Ideas for design: November 2008

IpCop Installation tutorial - Get a corporate level hardware firewall for peanuts!

So your networks starting to expand, and your starting to get worried about security. Some of your machine’s seem unusually slow when running a software firewall.

Ipcop is the solution for you – It can run on as little as a p3 200mhz CPU With 128 ram – Perfect if you’ve got some old kit lying around. Another advantage of using less powerful equipment is that it will use a lot less electricity.

Another thing that your firewall machine needs to have is two network cards. The way that IPCop works is there are (this is using IPcop for a simple firewall, you can configure it with as many as 4 network cards) it uses two “zones” one called green, one called red. One network card is the input, one is the output.

This is how the firewall in my tutorial will be configured:

First thing you need to do is download the latest version of IpCop from there website: http://www.ipcop.org/
In my tutorial I am going to be using the download ipcop-1.4.18-install-cd.i386

Once downloaded, burn the ISO to CD using Nero or another burning program.

Once burnt, pop the CD in your firewall server and set the BIOS to boot from CD.

(Important note: The installation will wipe your hard drive, make sure that all data you want off the hard drive is backed up )

(Pre install note1 : It make the setup a lot easier if you figure out which network card is which. Plug your router into one network card and write down what make / model that network card is along with the fact it is the router side. Do the same with the switch / hub network card)

(Pre install note 2: It is ALOT easier to use two PCI cards than one onboard and one PCI, this is down to IPcop Driver support)

Once booted from CD, you will be presented with the following screen:

Hit the enter key to install Ipcop.

Once loaded up, select English and press enter

Press enter again to get passed the welcome screen.

On the next screen select CDROM / USB Key and press enter

Press OK Again to the formatting screen.

At the next screen press the up key until you reach Skip, and press the space bar to select Skip. Then tab down to select Ok and press return.

This is where it gets slightly complicated. Select Probe and press return.

At this point Ipcop should have found two network cards, if not – don’t worry, I will include a troubleshooting guide at the bottom for this (its most likely that if you are using dual PCI Network cards then IPcop will detect them both, but it is likely if you are using one PCI and one onboard that it will want the drivers for the onboard network card). Press return to continue.

Now, this screen is where you setup the IP address for your firewall (Ipcop acts as a DHCP Server as well as firewall). I suggest 192.168.2.1 as the IP you use, as most routers use 192.168.1.1 as there IP address and you don’t want to run into conflicts between your Router and your DHCP firewall (IPCop in this case). Leave the network mask as default (255.255.255.0). Once this information is entered press return to continue.

Press Return on the next screen. Remote your IP CD from the CD drive.

At the next screen scroll up to select UK and tab to OK, then press return.

At the next screen scroll down to select “Etc/Greenwich” and tab to OK, then press return.

At the next screen this is where you enter your firewalls network name – I would leave at set the default of “ipcop”. Tab to OK and press return.

At the next screen this is where you input your domain name. This is whatever your current network is on, you can find this out by pressing right clicking on My computer, click properties, clicking computer name and see it under Workgroup:

My network is called “Ollie” so I entered this into the Domain name field – Then tab to OK and press return.

At the next screen tab to select “Disable ISDN” and press return.

At the next screen, this is the most important part of the configuration. Tab to “Network Configuration Type” and press return.

At the next screen, scroll down to select “GREEN + RED” and press return.

Now you are back at the initial configuration page, scroll down to “Drivers and card assignments”. This is where your earlier notes on which network card is which come into play. Press return “Drivers and card assignments”” is selected.

At the next screen press return to OK the fact you want to change the settings.

At this point, it should say there is an unclaimed network card. Press return at this screen

At this next screen press return to continue.

At the next screen scroll down to “Drivers and card assignments” again and press return.

At the next screen look at which network card is defined as “RED” and which is “Green”. Look at your notes and plug the cable from your router into the “RED” network card and the cable to your switch / hub into the “GREEN” network card. Press return to go back to the initial configuration page.

At the next screen scroll down to select “Address Settings” and press return.

At the next screen scroll down to select “RED” and press return.

At the next screen scroll down to select DHCP and press Return. Leave the hostname as the default. Tab to OK And press Return.

At the next screen tab to Done and press return to go back to the initial configuration screen.

At the next screen Scroll to the bottom and select “DHCP server configuration”. Press return.

