by Carla Schroder


In our first installment, we described why you need our Linux-based network appliances. Today we’re going to start construction. (Please see the Introduction to this series for hardware requirements.) We will be building two separate appliances: one for network border services, such as firewalling, secure remote access, and intrusion prevention; and one for LAN services, such as file and printer sharing, network storage, and backups. We’ll start with an Internet firewall/gateway for sharing a broadband Internet connection. Our Linux gateway will protect clients on all platforms, not just Linux. You’ll save money, have complete control and likely better protection.

Build a Linux Appliance

 

You should already have a shared broadband Internet connection, maybe with one of those Linksys or Netgear boxes, and with your soon-to-be firewall box connected to your LAN. You’ll administer it from a second LAN PC. This is handled via OpenSSH or a Web browser, so any Linux, Mac or Windows PC will do. A typical setup looks like this:

Broadband modem -> gateway -> switch or hub -> LAN hosts

If you do not already have some sort of router/gateway for sharing your Internet connection, you may connect your firewall box directly to the Internet. You still want a second PC connected via a switch or hub for remote administration, like this:

Broadband modem -> future gateway box -> switch or hub -> second PC

The penguin marks the spot for your Linux appliance

We’ll install the Debian GNU/Linux operating system as the foundation of our sturdy gateway box. Debian is easy-to-maintain and upgrade, and is stable and reliable. Debian comes in four flavors: Stable, Testing, Unstable and Experimental. Each flavor besides Experimental has a cute code-name: Sarge (stable), Etch (testing), and Sid (unstable).

Stable contains older, well-tested packages, so it’s always behind in terms of having the latest and greatest releases, which is exactly what you want on something as important as a firewall. You can run Testing or Unstable all you want to on desktop systems. They work perfectly well despite the scary names. But don’t use them on important servers.

Say What?

Not sure what a particular term means? Check out the PracticallyNetworked Glossary.

By choosing Debian we aren’t saying that other versions of Linux are inferior. We chose a single distribution to keep this series simple and to get you up and running as quickly as possible.

Getting Debian

We’ll install Debian Stable from the “business-card” CD image. This is around 40 megabytes. Simply download the .iso and burn it to a CD. If you don’t have the means to do this, you may order a commercial CD. The full-sized CD/DVDs are OK if you can’t get the business-card CD.

Once you have your installation disk in hand, just pop it in and boot up. All you want to do is install the base system, which runs around 380 megabytes. Don’t install anything else.

If you’re not familiar with installing Linux, refer to Falko Timme’s excellent how-to, The Perfect Setup – Debian Sarge (3.1). This is a complete how-to for setting up an ISP-style server, so please observe these exceptions:

  • The current version is debian-31r2-i386-businesscard.iso
  • Don’t install any extra packages. All you want is the base installation
  • Instead of creating an “admin” user, feel free to use your own name
  • Stop at the end of Page 2

Network Configuration During Installation

You only need to configure a single network interface card (NIC), because for now all you need is Internet connectivity.

If your future gateway box is on your LAN, and not directly connected to the Internet, go ahead and manually configure a static IP for it, since you’ll need one anyway. For example, since my subnet is 192.168.1.0/24, I configured mine with an IP of 192.168.1.15, netmask 255.255.255.0, gateway 192.168.1.10 (which is the LAN address of my own Internet gateway), and I used the nameserver of my ISP.

If your future gateway box is connected directly to the Internet, use the account information supplied by your ISP.

Almost There

The installation takes up to an hour, depending on the speed of your Internet connection. When it’s finished you’ll be looking at a plain command prompt. Not to worry, because by the end of this series you’ll be a whiz both on the command-line and with some excellent graphical interfaces. Come back next week to install Webmin, and to build a firewall.

Resources