SheevaPlug:Ubuntu Router/Firewall First of all, you will have noted that the SheevaPlug is a little limited in Ethernet ports to be a router - being that it only has one. So I popped into the local Apple Store to buy a USB Ethernet adapter ( http://store.apple.com/uk/product/MB442Z/A ) which, at under £20, isn't bad value - especially as it works out-of-the-box with the SheevaPlug.
I could wait until the GuruPlug Server Plus is available with two Gigabit ethernet ports but, for me, the 100Mbps USB Ethernet adapter will do fine for my ADSL broadband.
I think I should explain that my ADSL router, a nice Cisco 837 configure:Cisco837, is only bridging the IP network onto its Ethernet ports. It isn't doing and NAT or other nastiness to my IPv4 connection, but it is also terminating an IPv6 tunnel into Sixxs ( https://www.sixxs.net/main/ ).
The very first thing I need to do is make the SheevaPlug more secure.
Initially, when you receive the SheevaPlug, there is only a root user with a very publicly known password, and the root user can connect using ssh. If we connect the SheevaPlug to the Internet is this state it will get powned!
To make the SheevaPlug more secure, change the root users password and disable ssh access for the root user:
make sure /etc/ssh/sshd_config includes the following line - in the default SheevaPlug install line 26 has PermitRootLogin yes which we must change!
and make a new user that you will use to log in (I'll use myuser as an example), add them to the sudo group, and make sure the sudo group has sudo permisions:
the last line of /etc/sudoers must be uncommented and be something like this:
perhaps with the "NOPASSWD" option, but personally I have left that off.
From this point on I'll assume you've logged on as the user you've just created.
So, on with making the SheevaPlug into a router/firewall.
Setup some the IP addresses on the SheevaPlug.
My ISP allocates me an IPv4 /29 subnet (8 IP addresses, including the unusable network and broadcast addresses and the address that the router gets) so I have 5 usable IPv4 addresses in my Internet WAN side network. I need to allocate one of those IPv4 addresses to the SheevaPlug. The SheevaPlug will then NAT into my home LAN to one IPv4 /24 subnet (more subnets will come later when I get a VLAN capable switch).
I also have an IPv6 /48 subnet routed from Sixxs and I want the SheevaPlug to route a /64 subnet into my home LAN.
eth1 is the USB Ethernet adapter that I'm using for the Internet WAN side network, so this is what I add to /etc/network/interfaces on the SheevaPlug to configure eth1:
eth0 is the built-in Ethernet port on the SheevaPlug, which I am using for my home LAN, so this is what I add to /etc/network/interfaces to configure eth0:
and if I restart the networking and connect the Ethernet adapters I can ping and ping6 hosts on both networks.
Check the output of ifconfig and the IP address and route tables to see that everything looks correct.
You make need to kill the dhcp client, since it doesn't seem to go away when you convert an interface from being 'dhcp' to being 'static', and clear up the routing table.
Now that we have a server connected to the Internet WAN and home LAN we need to convert it into a router. We also need to create a firewall script that will protect the LAN hosts from being attacked over IPv4 and IPv6, while allowing them NAT IPv4 access and direct IPv6 to the Internet.
To make a Linux Kernel route IPv4 you run this as root:
To make a Linux kernel route IPv6 you run this as root:
So, what I do is to write a two scripts, one for IPv4 and one for IPv6. In those scripts I include all the sysctl calls I want, to enable routing and tweak the IP security, and all the iptables calls I want to create my kick-ass firewall. This tutorial is not going to describe how to create a firewall - there are plenty of other web sites doing that. But once you have your firewall honed to perfection you want to apply it to your SheevaPlug router.
Because this is just my home network I only want to implement the firewall when the Internet WAN facing Ethernet port is up. The easiest way to achieve that is to run the scripts I just described in the 'pre-up' phase of enabling eth1 (the USB Ethernet adapter):
Now if we bounce eth1 it will get reconfigured with routing enabled and all the firewall rules applied:
In my home network I use a DHCP server to hand out IPv4 addresses to the various clients. So apt-get install dhcp3-server and configure /etc/dhcp3/dhcpd.conf. Since man is not installed on the SheevaPlug by default you may want to read the man page for dhcpd.conf on another server or online. Particularly useful is the failover system in ISC dhcpd 3.1, which allows primary and secondary dhcpd servers so if one server dies or needs maintenance your clients can continue working.
When its configured you can start the dhcp service, with the default Ubuntu install it will be restarted at boot time.
In my home network I use a RADVD server to hand out IPv6 addresses to the various clients. So apt-get install radvd and configure /etc/radvd.conf. Since /etc/radvd.conf is not created by default it's probably easiest to copy the simple example and edit that.
As an example, this is my simple radvd.conf
When its configured you can start the radv service, with the default Ubuntu install it will be restarted at boot time.
In my home network I use a local DNS server to hand out DNS information to the local clients. I also host many domains for friends and family as a 'hidden master', which I secondary onto the Internet via a DNS hosting provider. This tutorial is not going to describe how to create a hidden master DNS server - but it's quite easy to install and setup a caching DNS server which you can hand out to your local clients with your dhcpd server.
Yep - that's it. You now have a caching DNS server available - and I only installed dnsutils to get the command 'dig' so we can prove that the local DNS server is working: