IPCop Firewall

Dave Whiteside wrote:
> Doc. Caliban wrote:
> SNIP
>   
>> I count on this add-on heavily, and since one of the updates is SP3  
>> (for better or worse) I will have at least 300 people accessing it if  
>> it's actually in the cache and accessible.
>>
>> Thanks,
>>
>> -Doc
>>
>>   
>>     
> For 300 People and windows updates [well for 30 people] I'd get a 
> Windows Server running on your network providing WUS services - and get 
> them all to connect to that 1st ... this will mean one machine will 
> hammer the internet and all the theres will hammer that machine
>   

Umm, could the proxy on IPCop not be used as well i.e. once the first
person has downloaded it, the rest will get it from the proxy? I ask as
it is what I want to do for Windows and OpenSuSE updates.

Hylton Conacher (ZR1HPC) wrote:
> Dave Whiteside wrote:
>   
>> Doc. Caliban wrote:
>> SNIP
>>   
>>     
>>> I count on this add-on heavily, and since one of the updates is SP3  
>>> (for better or worse) I will have at least 300 people accessing it if  
>>> it's actually in the cache and accessible.
>>>
>>> Thanks,
>>>
>>> -Doc
>>>
>>>   
>>>     
>>>       
>> For 300 People and windows updates [well for 30 people] I'd get a 
>> Windows Server running on your network providing WUS services - and get 
>> them all to connect to that 1st ... this will mean one machine will 
>> hammer the internet and all the theres will hammer that machine
>>   
>>     
>
> Umm, could the proxy on IPCop not be used as well i.e. once the first
> person has downloaded it, the rest will get it from the proxy? I ask as
> it is what I want to do for Windows and OpenSuSE updates.
>
> -------------------------------------------------------------------------
>   
I think windows makes it hard, as they get downloaded via BiTS - a few 
years back I looked at the connections when windows was doing it's stuff 
and it was bringing the conenction to it's kness - so I inversted in a 
MS server [mainly for this but use it for a couple of other windows things]
now they all get the updates from that and my connection is happy

I'm not 100% sure that the cache wont work for this but I'm happy to be 
told otherwise

Since the specs for the device don't list Linux as supported OS, you 
will need to find a driver for it. You might try asking the manufacturer 
if they will be providing one in the future, but I wouldn't hold my 
breath. And until there is a driver (and is to be compatible with a 2.4 
series kernel) you are out of luck.

R G wrote:
> I am trying to use a USB Ethernet Adapter on a new IPcop installation.
> 
> "AirLink 101 ASOHOUSB 10/100Mbps Fast Ethernet USB 2.0 Adapter"
> http://www.airlink101.com/products/asohousb.php
> 
> It does not appear in the list of supported hardware.
> 
> It has worked on boot up, on typical Linux desktop installs (like Ubuntu).
> 
> If anyone knows how to make this work with IPcop, please help me.
> 
> Thanks.
> 
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> IPCop-user mailing list
> IPCop-user@...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user

On Sat, Jun 28, 2008 at 11:33:40PM -0400, William Colls (william@...) wrote:
 
> Since the specs for the device don't list Linux as supported OS, you 
> will need to find a driver for it. You might try asking the manufacturer 
> if they will be providing one in the future, but I wouldn't hold my 
> breath. And until there is a driver (and is to be compatible with a 2.4 
> series kernel) you are out of luck.

That parenthetical statement is the key.

There are lots of USB-ethernet adapters that have drivers in current
standard kernel - 2.6 series that is - but don't work with 2.4 series.
Indeed it seeems quite hard to find one that _does_ work with 2.4.
(and IPCop).

Indeed that is the main reason I'm hoping IPCop 2.x comes out soon:
it has 2.6 series kernel with its better support for new hardware.

As for the ASOHOUSB, since it worked out of the box in Ubuntu,
it probably has some chipset that's supported in 2.6 but not 2.4.
Plugging it in the Ubuntu box would allow determining which chipset
it has and checking if there's a driver for 2.4.x. 

-- 
Tapani Tarvainen

Recently installed a ZOOM X4.  I found a very good bridging instruction
at ZOOM support.  Maybe you should check for this FAQ in ZOOM support
and check your bridge settings.

On Fri, 2008-06-27 at 11:15 +0100, Brian wrote:
> IPCop 1.18
> Zoom ADSL bridge modem
> 
> I have been trying to setup a PPPoE connection in IPCop using a Zoom 
> bridge modem which apparently allows one to use software (IPCop) 
> designed for PPPoE ADSL connections even though the actual ADSL 
> connection - as provided by BT internet - is PPPoA.
> 
> I have set up IPCop, apparently successfully, up to the stage of 
> specifying that PPPoE is being used.
> 
> I have opened IPCop in Firefox and gone to the dialup page under the 
> menu entry 'network'.   Here I have entered the username and password 
> for the PPPoE connection, and chosen automatic DNS.   I saved the page 
> and rebooted IPCop.
> 
> Once IPCop had rebooted I tried to connect (from the home page) but with 
> no success.   Typical of the error messages in the system log were:-
> 
> PPP has gone up on ppp0
> IPCop started
> Error:  Can't start red when its still active
> 
> I also notice that in the firewall logs there were entries of blocked 
> transmissions directed to an IP number which is my IP address actually 
> assigned by BT.   This seems to suggest that my configuration is almost 
> correct.
> 
> If anyone can give any indication of what I might try I would be very 
> grateful.
> 
> Incidentally, I am currently using a Zoom modem including a firewall and 
> a NAT.   This appears to be functioning very well with IPCop except that 
> there is double natting, and it was the double natting that initiated my 
> attempts at using a bridge modem.   In more detail, the NAT in the Zoom 
> firewall modem allocates 10.0.0.4 to IPCop which then passes this - 
> presumably using its NAT - to the network.
> 
> Regards to all
> 
> Brian
> 
> 
> 
> 
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> IPCop-user mailing list
> IPCop-user@...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user

On Thu, Jun 26, 2008 at 10:32 PM, mick winnett <help@...>
wrote:

> I have installed ipcop on an old box 400 MHz pentium2 with 385 mb ram 8 gig
> hd which I think may be sufficient for what I need.   It's up and running,
> and I'm connecting through it now, it goes through an isp provided dsl
> router which supplies an external ip address on login.   The router does
> dhcp and ipcop does dhcp too, should I turn off the dhcp in the router?
> Or
> does it not matter?
>

I think the router's dhcp is giving ip to ipcop, and ipcop's dhcp is giving
ip to your lan. So, it's ok to run both.


> For antivirus I read about copfilter, Is there a good guide to setting that
> up?   It looks like it might be complicated for a Linux newbie.   Is there
> a
> preferred order to install?
>

For any ipcop's addons, the general rules of thumb are:
1. Download the version for your ipcop's version.
2. Copy the downloaded addon into your ipcop through scp.
example: scp -P 222 filename.tar.gz root@...:
3. Connect to ipcop by ssh or from the console
4. Find and extract the file:
tar zxvf filename.tar.gz
5. Usually there will be a directory with the same filename name.
Go into it: cd directoryname.
6. Do: ls
See if there's a readme file. Follow the instruction.
-- 
Cheers,
Linux tutorial http://linux2.arinet.org
Let's use OpenOffice http://www.openoffice.org

> 
> For any ipcop's addons, the general rules of thumb are:
> 1. Download the version for your ipcop's version.
> 2. Copy the downloaded addon into your ipcop through scp.
> example: scp -P 222 filename.tar.gz root@...:
> 3. Connect to ipcop by ssh or from the console
> 4. Find and extract the file:
> tar zxvf filename.tar.gz
> 5. Usually there will be a directory with the same filename name.
> Go into it: cd directoryname.
> 6. Do: ls
> See if there's a readme file. Follow the instruction.

I just want to add that I use WinSCP because it has a gui and runs on
windows.  It will also launch putty for you so you can install the untar and
install the package after it is copied over.
I think the OP would probably get a bit out or reading the admin guide for
Advproxy, as it goes into it a little bit I think.
There must be a guide somewhere on using winscp and ipcop to install an
addon?  A bit of trial and error goes a long ways for first timers, do not
be afraid, just get stuck into it.  Worst case is you have to re-install
IPCop from scratch.

Maybe the OP would like to look into using BOT, to really lock it down or
perhaps just using OPENDNS and the kid safe filters as DNS servers is
enough?

-- 
Dave Taylor

>>> Stefanos E. Tsorakis<ad.ts@...> 6/25/2008 6:48:58 pm >>>
Well the 2 locations are routed and the router that connects the leased line 
from location B is connected to green network of location A. I assume that 
squid is prohibiting the connections from location B since they seem to be 
coming from the green network but the are using a completely different IP 
range.

I suppose that I have to add the network of location B in squid's acl 
however I am not sure what is the correct way to do it.


Stef 

you could add it to /var/ipcop/proxy/acl
as this seem not to be overwritten by the gui save

I would really recommend installing advanced proxy with updated accelerator
advproxy gives you the options to add acl's and lot's more
go look at http://www.advproxy.net 

Jayson

The weird thing is that I changed the firewall 2 weeks ago and everything 
was working fine until yesterday without anybody touching the firewall 
whatsoever!

