🚀 go-pugleaf

Marco Faltermann <falter@keep.touch.ch> wrote:
> Wo muss ich ansetzen,dass,wenn eine Win-Kiste am Heimnetz h�ngt,sich der
> Linux-Server nicht st�ndig ins Internet einw�hlt?

Simplify your setup:
   - do not route packet from inside to outside
   - do not masquerade
   - run a local DNS server for the local network
   - do not set the Internet service provider in resolv.conf, but the local
     one

then add a small complexity:
   - configure squid to do WWW/FTP proxying, chrooted so you can specify
     another resolv.conf (alternatively: compile squid static and
     change the path to resolv.conf in the binary ...)

Thus your whole Linux system will *never* dial out for anything else
except squid requests.

You can then add sendmail, with a smart-host being the IP address
of your ISP.

This setup is great since it avoids any risk of having uncontrolled
packets through the relay, or uncontrolled dial-up because of DNS
query, etc.

Alternatively you can configure masquerading *and block the
relaying of DNS, SAMBA, etc packets*. This could also be done
in /etc/diald.conf.