Internet access has also increased substantially our ability to interact with other law fims, in particular firms who frequently represent our opponents in litigation. We are able to use Internet email
to electronically exchange word processing documents that require modification and editing by opposing counsel, such as settlement agreements and discovery requests. At the time I set up our gateway, I believed that our firm was on the cutting edge of Internet connectivity among the law firms in our city. Since then, other local law firms have learned the value of Internet access and have obtained Internet access. As our needs have grown, so has the complexity of our Internet gateway. In mid-1999, I replaced the original 486DX2 Slackware-based gateway with a Pentium 200 RedHat 6.0 based system I built into our old file server. Right now, the gateway machine performs, inter alia the following functions: IP masquerading (NAT), DHCP service, hosting out local intranet home page, email retrieval and delivery, hosting of several listservs, web caching, firewalling, etc. We are planning to replace our dialup with with a dedicated DSL link in the very near future. Linux has enabled us to provide Internet access to anyone in our firm who needs it at a fraction of the cost of other commercial options on the market.
Configuration files from the old Slackware gateway
chatscript
exec /usr/sbin/chat -r /tmp/report ABORT BUSY "" atdt80,7627577 CONNECT \
"" ogin: your_username_here word: your_password_here
rc.inet1
#! /bin/sh
#
# rc.inet1 This shell script boots up the base INET system.
#
# Version: @(#)/etc/rc.d/rc.inet1 1.01 05/27/93
#
HOSTNAME=`cat /etc/HOSTNAME`
# Attach the loopback device.
/sbin/ifconfig lo 127.0.0.1
/sbin/route add -net 127.0.0.0
# IF YOU HAVE AN ETHERNET CONNECTION, use these lines below to configure the
# eth0 interface. If you're only using loopback or SLIP, don't include the
# rest of the lines in this file.
# Edit for your setup.
IPADDR="192.168.1.1" # REPLACE with YOUR IP address!
NETMASK="255.255.255.0" # REPLACE with YOUR netmask!
NETWORK="192.168.1.0" # REPLACE with YOUR network address!
BROADCAST="192.168.255.255" # REPLACE with YOUR broadcast address, if you
# have one. If not, leave blank and edit below.
GATEWAY="192.168.1.1" # REPLACE with YOUR gateway address!
# Uncomment the line below to initialize the ethernet device.
/sbin/ifconfig eth0 ${IPADDR} broadcast ${BROADCAST} netmask ${NETMASK}
# If the line above is uncommented, the code below can also be uncommented.
# It sees if the ethernet was properly initialized, and gives the admin some
# hints about what to do if it wasn't.
if [ ! $? = 0 ]; then
cat << END
Your ethernet card was not initialized properly. Here are some reasons why this
may have happened, and the solutions:
1. Your kernel does not contain support for your card. Including all the
network drivers in a Linux kernel can make it too large to even boot, and
sometimes including extra drivers can cause system hangs. To support your
ethernet, either edit /etc/rc.d/rc.modules to load the support at boottime,
or compile and install a kernel that contains support.
2. You don't have an ethernet card, in which case you should comment out this
section of /etc/rc.d/rc.inet1. (Unless you don't mind seeing this error...)
END
fi
# Uncomment these to set up your IP routing table.
/sbin/route add -net ${NETWORK} netmask ${NETMASK}
/sbin/route add 192.168.1.254 eth0
/sbin/route add -net 192.168.2.0 netmask 255.255.255.0 gw 192.168.1.254
# The following line is for DHCP to work correctly
/sbin/route add -host all-ones dev eth0
#/sbin/route add default gw ${GATEWAY} metric 1
# End of rc.inet1
rc.inet2
#!/bin/sh
#
# rc.inet2 This shell script boots up the entire INET system.
# Note, that when this script is used to also fire
# up any important remote NFS disks (like the /usr
# distribution), care must be taken to actually
# have all the needed binaries online _now_ ...
#
# Author: Fred N. van Kempen,
#
# Constants.
NET="/usr/sbin"
IN_SERV="lpd"
LPSPOOL="/var/spool/lpd"
# At this point, we are ready to talk to The World...
echo "Mounting remote file systems..."
/sbin/mount -a -t nfs # This may be our /usr runtime!!!
echo -n "Starting daemons:"
# Start the SYSLOGD/Klogd daemons. These must come first.
if [ -f ${NET}/syslogd ]; then
echo -n " syslogd"
${NET}/syslogd
echo -n " klogd"
${NET}/klogd
fi
# Start the SUN RPC Portmapper.
if [ -f ${NET}/rpc.portmap ]; then
echo -n " portmap"
${NET}/rpc.portmap
fi
# Start the INET SuperServer
if [ -f ${NET}/inetd ]; then
echo -n " inetd"
${NET}/inetd
else
echo "no INETD found. INET cancelled!"
exit 1
fi
# Start the NAMED/BIND name server.
if [ -f ${NET}/named ]; then
echo -n " named"
${NET}/named
fi
# # Start the ROUTEd server.
if [ -f ${NET}/routed ]; then
echo -n " routed"
${NET}/routed -g
fi
# # Start the RWHO server.
# if [ -f ${NET}/rwhod ]; then
# echo -n " rwhod"
# ${NET}/rwhod -t -s
# fi
# Start the DIALD server.
if [ -f /usr/local/sbin/diald ]; then
echo -n " diald"
/usr/local/sbin/diald -daemon 2> /dev/tty7 &
fi
# Start the HTTPD server.
if [ -f ${NET}/httpd ]; then
echo -n " httpd"
${NET}/httpd
fi
# Start the DHCPD server.
if [ -f /usr/local/sbin/dhcpd ]; then
echo -n " dhcpd"
/usr/local/sbin/dhcpd 2> /dev/null
fi
# Start the various INET servers.
for server in ${IN_SERV} ; do
if [ -f ${NET}/${server} ]; then
echo -n " ${server}"
${NET}/${server}
fi
done
# # Start the various SUN RPC servers.
if [ -f ${NET}/rpc.portmap ]; then
# Start the NFS server daemons.
if [ -f ${NET}/rpc.mountd ]; then
echo -n " mountd"
${NET}/rpc.mountd
fi
if [ -f ${NET}/rpc.nfsd ]; then
echo -n " nfsd"
${NET}/rpc.nfsd
fi
# # Fire up the PC-NFS daemon(s).
# if [ -f ${NET}/rpc.pcnfsd ]; then
# echo -n " pcnfsd"
# ${NET}/rpc.pcnfsd ${LPSPOOL}
# fi
# if [ -f ${NET}/rpc.bwnfsd ]; then
# echo -n " bwnfsd"
# ${NET}/rpc.bwnfsd ${LPSPOOL}
# fi
fi # Done starting various SUN RPC servers.
# The 'echo' below will put a carriage return at the end
# of the list of started servers.
echo
# # Setting up NIS:
# # (NOTE: For detailed information about setting up NIS, see the
# # documentation in /usr/doc/yp-clients and /usr/doc/ypserv)
# #
# # First, we must set the NIS domainname. NOTE: this is not
# # necessarily the same as your DNS domainname, set in
# # /etc/resolv.conf! The NIS domainname is the name of a domain
# # served by your NIS server.
#
# if [ -r /etc/defaultdomain ]; then
# domainname `cat /etc/defaultdomain`
# fi
#
# # Then, we start up ypbind. It will use broadcast to find a server.
#
# if [ -d /var/yp ] ; then
# echo "Running ypbind..."
# /usr/sbin/ypbind
# fi
# Done!
rc.local
#!/bin/sh
#
# /etc/rc.d/rc.local: Local system initialization script.
#
# Put any local setup commands in here:
#echo Starting diald...
