How to share the internet connection?

Question

An ordinally network topology in picture:



In words:
- "server" (e.g.: an Ubuntu 10.04 LTS) is connected to the "internet" through pppoe connection

- "server" is using it's wireless card in AP mode, so it could share the internet connection through wireless to the clients (WPA2/AES/63 char pass)

- The "server" has two ethernet ports: 1-is for the internet(using pppoe); 2-is connected to a gbit switch, were the clients also are connected

- The "server" (10.0.0.1) has a dhcp server (10.0.0.0/8), so the clients automagically got IP addresses, DNS server addresses and gateway addresses

- The "server" has a dns server (10.0.0.1), so the dns queries are cached, (better "network speed feeling")

- Extra: on the "server", there is an OpenVPN server, so the clients can OpenVPN to the server (even if not in the subnet, e.g.: from a netcafe)

- ExtraExtra: the "server" can be configured in two modes: 1-no internet forwarding to any client, just only after it's connects through OpenVPN; 2-internet forwarding to any client and optionally they could use OpenVPN to have a secure/authenticated tunnel

Question: How I need to configure the "server" to make this work (permanently, I mean no manual interaction is required after the server reboots, e.g.: the dhcp server starts automatically, internet forwarding is ok, openvpn is started, wifi is working, pppoe connection to the ISP is up, DNS server is working)?

Or does anyone has any exact howtos regarding this setup? Or at least part of them?

Answer 1

Gentoo Linux has a very nice Home Router Guide in it's Gentoo Linux Documentation: http://www.gentoo.org/doc/en/home-router-howto.xml

Many of the steps can be adapted to use with Ubuntu.

Answer 2

Note: This is from my own, very small home network, and I'm not a network guy. I don't understand much of why it works and will remove this post soon, if a better one occurs. Just in case it takes some time, this might be a start, but without anything about VPN.

I'm not sure whether I know what you know, and what you are searching for.

I think you have a pppoe-connection, dns-server up, dhcp up and running.

You just need to know how to do the forwarding, and the VPN-stuff? I don't know about the VPN.

After connecting pppoe, start this in the init-process or network-ifup:

#!/bin/bash
# test if ip-forward is up - if not, enable it:
#
ipf=$(cat /proc/sys/net/ipv4/ip_forward)
if [[ ipf -eq "0" ]] ; then 
    echo "1" > /proc/sys/net/ipv4/ip_forward
fi
#
# forward-masquerade
#
. /etc/ppp/masquerade
#
# start dhcp-server now

The /etc/ppp/masquerade could look like this:

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
#
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
#
iptables -A FORWARD -p tcp --tcp-flags SYN,RST, SYN -j TCPMSS --clamp-mss-to-pmtu

If the clients specify the server as their default gateway, they should have access to the net now.

IPv4-forwarding could be enabled by editing /etc/sysctl.conf too, and is, after testing, a better idea for a permanent setting.

From the comments in my /etc/sysctl.conf file, I guess you may control all the stuff from there, but don't ask me how. :)

Answer 3

If your server does nothing more than to serve as a firewall, you can use one of these ad-hoc linux distributions: ipcop or ipfire.

Both of them will transform your server in a highly configurable firewall with quite all your requirements in a couple of minutes.

OpenVPN is available as a plug-in for both of them but I never used this option.

Answer 4

You can always check the well-known Arch Wiki:

https://wiki.archlinux.org/index.php/Internet_Share