Slashdot Mirror
Linux Routers
Overview Linux Routers is an interesting little book that pulls together the kind of information that one could find browsing various HOW-TOs and guides into a concise narrative explaining the tasks required to build and operate Linux-based routers.
Opening the book is a discussion on the fundamental theories underlying routing and the infrastruture required to implement routing solutions. For those (like myself) who have little exposure to network administration this will be particulary helpful as a lead in to the following chapters.
There is a chapter to further build on the basics of IP (addresses including RFC1918, subnetting, routing tables), ethernet (MAC addresses, ARP, switching) and wide area networks (types of links, integrating with telco hardware, billing).
The detail increases as the book progresses. It starts with the simplest installation, routing between two ethernet segments covering the basics of setting up Linux networking and routing. Methods of IP accounting are also introduced. Mention is also made of the Linux Router Project and the single floppy distribution they have developed.
Moving onto WAN routers introduces the telco issues and ways to preserve bandwdith (http proxy, caching dns). IPchains is introduced in the context of masquerading otherwise unroutable addresses. Various tools are listed in a section that demonstrates how to view traffic on the network for educational and debugging purposes. Monitoring of traffic over a router is also described, using MRTG to collect and beautify data. Chapter 7 includes methods of reducing said traffic such as http caches and a DNS slave at the remote site.
A border router to the Internet is used to raise related security issues and the use of proxy servers to screen access from the outside in or the inside out. This information bridges across chapters 6 and 8 and includes topics like packet filtering firewalls, port redirection and proxies. The flexibility of Linux is demonstrated by the ability to integrate routing and Internet servers on a single box. With obvious reservations about how wise that is, it is pertinent that failure detection, notification and recovery are all covered.
What's to like The information starts out simple and builds on itself in cyclical nature as the book progresses. The six scenarios are the ones likely to be encountered in a production environment and illustrate the benefits of using Linux routers.
The issues of choosing Linux as a router are well addressed, including discussions on thorny topics like "Total Cost of Ownership," and provide a framework for you to assess your own situation. The writer's style is clear and easy to read.
Different WAN and Internet telco links are discussed (POTS, frame relay, dedicated digital access circuit) including how to configure the link and what protocols to run over it.
Peripheral issues, such as troubleshooting tcp or proxy servers, are dealt with well. Information is provided to allow you to understand the integration with the routing infrastructure you are deploying. When the topic starts to drift from the task at hand the author makes good use of redirecting people interested in more detail to other references (Web sites, books).
What's annoying The author is a part of the Debian project so some things have a bit of a Debian slant on them (this includes the file system layout referred to and the config files). This shouldn't be too much of an issue for most people, though it will require a thorough understanding of one's own system or problem-solving via your distribution's manual. WAN hardware and software discussions are limited by the author's experience, with a particular brand of card and one software package (wanpipe -- of which the author is the Debian maintainer) being focused on.
Alternatives are mentioned, but not in great depth, and the examples therefore might not be portable to your choice of card or software.
Summary If you are comfortable with enabling routing, IPchains, proxy servers and troubleshooting tcp/ip on Linux, this book will be of little use other than to provide a step-by-step approach. On the other hand, if you currently use brand-name routers but have sometimes wondered whether that 486 in the corner could be put to good use, this book will certainly guide you on your travels.
Table of Contents Note: the author uses the elements to name boxen, hence the names of the chapters.
- Routing Building Blocks (Hardware, Environment, Software)
- IP, Ethernet and Telephony Basics (Routing, Ethernet, WAN)
- Silicon - LAN Router (LAN Routing, IP Aliasing and Accounting)
- Erbium - an Extranet Router (IP Masq, IP Monitoring)
- Zinc - Frame Relay Router (WAN Hardware and Software, MRTG)
- Oxygen - Internet Router (Security, Firewalling, Failure Detection)
- Californium - Satellite Office Router (Caches and Slaves, Multifunction Routers, Remote System Support)
- Hafnium - Internet Services Router (Proxying, IP Redirection, Routing Daemons, Emergency Recovery)
- A) Links
- B) Compiling a Kernel
- C) Testing Strategies
- D) Ethics and Other Considerations
- E) GPL
You can purchase this book from ThinkGeek.
I've used a few flopy disk routers, out of all of them I found that free sco was the best. The setup was easy, and it let you get down and dirty w/ the ocnfig files if you wanted to, but I still prefer the linksys router. It's the fastest to setup, its secure, and it has free support, and updates... You also don't have to worry about user licnse issues. for my money it's the best. Besides you can't beat the low pewer consumtion.
Just make your own box with www.freesco.com they work wonders.
Well, if you had enough old boxes you could make a nice Beowulf cluster. Ooh shit, I'm going to get moderated down for that one. Seriously though, you can do a lot of things with an old box. Low cost X terminal, personal mail server, squid proxy cache, etc. You're obviously not going to be playing a lot of 3D games like Quake on a 486 but it's fine for text browsing the web with lynx or read mail with mutt. :-)
I liked the book, and certainly felt it would be very helpful to folks doing the most common 85% or so of network device setup tasks.
On the other hand, I felt the title of the book constituted a promise that it would include good coverage of dynamic routing protocols like OSPF, RIP2, and others--all of which are available in strong Linux implementations.
This book covers the entire concept of dynamic routing in about 4 pages, in section 8.4--and the coverage is completely inadequate. There isn't usable information on setting up ANY dynamic routing protocol--OSPF isn't even in the index of the book. (It's on mention is in the glossary.)
Matt
I have a Compaq Deskpro 486/66 that has been beefed up in some areas to make an excellent X terminal.
I added an 8Mb ATI card, and all the spare SIMMs in the junkbox that would fit to get about 96Mb, and it goes like a train with truecolour driving a 'spare' 21" monitor. It's relatively quiet too. I believe there are either netboot or floppyboot options like this that can do away with the harddrive altogether to make a very quiet system - the 486 has no fan, and the PSU can be knobbled to shut up a bit.
Getting PCI video cards is getting harder though, and X network security sucks big time.
"don't fall into the fallacy of believing that Perl can solve social problems. Maybe Perl 6 can, but that's a ways off"
I visited the advanced link, and I'm wondering where the best beginner's guide to IPsec could be. How is the reviewed book on that score?
I'm reading the ora "Building Internet Firewalls" book now, has anyone tried the "Building Linux and OpenBSD Firewalls" book? It covers OpenBSD 2.5, will it be relevant for 2.8?
Thanks.
I got a copy of the book at the Atlanta Linux Expo from a Sangoma rep. It does a relatively good job of explaining T1 circuits and how frame relay works. This was one of the first things I had to learn a while ago and the book would have saved some time for me.
I liked the book, it's pretty easy reading and was definitely worth the time spent reading it.
Well, one nice thing about using an old computer instead of a $200 NAT box, is that it can also run services for you, such as Squid, DNS cache, maybe even fringe things like nntpcache.
Every home or office should have one of these. :-)
---
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
For low end small business or backyard ISP use MTBF can be surpisingly good with commodity hardware. Infact my experience so far is that my ISPs routers are less reliable than anything I have built out of scrap. Ofcourse they are carrying a much greater load.
An easy way to cover the redundancy requirement is to have a complete standby unit preconfigured and ready to slot in. All that is needed is two obsolete PCs with identical WAN adapter and NIC. Either go the floppy approach as with LinuxRouter or get Sandisks. Since a sandisk just looks like another harddrive, an old IDE hardrive will do in the spare router to save on sandisk costs (I don't think they ever fail anyway)
It's not hot swappable, so you may lose a couple of customers in the minute it takes to swap cables and boot from sandisk, but if you are running amazon.com obviously you have a budget to buy better. To put the reliability issue in perspective, where I live my ISP lost 75% of it's bandwidth on Monday and its routers all went nuts. We had traffic interuptions for hours while they reconfigured their network and what looked like numerous router reboots.
So for those on a limited budget Linux routers can be both reliable and very flexible but like MySQL they have limitations that means they are not a solution for all situations.
Monty
I WANTED a closed-source security box.
Closed source and security tends not to go together. By definition it means that no independant expert can possibly have audited the software.
I just got the Linksys router/nat box, replacing that function in my linux box. I must say, even having run ip masq for the last couple years, the little Linksys does a great job. It has all the VPN behind NAT support built in (can be a pain with IPChains), port forwarding, DMZ option for a system, DHCP, web-interface. Not to mention that it is quicker at routing the IPSec VPN traffic than the linux box was (a K6-2 500 with 2 3c509s). Some models have a built in 10/100 switch, so you don't even need another hub (though I seem to be in no short supply of those).
