Date: Sat, 15 Jan 2000 20:19:21 -0500 (EST) From: "Crist J. Clark" <cjc@cc942873-a.ewndsr1.nj.home.com> To: ohoyer@fbwi.fh-wilhelmshaven.de (Olaf Hoyer) Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: Simple router with basic firewall functionalioties Message-ID: <200001160119.UAA53469@cc942873-a.ewndsr1.nj.home.com> In-Reply-To: <4.1.20000114165656.00c8d940@mail.rz.fh-wilhelmshaven.de> from Olaf Hoyer at "Jan 14, 2000 05:26:31 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
Olaf Hoyer wrote, > Hi! > > Well, I want to recycle my old 486 for a security project... > > Basic idea is, since i'm sitting on a LAN with my machine here in our > students home, I want to have a second machine as a router/gateway/firewall > betwenn my vaued box an the rest of my fellow bas-ass students... > > Are there any links to good documentation regarding this? > Or could someone tell some issues with the following config: > > 486/66 or 100 or: 486/sx 25 > 16/32 MB RAM 8/16 MB RAM > 1 GB HDD 300 MB HDD > 2 NIC (whether cheap Realtek ISA or AMD PCnet ISA from Allied telesyn) The first column should be able to handle the dedicated IPFW/NAT job fine. In the second case, 8 RAM would really be pushing things. The HDD is also pretty small. It would be enough to hold a FreeBSD install, but the machine would not have the room for much of anything else or to do make-worlds. > I have a FBSD 3.2 R here, or should I have a look at a different distro? Why not download 3.x-STABLE? But 3.2R should be just fine with the possible caveat that it may have one of the exploitable BIND versions. So if you plan to do DNS on the box... [snip] > So I want to connect the 486 to the TP network jack, then connect the big > machine with coax or TP to the second NIC. You want to have a firewall machine to protect _one_ machine? I would only bother with this if (1) you are doing it purely as an excercise or (2) the machine behind the wall is running an M$ OS. > I understand that I must have packet forwarding activated/compiled. > I also heard a lot about IP masquerading/NAT. CAn anyone explain the > difference between them, and give me some opinion if thats preferrable or not? To my knowledge, there is no difference between them. They are different words for the same thing. Masquerading is something that Linux-types talk about whereas everyone else calls it NATd, but I may be wrong. > Some braindead jerks are also trying to make funny games, like nuking > computers and that stuff of network games, mainly targeted on the M$ > machines running here. Any opinions about that, except that a UN*X runs > better here? Detection/Trace/Retaliation-wise? UNIX-type OSes will of course not be vulnerable to attacks specific to ones used on M$ OSes. That is not to say that a UNIX OS is completely secure either. However, if you are careful, even as a novice, you can probably put together a pretty secure firewall box with FreeBSD. IMHO, the only thing that might be more secure would be an OpenBSD box put together with equal care. > I also thought about a SAMBA server, to ensure compatibility to exchanga > data with the M$ machines running here. Any security issues? If you run Samba servers, yes. But... > Yes, I know that running a server app on a router/firewall imposes a severe > threat, but ir would be a thought, since I need some basic compatibility > with the rest of the environment. Depending on what type of "compatibility" we are talking about here, you may not need to run the Samba servers. If you want to be able to grab files from M$ networked machines or use their printers, you need only run smbclient(1). You only need to run a Samba server (smbd(8) and nmbd(8)) if you want other machines accessing files and resources on yours. Allowing such accesses are obviously big security issues. > Is it also possible to Send/receive the "messenging service" of NT, > respective the "Popups"? No idea what you are talking about. Can't help there. -- Crist J. Clark cjclark@home.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200001160119.UAA53469>