Date: Tue, 03 Jan 2006 18:00:06 -0200 From: Alex Soares de Moura <alex@rnp.br> To: freebsd-isp@freebsd.org Cc: DSA - JCR <juancr@dsa.es> Subject: Re: newby isp questions Message-ID: <43BAD7C6.4040909@rnp.br> In-Reply-To: <1621.217.114.136.133.1136295524.squirrel@llca513-a.servidoresdns.net> References: <1621.217.114.136.133.1136295524.squirrel@llca513-a.servidoresdns.net>
next in thread | previous in thread | raw e-mail | index | archive | help
Hello Juan, DSA - JCR wrote: >I would like to know if the configuration in which i am thinking is right >or not. > >I have and ADSL modem (1Mb by now) connecting to an ISP. > >This is what I am thinking to do: > >- I must have a fix IP from my ISP. > > That's ok for a (very) small start, but soon you'll realize that ISPs need an IP address block assigned to them, from a higher level ISP or organization. >- The ADSL modem will connect to a Firewall box (FreeBSD or m0n0Wall?). I >am thinking in an old PC I have. Can this be made without Hard disk, only >with CD?. > > My bet is that a m0n0wall box is faster, easier to deploy and manage. Yes, can be done from a CD, which is good for security, but bad for performance. For better performance, a HDD installation would be nice. For more features, you probably will like to take a look at the pfSense project: www.pfsense.com. >- This Firewall connect to a PC with FreeBSD 6.0 and web capabilities >(Apache, mail...). >- In order to protect my network, I would use NAT, in the Firewall, and >connect my PC to it as a gateway. > > Looking from the security side, Internet services aggregation is better done in separate environments (hosts, virtual machines, jails etc.), so one of them don't pose a unnecessary threat to each other in your ISP environment. Take a look at the references below. >Questions: >- Must I separate the Firewall/Nat from the Webserver box or can be the same? > > Again, it's a security issue. What if the webserver is compromised? Your firewall would be at risk... Another issue very discussed for a long time is that NAT is not considered a proper security feature tehcnology by network experts, and also that it breaks the end-to-end concept and cause a lot of trouble to some applications to function properly. "Security through obscurity is no security at all". See references below. >- My ADSL modem uses USB to conect to PC, can I use it or is better a hub >adsl type? > > That's my personal opinion: try to avoid core network devices that attach via USB in your ISP infrastructure. Mostly because of driver compatibility and performance. There is more support for NICs in every operating system today than support for USB devices, that have better support in the Windows OS. Maybe this will change in the future, but that's my opinion. This may not be an issue for you, if all your hardware is well supported by the FreeBSD. >- In the Webserver box, if I want to have diferent web domains,must I put >each one in a jail? and what about the IP of each domain, only one NIC?. > > Yes, you can have many IP addresses in one NIC and create jails to host different domains. Although, you'll spend more hardware resources (CPU, RAM) to run various Apache instances in each jail. The Virtual Hosts feature of the Apache server can be enough for your scenario. See below. >Where can I learn about this? books?... > > Yes, there are a lot of good resources of information on the Internet and in books. See the recommended reading list: [1] Network Startup Resource Center http://www.nsrc.org [2] NANOG ISP Resources http://www.nanog.org/isp.html [3] NANOG Mailing List FAQ http://www.nanog.org/listfaq.html [4] Building Internet Firewalls http://www.oreilly.com/catalog/fire2/index.html http://www.greatcircle.com/firewalls-book/ [5] Practical Unix and Internet Security http://www.oreilly.com/catalog/puis3/ [6] FreeBSD Planning, Installation and Security Tips http://www.nsrc.org/freebsd-tips.html [7] NAT http://en.wikipedia.org/wiki/NAT [9] NAT http://www.networkworld.com/details/645.html [10] Security Considerations of NAT http://safecomputing.umich.edu/tools/download/nat_security.pdf [11] TCP/IP Resources List http://www.faqs.org/faqs/internet/tcp-ip/resource-list/ [12] Simplify Your Life with Apache Virtual Hosts http://www.onlamp.com/lpt/a/4021 [13] Installing FreeBSD 6 for Internet Server http://freebie.miraclenet.co.th/server/install_fbsd/ Best regards, Alex
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?43BAD7C6.4040909>