1
vote

I'm looking to replace a default DSL router/modem with a "dummy modem" + "linux-based router" combo. I'm getting rid of the ZOOM ADSL modem because of its lack of capabilities. For instance, I can't forward external ports to different internal ports (e.g. forward external port 2000 to internal port 80 -- I have to go 2000 to 2000, 80 to 80, etc.). Although this can be done by logging into the router via telnet and manipulating the router's proprietary firewall, it's a huge pain. Also, it, under no circumstances allows for loopback traffic, which I often need so that I may test as though I'm an external user. So, I'm going linux.

I realize that it will take some time to get everything tweaked to my liking, however, I'm looking for the quickest means by which to get a quality, safe linux router up and running ASAP. As stated, the setup will be to revert back to the dummy DSL modem for general ISP connectivity, then flow all traffic through the linux-box, and finally to a gigabit switch for the office:

[INTERNET]  <--> ["DUMB" DSL MODEM] <--> [UBUNTU BOX (2 NICs) (w/Webmin?)] <--> [24-port gig switch] <--> [OFFICE COMPUTERS]

That said, can anyone provide some concise info on getting a decent (work-in-progress) linux router up and running? I've seen too many documents and YouTube tutorials to count, but everyone seems to touch on cases I'd likely never even use.

I have the following NEEDS:

GENERAL SAFETY (against general DOS, SMURFING, etc.), NAT, PORT FORWARDING

I have the following WANTS:

WEB PRE-LOAD/CACHING, DNS, WIRELESS SERVING (future -- I can use an access point for now), VPN

FYI, I've currently got an Ubuntu Jaunty box running Webmin, but I'm willing to use whatever so long as it is, at least initially, straightforward.

Best.

****BEGIN EDIT****

Hi All,

I've decided to go with pfSense. When I initially installed it, everything seemed to work just fine. Now, however, I can ping and SSH to all machines behind the pfSense box, but I can't access the internet. I reset to factory defaults but still no results. I do currently have the pfSense machine sitting just after the DSL router/modem. Are there perhaps DNS issues? What are the base set of items I need to check in order to get a "dirty" setup going?

Thanks again.

****END EDIT****

2
  • IMHO I would put your wants on a separate box to your linux firewall/router. Aug 19, 2009 at 6:45
  • Webmin's iptables module doesn't hid much of the iptables "pain". Have you thought about third party iptables wrappers sush as Shorewall or Firewall Builder?
    – David
    Aug 19, 2009 at 12:13

5 Answers 5

3
votes

m0n0wall and pfSense (BSD's, pfSense being forked from m0n0), Smoothwall, Vyatta, or IPcop will all do what you want effectively -- and are all different flavors of mostly the same coolaid. You might find the community is what sells you on one product over another. M0n0wall will fit on any storage device, pfSense seems to offer more advanced features, while Vyatta is a enterprisey Cisco replacement, and IPCop is super-simple. They are all excellent.

Here is a review of quite a few Firewall distro's that marks up pfSense as best-of-breed.

1
2
votes

Why don't you consider using a router based distribution like Smoothwall since they already have things done for you (including a nice GUI too).

2
  • Well, we purchased a group of server racks in a "lot" (a la eBay) and got an amazing deal on them. My only reservation is that the weakest of the lot is still a quad Xeon with 6 SCSI slots . I'd kinda like to use the machine for more than just routing. =\ And, nope, I don't have anything "weaker" that's not being used. Otherwise, no issue. Aug 19, 2009 at 4:19
  • I can't seem to get the Smoothwall web interface to come up. I've got it installed in a virtual machine but it's not playing nicely. FYI, I did get pfSense to work in a VM. One thing I like about pfSense is the ability to manipulate it easily from the command line. Anyway, I'd appreciate any info you have on my VM issue with Smoothwall. Thx Aug 19, 2009 at 5:49
2
votes

m0n0wall is drop-dead simple (Web GUI), rock-solid stable (haven't rebooted for > 2 years), and can do everything you want. Technically, it's FreeBSD under the covers, but you needn't even bother with knowing what it is - it just works. You can install it on old PC's or get a Soekris box to get a small, power efficient router.

4
  • I was just going to ask about that. I've seen many people reference pfSense. I realize they are similar, but, of the two, which would you recommend? Aug 19, 2009 at 4:10
  • 1
    pfSense is basically m0n0wall+. If you don't need any of the features from pfSense, then I'd recommend m0n0wall - it requires a lot less resources. pfSense is more of an appliance where m0n0wall is more of a firewall. pfSense is great, but I haven't had a need for the more advanced features of pfSense -- m0n0wall has served me well. Aug 19, 2009 at 5:26
  • Thanks. Would you mind mentioning which of my NEEDs/WANTs aren't addressed in m0n0wall? Aug 19, 2009 at 5:45
  • Sure: NEEDS - all are satisfied. WANTS - all are satisfied, except for web proxy (proxy requires a lot of disk, and m0n0wall will run on a 16MB flash). Also of note: at one time, wireless wasn't too reliable -- I bought a separate AP and have never looked back into it. It may be resolved, or might still be sporadic. Aug 19, 2009 at 12:19
0
votes

Look into the Endian firewall if pfSense isn't quite what you're looking for. I use Endians or pfSense depending on need, but the Endians are dead simple to set up, allow for the caching that you're looking for etc. Very simple VPN setup, routes, NAT/PAT/etc.

Really the only time I opt for pfSense boxes is when I need HA or Web pooling, although the pf's can probably do everything an Endian can, it's rather nice when it's all bundled together for you.

0
votes

Ebox Platform can do routing, firewall, dnat, dns, transparent proxy, mail, groupware, anti-virus, smb shares, pdc, vpn, and a long etc. It's an ubuntu based distro. All configuration is done in a web page.

Not the answer you're looking for? Browse other questions tagged .