LinuxQuestions.org - How to configure Proxy & Firewall on SuSE 11.4?

- Linux - Networking (https://www.linuxquestions.org/questions/linux-networking-3/)

- - How to configure Proxy & Firewall on SuSE 11.4? (https://www.linuxquestions.org/questions/linux-networking-3/how-to-configure-proxy-and-firewall-on-suse-11-4-a-873283/)

How to configure Proxy & Firewall on SuSE 11.4?

I need to restrict access to the internet and keep unwanted software out of LAN with 45 workstations at the school I teach at.
I thought about configuring a proxy and firewall on SuSE 11.4?
Any suggestions and directions on how to will be appreciated.

I am an admin in a company having 800 empl.

We use SLES9 and squid.

I migrated that from time to time. I really like it. Runs perfectly. Viruswall may be amavis.

If you need help do not hasitate to contact me.
You should think about personell account for each user, as users tend to make stupid things in the internet. Can be ldap or local pw-file, we did both but now we are using ldap as the users get to much to store the pw at two locations.

Did you think about using CentOS ? Maybe the better sollution. Depends on what you know about RedHat/Fedora. OpenSuSE may requiere an OS change more often ?

As we changed the OS three times now ( Started with SuSE7, then SLES8, then SLES9 ) I can say that it is easy but takes some time.

So my suggestion:

- Firewall : Iptables / really easy, fast and stabil if you once get used to it
- Proxy : Squid / I use it for 6-8 years now and its perfect
- Viruswall: Amavis / Not perfect, but how is ?
- Authentication : What you like : Ldap or local file

A layer 7+ device or application would be a choice. If you want, a Vm running something like untangle may work.

Thank you for the directions.

I am downloading CentOS. Haven't used it before, will look at it.

I will give iptabels and a squid as transparent proxy a try. Haven't done before.

Also saw ipfire on the internet. Is it worth trying/investigating?

There are many good products that you should look at and consider. Many make easy work of protecting your lan and wan.

Don't like untangle?

http://www.techradar.com/news/softwa...rewalls-697177

http://www.fsckin.com/2007/11/14/7-d...alls-reviewed/

http://en.wikipedia.org/wiki/List_of..._distributions

Quote:

Originally Posted by ckluyts (Post 4315481)

and

@saavik

Quote:

We use SLES9 and squid.

Squid will give you lots of control about who can do what and when, and so is the obvious thing to use.

A linux firewall will be iptables/netfilter underneath; there is a variety of 'friendly' front-ends that you could use and a variety of net-appliance type boxes that you could get that package and (somewhat) pre-configure things for you, but none of this is necessary, and may even be unhelpful if you have a network arch that is different from the default for the system that you are using.

I would advise that anyone tries to understand iptables and networking; even if you use an 'easy' front end, having a look at the ruleset that it generates is a good thing, and gives you an extra degree of confidence that its understanding of what is needed and your understanding are in line.

Given all this, it is less about 'What firewall product should I get' than 'Do I understand networking and firewalling well enough to get the best out of it'.

You don't say anything about your network arch; I'm guessing that the firewall you mention is a separate box, rather than firewalling the individual user workstations.

@saavik

Quote:

Viruswall: Amavis / Not perfect, but how is ?

If the workstations are windows or include windows machines, you will want some kind of virus scanning.

My idee is to put a linux box, with firewall (iptables) and transparent proxy (squid) between the wireless internet router and the windows network and to have a per user or per group access with usernames and passwords to access the internet. Preferable with logging and caching of pages as sometimes a whole class group nedd to access the same web pages. In that way redising to bandwidth used. I hope my idee is correct? Implementing is another challenge.

Quote:

Originally Posted by ckluyts (Post 4317950)

My idee is to put a linux box, with firewall (iptables) and transparent proxy (squid) between the wireless internet router and the windows network.

Code:

    Win          ---->            Router          ------->    Internet

    Netwk      (Wireless)          |

                                    |

                                Squid/iptables

                                    box

If that understanding is correct, you are giving the win network no real (extra) protection and doing nothing to stop workstations on the windows network from downloading undesirable content or malware. Each to their own, I suppose...but I'd have to be better informed about your aims in doing this, if this is what you intend.

Code:

    Win          ---->            Router    ---->    Squid/iptables      ------->    Internet

    Netwk      (Wireless)                              box

(which obviously needs the squid/ipt box to have an extra eth, which isn't a big issue, but it is unclear whether you mean this)

Quote:

In that way redising to bandwidth used.

Reducing? Well, it should, a bit. But it won't be very dramatic, in most cases, simply because most of the time, people will be looking at pages that other people haven't previously browsed. If all of a class has to look at a small set of particular pages, for a particular class, it will help more, obviously.

Sorry for the typing errors.

My idee is like this:

Windows Network (Wired LAN with Win 2003 Server)
-----> Squid IP tables box
-----> Router - MicroTik Installed by ISP
-----> Wireless Internet

Hope this is more clear.

sounds good to me.

Except of the wlan we use(ed) it in the same way.

If you need help...