Linux Firewall Part 4: Installation

For the purposes of this turotial, I am making several assumptions.  I am assuming that your green network is 192.168.1.x and your orange network is 192.168.15.x.  If you want a different network config, then modify as necessary.

If you already have an Internet Router that you’re intending to replace, I recommend some prep-work to make things easier.  Most routers are set as the gateway to their network (i.e. 192.168.1.1), and this is probably the address that you want your firewall to use.  Otherwise, you’ll have to set the firewall to 192.168.1.2 or some other address, which can get real confusing really fast.  Go ahead and log into your existing firewall, and change its address to 192.168.1.2, or some other number, so that it will not conflict with your new firewall.  And turn off DHCP, since your new firewall should be the new DHCP server… you don’t want two servers trying to dole out dynamic IP addresses and wreaking all sorts of havok.

Once your hardware is prepared, IPcop is very easy to install.  First you must download the latest distribution and burn the image to a CD. Then, go into your motherboard’s BIOS and make sure that your CD-ROM is your first boot device.

Then just plop in the CD and let it boot.  You are presented with a prompt which allows you to set any parameters you like before boot.  I actually ran into an issue where Linux could not find the hard drives because it wanted to install on the attached USB card reader.  In this case, I typed “vmlinuz nousb”, which disabled USB support.  If you do this, then you won’t be able to use USB keyboards, even after installation.  I would just temporarially unplug any USB storage devices during installation.

After setting any parameters (or just press Enter to continue), you are presented with an ANSI-based installation wizard.

The first few screens are rather self-explanatory.  You are asked to enter what type of keyboard you’re using , your time zone, and what you want to name your firewall.  By default, the name is ‘ipcop’ but you can change it to anything else you would like.  When it comes to the Domain screen, just leave it at default (localdomain).

ISDN screen

For some reason, the first major configuration screen is the ISDN configuraiton menu.  I’ve only known one person who ever used ISDN, and that was eight years ago.  It would benefit the firewall community to remove this screen, or only show this screen if you choose a particular parameter.  For most people, tab over to ‘Disable ISDN’ and press Enter.  If you really need help configuring ISDN, then consult the IPcop installation manual.

Choose Network Type

The next step is to configure your network type.  For the purposes of this tutorial, we are selecing a GREEN + ORANGE + RED configuration. You must have three seperate network cards to use this configuration.  If you only want a basic firewall, then select the GREEN + RED configuration.  Remember that the red network is the Internet connection, Orange is your DMZ, and Green is your internal network.  All of these networks will have a completely different IP range.

Enter IP addresses

You are then asked to enter the IP information of your Red (Internet) interface.  Your choices are Static, DHCP, PPPOE, and PPTP.  The type totally depends on your network configuration.  Business-class Internet access typically has a Static IP address, so enter that IP in the IP address field.  If you have cable or DSL then you could be using DHCP or PPPOE.  Some notes to remember are:

• Your RED network must have a static address if you wish to use IPCop’s aliasing feature.
• DHCP is used when your ISP has indicated you are to use automatic addressing.
• Some ISP’s, require you to provide a hostname to their DHCP server. This probably is not IPCop’s hostname. If it’s needed, you can probably use the first part of the fully qualified domain name you noted while gathering the network parameters.
• If your connection is via PPPOE, your ISP will supply all necessary information during the initial connection, so you won’t have to do anything, after selecting it.
• If your connection is via PPTP, you will have to supply your RED network IP address and Network mask, just like the static addressing case. This address is almost always 10.0.0.150 with a network mask of 255.255.255.0.

You can then choose the interfaces for your Orange and Green Networks.  You may need to select Probe for IPcop to find the interfaces, and then you can select each interface and assign IP addresses for them.  Remember that each interface must have its own IP address range.  To keep things simple, many people use 192.168.0.x for their Green Network, and 192.168.10.x for their Orange network.  Each of these network’s DNS servers are probably the same as the Red interface (which you previously entered).

You are then prompted for DNS information, which should have been provided to you by your ISP.  Enter that information in the DNS and Gateway settings.

We finish the installation on the next page…

DHCP server configuration

This screen lets you specify if you want to enable DHCP.  DHCP lets your firewall automatically assign dynamic IP addresses to comptuers on your Green network (each computer on the Orange network must have a static IP address).  Be sure that if you enable DHCP, that you disable it on any existing router appliances… I use an old router as my wireless access point, so I turned off DHCP on that device so that it’s not fighting with my firewall.

To enable, press the Space bar in the “[ ] Enabled” check box.  You can then specify which address range you want to use.  If you ever have any devices like an NAS or VOIP modem, then you’ll probably want these on a static IP address on your green network, so give yourself some breathing room.  Have the Start Address as “192.168.1.50” and end address as “192.168.1.200”.  That way you have 150 available dynamic IP addresses, which is more than enough for even a huge LAN party.  You now have 47 static IP addresses available (remember that the firewall is using one of them).  You can now assign any static devices to use 192.168.1.2 to 192.168.1.49.  Just remember to keep track of the IP addresses you use and write them down so there isn’t a network conflict.

Most people will never need a static device on their Green network, however, so if this confuses you, just don’t worry about it.

Password screens

You are now asked for a password on several different accounts.  For security purposes, you should use a different password for each of these screens, but honestly most people use the same password for all of them.  Each password should be very strong… meaning that it is at least 8 characters long, contains several numbers and at least one special character.  Do NOT use a word that can be looked up in a dictionary.  A password phrase might even be a good idea, such as “OC-ModShop1sT3hB3st” or something like that.

Enter your password in the “Password” and “Again” screen for the “root”, IPcop admin” and “backup” accounts.

Now we need to determine which physical network jacks ports have been assigned each address range.  They should be configured in order, but you can’t truly be sure until you do some testing.  Once you login to the admin console, you can actually see which MAC address has been assigned to which network, and then you can difinitively mark each network card… but we have to be able to login to the admin console first.  Connect up ONE network plug to the first network jack on the router, and try to ping 192.168.1.1, and you should get a response.  If not, then try each consecutive port until you get a reply.  Once you get a reply, mark this as the GREEN interface.  I use white paper labels, and just stick them over the network port, although if you have color-coded stickers, you can do that, too.

Do this for each seperate network, and use a computer on that seperate segment.  In our example, we have a Red + Green + orange network, and we’ve already determined which one is green (internal).  Now go to one of your web servers, and see if you can ping 192.168.15.1.  If you can, then mark this as the orange network.  The only network port that’s left is the Red (internet), so mark that and plug in your internet connection.

You should then instantly be able to get online.  Try pointing your browser to http://www.ocmodshop.com for the latest technology news, or try http://www.ocmodshop.com for the latest ramblings, discoveries, and general nerdiness that is the OCMS staff.  I guess you could try one of those lesser sites, like msn.com or google or something.

If you can’t get online, well, then you’ll have to login to the firewall to determine what the problem is, anyway, which is where we’re going next.

Now it’s time to configure your firewall, which is done through a browser on the GREEN network.  You will not be able to configure your firewall from the orange or red network (not at this point at least).  Point your browser to http://192.168.1.1:81 (by default IPcop’s admin console is on port 81).

Now we’ll look at the IPcop web interface and explain what everything does.