OK... well first I want to say thanks to everyone that has helped me so far.

Now I just finished getting our RH9 server up and running. Now I get to move on to what I have wanted to do for a while SECURITY.

Let me start by saying that I am a self taught IT person. Everything I know I learned on demand because we needed to do something or because something happened. I cover a wide range from running cables, MAC support, NT server, Linux Server, PHP/MySQL based web developement and so on. I know a little about a whole lot of subjects but don't know a whole lot about anything. I am very logical and have found so far that there is nothing I can't figure out. Maybe it takes a bottle of Exedrin but I can do it.

So... here is what we have.

T1 -Gateway
RH 9 - serves mail (sendmail), web (apache), FTP (vsftp), DNS (bind), and SSH.
NT4 server - file sharing and windows domain controller.
Win2K workstations (about 30)
Mac os9 workstations (5)

Everyone right now is on static IPs.

My goal. Stop all traffic from getting anywhere unless I want it to. Nothing in or out without my permission. Total Virus protection.

What I am wondering is what is my best option. Server/workstation based firewall and Virus scan? OR Firewall appliance right after teh T1 router?

I know I can get ZoneAlarm ( a great Firewal app) for all the workstations but I want to manage the rules centrally.

Norton Antivirus for the workstations sure... but I would rather have sendmail scan all the mail... or procmail actually I guess (right?).

I have seen Unspawns post and would love to read all the links he has... but the reality is... I am in a programming crunch, have no time to work on this, so I make time, and need to have a plan by early next week. If I can get some direction I will start reading and learn what I need to. That is how I have to work so I am used to it.

One thing I would like to avoid is using NAT. Reconfiguring everyones machine would be a pain? I know the theory of it but not sure how they work. Anyway, DHCP would be an adequate option for me I guess... Just some random thoughts anyway...

The nice thing is that at this point I have the chance to start off doing it right rather than hacking in fixes later on.

Thanks in advance to everyone.

you dont want to use nat, but you want to manage the rules centerally! you have static ips for the clients, but you are thinking about DHCP!


the best way to do this would be to put a machine with smoothwall after the t1 link and before the internal network. read the smoothwall documents and you will get a very good idea

I second the smoothwall recommendation. I have never used it personally, but from my linux sysadmin friends, I do hear very good things about it.

manthram, did you mean www.smoothwall.org ?

On a similar note, put AntiVir mail gate on the same box and that will solve your sendmail problem.