Linux gateway to the Internet

Question

Where is the documentation on how to configure a plain Linux box (probably running Ubuntu), with two NIC's so that eth0 is the input from the Internet and eth1 is the output to a wireless router?

While the traffic is passing through, I'd like to analyze it.

Answer 1

Use an existing firewall distribution such as smoothwall or ipcop. That will save you a ton of trouble and headache later. If you really want to get into the nitty-gritty of advance router configuration, check out LARTC.

Answer 2

this is nothing special, all you need is a good firewall script or framework that will NAT your traffic.

Take a look at this link to get started: http://ubuntuforums.org/showthread.php?t=713874

Searching google will return countless hits as this topic has been thoroughly investigated.

Answer 3

I use shorewall running on ubuntu. Very easy to set up and maintain, but it still has all the options you will likely need: http://www.shorewall.net/two-interface.htm

Answer 4

Here's a script I use on some debian systems:

#!/bin/sh
## This script starts an NAT internet gateway

## Settings
# Internal Interface
INTERNAL=eth1
# External Interface
EXTERNAL=eth0

## Ensure the modules are loaded
# Load the NAT module
modprobe iptable_nat
# Load the transparent FTP modules
modprobe ip_nat_ftp
modprobe ip_conntrack_ftp
# Load the transparent IRC modules
modprobe ip_nat_irc
modprobe ip_conntrack_irc

modprobe ipt_MASQUERADE
modprobe ipt_REDIRECT
modprobe ipt_REJECT
modprobe iptable_filter
modprobe ip_conntrack
modprobe ip_tables


## Flush the routing tables
iptables --flush
iptables --table nat --flush
iptables --delete-chain
iptables --table nat --delete-chain

## Set up the NAT table
iptables -t nat -A POSTROUTING -o $EXTERNAL -j MASQUERADE
iptables --append FORWARD --in-interface $INTERNAL -j ACCEPT

# Ensure that IP forwarding is on
echo 1 > /proc/sys/net/ipv4/ip_forward

Answer 5

You might also look at m0n0wall. A guy in my local LUG uses it extensively.

Answer 6

To analyze the traffic, you can use tcpdump