Cable Modem
|
|
VOIPModem
|
|
Linux-Firewall/Router/SQUID proxy
|
|
Dlink wireless router-------------W2K server
|
|
Windows 2k wireless clients



I am redoing my network and I am adding another machine and it is going to be my firewall/router.

Cable Modem
|
|
VOIPModem
|
|
Linux-Firewall/Router- Server
|
|
Linux-SQUID proxy- Server
|
|
Dlink wireless router----------W2K Server
|
|
Windows 2k wireless clients

On the Squid Server, do I need to enable IP forwarding on that machine and then forward the packets to my Firewall server to be able to get my clients to the internet or do I only enable ip forwarding on just my Firewall?How do I route my ip packets to allow my clients to get to the internet. Before I had one machine doing it all. I have taken some of that payload off of the one server.

i would not use the proxy as a hop, instead you would filter outbound port 80 traffic on the firewall and redirect it to the server. At the same time though, a single SmoothWall or IPcop box can do all those functions in one unit, and it'd be no biggy if you made your own standard distro firewall do the proxying too. but ultimately, i would not add an extra hop, that's not fun.

that is how I had it before. Isnt that too much for one machine to do, proxying and a firewalling? I wanted to lighten up the load on my main firewalling server. Will that extra hop slow things down or is it just more of a pain in the tookas?

Any machine made in the last 5 years, maybe even before that, should have no trouble with doing both the firewalling and proxying so unless you've actually monitored the performance on that machine and seen that its overloaded I wouldn't bother.

If you do want to split it out then its pretty simple. The firewall/router does NAT (so yes you enable IP forwarding) and the Squid proxy machine has the Firewall/router machine as its default gateway. The Win2k clients can only then access the net through the Squid proxy - they can't connect directly to the net. If this was your intention in doing this you can easily achieve the same by turning off IP forwarding and NAT on the existing combined firewall/proxy setup.

i wouldn't know if that machine is capable, as you didn't say how many clients there are... we're not psychic! like tkedwards said, it's probably safe to say yes it's fine, but IF you have +100 heavy net users behine it, then more likely not...

many thanks! I had one more questions:

I upgraded my servers to kernel 2.6+ and I wanted to put my VOIP modem in its own DMZ off of my firewall. Can anyone give me some iptables rules to add to my firewall to allow udp ports 5060 UDP, 1020-1030 UDP, 13456-13463 to my DMZ where my VOIP modem is located. My DMZ will be on a 192.168.2.0 network. thanks