Proxy server setup

[Vernon Brown_2]

I'm trying to set up a proxy server for my home network of 3 Windose computers. The proxy is running RedHat 7.2 and is a HP 8500. I have the network set up and working locally and I can get to the internet from the proxy server. Have not been able to configure it so that the local network can get to the internet.

I had this set up once before but have lost the instructions. I think I used an application called "pump". Haven't been able to find the internet location where I got the instructions.

Can anyone give me a clue.

[Vernon Brown_2]

Some additional info:

My proxy server has two eithernet cards one connected to my local LAN and the other to the internet through a StarBand 360 dish modem. I can duel boot the proxy between Windows 98 and RedHat Linux 7.2. Proxy works with windows WinProxy, not yet with Linux.

[Kodjo Agbenu]

Hello,

I think your question needs an explanation.

Using your hardware configuration (2 lan cards), there are 2 ways to do what you want :

1. Proxy configuration

With this method, your Linux box runs a special software that is specifically designed to relay requests from the "intranet" (your windows boxes) to the "internet".
There are many proxy softwares, depending on what you want to relay. For example, "squid" (http://www.squid-cache.org) is the best proxy software for http/ftp requests.

2. Simple router

In this configuration, your Linux box with 2 lan cards acts as a router (a gateway). Therefore, it relays IP packets from one world to another (from internet to intranet and vice-versa).


Both methods are secure and also both methods can be unsecure if you don't know how to do things the right way, and at last both methods can get very complex depending on what level of security you want to reach.

For the 1st method, the best way is to read the documentation of the proxy software (in case of squid : www.squid-cache.org).

To get the 2nd method working well, you need some network security basic knowledge.

Quick'n dirty : suppose that eth0 is connected to "intranet" and "eth1" is on "internet" :

=> Use this (optional) firewall rule to prevent incoming connctions

iptables -t filter -A INPUT -i eth1 -m state --state NEW,INVALID -j DROP

=> Use this (mandatory) firewall rule to "translate" your internal IP addresses into IPs compatible with the Internet rules :

iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE

=> Use this command to activate routing between internal and external worlds :

echo "1" >/proc/sys/net/ipv4/ip_forward


Of course, if you need some explanations on this, do not hesitate to post another question.

A good reference for security is an O'Reilly book :

Building Internet Firewalls (2nd Edition)
by Elizabeth D. Zwicky, Simon Cooper, D. Brent Chapman, Deborah Russell

Good luck.

Kodjo

[Vernon Brown_2]

Thanks; that gives me some places to look. What I want is just to get a way to the internet from my LAN. The most simple way. After I get that working I can explore ways to make it secure.

When I did this before it only took three lines of code in one of the startup scripts. Thanks for your help.

[Lindsay Hill]

I suspect you were looking for "Rusty's three line guide to masquerading" (or something like that. As I recall, that covered ipchains.

The answer you are after is right there in Kodjo's answer, it just covers the newer iptables.

Run the two iptables commands he has given you, then run the one starting echo "1" >

Presto, you will have masquerading, which is probably all you want.

You can work out how to make this survive reboots (hint: use the proper RH config files, don't just stick them on the end of rc.local)

- Lindsay

[Mark Fenton]

Vernon,

RH 7.2 comes out of the box with only IP chains enabled -- you have to go in and reconfigure the kernel to get iptables up and running.

I appreciate your situation, I keep on forgetting which commands I used where to get my network setup the way I liked. Iptables is definately a better firewalling/nat solution than ipchains as it will allow for true nat without having to run any additional programs. Plenty of information out there on how to set things up:
http://www.linuxdocs.org
http://www.netfilter.org
or if you want to download a sample firewall package, try
http://freshmeat.net and search on firewall.

Best regards.
Mark

[Vernon Brown_2]

Ok if RedHat 7.2 doesn't come out of the box with iptables set up that may be my problem. I'll try all the suggestions all of you have made. Thanks; now I have to figure out how to recompile the kernel with iptables enabled. Maybe a trip to the book store will help.