#/usr/sbin/diald
#/usr/bin/sleep 5
/bin/setserial /dev/modem spd_vhi
/sbin/depmod -a
/sbin/modprobe -a \*
echo Configuring IP Masquerade and Firewall...
/sbin/ipfwadm -F -p deny
/sbin/ipfwadm -F -a m -S 192.168.0.0/16 -D 0.0.0.0/0 -W ppp0
/sbin/ipfwadm -F -a m -S 192.168.0.0/16 -D 0.0.0.0/0 -W sl0
/sbin/ipfwadm -I -a deny -S 192.168.1.1/32 -D 0.0.0.0/0 -o -W ppp0
echo 1 > /proc/sys/net/ipv4/ip_dynaddr
echo Starting MARS_NWE...
/sbin/nwserv &
#/usr/sbin/syslogd &
options
# PPP options
silent
ipcp-accept-local
ipcp-accept-remote
named.boot
;
; boot file for name server
;
directory /etc
; type domain source host/file backup file
cache . root.cache
primary glancynet.com named.hosts
primary 0.0.127.IN-ADDR.ARPA named.local
primary 168.192.IN-ADDR.ARPA named.rev
forwarders 199.72.95.1 199.72.95.3
;slave
options forward-only
;options no-recursion
standard.filter
# This is a pretty complicated set of filter rules.
# (These are the rules I use myself.)
#
# I've divided the rules up into four sections.
# TCP packets, UDP packets, ICMP packets and a general catch all rule
# at the end.
#------------------------------------------------------------------------------
# Rules for TCP packets.
#------------------------------------------------------------------------------
# General comments on the rule set:
#
# In general we would like to treat only data on a TCP link as signficant
# for timeouts. Therefore, we try to ignore packets with no data.
# Since the shortest possible set of headers in a TCP/IP packet is 40 bytes.
# Any packet with length 40 must have no data riding in it.
# We may miss some empty packets this way (optional routing information
# and other extras may be present in the IP header), but we should get
# most of them. Note that we don't want to filter out packets with
# tcp.live clear, since we use them later to speedup disconnects
# on some TCP links.
#
# We also want to make sure WWW packets live even if the TCP socket
# is shut down. We do this because WWW doesn't keep connections open
# once the data has been transfered, and it would be annoying to have the link
# keep bouncing up and down every time you get a document.
#
# Outside of WWW the most common use of TCP is for long lived connections,
# that once they are gone mean we no longer need the network connection.
# We don't neccessarily want to wait 10 minutes for the connection
# to go down when we don't have any telnet's or rlogin's running,
# so we want to speed up the timeout on TCP connections that have
# shutdown. We do this by catching packets that do not have the live flag set.
# --- start of rule set proper ---
# When initiating a connection we only give the link 15 seconds initially.
# The idea here is to deal with possibility that the network on the opposite
# end of the connection is unreachable. In this case you don't really
# want to give the link 10 minutes up time. With the rule below
# we only give the link 15 seconds initially. If the network is reachable
# then we will normally get a response that actually contains some
# data within 15 seconds. If this causes problems because you have a slow
# response time at some site you want to regularly access, you can either
# increase the timeout or remove this rule.
accept tcp 15 tcp.syn
# Keep named xfers from holding the link up
ignore tcp tcp.dest=tcp.domain
ignore tcp tcp.source=tcp.domain
# Keep netbios from holding us up as well.
ignore tcp tcp.source=tcp.netbios-ns,tcp.dest=tcp.netbios-ns
# (Ack! SCO telnet starts by sending empty SYNs and only opens the
# connection if it gets a response. Sheesh..)
accept tcp 5 ip.tot_len=40,tcp.syn
# keep empty packets from holding the link up (other than empty SYN packets)
ignore tcp ip.tot_len=40,tcp.live
# make sure http transfers hold the link for 2 minutes, even after they end.
# If the link is already down, don't let a FIN packet bring it back up.
# NOTE: Your /etc/services may not define the tcp service www, in which
# case you should comment out the following two lines or get a more
# up to date /etc/services file. See the FAQ for information on obtaining
# a new /etc/services file.
ignore tcp !tcp.live,tcp.dest=tcp.www
ignore tcp !tcp.live,tcp.source=tcp.www
accept tcp 120 tcp.dest=tcp.www
accept tcp 120 tcp.source=tcp.www
# Once the link is no longer live, we try to shut down the connection
# quickly.
keepup tcp 5 !tcp.live
ignore tcp !tcp.live
# IP Masquerading splits the TCP/IP connection inbound/outbound
# Detect the FIN and allow 30 s for the acknowledgement
keepup tcp 30 tcp.fin # jmk 97.10.20 (added)
ignore tcp tcp.fin # jmk 97.10.20
# an ftp-data or ftp connection can be expected to show reasonably frequent
# traffic.
accept tcp 120 tcp.dest=tcp.ftp
accept tcp 120 tcp.source=tcp.ftp
#NOTE: ftp-data is not defined in the /etc/services file provided with
# the latest versions of NETKIT, so I've got this commented out here.
# If you want to define it add the following line to your /etc/services:
# ftp-data 20/tcp
# and uncomment the following two rules.
#accept tcp 120 tcp.dest=tcp.ftp-data
#accept tcp 120 tcp.source=tcp.ftp-data
# If we don't catch it above, give the link 10 minutes up time.
accept tcp 600 any
# Rules for UDP packets
#
# We time out domain requests right away, we just want them to bring
# the link up, not keep it around for very long.
# This is because the network will usually come up on a call
# from the resolver library (unless you have all your commonly
# used addresses in /etc/hosts, in which case you will discover
# other problems.)
# Note that you should not make the timeout shorter than the time you
# might expect your DNS server to take to respond. Otherwise
# when the initial link gets established there might be a delay
# greater than this between the initial series of packets before
# any packets that keep the link up longer pass over the link.
# Don't bring the link up for rwho.
ignore udp udp.dest=udp.who
ignore udp udp.source=udp.who
# Don't bring the link up for RIP.
ignore udp udp.dest=udp.route
ignore udp udp.source=udp.route
# Don't bring the link up for NTP or timed.
ignore udp udp.dest=udp.ntp
ignore udp udp.source=udp.ntp
ignore udp udp.dest=udp.timed
ignore udp udp.source=udp.timed
# Don't bring up on domain name requests between two running nameds.
#ignore udp udp.dest=udp.domain,udp.source=udp.domain
# Bring up the network whenever we make a domain request from someplace
# other than named.
accept udp 30 udp.dest=udp.domain
accept udp 30 udp.source=udp.domain
# Do the same for netbios-ns broadcasts
# NOTE: your /etc/services file may not define the netbios-ns service
# in which case you should comment out the next three lines.
ignore udp udp.source=udp.netbios-ns,udp.dest=udp.netbios-ns
accept udp 30 udp.dest=udp.netbios-ns
accept udp 30 udp.source=udp.netbios-ns
# keep routed and gated transfers from holding the link up
ignore udp tcp.dest=udp.route
ignore udp tcp.source=udp.route
# Anything else gest 2 minutes.
accept udp 120 any
# Give icmp packets 30 seconds.
accept icmp 30 any
# Any packets we did not catch above belong to some bizzare protocol
# that we don't know about. We ignore them.
diald.conf
mode ppp
connect "/etc/ppp/chatscript"
device /dev/ttyS1
speed 115200
modem
lock
crtscts
local 192.168.0.1
remote 192.168.0.2
dynamic
defaultroute
fifo /etc/diald.fifo
include /usr/local/lib/diald/standard.filter
pppd-options lcp-echo-interval 10 lcp-echo-failure 2
Last updated: May 20, 2005
J. William Snyder, Jr. (
)
Back to the Will's Home Page