Very Computer

by **EL C** » Fri, 29 Dec 2000 03:51:13

Hi there. Thanks for you replies in advance. Could I bother you guys
with another question? I am running my own private DNS server, and
Mail server. I want to be able to protect them by setting up a
firewall. Thats why I started learning on IP masq etc. I have been
told to install PMfirewall. My mail server and dns server runs on one
machine only. ( its private so it doesnt matter if it goes tip top, I
just set it up for learning experience ). Now, I want to learn on how
to protect them. What would people recommend me to do ? Do I install
and setup PMfirewall on the same box as well? Hence run my mail
server/dns server and firewall on the same box? Or Should I setup
PMfirewall on a SEPARATE box, and connect my dns/mail server to Eth1
located on the firewall box? If I do the latter, I will have to give
my servers a private non-routable IP such as 192.0.0.1. The problem
now lies on how to ROUTE the incoming mail/dns request to my mail
server behind my PMFirewall box? What would you recommend for me to
do? Please ig you have any info or links, please let me know. I know
I have a lots to read and learn, and I am all ready for it.!!!!!
bring it on guys!

by **Trygve Selme** » Fri, 29 Dec 2000 05:37:34

> [snip]
> my servers a private non-routable IP such as 192.0.0.1. The problem
> now lies on how to ROUTE the incoming mail/dns request to my mail
> server behind my PMFirewall box? What would you recommend for me to
> do? Please ig you have any info or links, please let me know. I know
> I have a lots to read and learn, and I am all ready for it.!!!!!
> bring it on guys!

Hi again!

First, your postings repeatedly refers to 192.0.0.1 as a private non-routable
IP. This is _not_ correct. The private IPs are:

10.0.0.0/8 = 10.0.0.0-10.255.255.255
172.16.0.0/12 = 172.16.0.0-172.31.255.255
192.168.0.0/16 = 192.168.0.0-192.168.255.255

The easy thing to do is running your mailserver and your firewall on the same
machine, but I will not recommend it. If you have an old i386/i486, set it up
as your firewall machine. To access the mail-server (now with private IP on
your local LAN), use port forwarding (as in: ipmasqadm portfw -a -P tcp -L
$EXT_IP 25 -R 192.168.0.2 25).

Trygve.

by **EL C** » Fri, 29 Dec 2000 06:19:54

Its nice to deal with people that knows goods stuffs!!.

Ok. I will try to setup a separate box as firewall. I will then
give my existing mail server/dns server a private ip as 192.168.0.1 (
I am learning ! ). and then open the port as you mentioned

# this will open port 25/110/113 to allow mail to come and go through
the firewall

ipchains -A input -i ETH0 -d 0.0.0.0/0 /25 -p tcp -j ACCEPT
ipchains -A input -i ETH0 -d 0.0.0.0/0 /110 -p tcp -j ACCEPT
ipchains -A input -i ETH0 -d 0.0.0.0/0 /113 -p tcp -j ACCEPT

# this will FORWARD incoming mail/out going mail to my mail server

ipmasqadm portfw -a -P tcp -L 209.67.45.110 25 -R 192.168.0.1 25
ipmasqadm portfw -a -P tcp -L 209.67.45.110 110 -R 192.168.0.1 110
ipmasqadm portfw -a -P tcp -L 209.67.45.110 113 -R 192.168.0.1 113

Got a quick questiong for you :).What I am thinking of doing then, is
to setup the firewall box with my dns/mail server REAL IP. So DNS
request and Mail server request will go to my firewall. From there of
course , they will be forwarded to the internal lan where my mail/dns
box is located. the question is on my DNS files , I will have to
change the MX records A records and PTR records to the new internal
private IPs? Finally, what port do i need to open for the dns to
work ? :)

Thanks a lot!! hopefully I am not bothering you!!! :)

HAppy new year too!

On Wed, 27 Dec 2000 21:37:34 +0100, Trygve Selmer

>> [snip]
>> my servers a private non-routable IP such as 192.0.0.1. The problem
>> now lies on how to ROUTE the incoming mail/dns request to my mail
>> server behind my PMFirewall box? What would you recommend for me to
>> do? Please ig you have any info or links, please let me know. I know
>> I have a lots to read and learn, and I am all ready for it.!!!!!
>> bring it on guys!

>Hi again!

>First, your postings repeatedly refers to 192.0.0.1 as a private non-routable
>IP. This is _not_ correct. The private IPs are:

>10.0.0.0/8 = 10.0.0.0-10.255.255.255
>172.16.0.0/12 = 172.16.0.0-172.31.255.255
>192.168.0.0/16 = 192.168.0.0-192.168.255.255

>The easy thing to do is running your mailserver and your firewall on the same
>machine, but I will not recommend it. If you have an old i386/i486, set it up
>as your firewall machine. To access the mail-server (now with private IP on
>your local LAN), use port forwarding (as in: ipmasqadm portfw -a -P tcp -L
>$EXT_IP 25 -R 192.168.0.2 25).

> Trygve.

by **Trygve Selme** » Fri, 29 Dec 2000 07:05:02

Short answer follows, longer answer mailed directly:

> Its nice to deal with people that knows goods stuffs!!.

> Ok. I will try to setup a separate box as firewall. I will then
> give my existing mail server/dns server a private ip as 192.168.0.1 (
> I am learning ! ). and then open the port as you mentioned

> # this will open port 25/110/113 to allow mail to come and go through
> the firewall

> ipchains -A input -i ETH0 -d 0.0.0.0/0 /25 -p tcp -j ACCEPT
> ipchains -A input -i ETH0 -d 0.0.0.0/0 /110 -p tcp -j ACCEPT
> ipchains -A input -i ETH0 -d 0.0.0.0/0 /113 -p tcp -j ACCEPT

> # this will FORWARD incoming mail/out going mail to my mail server

> ipmasqadm portfw -a -P tcp -L 209.67.45.110 25 -R 192.168.0.1 25
> ipmasqadm portfw -a -P tcp -L 209.67.45.110 110 -R 192.168.0.1 110
> ipmasqadm portfw -a -P tcp -L 209.67.45.110 113 -R 192.168.0.1 113

You only need to forward port 25 unless you want to read your mail from the
Internet.

Quote:> Got a quick questiong for you :).What I am thinking of doing then, is
> to setup the firewall box with my dns/mail server REAL IP. So DNS
> request and Mail server request will go to my firewall. From there of
> course , they will be forwarded to the internal lan where my mail/dns
> box is located. the question is on my DNS files , I will have to
> change the MX records A records and PTR records to the new internal
> private IPs? Finally, what port do i need to open for the dns to
> work ? :)

I recommend reading the IP-Masquerade-mini-HOWTO, DNS-HOWTO, and the
Firewall-HOWTO to fully understand this setup.

Quote:> Thanks a lot!! hopefully I am not bothering you!!! :)

> HAppy new year too!

Same to you and the rest of the group!

Trygve.

Very Computer

PMfirewall question.

PMfirewall question.

PMfirewall question.

PMfirewall question.

PMfirewall question.