I use Ubuntu Server as my router/firewall for my network for a number of reasons. Until recently, I was using 10.04 with great success for this purpose. The OS provides DNS lookup and DHCP using DNSMasq. I recently set up a new install with Ubuntu 12.04, since 10.04 support has ended.
The server supplies dns, routing, and dhcp.
My configuration is pretty straightforward.
/etc/network/interfaces
auto eth0 eth1
iface eth0 inet dhcp #WAN connection
iface eth1 inet static #LAN connection
address 192.168.16.1
netmask 255.255.255.0
network 192.168.16.0
broadcast 192.168.16.255
iptables commands (routing is enabled in the kernel)
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -t raw -F
iptables -t raw -X
iptables -A FORWARD -i eth1 -s 192.168.16.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -i eth0 -d 192.168.16.0/255.255.255.0 -j ACCEPT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
iptables -I INPUT 1 -i lo -j ACCEPT
iptables -I INPUT 1 -i eth1 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Relevant (non-default) /etc/dnsmasq.conf entries
listen-address=192.168.16.1
strict-order
interface=eth1
dhcp-range=192.168.16.100,192.168.16.199,72h
And finally, /etc/resolvconf/resolv.conf.d/tail
nameserver 97.64.168.12
nameserver 8.8.8.8
With the exception of the resolv.conf changes in Ubuntu 12.04, this is pretty much identical to my setup in 10.04. However, all devices on my network are subject to a very long (2+ second) TTFB delay when browsing the internet, except for a mostly immediate refresh of the page. Essentially, the first request for a page has this delay, but subsequent requests within a minute are served immediately (including with a CTRL-F5 cache-ignoring request). However, wait a minute or so, and refreshing the page, or really any request to any outside resource, will again take it's time.
At first, I expected this to be a problem with the DNS resolver, and approached it as such. However the browser dev tools clearly indicate that the dns request is near immediate compared to the TTFB time.
This is the graph for a typical request to google.com:
Again, this configuration has worked flawlessly for years on Ubuntu 10.04, but with 12.04, attempted on both the same and different hardware with multiple fresh installs, this behavior is constant and predictable.
I know it's a bit odd to use Ubuntu as a firewall/router, but it serves several other purposes to which it is well suited. Right now, however, this is a clean installation supplying only these roles to my network.
