Board index Linux Networking

IP Forwarding vs Proxy/Firewall

IP Forwarding vs Proxy/Firewall

Post by Frank Sweetse » Wed, 29 Oct 1997 04:00:00




> Hi all.

> Been up and running with linux for a few months now and I would like
> to use linux as a firewall/proxy for my home lan.

> I have 3 machines, a dedicated linux box, a winnt server, and a win95
> workstation.
> I currently run the proxy service from a winnt server machine, using
> wingate, a proxy server.

> When I initially wanted to set up a system to put all my machines on
> my home lan on the net thru one modem, I was remember being told by my
> isp that a proxy server was the only way to to accomplish this, as
> they were not prepared to update thier routing tables to forward
> packets to my second and third machines, without a cost being
> incurred.

> I would like to know if this is still the case, if I now use linux
> instead of nt4, to forward packets to my second and third machines. I
> know linux can act as a firewall/proxy and do ip forwarding?  But if I
> choose ip forwarding will my  my isp strill need to upgrade thier
> routing tables?

> Or is ip masquerading a better option?

Yes, it sounds like ip masquerading is the best choice here.  It acts like
a proxy server, but on the network level, instead of for just http
connects.   You can find a howto on setting it up at
http://sunsite.unc.edu/LDP

--
Frank Sweetser rasmusin at wpi.edu fsweetser at blee.net | PGP key available
paramount.res.wpi.net RedHat 4.9.1 Linux 2.0.31 i586     | at public servers
"If the future navigation system [for interactive networked services on
the NII] looks like something from Microsoft, it will never work."
(Chairman of Walt Disney Television & Telecommunications)

 
 
 
Top

IP Forwarding vs Proxy/Firewall

Post by Ross » Wed, 29 Oct 1997 04:00:00


Hi all.

Been up and running with linux for a few months now and I would like
to use linux as a firewall/proxy for my home lan.

I have 3 machines, a dedicated linux box, a winnt server, and a win95
workstation.
I currently run the proxy service from a winnt server machine, using
wingate, a proxy server.

When I initially wanted to set up a system to put all my machines on
my home lan on the net thru one modem, I was remember being told by my
isp that a proxy server was the only way to to accomplish this, as
they were not prepared to update thier routing tables to forward
packets to my second and third machines, without a cost being
incurred.

I would like to know if this is still the case, if I now use linux
instead of nt4, to forward packets to my second and third machines. I
know linux can act as a firewall/proxy and do ip forwarding?  But if I
choose ip forwarding will my  my isp strill need to upgrade thier
routing tables?

Or is ip masquerading a better option?

Can someone please clarify for me?

Reply via email would be appreciated, and I will forward to usenet if
you haven't already done so.

                                                        Rossco

Brisbane
Australia

 
 
 
Top

IP Forwarding vs Proxy/Firewall

Post by Nick Andr » Wed, 29 Oct 1997 04:00:00



Quote:>I would like to know if this is still the case, if I now use linux
>instead of nt4, to forward packets to my second and third machines. I
>know linux can act as a firewall/proxy and do ip forwarding?  But if I
>choose ip forwarding will my  my isp strill need to upgrade thier
>routing tables?
>Or is ip masquerading a better option?

You can use either. My preference when setting up these kind of things
is to use private network numbers on the "internal" side and IP
masquerade, but also a Squid proxy on the Linux gateway for all
HTTP and FTP requests. The Squid proxy will make things more efficient
for web and there's masquerade for other protocols. You'll probably want
to setup BIND on the Linux gateway as well.

Nick.
--
Kralizec / Zeta Microcomputer Software  Fax: +61-2-9233-6545 Voice: 9837-1397
G.P.O. Box 3400, Sydney NSW 1043        http://www.zeta.org.au/

 
 
 
Top

IP Forwarding vs Proxy/Firewall

Post by Henrik Storn » Wed, 29 Oct 1997 04:00:00



Quote:>Been up and running with linux for a few months now and I would like
>to use linux as a firewall/proxy for my home lan.
>I have 3 machines, a dedicated linux box, a winnt server, and a win95
>workstation.
>I currently run the proxy service from a winnt server machine, using
>wingate, a proxy server.

IP masquerading will let you do that, and your network access from the
Win* boxes will be transparent - the Linux box takes care of modifying
and forwarding packets between your internet connection and your local
network.

Your ISP does not need to do anything - the setup is invisible to the
outside (it seems as if all traffic is coming from your Linux box).

Check out the masquerading docs - http://www.indyramp.com/masq/  

--
Henrik Storner                               http://www.image.dk/~storner/
"The POP3 server service depends on the SMTP server service, which
 failed to start because of the following error:
 The operation completed successfully." -Windows NT Server v3.51

 
 
 
Top

IP Forwarding vs Proxy/Firewall

Post by nate dutr » Thu, 30 Oct 1997 04:00:00




Quote:

> Or is ip masquerading a better option?

You'll be amazed at how much better IP masquerading is than WinGate -
former WinGate user and now on with IP masq-much better.
 
 
 
Top

IP Forwarding vs Proxy/Firewall

Post by John Saunde » Fri, 31 Oct 1997 04:00:00




> >You'll be amazed at how much better IP masquerading is than WinGate -
> >former WinGate user and now on with IP masq-much better.

> Do tell. I would like some additional ammunition as to why it is preferable
> to pay for installation and configuration of a Linux machine which can
> handle any workload you like to throw at it versus buying an N-user
> license of a product which should have been part of Windows TCP/IP.

_transparency_ :-)

With "IP masquerading" (or NAT if you talk BSD/CISCO) you simply set
the "IP masquerading" host as the default route on all your clients.
Packets will transparently pass through the NAT machine and out onto
the 'net.

With WinGate/WinProxy (etc etc) you need to configure each client
program that will talk via the proxy to use the proxy. i.e. configure
SMTP, HTTP, FTP, etc.

Note that firewalls like TIS Gauntlet use a proxy in combination with
a "transparent proxy" feature to provide transparency.

Both Linux and FreeBSD provide good "IP masquerading" support. Linux
uses an "in kernel" method for speed at the expense of a larger kernel
memory footprint. FreeBSD uses a "user land" daemon. Also NetBSD and
OpenBSD can use the IP filter kernel module to provide "IP masquerading".

Cheers.
--        +------------------------------------------------------------+


 /  Oz  \ |                 http://www.nlc.net.au/~john/               |
 \_,--\_/ | SCITEC LIMITED  Phone +61 2 9428 9563  Fax +61 2 9428 9933 |
       v  |    "By the time you make ends meet, they move the ends."   |
          +------------------------------------------------------------+

 
 
 
Top

IP Forwarding vs Proxy/Firewall

Post by Nick Andr » Fri, 31 Oct 1997 04:00:00



Quote:>You'll be amazed at how much better IP masquerading is than WinGate -
>former WinGate user and now on with IP masq-much better.

Do tell. I would like some additional ammunition as to why it is preferable
to pay for installation and configuration of a Linux machine which can
handle any workload you like to throw at it versus buying an N-user
license of a product which should have been part of Windows TCP/IP.

Nick.
--
Kralizec / Zeta Microcomputer Software  Fax: +61-2-9233-6545 Voice: 9837-1397
G.P.O. Box 3400, Sydney NSW 1043        http://www.zeta.org.au/

 
 
 
Top

1. Firewall & Proxy server (IP forwarding)

Hi everyone,

A couple of days ago i wrote about not being able to find out whether
or not my firewalling problems would be solved with msaquerading or a
proxy server.

After getting some quite informative mails back i decided on using a
proxy server (socks).

Now I have run into a strange kind of problem.

My Linux box (slackware 1.2.13) is configured with two IP interfaces.
A token-ring interface connected to the protected network has the IP
addresse 192.100.1.254 (mask 255.255.25.0) while the other interface,
connected to the unsecure (internet) network, an etherlink III card
has the IP addresse 194.255.17.65. Before enabling the Firewalling
option and disabling the IP forwarding/gatewaying function in the
kernel it was possible for me to ping the both interfaces from the
secure and the unsecure network. Then I recompiled the kernel with
firewalling on and disabled forwarding and gatewaying.

Thereafter i installed SOCKS 4.2b to act as my connection from the
inside network to the unsecure network. It needed three files

sockd.route
194.255.17.65   0.0.0.0 0.0.0.0

Which should route all requests to the outgoing interfade (on the
unsecure net).

sockd.conf
deny 0.0.0.0    0.0.0.0 192.100.1.0     255.255.255.0
permit  192.100.1.0     255.255.255.0   0.0.0.0 0.0.0.0

Which should give me access from all machines on the local net to the
outside world.

Now the funny things comes. When i use netscape (from windows 95) to
get access to the outside network everything seems to work just fine.

But when i use ping from the internal network then i can ping both
interfaces on the firewall. The same is possible from the unsecure
network. This should not be possible when firewalling is on and
forwarding is off.

I then recompiled the kernel again, after reading the Firewalling
howto which stated that if this was possible then forwarding was not
disabled. this time making sure that forwarding was off. But to no
avail. It is still possible toe ping both interfaces from both the
"secure" and "insecure" side of the net ????

Do anyone have any ideas as to what might be wrong. What am i missing
here ???

Thanks in advance

Lasse K. christiansen

2. Windows 95 Info Guide

3. IP-Forwarding vs Socks5 or other firewalls

4. Linux' primary IP address ...

5. ipfw (IP Firewall), proxy and IP routing on Solaris 2.4

6. couldn't set locale correctly!

7. ftp client proxy ms proxy firewall http proxy unix

8. Since Microsoft Disapproves of Open Source Software...

9. IP forwarding is only good for port forwarding of only one IP ?

10. 2nd try: ftp client with firewall/proxy forwarding?

11. how do i forward requests from inside of my firewall to an external proxy?

12. ftp that will forward through a proxy/firewall

13. Forward / Proxy virtual Xsession across FIREWALL


All times are UTC
Board index