LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Debian
User Name
Password
Debian This forum is for the discussion of Debian Linux.

Notices

Reply
 
Search this Thread
Old 08-25-2004, 10:43 AM   #1
stormblast
LQ Newbie
 
Registered: Apr 2004
Location: Germany
Distribution: Debian 3.1
Posts: 24

Rep: Reputation: 15
Simple Debian Router including a DHCP Server


Hi there,

I'm a bit new to Debian/Linux and would like to setup a DSL Router on Debian for about 10 WinXP PCs.

I successfuly set up the PPPOE Connection to my Provider. Now I additionally need a DHCP Server running on Debian and I need to get it working that the other 10 WinXP Clients have access to the internet.

I'm sorry but I'm a little bit lost right now. What do I have to do to get this working?

Thanks a lot!
 
Old 08-25-2004, 04:26 PM   #2
TigerOC
Senior Member
 
Registered: Jan 2003
Location: Devon, UK
Distribution: Debian Etc/kernel 2.6.18-4K7
Posts: 2,380

Rep: Reputation: 49
In addition to dhcp you need ip-masquerade and I would suggest a firewall as well. Do apt-get install dhcp ipmasq . You will need to ip-forward and the easiest way is to get a firewall with all this built in and I suggest a visit to;

http://www.linuxorbit.com/modules.ph...icle&artid=529
 
Old 08-25-2004, 07:48 PM   #3
stormblast
LQ Newbie
 
Registered: Apr 2004
Location: Germany
Distribution: Debian 3.1
Posts: 24

Original Poster
Rep: Reputation: 15
Nice, thanks dude!
 
Old 08-26-2004, 02:01 AM   #4
TigerOC
Senior Member
 
Registered: Jan 2003
Location: Devon, UK
Distribution: Debian Etc/kernel 2.6.18-4K7
Posts: 2,380

Rep: Reputation: 49
No problem. Let us know how you go.
 
Old 09-10-2004, 07:25 AM   #5
stormblast
LQ Newbie
 
Registered: Apr 2004
Location: Germany
Distribution: Debian 3.1
Posts: 24

Original Poster
Rep: Reputation: 15
The script is telling me I'm using an old version of iptables or kernel.

I got the latest iptables installed via apt-get install iptables and I'm using Debian 3.0 r2.. what could be the prob?
 
Old 09-10-2004, 03:54 PM   #6
TigerOC
Senior Member
 
Registered: Jan 2003
Location: Devon, UK
Distribution: Debian Etc/kernel 2.6.18-4K7
Posts: 2,380

Rep: Reputation: 49
Check the kernel version - uname -r
 
Old 09-16-2004, 05:29 AM   #7
stormblast
LQ Newbie
 
Registered: Apr 2004
Location: Germany
Distribution: Debian 3.1
Posts: 24

Original Poster
Rep: Reputation: 15
It`s Debian Woody 3.0 r1

uname -r:

2.2.20-idepci
 
Old 09-16-2004, 07:03 AM   #8
reetep
Member
 
Registered: Oct 2003
Location: UK
Distribution: Debian
Posts: 122

Rep: Reputation: 15
There is an ipmasq howto on the ldp howto pages:

http://www.ibiblio.org/pub/Linux/doc...s/html_single/

It looks very daunting because at first sight it appears to be very long. However that's because it covers 2.0 2.2 and 2.4 kernels all at the same time, plus there's some troubleshooting stuff at the end padding it out somewhat.

The howto is actually very short, when you take this into account. I recommend it highly. If you don't need to recompile your kernel, it will only take you ten minutes. Even if you need to recompile, it tells you exactly what options you need.

It also includes a sample firewall, which is very good (as in secure).



