The first choice that must be made is what IP range to use - as mentioned in the last article, you should choose one of the reserved IP addresses, as defined in RFC 1918. A good choice for a basic intranet is as follows:
IP address: 192.168.x.y # where 1 > y < 254 Broadcast: 192.168.x.255 Network: 192.168.x.0 Netmask: 255.255.255.0
Securing the router is very important - see the articles by David Jericho and Jim Hewlett on post installation security - these are a good starting point for any Linux box. A good rule to follow is if you don't need a service, turn it off.
Configuring PPP is best done by some of the ready made packages available - under Debian, pppconfig seems to be pretty reasonable. Other packages that do a similar job (some graphical, some text) are available from Freshmeat.net. See the ISP-Hookup-HOWTO for more details on this.
One of the more popular ways of connecting an intranet to the Internet is using IP masquerading. To enable this, first you need to recompile your kernel with the following options (I'm using kernel 2.2 for this) - see the Kernel-HOWTO for more details on compiling your kernel.
Code maturity level options Prompt for development and/or incomplete code/drivers Networking options Network firewalls IP: firewalling IP: always defragment (required for masquerading) IP: masquerading IP: ICMP masquerading IP: masquerading special modules supportThere are many options that you can compile in, such as quality of service, various firewalling options, and advance router functionality, but none of this is required for simple ip masquerading.
To enable basic ip masquerading, simply run the following commands:
# Enable forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Flush the forwarding rules /sbin/ipchains -F forward # Set the default policy for forwarding to deny /sbin/ipchains -P forward DENY # Enable ip masq for your local subnet to anywhere /sbin/ipchains -A forward -j MASQ -s 192.168.x.0/24 -d 0.0.0.0/0This enables ip masquerading access for your local subnet to any destination. You can easily restrict access people have by modifying these rules - see the IPCHAINS-HOWTO and Jason Tackaberry's article on firewalls for more details. There are ip masq modules you need to load to enable certain protocols, such as CUSEEME, Real Audio, Quake, and a few others - see /lib/modules/`uname -r`/ipv4/ for the actual modules.
The next protocol to set up is DNS - the most common program used for this is ISC's Bind. To install it, either download a package for your distribution, or compile from source. After compiling it, you need to set up a domain for your intranet - we'll be using .intranet as an example domain, and assuming you are using 192.168.1.0. What we'll be doing is setting up your router as a primary DNS server for both .intranet, and 1.168.192.in-addr.arpa (the reverse entries for 192.168.1), and restricting access to it to the local intranet. To do this, add the following lines to your /etc/named.conf (this assumes you are using the current version of bind, 8.2):
acl localhosts {
192.168.1.0/24;
}
zone "intranet" {
type master;
file "named.intranet";
allow-query { localhosts; };
};
zone "1.168.192.in-addr.arpa" {
type master;
file "named.192.168.1";
allow-query { localhosts; };
};
After adding these lines to named.conf, create the following files in /var/named: named.intranet
;
; BIND data file for .intranet
;
@ IN SOA intranet. root.router.intranet. (
YYYYMMDDxx ; Serial
604800 ; Refresh
86400 ; Retry
2419200 ; Expire
604800 ) ; Default TTL
IN NS router.intranet.
IN A 192.168.1.1
router IN A 192.168.1.1
foo IN A 192.168.1.10
named.192.168.1
; ; BIND reverse data file for 192.168.1.0 ; @ IN SOA intranet. root.router.intranet. ( YYYYMMDDxx ; Serial 604800 ; Refresh 86400 ; Retry 2419200 ; Expire 604800 ) ; Default TTL ; @ NS router.intranet. 1 PTR router.intranet. 10 PTR foo.intranet.
As you can see, the format is pretty straight forward - there are a couple of things to be aware of, however. It is important to update the serial number after every change, before restarting the daemon. A common format to use is given as an example - it is useful in that you can easily tell the last time a zone was updated. The other important bit to notice is the ``.'' at the end of the hostnames - this specifies that the hostname is canonical. If you don't have the ``.'', bind assumes you are referring to a host in the current domain, and appends the domain - this leads to the common situation of router.intranet.intranet - doubling up of the domain name. For further information on this, see the DNS-HOWTO.
This is enough for your intranet to connect to the internet - there is much more functionality you can provide, and this will be covered in the next article in this series. Further functionality can include a web proxy, to reduce traffic, a DHCP server, to make it easier to configure clients, and much more.