Now that you have IPcop installed, you need to configure it. IPcop provies you with a web interface in which you can configure nearly all of the settings of your new firewall. To connect, just open up any web browser, and connect to the IP address you set up when you installed the software. The web interface requires an secure web connection (SSL), so type this into your browser:
https://192.168.1.1:443 (or whatever IP address you assigned to your firewall.
You will then be asked to login. By default the username is “admin” and use the password you set up when you installed your firewall. You are now presented with a Home screen and can configure nearly every aspect of your new firewall.
Home
This is the same welcome screen you’re presented with when you first log on to the web browser interface. It tells you the Firewall’s IP information as well as uptime statistics
Updates
Just like other open-source projects, IPcop periodically connects to the internet and gathers information about updates. This screen shows you any available updates to the software and provides a link to download. You can also upload an update file which will automatically update the system to a newer version. There is also information about your used storage space.
Passwords
This simple screen lets you change the ‘admin’ and ‘dial’ password. If you want to update ‘root’ then you’ll need to change it from the Linux command prompt (either physically at the console or terminaling in).
SSH Access
This screen toggles SSH Access and other features. I would leave this off unless you frequently need low-level access to your firewall. If you don’t know the Linux command prompt backwards and forward then you should definately leave this alone. Even though IPcop uses port 222 instead of the standard “22”, this will be the first thing hackers will try to use.
If you absolutely do need SSH access, turn it on for the time you need it, and then turn it back off.
GUI Settings
This refers to the web interface only. If you are using a modern browser then you can leave these settings alone. If you are using a browser without certain features, then you might want to disable Javascript.
GUI Settings and Backup screens
Backup
This screen allows you to backup your configuration in case of disaster recovery. If you have a backup then all you have to do is boot up IPcop from a CD and do a restore. I would recommend poutting this on removable storage because the most likely reason you need to reinstall IPcop is because of a hard drive failure. If you are running RAID 1 then you could get away with backing up to the hard drive. Once reinstalled go to this screen and IPcop will find any existing backup sets on your hard drive.
Shutdown
This screen allows you to remotely reboot or shutdown your Linux firewall. Although my firewall is pretty stable, there are times when the network throughput is slow, and the only way to remedy this is to reboot. If you find that your hardware behaves similarly, then you can also schedule daily or weekly reboots at a particular time.
Credits
There are a lot of people involved with open-source software solutions, and they want some recognition. Look at this screen if you like.
System Status
This page shows you the processes going on inside your firewall. The top section shows which Services are running and which are not. This can be helpful in diagnosing memory or performance issues. If you’re trying to VPN in and you see that the VPN service is stopped, well then there’s your answer.
The next sections show memory usage, disk usage and other statistics. You may want to keep an eye on Disk usage if you have logging enabled. I am using an 80GB drive in my firewall and am only using 1% of available space.
Network Status
This page shows you the status of your network adapters. The text of each adapter is colored according to its designation (the orange interface is colored “orange”, etc). This can be helpful in determining which physical card is assigned to which network (you DID write down the MAC address of each card when you installed the hardware, didn’t you?).
Below this are the current dynamic IP address leases, assuming your firewall also functions as a DHCP server. You can see all of the PCs or other internet appliances that use dynamic IP addresses. I can see my DirecTV receiver, Xbox 360, PS3, Wii, PSP, laptops, and other devices.
System Graphs
This is a neat little graph that auto-updates, showing you statistics like CPU and memory usage over time. This shouldn’t change very often, but can be helpful in diagnosing problems. If you notice your network is choking and at the same time the CPU usage is going through the roof, then either you have too many things running or your hardware isn’t powerful enough for your configuration.
Traffic Graphs
Same type of graphs, but show network traffic on all of your interfaces. The Green graph shows traffic on your internal network only. The Orange graph (assuming you have web servers) shows you how much traffic your small web farm is getting (and how much it’s serving). The Red graph shows the traffic on the internet. Since I have a 20Mbit fat-pipe I can see the obvious spikes when I start downloading large files at 2.5MB/s (yes, that’s MegaBYTES… I love FIOS).
Connections
This shows all of the current point-to-point connections going on through your firewall. Each IP address and port is shows, and each background color coinsides to the appropriate network interface. For example, if you see traffic that goes from Red –> Black –> Orange –> Red then that means an Internet user is being routed to one of your web servers and the firewall is expecting to spit the requested web data back to him. This can be a handy indicator to show exactly how many web users you have at any given time. An internal network client going out to the internet should look like Green –> Red
Most of the pages in the Network section deal with using your firewall with a modem, but if you’re really stuck in 1995 then you really don’t need a dedicated firewall. The Aliases section is helpful when you need to bind multiple IP addresses to your Internet port
Dialup
You can use this page if you have a modem installed to your firewall, but I’m not exactly sure how useful this is. You can use your firewall as a dial-up proxy but that is beyond the scope of these series of articles. I wouldn’t recommend this if you dial in to a long distance number. I still owe the phone company hundreds of dollars when I had an automatic dial-up proxy installed over a decade ago.
Upload
You can upload firmware to internal cards inside your firewall.
Modem
This screen lets you send low-level commands to your modem, and even specify how much idle time before the modem hangs up.
Aliases
This is the only part of the Network screen that is even significantly useful. This is the screen you go to if you need to bind multiple IP addresses to the firewall. Suppose you have multiple web servers… each of them needs its own external IP address (you COULD to a reverse proxy, but that requires a Firewall software that costs a lot more money and is much harder to configure). Trust me, just pay the extra $3 a month to your ISP for 5 IP addresses and translate each one to a physical server.
Proxy
This screen is used to configure a proxy server for your internal internet users. If you don’t know why you would need an Internet proxy, then just leave this screen alone.
DHCP Server
This is one of the most useful features of your dedicated firewall. You probably have lots of devices that connect to the internet like game consoles and laptops, but don’t want to configure each one. By default, most devices use DHCP and will grab a dynamic IP address if you have the DHCP server enabled. This is also very helpful if you host a LAN party. Most consumer routers have this enabled by default.
You can specify the start and end range of your DHCP. I like to start with x.x.x.50 and end with x.x.x.200, which gives you 150 usable dynamic addresses. Network devices like servers should have a static IP address (as your firewall is probably 192.168.1.1). I have a few NAS boxes, and as long as I give them an ending octet less than 50 then I’ll be sure not to conflict with a DHCP user.
You pretty much only have to deal with the top section on this screen. Leave the other things like Additional DHCP options alone unless you really know what you’re doing.
Dynamic DNS
So you want to host a web server, but your ISP won’t give you a static IP address… well you can register your firewall with dyndns.org and your internet users will be able to find you, even if your Internet IP address changes. You must register an account with dyndns.org first and then you can use this screen to set up your dynamic domain.
Edit HOSTS
HOSTS essentially acts as an “override” for network names. Web developers use hosts so they can test web sites that are on an internal network rather than having to connect to the Internet. Some people even use a bogus IP address for certain domains to defeat undesirable connectivity, such as registering with software activation servers (which is how pirates are able to override Adobe CS4’s copy protection). You can even defeat Google ads by putting in a bogus redirect to their ad servers.
Dynamic DNS and Edit HOSTS screens
People usually have to configure a HOSTS file on each PC, but if you use this screen on your firewall then you only have one list to maintain and all internet network clients are bound by it.
Time Server
You can make sure that your firewall always has the correct time… just enable this option.
Traffic Shaping
Bigfoot Network’s Killer Xeno network card has applications to let you shape traffic, but why do that at the client level when you can prioritize traffic at the firewall level? With this screen you can prioritize gaming traffic so that your huge-ass bandwidth isn’t used up by that large porno you’re downloading. If you’re running web servers, then you could prioritize web traffic over anything else, so that your web readers always get what they’re looking for.
Intrusion Detection
Snort is a technology that analyzes network traffic and checks for hacks or intrusions. You must first register with www.snort.org and obtain an “Oink Code”. You can then put this code into this screen and enable Intrusion Detection on any (or all) of your interfaces, but you probably only need it on the Red Interface. Your CPU usage goes up significantly with each enabled interface, so be aware of this. Enabling on the Red interface provides a significant amount of protection without wasting CPU cycles looking for malicious traffic on internal networks.
Port Forwarding
This screen is your friend if you have multiple Internet servers behind your firewall. If you bind multiple Internet IP addresses to your Red Interface, then this screen tells the firewall what to do with that traffic. We’ll show you how to do this in the next installment.
Port forwarding screen – the most powerful feature of IPCop
External Access
This page has absolutely no effect on the Green, Blue or Orange networks, but controls the ability to remotely administer the IPcop firewall from the Internet. I would recommend leaving this alone and doing any administrative work from the Green network. If you don’t know what you’re doing then you can seriously screw up your configuration or open huge security holes. If you absolutely need to configure your firewall from outside, then you should configure VPN.
DMZ Pinholes
Remember the “Orange Mantra”? All servers on the Orange Network have certain restrictions placed upon them, and if you can’t live with that then you don’t need a DMZ. You can set some pinholes, but they only go one way. Orange can talk to devices on the Green network, but not the other way around. This can be helpful if you want your web servers to backup to an NAS on the green network. You can find some other uses if you’re creative, but remember that this is one-way from Orange to Green.
Pinholes and External Access Screens
Firewall Options
Basically this screen lets you configure the “ping” behavior of the firewall. If you disable, then users will not be able to PING the firewall or any of your web servers, even if they are all up. The problem with this is that you cannot rely on “ping” to tell if your web server is up… if you ping our fictional internal www.google.com then you will get a positive response even if the server is down or powered off… the firewall is responding and not the actual server. My advice: Just leave this alone.
VPN and Log Screens
There are a few other screens dealing with VPNs and Logging options, and basically these deal with configuring a Virtual Private Network and Logging options. VPN will be covered in a future Firewall segment. The Log screens deal with logging absolutely everything that goes in and out of the firewall, and can quickly fill up space on your firewall’s hard drive. Most of the time you will only care about logs if you run a web server (and the logs are kept on the web server), as they are useful for traffic analytics. Logging absolutely everything on a firewall just wastes space for a home user, but is a completely different story for a corporate IT department… which begs the question: why would an IT department not be using a corporate-level firewall? Seriously, if you’re a home user then you don’t need to be logging everything. It just wastes space and time.
I hope this overview of the IPcop interface gives you an idea of the powerful options you have access to. You should see from these screens that running a custom firewall isn’t that much more complicated than running a consumer-level Netgear router, but provides you with a lot more flexibility and power.
1 Comment
This page is needed for people like me who use a mobile broadband (3G HSDPA) modem to connect to the net. My red interface is an USB stick!