DHCP is very very easy. You just need to apt-get install dhcp and configure it. You can do this by man dhcpd.conf or you can copy this one and modify it to your tastes (you must fill in your own dns servers here at the very least):


subnet 192.168.1.0 netmask 255.255.255.0 {
range 192.168.1.2 192.168.1.60;
default-lease-time 86400;
max-lease-time 86400;
option routers 192.168.1.1;
option ip-forwarding on;
option broadcast-address 192.168.1.255;
option subnet-mask 255.255.255.0;
option domain-name-servers 1.2.3.4, 5.6.7.8;
}

The advantage of this config is it forwards the dns info to the clients, meaning no config is necessary on the clients except to select "obtain an IP address automatically"

Hope this helps, good luck, reetep.
 
Old 09-17-2004, 05:31 AM   #9
stormblast
LQ Newbie
 
Registered: Apr 2004
Location: Germany
Distribution: Debian 3.1
Posts: 24

Original Poster
Rep: Reputation: 15
Hey, thanks a lot ! DHCP is working fine now.

I visited http://www.ibiblio.org/pub/Linux/do...ts/html_single/ but there are quite a lot tutorials. Found one which includes IPMasq+Napster and one very long IP Masq tutor. Which one do you mean?
 
Old 09-17-2004, 06:38 AM   #10
reetep
Member
 
Registered: Oct 2003
Location: UK
Distribution: Debian
Posts: 122

Rep: Reputation: 15
congratulations on your DHCP.

The ipmasq tutorial is called IP-Masquerade-HOWTO and the precise url is here:

http://www.ibiblio.org/pub/Linux/doc...ade-HOWTO.html

Yes it appears to be very long but look more carefully and read my explanation above - it is actually very short. Don't be put off; it's easy!

Good luck, and if you need help, you know where to come....
 
Old 09-17-2004, 08:28 AM   #11
stormblast
LQ Newbie
 
Registered: Apr 2004
Location: Germany
Distribution: Debian 3.1
Posts: 24

Original Poster
Rep: Reputation: 15
Allright, it's DSL dialup running over eth1.

eth0 is for the internal Lan

Code:
auto eth0
iface eth0 inet static
network 192.168.1.0
subnet 255.255.255.0
address 192.168.1.1
Code:
auto eth1
Code:
auto lo

My rc.firewall-2.2 looks like that:
Code:
#!/bin/sh
#
# rc.firewall-2.2
#
#     - Initial SIMPLE IP Masquerade test for 2.1.x and 2.2.x kernels 
#       using IPCHAINS.
#
#       Once IP Masquerading has been tested, with this simple 
#       ruleset, it is highly recommended to use a stronger 
#       IPTABLES ruleset either given later in this HOWTO or 
#       from another reputable resource.

FWVER="1.22"
#
# 1.22 - ruleset now uses modprobe instead of insmod
# 1.21 - Added clarification that PPPoE users need to use
#        "ppp0" instead of "eth0" for their external interface
# 1.20 - Updated the script to use environment vars
# 1.01 - Original version


echo -e "\n\nLoading simple rc.firewall-2.2 : version $FWVER..\n"


# The location of the ipchains and kernel module programs
#
#   If your Linux distribution came with a copy of ipchains, 
#   most likely all the programs will be located in /sbin.  If 
#   you manually compiled ipchains, the default location will
#   be in /usr/local/sbin
#
# ** Please use the "whereis ipchains" command to figure out 
# ** where your copy is and change the path below to reflect 
# ** your setup
#
IPCHAINS=/sbin/ipchains
#IPTABLES=/usr/local/sbin/ipchains
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprobe


#Setting the EXTERNAL and INTERNAL interfaces for the network
#
#  Each IP Masquerade network needs to have at least one
#  external and one internal network.  The external network
#  is where the NATing will occur and the internal network
#  should preferably be addressed with a RFC1918 private addressing
#  scheme.
#
#  For this example, "eth0" is external and "eth1" is internal"
#
#  NOTE:  If this doesnt EXACTLY fit your configuration, you must
#         change the EXTIF or INTIF variables above. For example:
#
#            If you are a PPPoE or analog modem user:
#
#               EXTIF="ppp0" 
#
#  ** Please change this to reflect your specific configuration **
#
EXTIF="ppp0"
INTIF="eth0"
echo "   External Interface:  $EXTIF"
echo "   Internal Interface:  $INTIF"


# Network Address of the Internal Network
#
#   This example rc.firewall file uses the 192.168.0.0 network
#   with a /24 or 255.255.255.0 netmask.
#
#    ** Change this variable to reflect your specific setup **
#
INTLAN="192.168.1.0/150"
echo -e "   Internal Interface:  $INTLAN\n"



# Load all required IP MASQ modules
#
#   NOTE:  Only load the IP MASQ modules you need.  All current IP MASQ modules
#          are shown below but are commented out from loading.
echo "   loading required IPMASQ kernel modules.."

# Needed to initially load modules
#
$DEPMOD -a

echo -en "   Loading modules: "

# Supports the proper masquerading of FTP file transfers using the PORT method
#
echo -en "FTP, "
$MODPROBE ip_masq_ftp

# Supports the masquerading of RealAudio over UDP.  Without this module,
#       RealAudio WILL function but in TCP mode.  This can cause a reduction
#       in sound quality
#
#echo -en "RealAudio, "
$MODPROBE ip_masq_raudio

# Supports the masquerading of IRC DCC file transfers
#
echo -en "Irc, "
$MODPROBE ip_masq_irc


# Supports the masquerading of Quake and QuakeWorld by default.  This modules is
#   for for multiple users behind the Linux MASQ server.  If you are going to 
#   play Quake I, II, and III, use the second example.
#
#   NOTE:  If you get ERRORs loading the QUAKE module, you are running an old
#   -----  kernel that has bugs in it.  Please upgrade to the newest kernel.
#
#echo -en "Quake, "
#Quake I / QuakeWorld (ports 26000 and 27000)
#$MODPROBE ip_masq_quake
#
#Quake I/II/III / QuakeWorld (ports 26000, 27000, 27910, 27960)
$MODPROBE ip_masq_quake 26000,27000,27910,27960


# Supports the masquerading of the CuSeeme video conferencing software
#
#echo -en "CuSeeme, "
#$MODPROBE ip_masq_cuseeme

#Supports the masquerading of the VDO-live video conferencing software
#
#echo -en "VdoLive "
#$MODPROBE ip_masq_vdolive

echo ".  Done loading modules."


#CRITICAL:  Enable IP forwarding since it is disabled by default since
#
#           Redhat Users:  you may try changing the options in 
#                          /etc/sysconfig/network from:
#
#                       FORWARD_IPV4=false
#                             to
#                       FORWARD_IPV4=true
#
echo "   enabling forwarding.."
echo "1" > /proc/sys/net/ipv4/ip_forward


#CRITICAL:  Enable automatic IP defragmenting since it is disabled by default 
#           in 2.2.x kernels.  This used to be a compile-time option but the 
#           behavior was changed in 2.2.12
#
echo "   enabling AlwaysDefrag.."
echo "1" > /proc/sys/net/ipv4/ip_always_defrag


# Dynamic IP users:
#
#   If you get your IP address dynamically from SLIP, PPP, or DHCP, enable this 
#   following option.  This enables dynamic-ip address hacking in IP MASQ, 
#   making the life with Diald and similar programs much easier.
#
#echo "   enabling DynamicAddr.."
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr


# Enable the LooseUDP patch which some Internet-based games require
#
#  If you are trying to get an Internet game to work through your IP MASQ box,
#  and you have set it up to the best of your ability without it working, try
#  enabling this option (delete the "#" character).  This option is disabled
#  by default due to possible internal machine UDP port scanning 
#  vulnerabilities.
#
#echo "   enabling LooseUDP.."
#echo "1" > /proc/sys/net/ipv4/ip_masq_udp_dloose


#Clearing any previous configuration
#
#  Unless specified, the defaults for INPUT and OUTPUT is ACCEPT
#    The default for FORWARD is REJECT
#
echo "   clearing any existing rules and setting default policy.."
$IPCHAINS -P input ACCEPT
$IPCHAINS -P output ACCEPT
$IPCHAINS -P forward REJECT
$IPCHAINS -F input
$IPCHAINS -F output
$IPCHAINS -F forward


# MASQ timeouts
#
#   2 hrs timeout for TCP session timeouts
#  10 sec timeout for traffic after the TCP/IP "FIN" packet is received
#  160 sec timeout for UDP traffic (Important for MASQ'ed ICQ users) 
#
echo "   setting default timers.."
$IPCHAINS -M -S 7200 10 160


# DHCP:  For people who receive their external IP address from either DHCP or 
#        BOOTP such as ADSL or Cablemodem users, it is necessary to use the 
#        following before the deny command.  
#
#        This example is currently commented out.
#
#
#$IPCHAINS -A input -j ACCEPT -i $EXTIF -s 0/0 67 -d 0/0 68 -p udp

# Enable simple IP forwarding and Masquerading
#
#  NOTE:  The following is an example for an internal LAN address in the 
#         192.168.0.x network with a 255.255.255.0 or a "24" bit subnet mask
#         connecting to the Internet on interface eth0.
#
#         ** Please change this network number, subnet mask, and your Internet
#         ** connection interface name to match your internal LAN setup
#
echo "   enabling IPMASQ functionality on $EXTIF"
$IPCHAINS -P forward DENY
$IPCHAINS -A forward -i $EXTIF -s $INTLAN -j MASQ

echo -e "\nrc.firewall-2.2 v$FWVER done.\n"
I created it in /etc/init.d/

My resolv.conf is
Code:
nameserver 192.168.1.0
Or should that be the nameserver of the provider?

However if I try to execute rc.firewall-2.2 the following error occurs:
./rc.firewall-2.2
: Bad interpreter : No such file or directory


Btw. thanks a lot for all your help guys, I really appreciate it!
 
Old 09-17-2004, 08:54 AM   #12
reetep
Member
 
Registered: Oct 2003
Location: UK
Distribution: Debian
Posts: 122

Rep: Reputation: 15
Ok good work, but I notice a few things amiss with your config.

Firstly in /etc/network/interfaces you need to finish your configuration of eth1. If you get your IP address from your ISP using DHCP, you need:

auto eth1
iface eth1 inet DHCP

If your ISP has given you a static IP address, you need to configure it in the same way as eth0.

Now for (some perhaps only potential) faults in your firewall:


1.check that this is correct for your system (eg do whereis ipchains):

IPCHAINS=/sbin/ipchains
#IPTABLES=/usr/local/sbin/ipchains
DEPMOD=/sbin/depmod
MODPROBE=/sbin/modprobe


2. This following section doesn't seem to match what you told us:

# NOTE: If this doesnt EXACTLY fit your configuration, you must
# change the EXTIF or INTIF variables above. For example:
#
# If you are a PPPoE or analog modem user:
#
# EXTIF="ppp0"
#
# ** Please change this to reflect your specific configuration **
#
EXTIF="ppp0"
INTIF="eth0"

I though you wanted:

EXTIF="eth1"
INTIF="eth0"


3.Did you write in this "150" ? I would have thought you wanted "24"

INTLAN="192.168.1.0/150"



4. Nota Bene:

# Dynamic IP users:
#
# If you get your IP address dynamically from SLIP, PPP, or DHCP, enable this
# following option. This enables dynamic-ip address hacking in IP MASQ,
# making the life with Diald and similar programs much easier.
#
#echo " enabling DynamicAddr.."
#echo "1" > /proc/sys/net/ipv4/ip_dynaddr

If you get your IP from your ISP using DHCP you will want to uncomment this.

And also the following:

# DHCP: For people who receive their external IP address from either DHCP or
# BOOTP such as ADSL or Cablemodem users, it is necessary to use the
# following before the deny command.
#
# This example is currently commented out.
#
#
#$IPCHAINS -A input -j ACCEPT -i $EXTIF -s 0/0 67 -d 0/0 68 -p udp




I'm not sure which line gave you an error. My first guess is there is no ppp0 device on your machine, so once you ammend that to eth1 you should be ok. Alternatively, maybe one of the files in /proc/... is missing (indicating that you don't have that appropriate option in the kernel). Did you check your kernel for compatibility as described in the first section of the HOWTO?



First off, I suggest you correct all of the above and try again.
 
Old 09-17-2004, 08:56 AM   #13
reetep
Member
 
Registered: Oct 2003
Location: UK
Distribution: Debian
Posts: 122

Rep: Reputation: 15
PS you need to put the nameserver of your ISP in /etc/resolv.conf - not 192.168.1.1
 
Old 09-17-2004, 10:01 AM   #14
stormblast
LQ Newbie
 
Registered: Apr 2004
Location: Germany
Distribution: Debian 3.1
Posts: 24

Original Poster
Rep: Reputation: 15
1
Allright changed that.

2
Quote:
2. This following section doesn't seem to match what you told us:

# NOTE: If this doesnt EXACTLY fit your configuration, you must
# change the EXTIF or INTIF variables above. For example:
#
# If you are a PPPoE or analog modem user:
#
# EXTIF="ppp0"
#
# ** Please change this to reflect your specific configuration **
#
EXTIF="ppp0"
INTIF="eth0"

I though you wanted:

EXTIF="eth1"
INTIF="eth0"
I filled in ppp0 there because of their statement If you are a PPPoE or analog modem user: EXTIF="ppp0"
I got 2 nics installed, eth0 for internal eth1 is directly connected to the DSL Modem. It's PPPoE and I establish the connection via pon dsl-provider. Although I don't see a ppp0 connection in ifconfig after establishing the connection, just eth1.

Changed to eth1.

3
Code:
3.Did you write in this "150" ? I would have thought you wanted "24"

INTLAN="192.168.1.0/150"
I raised DHCP and the value in the script to 150

4
Allright changed

Also adjusted resolv.conf to the IP of my ISP Nameserver.

I checked my kernel once again -> 2.2.20-idepci . That one should be compatible, isn't it? (Used the manual for 2.2.x Kernels)

However I'm still getting : Bad interpreter : No such file or directory
The sbin paths are all correct. ( Checked with locate )

It's strange.
 
Old 09-17-2004, 01:11 PM   #15
reetep
Member
 
Registered: Oct 2003
Location: UK
Distribution: Debian
Posts: 122

Rep: Reputation: 15
Quote:
2.2.20-idepci - That one should be compatible, isn't it?
I don't know. That's why I asked:

Quote:
Did you check your kernel for compatibility as described in the first section of the HOWTO?
- that is to say the howto tells you how to test your kernel.




If you find you need a new kernel, don't be afraid if you haven't done it before - the HOWTO tells you exactly what options you need, and you can use your current config for the rest.

Just do

apt-get install kernel-source-of-your-choice
cd /usr/src/
tar xjvf kernel-source-blah-blah.bz2
rm linux (if it exists)
ln -s $(whatever the name of the new directory is) linux
cp /boot/config-2.2.20-idepci /usr/src/linux
cd linux
make menuconfig or make xconfig

and have a print out of the relevant section of the HOWTO to tell you how to fill in the relevent options.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
local web server behind dhcp router j4b Linux - Networking 10 08-09-2004 11:21 PM
simple ftp server for embedded router amitchandel Linux - Software 2 06-09-2004 11:20 PM
Replace a string including simple quotes. philipina Programming 4 03-18-2004 09:01 AM
Debian Router/DHCP retiqlum Linux - Networking 0 01-30-2004 02:42 PM
dhcp server in linksys router maxvenum Linux - Networking 3 09-02-2003 08:56 AM


All times are GMT -5. The time now is 02:53 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration