🚀 go-pugleaf

whyza@mindless.com (Rossco) writes:

> 
> Hi all.
> 
> Been up and running with linux for a few months now and I would like
> to use linux as a firewall/proxy for my home lan.
> 
> I have 3 machines, a dedicated linux box, a winnt server, and a win95
> workstation.
> I currently run the proxy service from a winnt server machine, using
> wingate, a proxy server.
> 
> When I initially wanted to set up a system to put all my machines on
> my home lan on the net thru one modem, I was remember being told by my
> isp that a proxy server was the only way to to accomplish this, as
> they were not prepared to update thier routing tables to forward
> packets to my second and third machines, without a cost being
> incurred.
> 
> I would like to know if this is still the case, if I now use linux
> instead of nt4, to forward packets to my second and third machines. I
> know linux can act as a firewall/proxy and do ip forwarding?  But if I
> choose ip forwarding will my  my isp strill need to upgrade thier
> routing tables? 
> 
> Or is ip masquerading a better option?

Yes, it sounds like ip masquerading is the best choice here.  It acts like
a proxy server, but on the network level, instead of for just http
connects.   You can find a howto on setting it up at
http://sunsite.unc.edu/LDP 

-- 
Frank Sweetser rasmusin at wpi.edu fsweetser at blee.net | PGP key available
paramount.res.wpi.net RedHat 4.9.1 Linux 2.0.31 i586     | at public servers
"If the future navigation system [for interactive networked services on
the NII] looks like something from Microsoft, it will never work."
(Chairman of Walt Disney Television & Telecommunications)

In <34556e84.5449986@192.168.0.1> whyza@mindless.com (Rossco) writes:

>I would like to know if this is still the case, if I now use linux
>instead of nt4, to forward packets to my second and third machines. I
>know linux can act as a firewall/proxy and do ip forwarding?  But if I
>choose ip forwarding will my  my isp strill need to upgrade thier
>routing tables? 

>Or is ip masquerading a better option?

You can use either. My preference when setting up these kind of things
is to use private network numbers on the "internal" side and IP
masquerade, but also a Squid proxy on the Linux gateway for all
HTTP and FTP requests. The Squid proxy will make things more efficient
for web and there's masquerade for other protocols. You'll probably want
to setup BIND on the Linux gateway as well.

Nick.
-- 
Kralizec / Zeta Microcomputer Software  Fax: +61-2-9233-6545 Voice: 9837-1397
G.P.O. Box 3400, Sydney NSW 1043        http://www.zeta.org.au/

In <34556e84.5449986@192.168.0.1> whyza@mindless.com (Rossco) writes:

>Been up and running with linux for a few months now and I would like
>to use linux as a firewall/proxy for my home lan.

>I have 3 machines, a dedicated linux box, a winnt server, and a win95
>workstation.
>I currently run the proxy service from a winnt server machine, using
>wingate, a proxy server.

IP masquerading will let you do that, and your network access from the
Win* boxes will be transparent - the Linux box takes care of modifying
and forwarding packets between your internet connection and your local
network.

Your ISP does not need to do anything - the setup is invisible to the
outside (it seems as if all traffic is coming from your Linux box).

Check out the masquerading docs - http://www.indyramp.com/masq/  

-- 
Henrik Storner                               http://www.image.dk/~storner/ 
"The POP3 server service depends on the SMTP server service, which
 failed to start because of the following error:
 The operation completed successfully." -Windows NT Server v3.51

Rossco <whyza@mindless.com> wrote in article
<34556e84.5449986@192.168.0.1>...
> 
> Or is ip masquerading a better option?

You'll be amazed at how much better IP masquerading is than WinGate -
former WinGate user and now on with IP masq-much better.

Nick Andrew <nick@zeta.org.au> wrote:
> In <01bce4c3$964289f0$7e1411ac@epic406> "nate dutra" <dutra@cs.wisc.edu> writes:
> 
> >You'll be amazed at how much better IP masquerading is than WinGate -
> >former WinGate user and now on with IP masq-much better.
> 
> Do tell. I would like some additional ammunition as to why it is preferable
> to pay for installation and configuration of a Linux machine which can
> handle any workload you like to throw at it versus buying an N-user
> license of a product which should have been part of Windows TCP/IP.

_transparency_ :-)

With "IP masquerading" (or NAT if you talk BSD/CISCO) you simply set
the "IP masquerading" host as the default route on all your clients.
Packets will transparently pass through the NAT machine and out onto
the 'net.

With WinGate/WinProxy (etc etc) you need to configure each client
program that will talk via the proxy to use the proxy. i.e. configure
SMTP, HTTP, FTP, etc.

Note that firewalls like TIS Gauntlet use a proxy in combination with
a "transparent proxy" feature to provide transparency.

Both Linux and FreeBSD provide good "IP masquerading" support. Linux
uses an "in kernel" method for speed at the expense of a larger kernel
memory footprint. FreeBSD uses a "user land" daemon. Also NetBSD and
OpenBSD can use the IP filter kernel module to provide "IP masquerading".

Cheers.
--        +------------------------------------------------------------+
      .   | John Saunders   mailto:John.Saunders@scitec.com.au  (Work) |
  ,--_|\  |                 mailto:john@nlc.net.au              (Home) |
 /  Oz  \ |                 http://www.nlc.net.au/~john/               |
 \_,--\_/ | SCITEC LIMITED  Phone +61 2 9428 9563  Fax +61 2 9428 9933 |
       v  |    "By the time you make ends meet, they move the ends."   |
          +------------------------------------------------------------+

In <01bce4c3$964289f0$7e1411ac@epic406> "nate dutra" <dutra@cs.wisc.edu> writes:

>You'll be amazed at how much better IP masquerading is than WinGate -
>former WinGate user and now on with IP masq-much better.

Do tell. I would like some additional ammunition as to why it is preferable
to pay for installation and configuration of a Linux machine which can
handle any workload you like to throw at it versus buying an N-user
license of a product which should have been part of Windows TCP/IP.

Nick.
-- 
Kralizec / Zeta Microcomputer Software  Fax: +61-2-9233-6545 Voice: 9837-1397
G.P.O. Box 3400, Sydney NSW 1043        http://www.zeta.org.au/