Now since I have my new-fangled cable Internet service with my 5 static IPs I got to work figuring out how to best use this new techno-inter-magic while trying to keep my expenditures as close to $0 as possible.
For a server I’m going to use my old Compaq laptop, after all, it has a built-in UPS! (not that the rest of my networking hardware that is needed to keep a site up in the eventuality of a power failure has a UPS ;-).) Also, it is the next machine I have that is outfitted with 2GB of RAM. For this I installed Fedora 9.
The real problem was the router. Optimum provides a router (Cisco 800-based), but it’s all locked up. The only thing this puppy does is expose to my network the 5 raw, completely unblocked IP addresses. Ideally I wanted one piece of hardware that can NAT firewall my network but where I could manage multiple external (WAN) IP addresses. All the routers I had with their intrinsic software aren’t intended for this purpose: they’re “consumer grade” after all – just for connecting to broadband. Fortunately, there are a lot of good hackers out there that realize that this perspective from vendors is pure nonsense. Those hackers have come up with their own firmware replacements for many devices.
The options I had available to me were:
The places I look for some firmware goodness were OpenWrt and dd-wrt.
The NetGear would be ideal because it does not have wireless capability so I would not be sacrificing anything when I put it down the basement, but no-dice. The Linksys is a no-go on OpenWrt because the “brain trust” at Cisco decided to go with a proprietary OS for all newer versions of the WRT54 series after version 3 resulting in a smaller amount of flash making it is harder to build a decent system. However, dd-wrt has a micro version that fits in the V7 WRT54. Downloaded it, flashed it, held breath, and YESS! It worked! For sure the dd-wrt ROM is a significant improvement over the intrinsic firmware: you get performance graphs, real DMZ support telnet to a BusyBox shell, and a whole lot more. But this is the “micro” version. A number of things have been stripped out like many command line tools (ls for instance) and no ssh server, only telnet. It would be possible to proceed with the Linksys, but I wanted to see if what could be done with the ActionTec. Well, OpenWrt can be made to work! Just not so easily, but after carefully following instructions, reading a ton about Redboot (VERY COOL BTW) I got the puppy to boot Linux! After a little more hackery I got the OpenWrt image to boot into a Linux system on power up.
On a side note: like all good Linux distros both OpenWrt and dd-wrt can be extended through community created packages. OpenWrt actually has a package manager opkg that works a lot like aptitude or yum, very sweet.
The only problem I ran into with the ActionTec setup was that you install a very bleeding edge image, and the Web-based UI tools and boot scripts do not set up NATing and the firewall correctly no matter how many pretty web pages you fill out. But never fear! This is Linux! I just installed my own boot script after the networking script and poof! working firewall and packet forwarding!
Here’s my script (stored in /etc/init.d/custom_rules)
START=45
LAN=eth0
WAN=eth1
VWAN0='<some ip>'
VWAN1='<some other ip>'
WEB1='<internal server 1>'
VPN='<vpn server>'
start() {
/usr/sbin/iptables -I INPUT 1 -i ${LAN} -j ACCEPT
/usr/sbin/iptables -I INPUT 1 -i lo -j ACCEPT
/usr/sbin/iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
/usr/sbin/iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
/usr/sbin/iptables -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
/usr/sbin/iptables -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
/usr/sbin/iptables -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
/usr/sbin/iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
/usr/sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 -i ${WAN} -d ${VWAN1} -j DNAT --to ${WEB1}:80
/usr/sbin/iptables -t nat -A PREROUTING -p tcp --dport 22 -i ${WAN} -d ${VWAN0} -j DNAT --to ${VPN}:22
}The command-line environment in OpenWrt is much nicer than the “micro” dd-wrt envirement: vi, ls, and most typical command-line stuff you would expect is there. All the config stuff is in nice text files located under /etc/config. The root file system is a mount of the flash ROM image using jffs the file system especially designed for flash – all my changes are persistent as one would expect. Very sweet.
One warning – the OpenWrt firmware does not properly support the ActionTec wireless chip at the moment, but that is not a loss for me since I would have disabled wireless anyway for this puppy.
So now I have Linux all the way out to the borders of my network, and life is good.
Tags: Embedded systems, Fun, GNU/Linux, Hacking, Maintenance
