I would add the below:
-Recommend using CentOS 4.0
-Use squid rpm, no tar (this is for new users I'm guessing).
-Recommend using etherape and iptraf (available as rpms) for a graphical
overview of traffic. http://etherape.sourceforge.net/
-Recommend the use of chkrootkit, and TCP Wrappers (at the least put
ALL: ALL EXCEPT PARANOID in /etc/hosts.allow) to protect servers.
-Provide some information about how to protect the whole network from
spyware with the /etc/hosts file (a nice side benefit from doing DNS
proxy). http://www.mvps.org/winhelp2002/hosts.htm
-A *huge* disclaimer on running squid on a machine with a public
interface.
-Consider using webmin to manage this outside a GUI.
-fwlogwatch can parse log files nicely. http://fwlogwatch.inside-
security.de/
Biggest issue I have with your setup:
-I wouldn't use Guard Dog as the GUI setup - it is very nice, but
inflexible and not really meant for what you are doing.
Try kmyfirewall instead if you want a GUI for iptables. It offers near
complete control of iptables functions.
If you can get along with using webmin, try shorewall.
*If* this is going to be in a bigger than SOHO (+ 30 PC) network, go
with shorewall.
Just my $.02, good luck with the site, it'll help a lot of people. :-)
On Wednesday 30 March 2005 13:27, Seth Bardash wrote:
> To the list:
>
> HOW-TO on DNS + DHCP + SQUID + Firewall + Router
>
> Since this seems to be a recurring topic:
>
> Thought you might be interested in a working set up of
> DNS + DHCP + SQUID + Firewall + Router machine that took
> quite an effort to get working but now runs flawlessly.
>
> Don't get discouraged. This takes some time to set up
> correctly but once you get through it - it works great!
>
> Remember: tcpdump is your friend!!!!
>
> Anyone having a network internally that needs these
> features should continue reading:
>
> We set up a new firewall based on CentOS 3.3. (3.4 should work fine)
>
> We needed it to serve many protocols internally.
>
> The specifications for it are:
>
> NOT Microsoft based
> (We are a MS Partner with all the software but I wanted something
that
was
> MS virus proof)
>
> KDE Graphical Firewall Control
> External Internet LAN Port x 1
> Internal Networks x 2 (more can be added) -> we used 192.168.0.X and
> 192.168.1.X
> DNS Name Caching Server - internal and external, forward and reverse
> lookups DHCP Server that does ddns-update internally
> Squid Server
> IP Masqerading
> Routing between all networks
>
> Hardware:
>
> OLD P3-800 Based System (Only non AMD system we run)
> 3 x Intel Pro 100 NIC's (We have a big box of these)
> 1GB SDRAM
> 40GB IDE Disk
> CDROM Drive
> Floppy
> Standard PC Case with extra cooling and 400 w ps.
>
> This hardware is overkill as it never runs above 30% load.
> Any machine supported by Centos with > 600 MHz CPU and 512M Memory
should
> do.
>
> Software:
>
> Centos 3.3 Full Install (Lessens the chance of missing packages)
>
> Guarddog Firewall RPM for Centos
> (http://centos.hughesjr.com/3/guarddog/RPMS/)
> Guidedog router/masqerader RPM for RH9 (works fine)
>
(http://www.simonzone.com/software/guidedog/guidedog-1.0.0-1_rh9.i386.rpm)
>
> Squid source tar ball.
>
> First install Centos and set it for a KDE graphical boot up.
> Turn off all services not used
> Leave Iptables on but turn off IP6tables
>
> Then Install Guarddog
> Then install Guidedog
> Configure both of the above - read the instructions for these
carefully.
> - questions for these should go to the
writer
> or his mail forum
> - Make sure to enable DHCP for eth1 and
eth2
> BUT NOT eth0 (external LAN NIC)
>
> Make sure you can see the internet from the inside LANs with the
clients
> set to use static IPs.
>
> NEXT ---
>
> Please read the instructions on how to set up DHCP and bind(DNS) here:
>
> http://integratedsolutions.org/downloads/DHCP-DDNS.txt
>
> Read this multiple times and make sure you understand it!
>
> Cut and paste can be an enemy. Be careful which editor you use
>
>
> This set up allows us to have any number of machines on our internal
> network automagically connected to each other and the internet with
all the
> IP information coming from our firewall / router / masquerader / squid
> server.
>
> It works for forward and reverse DNS internally for Windows and linux
> clients and servers.
>
> It also speeds up client internet traffic by caching most outside
pages.
>
> Install squid per the INSTALL in the src tar ball and
> add a startup entry to either chkconfig or rc.local.
> We set it to use 5 GB of disk cache and start
> automatically at boot time. We used the standard proxy port.
>
> We configured squid using webmin and this works fine.
>
> We added Webmin just to see how well it works:
> It can break DNS and DHCP easily if you are not careful but it was
helpful
> getting squid working.
>
> Read up on syslogd and change the config file (or use webmin) to
rotate
> logs every day and keep 7 to 14 old logs for back checking purposes.
This
> will limit log size and make it easier to find any problems.
>
> Your milage mary vary.
>
> Standard software disclaimer applies.
>
> If this is helpful drop me an email so I know.
>
> If this needs work drop me an email with specifics.
>
> We will be adding a knowledgebase to our website with complete
instructions
> for this in the next few weeks.
>
> Best
>
> Seth Bardash
>
> Integrated Solutions and Systems
>
> seth@xxxxxxxxxxxxxxxxxxxxxxx
>
> 719-495-5866
>
> Failure can not cope with perseverance!
