🚀 go-pugleaf

Dominic Baines (dombaines@dial.pipex.com) wrote:
: I have a bit of a nightmare connection to put in place for a remote
: office and was wondering if anyone could advise on a solution:

: Internet = Router/Gateway === Linux Server 1
:                                 +
:                                 + PPP connection (2 x 56K modems)
:                                 +
:                               Linux Server 2 ===== LAN

: The Internet side (Linux Server 1) of the PPP connection has real IP
: numbers. (I do have 3 extra IP's spare if needed)
: The PPP connection have 192.168.2.x IP numbers.
: The LAN side (Linux Server 2) of the PPP connection has 192.168.1.x
: private IP numbers.

: The PPP connection could be 100%, dial on demand or manual connection
: yet to be decided (advice ?).

: I need to firewall protect both ends of the PPP connection whilst
: allowing FTP, HTTP, News & email traffic through from LAN to Internet.
: (I could add an extra box in at either end to achieve this.)

No Problem as long as they use TCP/IP (not IPX)

: Linux Server 2 and LAN also have HTTP, FTP, and an Oracle server that
: sometimes need to be connected to by the Internet side of the
: connection. There is also Video Conferencing (CU-SeeMe) used from LAN
: out to the Internet.

: LAN default gateway route will obviously be the eth0 IP on Linux
: Server1, BIG NOTE: I have no control over the Router/Gateway on the 
: Internet side so it looks as if IP Masq is required for Linux Server 1 
: so that I can sort out any returning traffic from Internet side to LAN
: side.

: The Linux Servers currently are 586/133's but could easily be upgraded.

: Could anyone help ?

: Thanks,

: Dominic Baines

--
Very easy, I am doing similar things at home. Without having control over the
internet connection you will have to use masquerading for you non valid IP
numbers. This will result in you being able to initiate sessions with
other computers on the internet but other computers CANNOT connect to yours
as you will not be using a valid IP address. ie you can telnet out of a non
valid IP address machine but others cannot telnet into it (unless within your
private network).

On server 1 you will configure the default route to the internet and routes
to the 192.168.2.? network out the ppp connnection. you then set up a route
to the 192.168.1.? subnet out the ppp connection with gateway of the ppp
address of server 2 (192.168.2.?).

Server 2 should be set up to rout information out its ether card for 192.168.1.?
and out the ppp link to 192.168.2.?. Then the default route is set to
the ppp link with gateway ov server 1 (192.168.2.?)

You have now set up the routing so that your machines now know where to send
packets. Now you have to set up your firewalls.

You will allow all access to the outside net except for addresses in the range
192.168.?.? (non valid IP addresses)
You will allow connections with 192.168.?.? via ppp.
you will disable forwarding but allow masquerading forwarding from your
private networks to the internet.

The above commands should be somewhere that they are run on boot-up

These commands are detailed in the Masquerading howto which I can mail to you
if you cannot get a hold of it.

My explanation may be a bit confusing so please feel free to contact me to
clarify anything.