LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Distributions > Slackware
User Name
Password
Slackware This Forum is for the discussion of Slackware Linux.

Notices

Reply
 
Search this Thread
Old 07-13-2013, 02:23 PM   #1
tronayne
Senior Member
 
Registered: Oct 2003
Location: Northeastern Michigan, where Carhartt is a Designer Label
Distribution: Slackware 32- & 64-bit Stable
Posts: 3,042

Rep: Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761
Set Up a LAN Where There is No Access From the Outside World


I have a LAN consisting of four systems (three desk tops and one lap top occasionally connected). My ISP is HughesNet which does not permit access from the outside -- it's a modem/router and you can't get though the router from the Internet. In addition to my LAN, I'm going to be setting up a similar LAN for a non-profit institute I'm associated with; that ISP allows connection from the outside but that's not going to happen if or until the board of directors approves doing so. I suspect that both my LAN and the institute LAN will be similar. The institute will have two Slackware 64-bit servers and there are, oh, four or five WinXP PC's that will access the servers via the LAN.

Neither I or the institute have a registered domain name; the institute will when I can talk somebody into it but, for now, no.

The way I have configured things for a long time is that I use fixed-IP addresses for each machine, they all talk to each other with SSH, and one has a web server that the others access with a browser. I happen to have a router (because I am connected to the Internet) but the institute will not, I suspect it will be connected via a switch (which can later be connected to the Internet). Every on of my boxes (all Slackware) has an identical /etc/hosts file (so they can talk to each other with SSH and can access the network-connected plotter and printer which also have fixed-IP addresses as well as the Internet).

Now the question is, what's the best way to do a LAN (both for me and for the institute)? Set up one machine as a pseudo "internet" with DNS services, perhaps internal and maybe external mail services along with print service?

Is there a tutorial that might be good guide?

I have been doing some reading, much of which is a little confusing but the little light hasn't popped on and I'd appreciate any advice.
 
Old 07-13-2013, 05:57 PM   #2
Z038
Member
 
Registered: Jan 2006
Distribution: Slackware
Posts: 804

Rep: Reputation: 157Reputation: 157
I don't completely follow what you are trying to accomplish. Are you looking for a way to configure the LAN so that you don't have to use static IPs and maintain synchronized /etc/hosts files, but still be able to access each system on the LAN from any other system via ssh user@hostname?

If that is what you are after, you can set up a DNS server (actually, a master on one system and a slave on another so you have redundancy), and a dhcpd server (and a backup for failover), and let it assign dynamic IP addresses to most systems. You configure dynamic DNS in the dhcp server and it will keep your DNS server updated with the current IP address for each host on your LAN. The dhcp server will also supply the DNS server addresses to each client.

You would need to continue to assign a static IP to the systems that host the DNS and dhcp servers. I feel it is best to assign static IPs to appliances like printers and NAS systems. But all the regular desktop systems could be assigned dynamic IP.

This is what I do on my LAN, which has both Linux and Windows systems on it, and I can ssh to any system from any other by using hostname, so I don't have to be concerned with what the IP addresses happen to be at the moment.

If I misunderstood what you were after, I apologize.

Last edited by Z038; 07-13-2013 at 06:00 PM.
 
Old 07-13-2013, 06:24 PM   #3
Richard Cranium
Senior Member
 
Registered: Apr 2009
Location: Carrollton, Texas
Distribution: Slackware64 14.1
Posts: 1,494

Rep: Reputation: 437Reputation: 437Reputation: 437Reputation: 437Reputation: 437
IMO, as long as you have a valid name in your local network DNS server, there's no real reason to give static IPs to your printers and NAS systems.

In my case, I run an internal DHCP service that uses a totally BS internal network name (one that is highly unlikely to exist in the external world) that dynamically updates my internal DNS server. However, I'm not running an internal e-mail service which has implications on how you configure your MTA.

It's best to read the DNS HOW-TO. It's chock full of good information and even gives an example.
 
Old 07-13-2013, 06:41 PM   #4
Z038
Member
 
Registered: Jan 2006
Distribution: Slackware
Posts: 804

Rep: Reputation: 157Reputation: 157
Richard, the only reason I give static IPs to network printers on my LAN is because a Windows Vista desktop system on my LAN can't handle it when the printer's IP address changes and it takes a reboot of the Vista system to fix it. I could get away with giving the NAS a dynamic IP.
 
Old 07-13-2013, 07:22 PM   #5
manwichmakesameal
Member
 
Registered: Aug 2006
Distribution: Slackware
Posts: 800

Rep: Reputation: 100Reputation: 100
Here's how I would do it. I would set up one for doing firewall/router services including dhcp. I would set up that box with "sticky" ip's for every machine on the network. You can also set up that machine to do DNS and have everything set up to have CNAMES for everything. Then when/if you get connection, you can have that box do the routing for you and you don't have to worry about the rest of the network when you don't/can't have connectivity. I've set up networks like this and used something like pfSense for that box. Works like a charm.
 
Old 07-13-2013, 09:22 PM   #6
allend
Senior Member
 
Registered: Oct 2003
Location: Melbourne
Distribution: Slackware-current
Posts: 3,433

Rep: Reputation: 849Reputation: 849Reputation: 849Reputation: 849Reputation: 849Reputation: 849Reputation: 849
At my workplace, I have a Slackware firewall/gateway server with two network interface cards; one connected to the corporate LAN, the other to an intranet of Windows machines.
The layout is
Code:
Internet --- corporate LAN --- (NIC1) Server (NIC2) --- Switch --- Windows PCs
The server is running dnsmasq to provide IP addresses to the Windows PCs via DHCP with dnsmasq configured to always supply the same IP address (effectively static addressing).
The server is running CUPS to provide access to LAN printers from the Windows PCs.
The server is running Samba to provide access to files on the Windows PCs from the corporate LAN.
The server is running iptables with a ruleset that does port forwarding of RDP from the corporate LAN to the Windows PCs to allow remote desktop connections. The ruleset also governs access to the internet from the Windows PCs.

This is certainly not bullet proof, but is an arrangement that has served well for many years.
 
Old 07-14-2013, 08:09 AM   #7
tronayne
Senior Member
 
Registered: Oct 2003
Location: Northeastern Michigan, where Carhartt is a Designer Label
Distribution: Slackware 32- & 64-bit Stable
Posts: 3,042

Original Poster
Rep: Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761
Wow.

OK, maybe I can explain this a little better. I was having a problem with sendmail on the lap top I'm using to install and check out DSpace, a "a turnkey institutional repository application." See http://www.dspace.org if you're interested; the institute I mentioned has large diverse collections (think Smithsonian writ small without bugs-'n'-bones and airplanes). sendmail, on Slackware, usually "just works," but on this box, with a fresh install of Slackware 64-bit 14.0 (fully patched) just didn't want to work properly. I solved that, after a lot of suggestions from LQ members (including Pat) by saying to hell with, just reinstall Slackware and see what happens which "fixed" the problem. That entire thread is at http://www.linuxquestions.org/questi...1/#post4983424, probably not worth your time to look at.

Pat kindly posted this: http://www.linuxquestions.org/questi...ml#post4987332:
Quote:
I think the fix might be to use a hostname like somehost.pita.lan, where the hostname will be seen as "somehost" and the domain name as "pita.lan". I've never deployed a machine that had only a domain name (or a domain name of just .com). With slackware.com, for example, the actual machine has a longer hostname (connie.slackware.com) and reaching it via "slackware.com" is done with a CNAME in DNS. I think that might be what is confusing sendmail, since here it works out of the box on hive64.slackware.lan.
Which got me thinking and realizing that I did not have a clue what all the means (I'm pretty good with some stuff but not so hot with every stuff, ya know?). And I haven't been able to get my arms around stuff I'm reading from Google searches, dang it.

The whole sendmail thing is over and done, but CNAME in DNS? somehost.pita.lan? Uh... duh. That's what prompts this thread (that lap top is now named pita.lan and I'm thinking it would be a good idea to rename all my other boxes somename.lan while I'm at it).

I guess I still don't know how to ask a decent question, but perhaps this is a little clearer?
 
Old 07-14-2013, 01:13 PM   #8
Z038
Member
 
Registered: Jan 2006
Distribution: Slackware
Posts: 804

Rep: Reputation: 157Reputation: 157
A CNAME is an alias for an A (address) record in the zone file for your domain. An A record resolves to an IP address. You'll need to set up /etc/named.conf and your zone files for localhost, pita.lan, and the reverse zones for both of those.

Would an example help?

Edit: I can post a sample named.conf and the forward and reverse zone files for a DNS server, and a dhcpd.conf for a DHCP server, if you would like. But I don't want to clutter up the thread if you don't want to see the example.

Last edited by Z038; 07-14-2013 at 02:46 PM. Reason: elaborate
 
1 members found this post helpful.
Old 07-14-2013, 03:14 PM   #9
tronayne
Senior Member
 
Registered: Oct 2003
Location: Northeastern Michigan, where Carhartt is a Designer Label
Distribution: Slackware 32- & 64-bit Stable
Posts: 3,042

Original Poster
Rep: Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761Reputation: 761
Quote:
Originally Posted by Z038 View Post
Edit: I can post a sample named.conf and the forward and reverse zone files for a DNS server, and a dhcpd.conf for a DHCP server, if you would like. But I don't want to clutter up the thread if you don't want to see the example.
I would be grateful to see a sample; trust me, it won't clutter up anything and may actually unclutter me!
 
Old 07-14-2013, 03:40 PM   #10
descendant_command
Member
 
Registered: Mar 2012
Posts: 796

Rep: Reputation: 180Reputation: 180
dnsmasq would kill several birds with one stone.
It is a DHCP/(forwarding)DNS server that is very easy to configure to do exactly what you want.
Just set it up on your server and set all your clients for DHCP.
You can also assign static ip's to specific machines (e.g. by MAC) via DHCP.
 
Old 07-14-2013, 05:52 PM   #11
Z038
Member
 
Registered: Jan 2006
Distribution: Slackware
Posts: 804

Rep: Reputation: 157Reputation: 157
So here is an example. Please note that I am no expert on DNS or DHCP, but through trial and error and after reading lots of examples on the web, I managed to get it all working on my LAN. A real expert may find fault with the example I'm going to give you and could probably improve it a lot.

If pita.lan is your domain name, then you need to give each system a unique hostname on that domain. lap1.pita.lan, desk1.pita.lan, server1.pita.lan, and so forth, where lap1, desk1, and server1 are all hostnames.

Let's say you are running a BIND master DNS server on server1.pita.lan, and a slave DNS server on server2.pita.lan. You give both of these systems static IP addresses, 192.168.15.5 and 192.168.15.10, respectively. All your other systems, like lap1, are assigned dynamic IP addresses by your DHCP server, which is also running on server1.

Here is /etc/named.conf for your master DNS server on server1.pita.lan at 192.168.15.5. The files named in the zone definitions are relative to the base directory "/var/named" that is specified in the options section at the top.

The DNS configuration is defined using views. The internal view is for machines on your private LAN. It includes your localhost zone, your pita.lan zone, and the reverse pointer zones that correspond to those.

The external view is for public internet access from the outside, in the event that you exposed your DNS server to the world. It's not applicable in your case because you said there won't be any access from the internet. I just wanted to show you the structure. You could delete that whole section.

Code:
# named.conf configuration for master bind server.

acl internals { 127.0.0.1; 192.168.15.0/24; };
acl servers   { 192.168.15.5; 192.168.15.10; };
acl slaves    { 192.168.15.10; };

options {
   directory "/var/named";
   version "not available";
   allow-query {localnets; };
   allow-transfer {"none";};
   recursion no; 
   notify no; 
   empty-zones-enable yes;
};

view "internal" IN {
   match-clients { internals; };
   recursion yes;
   disable-empty-zone "15.168.192-in-addr.arpa";
   disable-empty-zone "0.0.127-in-addr.arpa";

   zone "." IN {
      type hint;
      file "root.hints";
   };

   zone "localhost" IN {
      type master;
      file "internal/zone.localhost";
      allow-update { none; };
   };

   zone "0.0.127.in-addr.arpa" IN {
      type master;
      file "internal/revp.127.0.0";
      allow-update { none; };
   };

   include "/etc/ddns.key";

   zone "pita.lan" IN {
      type master;
      file "internal/zone.pita.lan";
      allow-update { key DDNS_UPDATE; };
      allow-transfer { slaves; };
      check-names ignore;
   };

   zone "15.168.192.in-addr.arpa" IN {
      type master;
      file "internal/revp.192.168.15";
      allow-update { key DDNS_UPDATE; };
      allow-transfer { slaves; };
      check-names ignore;
   };
};

view "external" IN {
   match-clients { any; };
   match-destinations { !localnets; !localhost; };

   zone "." IN {
      type hint;
      file "root.hints";
   };

   zone "pita.lan" IN {
      type master;
      file "external/zone.pita.lan";
      allow-transfer { slaves; };
   };
# Note:  You might have a reverse lookup zone file for your public IP here if 
# you owned a whole class C or larger network block of addresses, or if the 
# owner of the network delegated the reverse lookup zone for a subnet to you.  
# Otherwise, the owner of the network would manage the reverse lookup. 
;
Here is localhost forward zone file at /var/named/internal/zone.localhost.

Code:
$TTL	86400
$ORIGIN localhost.
@	1D IN SOA	@ root (
			42		; serial 
			3H		; refresh
			15M		; retry
			1W		; expiry
			1D )		; minimum

	1D IN NS	@
	1D IN A		127.0.0.1
Here is the reverse lookup zone file for localhost at /var/named/internal/revp.127.0.0

Code:
$TTL	86400
@       IN      SOA     localhost. root.localhost.  (
                        2013040300 ; Serial
                        28800      ; Refresh
                        14400      ; Retry
                        3600000    ; Expire
                        86400 )    ; Minimum
        IN      NS      localhost.
5       IN      PTR     localhost.
Here is the pita.lan forward zone file at /var/named/internal/zone.pita.lan.

Code:
$ORIGIN .
$TTL 86400	; 1 day
pita.lan		IN SOA	server1.pita.lan. hostmaster.pita.lan. (
				201305428  ; serial
				28800      ; refresh (8 hours)
				14400      ; retry (4 hours)
				2419200    ; expire (4 weeks)
				86400      ; minimum (1 day)
				)
			NS	server1.pita.lan.
			NS	server2.pita.lan.
$ORIGIN pita.lan.
$TTL 3600	; 1 hour
server1			A	192.168.15.5
server2			A	192.168.15.10
localhost		A	127.0.0.1
router			A	192.168.15.1
pub			CNAME	server1
samba1			CNAME	server1
samba2			CNAME	server2
www			CNAME	server1
Here is the reverse lookup zone file for pita.lan at /var/named/internal/revp.192.168.15.

Code:
$ORIGIN .
$TTL 86400	; 1 day
15.168.192.in-addr.arpa IN SOA	server1.pita.lan. hostmaster.pita.lan. (
				201305210  ; serial
				28800      ; refresh (8 hours)
				14400      ; retry (4 hours)
				2419200    ; expire (4 weeks)
				86400      ; minimum (1 day)
				)
			NS	server1.pita.lan.
			NS	server2.pita.lan.
$ORIGIN 15.168.192.in-addr.arpa.
1                       PTR     router.pita.lan.
5			PTR	server1.pita.lan.
10			PTR	server2.pita.lan.
Here is /etc/dhcpd.conf for your DHCP server on server1 at 192.168.15.5.

Code:
#
# dhcpd.conf
#
# Configuration file for ISC dhcpd (see 'man dhcpd.conf')
#
  
authoritative;
ignore bootp;
option domain-name-servers 192.168.15.5, 192.168.15.10;

# Dynamic DNS setup
ddns-update-style interim;
# DDNS update key was created by issuing the following command as root:
# dnssec-keygen -a HMAC-MD5 -b 128 -r /dev/urandom -n USER DDNS_UPDATE
key DDNS_UPDATE {
        algorithm HMAC-MD5.SIG-ALG.REG.INT;
        secret 0wPvV+S8FmokHr7651RHSQ==; 
}
zone pita.lan. {
     primary 192.168.15.5;
     key DDNS_UPDATE;
}
zone 15.168.192.in-addr.arpa. {
     primary 192.168.15.5;
     key DDNS_UPDATE;
} 

subnet 192.168.15.0 netmask 255.255.255.0 {
    option domain-name "pita.lan";
    option broadcast-address 192.168.15.255;
    option subnet-mask 255.255.255.0;
    option routers 192.168.15.1;
    option ntp-servers 192.168.15.5, 192.168.15.10;
    ddns-domainname "pita.lan";
    # Reserve range 192.168.15.1 to 99 for static IP addresses
    pool {
      # Known clients (i.e. configured with a 'host' statement)
      # that request an IP address via DHCP
      range 192.168.15.100 192.168.15.149;
      default-lease-time 604800;
      max-lease-time 2419200;
      deny unknown clients;
    }
    pool {
      # Guests
      range 192.168.15.150 192.168.15.249;
      default-lease-time 86400;
      max-lease-time 259200;
      deny known clients;
    }
}

