Linux

Ask something
Discussion Locked

Logon to Win2K domain thru Linux firewal

0 helpful
2 replies

by cthomas at johnsonlumber.

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am planning on setting up a nice little Linux box to take the place of a Netopia router our DSL provider supplied at install. We use a Win2K domain here, and I was thinking of setting up a VPN server to log on to the domain and allow access through the broadband connections my users have at home. I figured if I could get a Linux server to handle the VPN logons, everything would be more secure. I'm just not sure how I should go about setting this up. Any help would be greatly appreciated. Thanks!

2 replies

by cxy

You need to setup iptables on your linux box and use port forwarding feature.

The iptables rule is straight-forward, you only need port number where your server (W2K) is listening for incoming connection.

# /sbin/iptables -t nat -I PREROUTING -p tcp -d your_internet_ip_address_here --dport your_port_number -j DNAT --to your_w2k_internal_ip_address_here
# /sbin/iptables -t nat -I POSTROUTING -p tcp -d your_w2k_internal_ip_address_here --dport your_port_number -j SNAT --to your_internet_ip_address_here

Off course you should use -p udp instead of -p tcp if you are listening on udp port.

Hope that helps.

by nico baggus

For VPN you need a little more then just IP
table commands. The IP table commands allow you
to define a firewall.
(more friendly way: fwbuilder)

VPN is supplied by stunnel, (ssl tunnels)
or openswan/strongswan/freeswan/kame for (IPSEC
tunnels).

kame is the IKE component needed for key
negotioation on Linux 2.6

*swan uses pluto for this. On 2.4 kernels you
need one from the *swan family because they also
provide an interface driver (klips) for the
IPSEC protocol. A new version of openswan now
also provides klips for 2.6 kernels.

klips gives you an extra interface so you can
distinguish between traffic throught the tunnel
from traffic outside of the tunnel.
(ipsec0 is bound to eth0 f.e.) Packets from
ipsec0 came from a tunnel through the eth0
interface,
then packets from eth0 just arrived from the
wild side.

Kind regards,

This discussion is closed to new replies.