Build It Yourself: A Linux Network Appliance, Part 2

In our first installment, we described why you need a Linux-based network appliances. Today, we’re going to start construction. (Please see the Introduction to this series for hardware requirements.) We will be building two separate appliances: one for network border services, such as firewalling, secure remote access, and intrusion prevention; and one for LAN services, such as file and printer sharing, network storage and backups. We’ll start with an Internet firewall/gateway for sharing a broadband Internet connection. Our Linux gateway will protect clients on all platforms, not just Linux. You’ll save money, have complete control and likely better protection.






Build a Linux Appliance


  • Part 1: Introduction and Hardware Requirements
  • Part 2: Install and Configure Linux
  • Part 3: The Firewall
  • Part 4: Locking Down the Firewall Box
  • Part 5: Internet Connection Sharing Firewall
  • Part 6: The Firewall

  • You should already have a shared broadband Internet connection, maybe with a Linksys or Netgear router. Soon you’ll have a firewall box connected to your LAN. You’ll administer it from a second LAN PC. This is handled via Open Secure Shell or a Web browser, so any Linux, Mac or Windows PC will do. A typical setup looks like this:

    Broadband modem -> gateway -> switch or hub -> LAN hosts

    If you do not already have some sort of router/gateway for sharing your Internet connection, you may connect your firewall box directly to the Internet. You still want a second PC connected via a switch or hub for remote administration. The setup would look like this:

    Broadband modem -> future gateway box -> switch or hub -> second PC

    We’ll install the Debian GNU/Linux operating system as the foundation of our sturdy gateway box. Debian is easy-to-maintain and upgrade, and is stable and reliable. Debian comes in four flavors: Stable, Testing, Unstable and Experimental. Each flavor besides Experimental has a cute code-name: Sarge (stable), Etch (testing), and Sid (unstable).

    Stable contains older, well-tested packages, so it’s always behind in terms of having the latest and greatest releases, which is exactly what you want on something as important as a firewall. You can run Testing or Unstable all you want to on desktop systems. They work perfectly well despite the scary names. But don’t use them on important servers.

    By choosing Debian we aren’t saying that other versions of Linux are inferior. We chose a single distribution to keep this series simple and to get you up and running as quickly as possible. Getting Debian
    We’ll install Debian Stable from the “business-card” CD image. This is around 40 megabytes. Simply download the .iso and burn it to a CD. If you don’t have the means to do this, you may order a commercial CD. The full-sized CD/DVDs are OK if you can’t get the business-card CD.








    Network diagram
    The penguin marks the spot for your Linux appliance

    Once you have your installation disk in hand, just pop it in and boot up. All you want to do is install the base system, which runs around 380 megabytes. Don’t install anything else.

    If you’re not familiar with installing Linux, refer to Falko Timme’s excellent how-to, The Perfect Setup – Debian Sarge (3.1). This is a complete how-to for setting up an ISP-style server, so please observe these exceptions:


    • The current version is debian-31r2-i386-businesscard.iso
    • Don’t install any extra packages. All you want is the base installation
    • Instead of creating an “admin” user, feel free to use your own name
    • Stop at the end of Page 2
    Network Configuration During Installation
    You only need to configure a single network interface card (NIC), because for now all you need is Internet connectivity.

    If your future gateway box is on your LAN, and not directly connected to the Internet, go ahead and manually configure a static IP for it, since you’ll need one anyway. For example, since my subnet is 192.168.1.0/24, I configured mine with an IP of 192.168.1.15, netmask 255.255.255.0, gateway 192.168.1.10 (which is the LAN address of my own Internet gateway), and I used the nameserver of my ISP.

    If your future gateway box is connected directly to the Internet, use the account information supplied by your ISP. Almost There
    The installation takes up to an hour, depending on the speed of your Internet connection. When it’s finished, you’ll be looking at a plain command prompt. Not to worry, because by the end of this series you’ll be a whiz both on the command-line and with some excellent graphical interfaces. Come back next time to install Webmin, and to build a firewall.

    Resources



    Adapted from PracticallyNetworked.com, part of the EarthWeb.com Network.





    Do you have a comment or question about this article or other small business topics in general? Speak out in the SmallBusinessComputing.com Forums. Join the discussion today!

    Must Read

    Get the Free Newsletter!

    Subscribe to Daily Tech Insider for top news, trends, and analysis.