# === Group definitions =============================================

group {
  # Non-PXE machines

  default-lease-time 604800;
  max-lease-time 1209600;
 
  # HP75C491 HP Officejet 6310 network printer
  host HP75C491 {
    hardware ethernet 00:1f:48:7e:c4:9a;
    fixed-address 192.168.15.77;
  }
}

group {
  # PXEboot

  default-lease-time 86400;
  max-lease-time 172800;
  allow bootp;

  # Point to the TFTP server (required parameter!):
  next-server 192.168.15.5;

  use-host-decl-names on;

  if substring (option vendor-class-identifier, 0, 9) = "PXEClient" {
    filename "/slackware-current/pxelinux.0";
  }
  else if substring (option vendor-class-identifier, 0, 9) = "Etherboot" {
    filename "/slackware-current/kernels/hugesmp.s/bzImage";
  }

  host server2 {
    hardware ethernet 00:13:d9:ff:0c:8a;
    fixed-address 192.168.15.10;
  }

  host lap1 {                              # Dell Latitude D505 laptop
    hardware ethernet 00:0f:4f:cd:1e:1f;   # eth0, wired interface
  }
}
You may have noticed that named.conf had an include for /etc/ddns.key, and the dhcp.conf had a dynamic DNS key section also. Both specify the same key, and this is what allows your DHCP server to update your DNS server to add the currently assigned dynamic IP address for any DHCP client system to your zone files. If your DNS and DHCP server were running and clients named desk1 and lap1 joined the network and were given dynamic IP addresses, your pita.lan zone file would be dynamically updated to add something like this:

Code:
desk1			A	192.168.15.149
			TXT	"004561f997476f4e16c508ac149560e318"
lap1			A	192.168.15.202
			TXT	"314561f997476f4e16c508ac149560e318"
Here is an example /etc/ddns.key file. Note that the password in this example is a real one that was generated with dnssec-keygen, but it's not one I use. The same password must be in named.conf and in dhcpd.conf.

Code:
# DDNS update key was created by issuing the following command as root:
# dnssec-keygen -a HMAC-MD5 -b 128 -r /dev/urandom -n USER DDNS_UPDATE
# Note: This file is suitable for inclusion in named.conf, but it won't
# work for dhcpd.conf.  In order to include it in dhcpd.conf, the double
# quotes around the secret key and the trailing semi-colon after the 
# final closing brace must be removed.
key DDNS_UPDATE {
        algorithm HMAC-MD5.SIG-ALG.REG.INT;
        secret "0wPvV+S8FmokHr7651RHSQ==";
};
It probably goes without saying that the ddns.key file and the dhcpd.conf file need to have restrictive permissions with no world access, since they contain the dynamic update key that DHCP uses to talk to DNS.

I have not shown what a slave DNS configuration would look like. It will have a named.conf that looks similar to the master one, but with a few differences, and its zone files are different. They get transferred from master. I can add that in another post later.

I have not shown the root.hints file. You download that from the web periodically. It doesn't change very often, and it works even if it isn't totally up to date. I'll follow up with more info on that later also.

I hope this helps.
 
Old 07-15-2013, 01:51 AM   #12
descendant_command
Member
 
Registered: Mar 2012
Posts: 796

Rep: Reputation: 180Reputation: 180
Or ...
You could use dnsmasq, set your local network name and and upstream dns, and just add a single line for any hosts that need a static ip.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
SSH to the world (outside LAN) Laodiceans Slackware 4 02-02-2011 06:05 PM
LAN cannot access other LAN systems, only WAN Myrion Linux - Networking 1 09-06-2007 07:29 PM
Wireless LAN access, how to set up? bulliver Linux - Wireless Networking 5 01-18-2006 08:22 PM
Linux Bricktop-->XP box-->LAN-->Proxy-->The World - but how? MooUK Linux - Networking 2 10-09-2005 03:51 PM
ftp from LAN to big wide world acid_kewpie Linux - Networking 2 11-14-2001 04:05 PM


All times are GMT -5. The time now is 10:46 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration