Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
linux_router:ubuntu [2024-12-15 Sun wk50 10:13] – [Router Configuration] baumkplinux_router:ubuntu [2024-12-15 Sun wk50 11:30] (current) – [Ubuntu Router Setup] baumkp
Line 12: Line 12:
     - NAT obfuscates Local IP addresses behind public addressable WAN IP address(es).  This obfuscation arguably provides some security. The key security is the restriction of gateway traffic into the LAN. See interesting notes on this from [[https://www.grc.com/nat/nat.htm|GRC NAT Router Security Solutions]], note that I do not necessarily agree with NAT being a primary security function (The primary security function is the firewall that only allows a type of one way start of discourse. NAT does provide some obfuscation, but this is of very limited security value to an experience hacker, double NAT also allows double fire wall, but the performance affects and complexity on the LAN are simply not worth the trouble.  Also again many vectors of hacker attack can by-pass this type of security.)     - NAT obfuscates Local IP addresses behind public addressable WAN IP address(es).  This obfuscation arguably provides some security. The key security is the restriction of gateway traffic into the LAN. See interesting notes on this from [[https://www.grc.com/nat/nat.htm|GRC NAT Router Security Solutions]], note that I do not necessarily agree with NAT being a primary security function (The primary security function is the firewall that only allows a type of one way start of discourse. NAT does provide some obfuscation, but this is of very limited security value to an experience hacker, double NAT also allows double fire wall, but the performance affects and complexity on the LAN are simply not worth the trouble.  Also again many vectors of hacker attack can by-pass this type of security.)
     - NAT obfuscation wrecks simple end to end IP addressing that is required for some services, e.g. VoIP.  This requires additional services to compensate, e.g. STUN/TURN services.     - NAT obfuscation wrecks simple end to end IP addressing that is required for some services, e.g. VoIP.  This requires additional services to compensate, e.g. STUN/TURN services.
 +    - I have tried to use IPv6 via a HE tunnel arrangement, but felt this was not would the trouble in the end.  I am not sure if I would use NAT on a IPv6 LAN, but a good firewall is absolutely mandatory in all cases.
 Key networks services, such as DNS and DHCP are separate functions that a router may perform, although correct router setup is required to allow these services to function. Key networks services, such as DNS and DHCP are separate functions that a router may perform, although correct router setup is required to allow these services to function.
  
Line 25: Line 26:
 =====Ubuntu Router Setup===== =====Ubuntu Router Setup=====
 ++++tl;dr;| ++++tl;dr;|
 +See [[https://arstechnica.com/gadgets/2016/04/the-ars-guide-to-building-a-linux-router-from-scratch/|The Ars guide to building a Linux router from scratch]]\\
 Download the latest Ubuntu Server amd64 ISO file from the Ubuntu website. I setup the IPMI KVM to provide virtual storage to the Ubuntu ISO file and started up the Router. The Ubuntu software loads up of the ISO across the KVM virtual storage setup and can be then setup as normal. When setting up Ubuntu below are some the of keypoints: Download the latest Ubuntu Server amd64 ISO file from the Ubuntu website. I setup the IPMI KVM to provide virtual storage to the Ubuntu ISO file and started up the Router. The Ubuntu software loads up of the ISO across the KVM virtual storage setup and can be then setup as normal. When setting up Ubuntu below are some the of keypoints:
   *I set-up Ubuntu to use LAN port 2, as I want to use LAN port 1 as the Router WAN port.   *I set-up Ubuntu to use LAN port 2, as I want to use LAN port 1 as the Router WAN port.