eth1 -j MASQUERADE

```

should do the trick.

eth0's ip is static, so you can use source nat instead of masquerading. That would be something like:

```

iptables -t nat -I POSTROUTING -o eth0 -j SNAT --to-source 192.168.0.99

```

----------

## p3nguin

well i read that guide....tried to use the firewall script

```
Loading simple rc.firewall version 0.74..

   External Interface:  eth0

   Internal Interface:  eth1

   loading modules:   - Verifying that all kernel modules are ok

depmod: *** Unresolved symbols in /lib/modules/2.4.20-gentoo-r5/kernel/net/ipsec/ipsec.o

----------------------------------------------------------------------

ip_tables, modprobe: Can't locate module ip_tables

ip_conntrack, modprobe: Can't locate module ip_conntrack

ip_conntrack_ftp, modprobe: Can't locate module ip_conntrack_ftp

ip_conntrack_irc, modprobe: Can't locate module ip_conntrack_irc

iptable_nat, modprobe: Can't locate module iptable_nat

ip_nat_ftp, modprobe: Can't locate module ip_nat_ftp

----------------------------------------------------------------------

   Done loading modules.

   Enabling forwarding..

   Enabling DynamicAddr..

   Clearing any existing rules and setting default policy..

   FWD: Allow all connections OUT and only existing and related ones IN

iptables: No chain/target/match by that name

   Enabling SNAT (MASQUERADE) functionality on eth0

rc.firewall-2.4 v0.74 done.

```

still doesnt work.  

I have the setup exactly like you explained matkel, and i tried that command, but still nothing

i dont no whats going on!

----------

## p3nguin

anotherthing....I dont get why, even if i plug my box(the one thats supposed to be behind the router on the hub) directly into eth1 of the router, why it cannot ping it.

one thing i did notice is that the file ip_masquerade is not listed in /proc/net nor it it under lsmod....I couldnt fine it in the kernel anywhere either.

----------

## p3nguin

FIXED:  I unplugged the net cable going from the router to the hub out of the uplink port and plugged it into port 2.  

WTF!    :Laughing:    I was told to plug that into uplink.....why wouldnt it work when plugged straight into eth1 but work when eth1 is into hub...very weird.  oh well...thanks alot for the help, now i just need to learn more about firewall scripts!

----------

## devon

The uplink port on switches/hubs are designed so you can connect another switch/hub without using a cross-over cable. I.e. the RX and TX pairs are reversed when compared to a "normal" Ethernet port.

----------

## RangerDude

My switch has a little switch-button to switch between crossed or not in port 1, pretty neat.

----------

## lucindrea

in a hub you basicly have 2 sets of lines .. the transmit and the recive , all the "normal" ports recive wires connect to the transmit line that transmits to all the other ports ... the exception being the uplink port .. the reasion for this is so you can connect a cable to another hub directly , basicly connecting the recive part of the pair to the xmit part of the other hub ... and doing the job of a crossover cable .. yes if you connect a computer to a hub you would use a normal cable for a normal port and a crossover for the uplink ...

before anyone flames , i know this is an oversimple version ( their is acctully alot of internal switching and digital stuff inside the device , and acctual switchs , bridges and routes are a whole differnt story ) .. but it does serve to give a general idea of what cable to use where.

----------