At the next screen there should be a start next to “Enabled”. If there isn’t please re read the last section on Address Settings. Next tab to “Start address” and enter 192.168.2.2 (One more IP address than the IP you defined for the IP address of the firewall PC your working on now). Next tab down to end address and enter 192.168.2.50 (this is what I recommend for the averadge home network, if you are doing this corporate level you may want to do more than a 50 ip address block). Once you have input those details, tab down to OK and press return to go back to the initial configuration screen.

At the next screen tab to Done and press return.

At the next screen tab to OK and press return, since you have already configured this information.

Now that the configuration of all the interfaces and IP address has been done you now need to enter your passwords. IPcop creates three account, One called admin, once called root and one called backup. Root logs you into the command line (both physically of it you are SSH’d into the machine – SSH will be covered later) admin is the username for the web interface and backup, is, a backup account.

Enter your password for root twice and press OK (careful – you don’t get astrix’s for each character you enter – even thought you’ve typed something in it doesn’t show you have in the box). Tab to OK and press return once you have done this. Do the same for both of the other screens that ask your for passwords for the admin and backup accounts.

At the next screen press enter to reboot the PC – make sure your installation CD is out of the drive.

At this point your machine will reboot – watch it boot through until you get this screen:

At this point the install is done and you need to switch to your client machines connected to the hub / switch. However before this, power off the switch, leave it 15 seconds or so, and power it back on.

Boot up a client machine connected to the hub and logon. Click start>run>type cmd and click OK. When command line comes up type “ipconfig” and press return. You should now see your ip address settings for your client machine. It should read (As long as you’ve used my settings ive used in the tutorial):

IP Address: 192.168.2.something
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.2.1

If this is the case then all is well and your firewall installation is correct. If not, please refer to the troubleshooting section at the bottom of this tutorial.

At this point you could quite easily leave it – Everything Is up and running and working – However, there are lots of neat features IpCop has that you wouldn’t miss out on. Open up your web browser and type in the address bar:

http://192.168.2.1:81

Click Go and you should be confronted by this screen:

From the status menu click “system status”. You will now be confronted with a login box. Under username put admin (important – Don’t use a capital A, its lower case). For password input the password you put in earlier.

You are now logged in with admin privileges, meaning you can edit settings e.t.c.

This status page shows you all kinds of things about your firewall, but the most important bit is that status centre. Here you can see all the services that are running / not running on your firewall. By default Intrustion Detection (A neat tool that analysis your network traffic and look for possibly hacking activity that mite be happing to you – Then automagically blocks that traffic) is disabled. To enable this:

Click “Services” tab and click “Intrusion Detection”. At the next page click the boxes next to “GREEN” and “RED”. IpCop uses a technology called Snort that downloads update files with definitions of hacking activities (like anti virus updates but for intrusion detection). To get these updates you need to register with snort. Follow the instructions of signup and how to get the Oink Code, and paste the code into the box. Click Save, then Click “Apply now”. Congratulations – you are now protected.

Now the rest is up to you – Have a look around the interface and see what you like. In particular take a look at the Firewall tab – This has all kinds of advanced firewall settings you can setup.

Final Note: Since you are now protected by a dedicated firewall, turn the inbuilt firewall off on the Router. Since all traffic goes through Ipcop, this feature on your router is no longer needed.

TROUBLESHOOTING:

Q) It doesn’t pickup my onboard network card! Help!

First thing you need to do is find out what make / model your onboard network card is. For this example I am doing to say that it is a Realtek adapter. At the configure networking screen tab to Select and press return.

At the next screen scroll down the list until you see the make and model of the onboard control you are using – Then press return. You should now be able to select and use your onboard interface. Still not working? Well then use a PCI network card instead – Im tired and this tutorial is big enuff already

Q) I cant connect my client machine to the new network! Help!
Sometimes your client may be set to use a specific IP address – And not be set to Automatic, which it should be. In Windows XP Click start>Control Panel>Network Connections>Right click on your network connection>click properties>scroll down to “Internet Protocol (TCP/IP)> select and press Properties. Click the “Obtain an IP address automatically” radio button. Click “Obtain DNS server address automatically” radio button as well. Click OK. Click OK again to the Properties dialog.

You should now be able to connect.

Q) What the hecks DHCP?

http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol