Robert,
I have a M1 cable modem, and I've had great success and fun with it. I use
a Linux box as a server for two other PCs. I have a few suggestions to
offer that will help in setting yours up.
1) put the M1 connection on eth0
2) uninstall pump (rpm -e pump)
3) make sure dhcpcd is installed (rpm -qa | grep dhcpc)
4) use netconf to configure your interfaces
Additionally you might want to register with a dynamic DNS such as JustLinux
(www.justlinux.com). If you do, all you have to do is add a script called
/etc/dhcpc/dhcpcd-eth0.exe which updates your dynamic DNS everytime your
DHCP address is changed. M1 has been pretty consistant with IPs, mine only
changes when they increase the subnet mask. M1 (actually Road Runner) will
soon be implementing their backend DOCSIS system. Most all M1 customers
already have DOCSIS compatable cable modems. The DOCSIS system encrypts
data between the cable modem and the CMTS (backend)
Here is what I have in my /etc/rc.d/rc.local file. The reason for all the
extra port specific chains is that those ports are open on the inside
network, and even though tcpwrappers should block any outside attemps, one
can never be too cautious.
---------------------------------------------------------------------
echo "Enabling IP Forwarding"
echo "1" > /proc/sys/net/ipv4/ip_forward
route add default eth0 # Cable modem
echo "Enabling IP Masquerading (ipchains)"
/sbin/ipchains --flush
/sbin/ipchains -P forward DENY
/sbin/ipchains -A forward -j MASQ -s 192.168.1.0/24 -d 0.0.0.0/0
/sbin/ipchains -A input -j DENY -i eth0 -s 192.168.1.0/24 -l
/sbin/ipchains -A input -p udp -i eth0 --destination-port snmp -j DENY
/sbin/ipchains -A input -p udp -i eth0 --destination-port snmp-trap -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port imap -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port nntp -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port http -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port webcache -j DENY
/sbin/ipchains -A input -p udp -i eth0 --destination-port webcache -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port telnet -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port finger -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port pop-3 -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port pop-2 -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port ftp-data -j DENY
/sbin/ipchains -A input -p tcp -i eth0 --destination-port ftp -j DENY
#/sbin/ipchains --list
echo "Loading specific IP Masquerading modules"
/sbin/modprobe ip_masq_ftp.o
/sbin/modprobe ip_masq_raudio.o
/sbin/modprobe ip_masq_quake.o
/sbin/modprobe ip_masq_irc.o
/sbin/modprobe ip_masq_vdolive.o
/sbin/modprobe ip_masq_cuseeme.o
---------------------------------------------------------------------
Another neat trick is that I setup my /etc/hosts.allow to only allow
sendmail connections from iname.com (">jimpop@rocketship.com) which forwards
email to my server. This again is an extra step, since sendmail is setup to
deny relaying. Again, one can never be too careful. Here are some excerpts
from my /etc/hosts.allow
---------------------------------------------------------------------
# Allow ssh from anywhere
sshd: ALL
# Allow ftp connections
in.ftpd: ALL: spawn \
( /usr/bin/logger -p authpriv.info -t FTP access to %s granted to %c )
: ALLOW
# Allow only certain domains to relay email to us
sendmail: .opti-ups.com .iname.net .mail.com 192.168.1.0/255.255.255.0
.onelist.com
# Notify all other smtp attempts
sendmail: ALL@ALL: spawn \
( /usr/bin/logger -p authpriv.alert -t SMTP access to %s denied to %c )
: DENY
# Allow the internal network free reign
ALL: 192.168.1.0/255.255.255.0
ALL: 127.0.0.0/255.0.0.0
---------------------------------------------------------------------
One last thing: I gave in to M1s constant changing (bringing up/down) of
their name servers. I was hard coding forwarder IPs in my /etc/named.boot.
Everytime M1 switched DNS servers I was SOL. My solution was to only run a
caching name server for the internal network (but not the server). I let
dhcpcd set the /etc/resolv.conf everytime I refresh. The caching name
server doesn't need you to specify forwarders, it will use the current ones
specified in /etc/resolv.conf.
When you get hooked up run nslookup, set your server to ns1 (no domain name
needed, you're on their network) and do a "ls atl.mediaone.net". You will
be surprised what all they have hooked up on their network.
Hope this helps. ;-)
-Jim P.
----- Original Message -----
From: "Robert Heaven" ">rheaven@bellsouth.net>
To: "ALE" ">ale@ale.org>
Sent: Monday, January 17, 2000 10:36 PM
Subject: [ale] ipchains scripts
> MediaNone is scheduled to come out this week to install my cable modem
> service. I have an old Compaq P133 with RH6.1 on it and plan to install 2
> NIC's and use as a firewall. I've read "Linux Firewalls" by Robert L.
> Ziegler and he seems a bit paranoid and his examples are much more complex
> than my simple one LAN gateway/firewall. I've also read the IPCHAINS-HOWTO
> by Paul Russell, who's much less paranoid but, his examples are also too
> complex.
>
> I would greatly appreciate any good ipchains scripts that anyone would
> consider sending me.
>
> Thanks,
> Robert
>
> --
> To unsubscribe: mail ">majordomo@ale.org with "unsubscribe ale" in message
body.
>
--
To unsubscribe: mail ">majordomo@ale.org with "unsubscribe ale" in message body.