HN

Comments (41)

• chatmasta
  This is an excellent post and great reference material. I’ve done this a few times before and the information was scattered all over the place. I appreciate the clear and concise writing here. I even added it to my HN favorites - a rare accolade!One thing I’d add, is that the best explanation I’ve ever seen for this, is the famous diagram [0] on Wikipedia of the netfilter API — I remember when I saw that, everything clicked into place. I’m not sure how up to date it is now, but it’s really good.[0] https://commons.wikimedia.org/wiki/File:Netfilter-packet-flo...
• Menu

  freetime2
  Are there any preconfigured images/installers available for a major Linux distro to turn them a router with safe and sensible defaults?I know there is OpenWrt, but my experience is that is more geared toward running on embedded wifi hardware than an x86 machine. The x86 install comes with a tiny root partition that's actually pretty difficult to resize, for example, and upgrades are quite brittle compared to standard Linux distros.And there's also pfSense and OPNsense, but these run on FreeBSD which seems to lag behind Linux for hardware support. There's no support for the Aquantia AQC113 NIC, for example (although it looks like this may finally have been added in the last month or so).Something like an Ubuntu Appliance [1] would be quite nice.[1] https://ubuntu.com/appliance
• Menu

  ValdikSS
  The Linux box instantly turns into a router as soon as you run `sysctl net.ipv4.ip_forward=1`, because the default policy for FORWARD table is ACCEPT.You need to explicitly reconfigure the iptables/nftables to prevent that from happening.Some software, say LXD/Incus, enable forwarding automatically upon installation/startup, and do not configure firewall to block non-their traffic, making the machine an open router. I've reported that, the developers said that's by design (despite other virtualization/containerization systems block forwarding if they happen to enable the sysctl).
• Menu

  Havoc
  Used to run a virtualized firewall setup. And then one day discovered that somewhere along the lines I had made a change (or an update changed something) that meant proxmox admin interface was being served publicly. That's despite confirming during initial setup that it isn't.So now I do not do any funky stuff with firewalls anymore. Separate appliance with opnsense bare metal.
• Menu

  gxs
  My very first exposure to Linux was in 2000, my school was about to throw away an old gateway computer and I took it home and turned it into routerAs a kid with no AI, no google, it was quite a feat and I’m still very proud of itWas my introduction into how the internet works and I’ll never forget working with ipchainsI remember enduring a lot of people in forums calling me a noob, but only after spending collective hours answering my dumb questionsI credit a big part of my moderate success in tech, to being familiar with stuff at just a tad bit lower of a level than the average bearTo my friend Sam who I haven’t talked to in 20 years, thanks for the idea
• ValveFan6969
  [dead]
• Menu

  eqvinox
  [flagged]