It is small, makes no noise (not an issue for where I use it - 10krpm scsi drives and fans take care of that), works well and is easily configured. All for ~$130... saves on power, if you had a system dedicated to only the masq/firewalling, too.
There's no client license or anything - just use up all the IPs you want. Good stuff.
--
"It's tough to be bilingual when you get hit in the head."
Hmm...
-
Most 486-class CPUs are adequately cooled with just a heatsink (an i486DX4-100 might need a fan, but <=66-MHz and/or 3.3-volt (Cyrix/AMD) CPUs often don't; my firewall uses a Cyrix 5x86-120 and it only has a smallish heatsink epoxied to the processor).
-
If your router setup will fit on a floppy, you can set things up so the floppy is only accessed at bootup. If more space is required, you could get one of those CompactFlash-to-IDE adapters and an appropriately-sized CF card and use it in place of the usual spinning-metal contraption.
-
Once you've gotten the overall power consumption down low enough, if you're a little daring you could try removing the power supply fan. With an old, slow processor and no HD, power consumption should be a small fraction of what the power supply can deliver.
Do that and you'll have no moving parts to wear out, and it'll still run Linux.20 January 2017: the End of an Error.
>What sort of routers have you been using? the
>kind I'm used to would give you industrial
>deafness from the fans! Take a look at any Cisco
>5500 or up - the fans on those babies could cool
Cisco 1600 series and Linksys Etherfast DSL
Amorphis
one of the biggest advantages of "normal" routers is that they're solid state. there aren't any moving parts (fans/spindles/etc) to wear out.
Amorphis
My answer: it runs EMACS.
Carefree highway, let me slip away on you.
It would be nice to have an updated "Advanced Routing Howto" that includes more information on the options for and configuration of such things as:
Secure IP (FreeS/WAN)
Routing daemons (Gated, Routed, Zebra, etc.)
(Layer 2) Bridging (also with firewalling, etc.)
Port / service redirection
- Michael T. Babcock (Yes, I blog)
Does it cover IPv6 routing?
Someone you trust is one of us.
Oh get a gripe you whinny pathetic redhat luser.
The current Slashdot moderation system is made by gay communists!
Cool! I'm running linux on an old Acer system as my firewall. 16mb RAM, 486/33, 270mb hard drive. I can slap it around and rewire it any way I please. It's hooked to a 486/33 NCR laptop with 11mb RAM that's the main display and X terminal on the system. An HP NetServer LM (P60, 128mb RAM) running Solaris does a lot of the graphical work like running Netscape. Why Solaris? Hardware support (I couldn't find an open source system with drivers for EISA Mylex hardware RAID controllers). I have a DSL hookup, running whatever services I feel like is just a matter of setting them up and adjusting my firewalling and forwarding rules. And while I'm learning the tricks to get this done, I'm also learning how things work. There is no Magic Button to drop pings from everywhere but a few trusted servers. There's no need have your mouse perform the Macharena while clicking through the Gettysburg address in morse code just to access some hidden functionality.
This is the true benefit of open source solutions. I think too many people get used to knowing things and forget that. Someone could write an interface for ipfwadm, ipchains, or ipmasqadm and make it look as pretty as they liked. But when it comes right down to it, you can look under the hood and see how the magic works. This holds just as true for my router as it does for the machine I sit at. This is an idea that's still spreading. It hasn't hit all ends of the market. But companies such as Myricom and IBM have produced open source software. Conglomerates such as the ISC and Kame forward research and developement of IPsec, IPv6, and other radical new toys. Closed, proprietary systems can be useful for ideas. New directions to go in (I could write a series of shell scripts to pull off the rather convenient Solaris 'share' commands, for example). But who wants to be stuck with them?
Hell, this book is even a good example of how to make money doing this. Everybody needs HOWTO's and man pages, and bound hardcopy is -convenient-.
Lanir
Having worked with small non-profits with close to no money, as well as having used hardware routers for dial-up, cable and DSL like Netopia and Linksys, I think that there are easy arguments for both. Sometimes it is in fact quite a lot easier to just put a little box with good NAT and firewall capabilities that takes less than 30 minutes to configure in. Sometimes, that $200-400 is more than someone can afford, and converting an old 486 or pentium to use as a small network router is a good idea. It's not at all either or - there are good reasons and situations for both. Also, if you're installing a small network with a linux box for file serving, e-mail and the like, why not use the box as a router as well?
I think that you can define a DMZ host in addition to the NAT range. Admittedly that's just one host, but...
Besides, who says you can't do port forwarding of 53, 25/110, and 80/8080/443 from the outisde to static inside ips? You can disable dhcp on the inside you know...
Well, it is a moot point if you already got the sonicwall :-)
--
News for Geeks in Austin, TX
and by the same token it also means that no one is privy to the exploits just by reading the code. they have to break into your box the old fashoined way.
--
--
"It is now safe to switch off your computer."
for an extra $50, I went with the webramp/sonicwall. it DOES allow a mix of public and private addresses. its not a "all nat or no nat" choice, which I find very limiting.
--
--
"It is now safe to switch off your computer."
it does nat (for 5 clients at the current licensing price; upgradable), all the usual stateful firewalling, routing, port forwarding, etc.
I'm a linux guy (by hobby and profession) yet I chose this standalone box. why? well, I WANTED a closed-source security box. I still run openbsd as my main access point but I wanted a 2nd level of protection. using linux for security is pretty laughable for 99% of the users out there. I think I have peace of mind now with one of these boxes in series with an openbsd box.
yeah, it wasn't free. but the ultra small footprint, the total lack of fan noise and the very usable web mgmt front-end made it an easy decision.
there are things that linux wins in. being a quiet and small footprint access router device isn't one of them.
--
--
"It is now safe to switch off your computer."
I installed UMSDOS Slackware from the A and N floppies (around 10 in those days) on one of the PCs in the lab, then installed a kernel I compiled at home in my spare time - the kernel having routing enable. Then I added a spare NIC to this machine.
This is one of the things they are very usefull for. In particular this makes a very good option for SOHO type setups. I do a bit of side work setting up SOHO types with this. The other thing older boxes are good at is a simple static web server. For example one Dr. I worked for wanted to put a simple static schedule for this office and have a browser front end for it. An old Pentium is doing fine in that role. Print servers using Samba is something else they do quite well.
Cypherpunks: Civil Liberty Through Complex Mathematics. Those who live by the sword die by the arrow.
Okay, it's cliche, but has anyone ever made a cluster of old boxes? Perhaps even for scalable routing?
----
\ Why do people always talk about something and not provide a link? If we haven't heard of it, we don't know where it is. True, freesco.org is (should be) an obvious guess, but for others it's much more difficult, like when I tried to find bugtraq a year or so ago. \
If you want to save your money, you could read the advanced routing howto instead.
The people who wrote it really know what they're talking about.
Also, Linux router is a router on a floppy disk with most of the hard work done for you, so a lot of the information in the book will be redundant.
And just as a point, software routing is not really appropriate for large networks, so you're not going to throw away those Cisco boxes any time now.
Free Anne Tomlinson!!
Hi! This is the Sig, blatantly attached to the end of this comment.
Well, this seems to be one of the biggest damn challenges, doesn't it... people cannot get past their biases to write something more universal. Now, before someone goes off and tries to kill me for this, let me continue...
Yes, I know that you need to give examples in such texts. Yes, I know there are many differing distributions, and many have their little nuances and quirks. I realize that it's not feasable to cover all of these subtleties - BUT that doesn't give an author an excuse to not acknowlege those subtleties. Yes, its hard to do, but in all fairness, if you write such a text for other, completely non-related topics/subjects, you cannot get away with heavy bias - without flat-out saying so - particularly in the title, or at least on the front cover. Its only fair to the reader.
Again - I don't want to start one of those oh-so-fun flame wars over who's distro is better than who's, or why YOU think the bias must be there. I'm simply saying that the bias doen't HAVE to be there, and I'd really like to see someone take the initiative and put some effort into working around this.
And, yes, I'm sure there are some level-headed individuals, and maybe even groups, trying to do this. I (we - see the bio) do not live within the "geek" culture... we're linux fans, we're BSD fans, we're gamers, we're fairly unusual users... but it does not permeate our lives - its only a small part of what we do. And sometimes, we're the ones who need to get a book like this, and make it work for us...
Just some food for thought
Hi! This is the Sig, blatantly attached to the end of this comment.
At the Swedish University of Agricultural Sciences they have put together a router for wirespeed Fast-Ethernet. I am runnign several of these, with good results. They run a customized kernel with very customised tulip-drivers and can do 148kpps at 64byte/packet.