Setting Up A Gateway With Linux

This was another workaround I have done to set-up a gateway between the internal and external network to access the internal resource from outside.

Yes, there is no change, it’s a dedicated Linux machine for the Gateway installed with RedHat Advanced Server-4.

Setting Up The Gateway

I will just brief the set-up before I start into the configuration part.
Well… The machine has two NIC and configured accordingly:

eth0: 192.168.1.1/24 connecting to internal network.
Gateway: 192.168.1.254

eth1: 10.1.0.1/28 Connected to a Layer-3 switch(WAN Connection) and then it terminate at the users end whom gonna access the internal resource.
Gateway: 10.1.0.3.
The resource is in 192.168.2.0/24 network. Note not on the same network.

Yes.. thats a Q..! Dude why don’t you set it up on the Layer-3 Switch ?

hmmm… I don’t have the access to the CPE and that is dealt by the Service Provider. (We should always keep an alternate way to run out of the heck….) and moreover its a temporary set-up for a short period of time.

Next step enable the IP_forwarding between the NIC.

camel # vi /etc/sysctl.conf
net.ipv4.ip_forward = 0 # change this 0 to 1

You have done with the IP_forwarding and now the beauty; restart the system to apply the change…

?hey…I don’t wanna restart my system…?

Oho..really, then please talk to the kernel.

To pass the information to the kernel on the fly without restarting
camel # echo “1″ > /proc/sys/net/ipv4/ip_forward
or more easily by updating the sysctl by
camel # /sbin/sysctl -p

And now keep talking to the kernel about the routing table.

camel # netstat -nr shows the current kernel routing table.

I configured in the following

camel # route del default
camel # route add -net 192.168.2.0/24 gw 192.168.1.254
#now kernel knows all the request to the destination192.168.2.0 network should go via192.168.1.254 and the rest will taken care by internal routing table.
camel # route add default gw 10.1.0.3 #anythin else should go via 10.1.0.3

Now the external people has the access only to the 192.168.2.0 network after they logged into the gateway and get authenticated, thats the Security Hardening part. Yes.. the rest of the hardening part is coming right away…

Leave a Reply