Network setup, can this be done easily...

[jimothy]

I'm planning on reorganising my home network for a software project I'll be working on with a mate.

What I'd like to have is a Linux box connected to the net hosting a web/ftp site (using a nifty thing I've discovered for mapping a static to my dynamic IP address).
Then have the net connection routed through a nice secure firewall to another network containing a Linux server running CVS, MySQL and other development servers that I'd like to keep secure (this box could be used as the firewall as well, I guess), and other workstations.
And finally, just to be a bit different, have a secure connection from a remote user so they can get through my firewall to access databases, CVS etc.

Can this be done, and can anyone point me in the direction of some good resources on how to do it.

Thanks in advance.

[Plotloss]

Run VNC on the machine that sits directly behind the firewall.

Open the VNC port on the router to accept connections from the IP range of the machine you will be accessing if this is static or all IP addresses if not.

That should do it.

You could add VPN type stuff on as well for extra peace of mind.

I run a very similar setup.

[jimothy]

Thanks, I sort of understand that. Any resources you can recomend for info on this, or should I just hit google. Also, what flavour of linux would you recomend to get this set up easily?

And firewall wise, can I use the linux box outside the firewall to route the internet connection to a router/firewall/hub type box with the rest of the network plugged into it?

[zumbruk]

Plotloss said:

Run VNC on the machine that sits directly behind the firewall. Open the VNC port on the router to accept connections from the IP range of the machine you will be accessing if this is static or all IP addresses if not. That should do it. You could add VPN type stuff on as well for extra peace of mind. I run a very similar setup.

You do realise that VNC doesn't encrypt the session, so the whole session, passwords and all, is transitting the 'net in clear? You should tunnel it through SSH - have a look at 'stunnel' for a start.

[zumbruk]

jimothy said:

Thanks, I sort of understand that. Any resources you can recomend for info on this, or should I just hit google. Also, what flavour of linux would you recomend to get this set up easily? And firewall wise, can I use the linux box outside the firewall to route the internet connection to a router/firewall/hub type box with the rest of the network plugged into it?

You should put the web/ftp server *behind* the firewall and "port forward" the connections from the firewall to it. That way the web server is protected against everything (except the services you choose to forward to it, of course).

Any flavour of Linux can do all of this - just use whichever one you are most comfortable with (personally I think the whole distro debate is mostly religious, anyway). I'd use Fedora, since it's probably the most common one.

So far as doco goes, some URLs;

www.bolthole.com/solaris/firewall.html
(ignore the solaris reference - it's just as applicable to Linux)
www.faqs.org/faqs/firewalls-faq/

Good luck!

[aldi]

jimothy said:

Also, what flavour of linux would you recomend to get this set up easily?

Whichever one you're most familiar with at the moment I suppose. Personally I've just started messing with Debian and like it for its simplicity and minimalism - doesnt do much of the work for you though. Fedora or Redhat are probably easier to get something working on.

jimothy said:

And firewall wise, can I use the linux box outside the firewall to route the internet connection to a router/firewall/hub type box with the rest of the network plugged into it?

Yes, IPTables can do all kinds of crazy routing, forwarding and translating. The command lines are longer and harder than an untimate special move combo in street fighter 2 special move edition though.

You want this webby server accessible from the internet... and you want access to the internet to your CVS/databasey stuff too... so basically you want net access to everything? Or does the CVS/databasey stuff only need to be accessible from one particular fixed IP?

[zumbruk]

aldi said:

Yes, IPTables can do all kinds of crazy routing, forwarding and translating. The command lines are longer and harder than an untimate special move combo in street fighter 2 special move edition though.

A quick Google for "iptables gui" will sort that out ...

[jimothy]

aldi said:

You want this webby server accessible from the internet... and you want access to the internet to your CVS/databasey stuff too... so basically you want net access to everything? Or does the CVS/databasey stuff only need to be accessible from one particular fixed IP?

I'd like the web and ftp server available over the internet to all, but the database/CVS/rest of the network only available to one person outside the network (and very secure) who'll be on a dynamic IP address (such is the delights of cheap home broadband).

[jimothy]

zumbruk said:

You should put the web/ftp server *behind* the firewall and "port forward" the connections from the firewall to it. That way the web server is protected against everything (except the services you choose to forward to it, of course).

Makes sense I guess to stop the web site being hacked.

zumbruk said:

Any flavour of Linux can do all of this - just use whichever one you are most comfortable with (personally I think the whole distro debate is mostly religious, anyway). I'd use Fedora, since it's probably the most common one.

I've got Fedora installed and it seems ok, but it would be nice if I could set these things up with a nice GUI and simple clicks - too used to Mac OS X I guess!

[aldi]

Just a thought, how about just one well locked-down internet facing box, with a couple of network cards in it. One card for the web server box, one to link to the databasey stuff. You should set it up so it's not possible to connect to the firewall machine from the webserver (and that theres no route to the databases through it) but apart from that forward ports / route as required. Use a GUI if you like

[zumbruk]

The standard corporate way of doing this is with a "DMZ";

Internet---firewall---web server---firewall---database server

You could emulate this quite easily, since most ADSL routers have a firewall in them, so that forms your external firewall, then put the web server, then have another firewall (a cheapo PC running iptables would do for this) then everything else. Port forward from the ADSL router to the web server, configure the inside firewall to allow your web server to talk to your database server and Bob is your extremely secure Uncle. Forward the HTTP, SSL and ftp (*) ports in from the outside, tunnel VNC over SSH for remote access and you're done. This does mean doing double NAT, but unless you're running a huge web site, that shouldn't matter.

(* You shouldn't really be using ftp. It sends the username and password over the net in clear. Use scp instead.)

[jimothy]

zumbruk said:

The standard corporate way of doing this is with a "DMZ"; Internet---firewall---web server---firewall---database server You could emulate this quite easily, since most ADSL routers have a firewall in them, so that forms your external firewall, then put the web server, then have another firewall (a cheapo PC running iptables would do for this) then everything else. Port forward from the ADSL router to the web server, configure the inside firewall to allow your web server to talk to your database server and Bob is your extremely secure Uncle. Forward the HTTP, SSL and ftp (*) ports in from the outside, tunnel VNC over SSH for remote access and you're done. This does mean doing double NAT, but unless you're running a huge web site, that shouldn't matter. (* You shouldn't really be using ftp. It sends the username and password over the net in clear. Use scp instead.)

That actually sounds rather simple. I don't even need the web server to talk to the database so thats one thing I won't need to set up. Never heard of scp before though, so something to look up. I've got all but one of the machines I need, and I'll need to get the cable modem router with built in firewall but they're really cheap from what I remember. Just need to source the cheapest PC I can for either the firewall, or for the database server depending on if it's more or less powerful than my 600MHz Duron...

Best not let my g/f, Natalie, read this though. If she hears you're suggesting doing a double Nat she may run away screaming...

[zumbruk]

jimothy said:

Best not let my g/f, Natalie, read this though. If she hears you're suggesting doing a double Nat she may run away screaming...

(This is how my setup at home works, BTW, as well as the stuff I look after at work.)

[aldi]

zumbruk said:

You do realise that VNC doesn't encrypt the session, so the whole session, passwords and all, is transitting the 'net in clear? You should tunnel it through SSH - have a look at 'stunnel' for a start.

Fair point, but it would only be vulnerable to either someone sniffing on your LAN or someone sniffing at the ISP. How likley is that? (JamieB??)

[zumbruk]

Why take the chance? OpenSSH comes with every Linux distro ...