🚀 go-pugleaf

In article <35947146.477110082@news.kcbbs.gen.nz>,
	prob@usa.net (Paul Robertson) writes:

> Our office has a NT4 server and a network of 25 pc's. We use MS
> Proxy Server to allow internet access but for the moment we are not
> allowing any incoming traffic. I want to connect it to the internet
> via our ISDN connection. An industrial strength firewall is called
> for. I have priced commercial firewalls but they are quite
> expensive. I wondered whether we could run Apache as a firewall on a
> separate server under Linux..

Apache's not a firewall, it can act as a WWW proxy, but a WWW proxy
and a proxy firewall are two different things. You'll need to install
the linux firewall in the kernel (just config the kernel, the source
is already there) and configure some firewall rules, read the firewall
HOWTOs for more info on that. Unless the linux box can connect to the
net without going through the MS firewall, no incoming connections
will come through unless the MS firewall is configured to let them
through, if it's up to doing that. The linux firewall is very secure
and flexible, I heard nothing but bad things about Microsoft's while I
was supporting the leading firewall (checkpoint) for a living. They
don't appear to have much of an idea about security.

If you're trying to set up a WWW server, then you've not made it clear
if the ISDN connection is what's connecting your office to the net, or
what's connecting your machine to the net. If you want to provide a
web server via ISDN, there's precious little point as no-one can
connect unless the ISDN link is up or your ISP will dial you when an
incoming connection reaches them.

Basically, you've not made it clear what you're trying to do, where
the linux box is on the network, and what kind of network connection
you've got, so anyone trying to provide answers is going to have to
guess a lot! Please provide more info.

-- 
Ian - Edit address before mailing. | Have you got a question you want to ask
     Running Linux in the UK.      | Usenet? Search www.dejanews.com first!
             -- There are no facts, only opinions --

This is a multi-part message in MIME format.
--------------671E2D86DF4FE525116C54A8
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hmmm. Apache is just a web server isn't it? If you mean using the linux as
a firewall and running apache as well, that's possible. Conventional
wisdom says that a firewall box (of which Linux is a very good candidate)
should have as few additional services as possible, so putting apache on
top of it would violate that wisdom. Still it is possible, but I would
recommend two Linux boxes: one for a firewall and the other for the apache
web server which can be outside of the firewall (if you want an internet
and/or intranet) or inside (if you want an intranet alone):

Internet <----------------->Firewall Box <-----------------> Internal
Network
                                                   |
                                           Apache Server (in DMZ)

The firewall could be a masquerading or proxy type. The /usr/doc/HOWTO
files with RH 5.x contain excellent help on how to make all this happen.

Paul Robertson wrote:

> Our office has a NT4 server and a network of 25 pc's. We use MS Proxy
> Server to allow internet access but for the moment we are not allowing
> any incoming traffic. I want to connect it to the internet via our
> ISDN connection. An industrial strength firewall is called for. I have
> priced commercial firewalls but they are quite expensive. I wondered
> whether we could run Apache as a firewall on a separate server under
> Linux..
>
> Suggestions..
>
> Paul Robertson
> Auckland
> prob@usa.net <home>
> par@heaneyco.co.nz <work>



--
********************************
Daryle Niedermayer
Programmer/Analyst
GDS & Associates Systems. Ltd.
400 - 4211 Albert St.
Regina, SK Canada -- S4S 3R6
Phone: 306.586.7832
Fax: 306.585.1514
email: dniederm@gds.ca
http://www.gds.ca
********************************


--------------671E2D86DF4FE525116C54A8
Content-Type: text/x-vcard; charset=us-ascii; name="vcard.vcf"
Content-Transfer-Encoding: 7bit
Content-Description: Card for Daryle Niedermayer
Content-Disposition: attachment; filename="vcard.vcf"

begin:          vcard
fn:             Daryle Niedermayer
n:              Niedermayer;Daryle
org:            GDS & Associates Systems Ltd.
adr:            400 - 4211 Albert St.;;;Regina;SK;S4S 3R6;Canada
email;internet: dniederm@gds.ca
title:          Programmer/Analyst
tel;work:       306.586.7832
tel;fax:        306.585.1514
x-mozilla-cpt:  ;-2112
x-mozilla-html: FALSE
version:        2.1
end:            vcard


--------------671E2D86DF4FE525116C54A8--

In article <3593BDD5.7B56186B@gds.ca>,
Daryle Niedermayer  <dniederm@gds.ca> wrote:
>
>Hmmm. Apache is just a web server isn't it? If you mean using the linux as
>a firewall and running apache as well, that's possible. Conventional
[snip]
>
>Paul Robertson wrote:
>
>> Our office has a NT4 server and a network of 25 pc's. We use MS Proxy
>> Server to allow internet access but for the moment we are not allowing
[snip]
>> whether we could run Apache as a firewall on a separate server under
>> Linux..

If you mean you want to use Apache as a http proxy on a Linux firewall
machine, then yes.  Apache with mod_proxy compiled in makes a great http
proxy.

	Anthony

Paul Robertson (prob@usa.net) wrote:

: An industrial strength firewall is called for. I have priced commercial
: firewalls but they are quite expensive. I wondered whether we could run
: Apache as a firewall on a separate server under Linux..

(Everyone's dealt with the Apache issue, so I'll ignore that).

Yes, you can build a very secure setup using a PC and Linux.  However if you
do choose the "homebrew" approach the security of it will depend directly on
who designs and implements the solution.  If an "industrial strength"
solution is called for, don't do it yourself.  Find someone with qualifications
and experience.

You can build a reasonable packet filtering firewall using Linux and its
IP filtering facility.  You can put proxies or a cache on top of that.  You
can also make quite a good proxy server firewall using Linux and the TIS
Firewall toolkit.   All it will cost you is hardware and someone's time,
the software is all free.

Daniel.

------------------------------------------------------------------------------
Daniel Ayers, B.Sc (Hons), M.Sc              Email: daniel.ayers@netlink.co.nz
Network Security Specialist              DDI Phone: +64-4-916-5622
Netlink                                        Fax: +64-4-916-5300
23 Waring Taylor St, PO Box 5358            Mobile: +64-21-387-334
Wellington, New Zealand                        URL: http://www.netlink.co.nz
-- Disclaimer: These opinions are solely my own, and not those of Netlink. --

Paul Robertson <prob@usa.net> wrote:
: Our office has a NT4 server and a network of 25 pc's. We use MS Proxy
: Server to allow internet access but for the moment we are not allowing
: any incoming traffic. I want to connect it to the internet via our
: ISDN connection. An industrial strength firewall is called for. I have
: priced commercial firewalls but they are quite expensive. I wondered
: whether we could run Apache as a firewall on a separate server under
: Linux..

Apache isn't a firewall - it's a web server.

The Linux kernel itself includes all you need to do the packet side of
firewalling - compile the relevent options in (which I'll happily list if you
like) and setup some rules using ipfwadm. 

However, you'll probably want to include proxying for web/ftp access, in which
case, Apache could be used. Personally, I'd prefer Squid since it's built from
the ground up as a proxy, not a web server. YMMV.

-- 
This is not my .sig
prefered email: dave2@earthling.net

It's 26 Jun 98  21:00,
We'll return to prob@usa.net and All's
discussion of Apache WWW server - A good firewall? - how hard to set up?

 pr> Our office has a NT4 server and a network of 25 pc's. We use MS Proxy
 pr> Server to allow internet access but for the moment we are not allowing
 pr> any incoming traffic. I want to connect it to the internet via our
 pr> ISDN connection. An industrial strength firewall is called for. I have
 pr> priced commercial firewalls but they are quite expensive. I wondered
 pr> whether we could run Apache as a firewall on a separate server under
 pr> Linux..

No, Apache is a web server, not a firewall.

There are a few possible solutions, depending on what you want.  I'll
just mention those that need little or no extra expense.

1.  You could keep the existing MS Proxy, patch NT to the latest
hotfixes and put a Linux box in front to act as a packet filter, to add
a first line of defence.  You would need to obtain a block of IP
addresses for the new external subnet, if you don't already have a block
assigned to you.  If you decide to host things like web servers for the
outside world to access, they could be placed between the filter and the
proxy server.

2. Check out the Firewall ToolKit.  It's a set of building blocks to
construct your own firewall, and will work under Linux.  It's not the
easiest thing to setup, and there's a couple of features missing (it
doesn't support Socks 5, for instance).

3. IP masquerading and packet filtering might be worth a shot, though
I'd be more comfortable if these functions were hosted by separate
boxes.  Similar to option 1, except a Linux box with IP masquerading
would replace the MS Proxy.

4. Other freely available proxy servers?

... "Sleep?  What is this?"  Bluewave posters
--
| Fidonet:  Tony Langdon 3:632/367.2
| Internet: tlang@freeway.DIALix.oz.au
|
| Freeway Internet Gateway, Melbourne, Australia.  For information about
| our services and conditions of use, e-mail:
| info@freeway.DIALix.oz.au, to receive a copy of the FAQ.

tlang@freeway.DIALix.oz.au (Tony Langdon) writes:

> 4. Other freely available proxy servers?

If you're after a good high performance freely available proxy server
for web clients i'd recommend squid: http://squid.nlanr.net/

Much better than Apache's proxy module imo.

carl

In article <m23ecolubs.fsf@brutus.caverock.co.nz>,
  Carl Ansley <carl@caverock.co.nz.NOSPAM> wrote:
>
> tlang@freeway.DIALix.oz.au (Tony Langdon) writes:
>
> > 4. Other freely available proxy servers?
>
> If you're after a good high performance freely available proxy server
> for web clients i'd recommend squid: http://squid.nlanr.net/
>
> Much better than Apache's proxy module imo.
>
> carl
>

Try also FWTK, this is a complete solution (tn, ftp, plug ... proxy)
www.tis.com

But I'm agreeing with Carl. Squid is great.



-----== Posted via Deja News, The Leader in Internet Discussion ==-----
http://www.dejanews.com/rg_mkgrp.xp   Create Your Own Free Member Forum