Re: One Nic; Multiple Subnets

[Mike <1100100@gmail.com>]

Martijn,

Thanks for your help.
I've definitely decided to go down the "2-nic" path and make life simpler.
Now of course I'm wondering if I should buy some better equipment to
run a strong ethereal/snort combo. on the routerbox.  I'm way overdue
on intrusion detection and network usage.

Any suggestions on the level of hardware required to run ethereal and
snort on a routerbox.

Best regards.

Mike




On Tue, 28 Dec 2004 13:35:35 +0100 (CET), Martijn Lievaart <m@rtij.nl> wrote:
> Mike said:
> > Jason,
> > Thanks for the reply.
> > Sounds like a second nic. is really what's needed here.
> > John Sullivan suggested it could be done using iptables in combination
> > with iproute2; but I'm not sure I could manage it well.  I'm
> > challenged enough by iptables, itself.
> >
> > I'm thinkin' new mobo/cpu/ram combo. for $150 from newegg.com  :-)
> 
> YES! make it as simple as possible. Do it like this:
> 
> * Add another nic, eth2 (I assume you want the new mobo because you cannot
> add another nic to the current setup, right? Otherwise, just add another
> nic and you're set).
> * Give the new nic 192.168.2.1/24, add all new hosts on this second subnet.
> * Make sure the nets can only access the Internet, not eachother.
> (from memory, may not be 100% correct)
>   -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
>   -A FORWARD -i eth1 -o eth0 -j ACCEPT
>   -A FORWARD -i eth2 -o eth0 -j ACCEPT
>   -A FORWARD -m limit --limit "10/s" -j LOG --log-prefix "Invalid forward: "
>   -A FORWARD -j DROP
> 
> Obviously, you also have to add the relevant MASQ, INPUT and OUTPUT rules,
> but those should not be wildly different from what you have now.
> 
> HTH,
> M4
> 
>