LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   How to configure centos 5.4 to work as a router and firewall on its own (https://www.linuxquestions.org/questions/linux-newbie-8/how-to-configure-centos-5-4-to-work-as-a-router-and-firewall-on-its-own-886523/)

gpaxs 06-15-2011 10:36 AM

How to configure centos 5.4 to work as a router and firewall on its own
 
Hi,can anyone pls guide me step by step on how to setup centos to act as router and firewall at our office i just installed the os now i dont know where to go from here i have all the isp adresses,dns and gateway any assistance will be greatly appreciated coz am really interested in learning linux thanxs



iused some instructions on this site http://wiki.centos.org/HowTos/Network/IPTables and when i try the /sysctl.config on my terminal now i get the message permission denied

acid_kewpie 06-15-2011 10:45 AM

There's really very little to it. You turn it into a "router" by going into /etc/sysctl.conf and setting the parameter "net.ipv4.ip_forward = 1" and reboot (you can do it without rebooting, but let's not confuse things).

as for the firewall side, the standard firewall settings live in /etc/sysconfig/iptables. you can edit that file directly or use system-config-firewall

To most people routing also implicitly means natting, so IF that's the case, then you'd need to enable ip masquerading for nat. The best way for you to achieve this is probably to add a few lines that say:

Code:

iptables -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -o eth0 -j MASQUERADE
(which means, in order of commands, traffic about to leave the system that is from the 192.168.122.0/24 subnet that is not going to that subnet and is going out of interface eth0 should be masqueraded to the address of the eth0 interface itself)

updating the subnets and interface appropriately. You can make this permanent by running "service iptables save"

That's really the basics of it. You should be comfortable with what you're doing before it goes into service though, there are so many ways you could possibly be at risk if you don't know what you're doing.

chrism01 06-15-2011 07:09 PM

Great advice from acid_kewpie as always :)
I'd just add that you'll probably want to bookmark and read the Admin HOWTO Guide here http://www.linuxtopia.org/online_boo...ion/index.html

gpaxs 06-16-2011 06:20 AM

thank you
 
Quote:

Originally Posted by acid_kewpie (Post 4386567)
There's really very little to it. You turn it into a "router" by going into /etc/sysctl.conf and setting the parameter "net.ipv4.ip_forward = 1" and reboot (you can do it without rebooting, but let's not confuse things).

as for the firewall side, the standard firewall settings live in /etc/sysconfig/iptables. you can edit that file directly or use system-config-firewall

To most people routing also implicitly means natting, so IF that's the case, then you'd need to enable ip masquerading for nat. The best way for you to achieve this is probably to add a few lines that say:

Code:

iptables -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -o eth0 -j MASQUERADE
(which means, in order of commands, traffic about to leave the system that is from the 192.168.122.0/24 subnet that is not going to that subnet and is going out of interface eth0 should be masqueraded to the address of the eth0 interface itself)

updating the subnets and interface appropriately. You can make this permanent by running "service iptables save"

That's really the basics of it. You should be comfortable with what you're doing before it goes into service though, there are so many ways you could possibly be at risk if you don't know what you're doing.

well i was used to windows bt itrust i can work with this as well only with guidance am a quick learner i just realised at terminal when i type /etc/sysctl/config it it says access denied i dont know what am doing wrong even after i installed the os afresh. thanks a bunch for your time and please assist me atleast setup this one server.

chrism01 06-16-2011 08:36 PM

You definitely need to read that link I supplied. Also, this is a great tutorial http://rute.2038bug.com/index.html.gz

acid_kewpie said
Code:

/etc/sysctl.conf
but you used
Code:

/etc/sysctl/config
Note the difference. Also, it's a file not a program, so you can't type that as a cmd. It's a file that needs editing.
Also, at this level you'll need to be the root (aka admin) user, not a normal user.

John VV 06-16-2011 09:25 PM

well the very first thing is to upgrade to THE ONLY SUPPORTED version CentOS 5.6
5.4 will NEVER get updates

hopefully you have let yum auto do this but????
if not
Code:

su -
yum upgrade



All times are GMT -5. The time now is 08:56 AM.