LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 08-15-2008, 04:49 PM   #1
Spiteful
LQ Newbie
 
Registered: Aug 2008
Posts: 3

Rep: Reputation: 0
Ubuntu, Vmserver 2.0, pfSense, and dual wan. How to protect host?


I have a Ubuntu box setup and am running vmserver 2.0 on it with a guest running pfsense, it is also a dual wan setup fyi. I have all the machines in my house on a lan hooked to my linux box. I use for my box for many other tasks and it just made sense to set it up this way.

Here is my question though, it all is working fine and dandy but the host machine running the vm of pfsense is fully opened to the outside via the bridged connection for the vm. I have 3 nics. two of them are my wan (both cable connections) and one is for my lan. Is there a way for me to tell ubuntu only to get internet access from the bridged lan connection and not from either bridged wans? I would like the host to be covered by pfsense is the purpose.

Any and all help is GREATLY appreciated.
 
Old 08-15-2008, 09:02 PM   #2
Spiteful
LQ Newbie
 
Registered: Aug 2008
Posts: 3

Original Poster
Rep: Reputation: 0
no one has any ideas how I might go about this?
 
Old 08-15-2008, 09:32 PM   #3
GlennsPref
Senior Member
 
Registered: Apr 2004
Location: Brisbane, Australia
Posts: 3,366
Blog Entries: 33

Rep: Reputation: 216Reputation: 216Reputation: 216
Hi, I'm not too sure how to do this with pfsense firewall, you may read the manual to clarify,

but with iptables firewall you can name the external interface (EXT_IF=device name) and any internal interfaces (INT_IF=device name).

Quote:
# Environment variables, change these values accordingly

EXT_IF=ppp0
INT_IF=eth0
INT_NET=192.168.0.0/24
This may be what you need to find within the pfsense manual.

Regards, Glenn
 
Old 08-16-2008, 01:34 PM   #4
Spiteful
LQ Newbie
 
Registered: Aug 2008
Posts: 3

Original Poster
Rep: Reputation: 0
Unhappy

So what I am trying to do is isolate the host machine (my ubuntu box) from the internet totally except for the ethernet connection that my VM (pfsense) uses for the internal lan here at my house. This way the Host will be protected by the firewall as all the other machines hooked to my lan here are.

Currently I know it isnt behind the firewall because it has a working internet connection before the VM (pfsense) has fully booted.

So I didnt know if there was some easy wat to tell ubuntu to ONLY use a certain eth for any and all network access while still allowing the VM (pfsense) to have control over them all via the brideged connections it requires to run it in a VM.

It's also a dual wan setup on my VM of pfsense. if that makes any difference.

3 nics and they are all bridged so that the VM of pfsense has accesss to them. 2 are my wans and 1 is my lan. I want to isolate Ubuntu from both wans and have it only use the lan so that it will be protected by pfsense.

What is the easiest way to make this happen?
 
Old 08-16-2008, 08:36 PM   #5
GlennsPref
Senior Member
 
Registered: Apr 2004
Location: Brisbane, Australia
Posts: 3,366
Blog Entries: 33

Rep: Reputation: 216Reputation: 216Reputation: 216
OK, I don't have any bridges between connections, I have an internal eth0 and external ppp0, on this (gateway) pc.

Anything directed to the internet from the other box(192.168.0.3), comes in at eth0(192.168.0.2), and is redirected to the proxy cache (squid) before accessing ppp0.

Connections from my system are also routed to the squid proxy cache, via 192.168.0.2 before finding it's way to ppp0.
I do that via the browser connection preferences, both konqueror and mozilla firefox.

I'm using iptables and squid to do this with forwarding in /etc/sysctl.conf

Quote:
#---------------------------------------------------------------
# Enable IP routing. Required if your firewall is protecting a
# network, NAT included
#---------------------------------------------------------------
# Activate IP forwarding
net.ipv4.ip_forward = 1
The rest of the configs, /etc/host /etc/host.allow, /etc/host.deny, and /etc/resolv.conf (dns addresses),

/etc/sysconfig/network
Quote:
NETWORKING=yes
GATEWAY=10.64.64.64
GATEWAYDEV=ppp0
HOSTNAME=GamesBox.GlennsPref.net
DOMAIN=GlennsPref.net
FORWARD_IPV4=true
/etc/sysconfig/network-scripts/ifcfg-eth0
Quote:
DEVICE=eth0
BOOTPROTO=static
IPADDR=192.168.0.2
NETMASK=255.255.255.0
GATEWAY=192.168.0.0
ONBOOT=yes
METRIC=10
MII_NOT_SUPPORTED=no
USERCTL=yes
DNS1=192.168.0.0
RESOLV_MODS=no
LINK_DETECTION_DELAY=6
IPV6INIT=yes
IPV6TO4INIT=yes
The others are iptables and squid.conf, I can post them too if need be.


So all out-going connections are directed to the eth0(int), hits the cache and goes out via ppp0.

That's all I have to share, Except two pages I have found to be helpful to me...

http://www.linuxhomenetworking.com/

http://www.opensourcehowto.org/home/

Regards, Glenn. I hope this helps.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Dual WAN failover kool_kid Linux - Networking 3 07-16-2010 09:26 AM
I wan my devloprs to simltaneously put php sites using ftp and also host on same srv zaki Linux - Newbie 1 02-15-2008 06:49 AM
dual wan questions shinystuffrox Linux - Networking 3 02-09-2008 12:02 AM
migrating server to vmserver nazs Linux - Newbie 2 10-13-2007 09:07 AM
FreeS/Wan Vs. OpenS/Wan Vs. StrongS/Wan bkankur Linux - Security 1 03-01-2005 10:27 AM


All times are GMT -5. The time now is 09:04 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration