0

So I work in a company where we have a linux machine acting as a router/firewall, and I like all the control you get in this kind of setup compared to having a consumer grade router that ISPs usually give you.

Knowing that, I decided to build a Mini PC to have the same kind of setup in my home, kind of as described in this guide: http://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/

So the computer in question would act as a a router, DHCP server and firewall, but I have another linux server already in my home, which runs a Teamspeak service that is accessible from the internet and a few other services that are only for my LAN (a Samba server, for example), and I've read somewhere that it is not advisable to run services that should only be accessible to the LAN on a firewall machine, for security reasons. But it would be way more convenient to have only one machine running both my router services and LAN services such as the Samba server.

The question is: Is there any way I could make this setup work and make this new machine which is going to be the router/firewall run my LAN services in a secure way, making it impossible for the services to be accessible from the web?

3
  • 1
    Yes it is possible. It is also ill advised because it is harder to secure properly. My recomendation is if you need to ask this question the answer is simple - Don't. Apr 22, 2016 at 20:03
  • 1
    "So the computer in question would act as a a router, DHCP server and firewall" - isn't that what your home router is doing now?
    – Sum1sAdmin
    Apr 22, 2016 at 22:34
  • Why do you want only one machine? If it is because it is more convenient to have only a single piece of hardware, then use virtualization to separate the tasks. If it is because you want a simpler configuration, then I think two physical machines is not a lot more complicated to configure than a single one with all of the services.
    – kasperd
    Apr 23, 2016 at 10:48

1 Answer 1

1

You can achieve this by using virtualization, either with a bare-metal hypervisor (ESXi, Hyper-V, KVM) or containers (Solaris Zones, *BSD Jails, Linux LXC), depending if you need different operating systems for your servers.

There is much debate over if this is a smart or terrible idea, so I won't lecture you on it much. There a guides out there how to setup the network correctly depending on your virtualization solution. I just want to note that for single setups it can be quite inconvenient if you have to shut down internet access to do anything on the machine (add a PCIe card, for example), especially if you have a whole network behind it.

It is more useful if you have special requirements on the performance side (strong CPU needed for VPN traffic, power should not be wasted when idle for example) and also at least two such machines.

2
  • ......use all the things!!
    – Sum1sAdmin
    Apr 22, 2016 at 23:17
  • Sounds like LXC would solve my problem nicely. Thanks! Apr 23, 2016 at 15:37

Not the answer you're looking for? Browse other questions tagged .