Anyway I added the location B network in the squid acl and everything works 
again

----- Original Message ----- 
From: <jayson@...>
To: <Ipcop-user@...>
Sent: Wednesday, June 25, 2008 11:56 PM
Subject: Re: [IPCop-user] squid access control lists


>
>
>>>> Stefanos E. Tsorakis<ad.ts@...> 6/25/2008 6:48:58 pm >>>
> Well the 2 locations are routed and the router that connects the leased 
> line
> from location B is connected to green network of location A. I assume that
> squid is prohibiting the connections from location B since they seem to be
> coming from the green network but the are using a completely different IP
> range.
>
> I suppose that I have to add the network of location B in squid's acl
> however I am not sure what is the correct way to do it.
>
>
> Stef
>
> you could add it to /var/ipcop/proxy/acl
> as this seem not to be overwritten by the gui save
>
> I would really recommend installing advanced proxy with updated 
> accelerator
> advproxy gives you the options to add acl's and lot's more
> go look at http://www.advproxy.net
>
> Jayson
>
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> IPCop-user mailing list
> IPCop-user@...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user

Right ok, so that delay on the DHCP page is being caused by hardware
limitations.
That's the confirmation that I needed.

I've never noticed a problem like this before... response from IPCop is
usually instant.
This is the first time I've noticed a potential performance problem.

Thanks, B


PS: Sorry for dbl post... didn't hit reply to all


2008/6/26 Ben Bradley <ben@...>:

> Right ok, so that delay on the DHCP page is being caused by hardware
> limitations.
> That's the confirmation that I needed.
>
> I've never noticed a problem like this before... response from IPCop is
> usually instant.
> This is the first time I've noticed a potential performance problem.
>
> Thanks, B
>
>
> 2008/6/26 Johnny Miller <millerj@...>:
>
> You need a more a power full pc to handle this.  Here is what one guy told
>> me about spec's for a good solid Ipcop box is.  This guy tells me this is
>> the best and what he uses when he sells his services to use Ipcop.
>>
>>
>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>> I started out using spare p4 2.8ghz systems I was obtaining from customer
>> upgrades...but for the last year, I have been using some small form factor
>> MSI systems that have one onboard nic. I then add one netgear nic and a
>> 3com
>> nic for a total of three interfaces.  The systems I have that have four
>> interfaces use supermicro boards with 4 intel e1000 nics onboard.  Most
>> customers don't really need this though because if their network
>> requirements are that extensive, they will usually have multiple IP
>> addresses and I setup a completely seperate DMZ on a completely seperate
>> IP
>> and use multiple routers to control traffic.
>>
>> Anyways, a few rules of thumb for a maintenance free IPCop box...Celeron
>> 2.0GHz or higher will give you great performance and little headache,
>> 512MB
>> Ram or higher, I use 1GB since most boxes are in business setting. I use
>> 80GB drives but 40GB is more than enough.  IPCop does not support SATA
>> drives without modification...stick to IDE drives for now. As for the
>> motherboard, I prefer to stick with intel based boards, I don't much care
>> for via chipsets or other chipsets due to reliability. For Linux based
>> routers, intel chipsets and intel cpus will cause you less grief; however,
>> if you ever wanna tinker with 64bit Linux OS versions, AMD kicks ass but
>> are
>> not as reliable in business environments.
>>
>> Download Putty and WinSCP on any Windows PC attached to the green
>> interface:
>> Putty - http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html<http://www.chiark.greenend.org.uk/%7Esgtatham/putty/download.html>
>> WinSCP - http://winscp.net/eng/index.php
>>
>> For best results, load in this order:
>> 1. IPCop 1.4.18 ISO if possible or whatever version you can get to load
>> 2. addons-2.3 from here:
>>
>> http://prdownloads.sourceforge.net/firewalladdons/addons-2.3-CLI-b2.tar.gz?d
>> ownload
>> 3. Latest Copfilter for the ver of IPCop you installed from here:
>> http://www.copfilter.org/downloads.php
>> 4. Advance Proxy from here: http://www.advproxy.net/
>> 5. URLFilter from here: http://www.urlfilter.net/
>>
>> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>>
>>
>>
>> -----Original Message-----
>> From: ipcop-user-bounces@...
>> [mailto:ipcop-user-bounces@...] On Behalf Of Ben
>> Bradley
>> Sent: Thursday, June 26, 2008 5:30 AM
>> To: ipcop-user@...
>> Subject: [IPCop-user] DHCP web admin page... long delay in loading
>>
>> Hi everyone
>>
>> A few days ago I turned the DHCP service off on our Exchange server, and
>> activated it on IPCop.
>> I want IPCop to be handling as much as possible, as we're planning to
>> phase
>> out the Exchange server over the next 6 months. We're only a small
>> business
>> of 10-15 users.
>> I've added a bunch of static leases which correspond to our various
>> servers,
>> to make sure they don't wander onto different IP addresses.
>> Their IP addresses are also set manually in network properties.
>> Everything seems to be working perfectly so far, slightly better in fact.
>>
>> Anyway, I've noticed that when loading the IPCop DHCP admin page I'm
>> getting
>> a significant delay in the loading. Often of about 1 minute before the
>> page
>> completes.
>> In firefox it appears to stall at the Current Fixed leases section of the
>> DHCP admin page.
>>
>> Is this due to my really old hardware (Pentium 2, 250MHz) or is this how
>> it
>> always happens?
>> I guess the delay could be caused by the way IPCop reads/processes the
>> information on current DHCP leases, but I don't know enough about IPCop or
>> Linux to know what IPCop actually does behind the scenes here to generate
>> this information.
>>
>> Any ideas/suggestions/comments?
>>
>> Thanks, Ben
>> -------------------------------------------------------------------------
>> Check out the new SourceForge.net Marketplace.
>> It's the best place to buy or sell services for
>> just about anything Open Source.
>> http://sourceforge.net/services/buy/index.php
>> _______________________________________________
>> IPCop-user mailing list
>> IPCop-user@...
>> https://lists.sourceforge.net/lists/listinfo/ipcop-user
>>
>>
>

We will (hopefully) be replacing Exchange with the most excellent Zimbra!
So long as Microsoft continue to stay away from Yahoo that is.
This will mean no more fudged M$ proprietory IMAP implementation for our
Mac/Thunderbird users!!

At some point I do want to build a small mini ITX or 1U rackmount machine to
run IPCop, but there should be a spare Intel Celeron desktop machine
available within a few months.

Thanks, B


2008/6/26 Johnny Miller <millerj@...>:

>  Yes I have an old 433 mhz pc and I loaded with all the stuff on that page
> I sent you and it came to a crawl.  After I removed everything except
> copfilter I was back in business.  I'm going to be getting a pc like the one
> he spec'ed and load it to test it out.  This guy I have been chatting with
> said this is what he uses and he has no problems.
>
>
>
> What are you going to use instead of exchange if I may ask?
>
>
>  ------------------------------
>
> *From:* batfastad@... [mailto:batfastad@...] *On Behalf Of *Ben
> Bradley
> *Sent:* Thursday, June 26, 2008 6:17 AM
> *To:* Johnny Miller
> *Subject:* Re: [IPCop-user] DHCP web admin page... long delay in loading
>
>
>
> Right ok, so that delay on the DHCP page is being caused by hardware
> limitations.
> That's the confirmation that I needed.
>
> I've never noticed a problem like this before... response from IPCop is
> usually instant.
> This is the first time I've noticed a potential performance problem.
>
> Thanks, B
>
>  2008/6/26 Johnny Miller <millerj@...>:
>
> You need a more a power full pc to handle this.  Here is what one guy told
> me about spec's for a good solid Ipcop box is.  This guy tells me this is
> the best and what he uses when he sells his services to use Ipcop.
>
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
> I started out using spare p4 2.8ghz systems I was obtaining from customer
> upgrades...but for the last year, I have been using some small form factor
> MSI systems that have one onboard nic. I then add one netgear nic and a
> 3com
> nic for a total of three interfaces.  The systems I have that have four
> interfaces use supermicro boards with 4 intel e1000 nics onboard.  Most
> customers don't really need this though because if their network
> requirements are that extensive, they will usually have multiple IP
> addresses and I setup a completely seperate DMZ on a completely seperate IP
> and use multiple routers to control traffic.
>
> Anyways, a few rules of thumb for a maintenance free IPCop box...Celeron
> 2.0GHz or higher will give you great performance and little headache, 512MB
> Ram or higher, I use 1GB since most boxes are in business setting. I use
> 80GB drives but 40GB is more than enough.  IPCop does not support SATA
> drives without modification...stick to IDE drives for now. As for the
> motherboard, I prefer to stick with intel based boards, I don't much care
> for via chipsets or other chipsets due to reliability. For Linux based
> routers, intel chipsets and intel cpus will cause you less grief; however,
> if you ever wanna tinker with 64bit Linux OS versions, AMD kicks ass but
> are
> not as reliable in business environments.
>
> Download Putty and WinSCP on any Windows PC attached to the green
> interface:
> Putty - http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html<http://www.chiark.greenend.org.uk/%7Esgtatham/putty/download.html>
> WinSCP - http://winscp.net/eng/index.php
>
> For best results, load in this order:
> 1. IPCop 1.4.18 ISO if possible or whatever version you can get to load
> 2. addons-2.3 from here:
>
> http://prdownloads.sourceforge.net/firewalladdons/addons-2.3-CLI-b2.tar.gz?d
> ownload
> 3. Latest Copfilter for the ver of IPCop you installed from here:
> http://www.copfilter.org/downloads.php
> 4. Advance Proxy from here: http://www.advproxy.net/
> 5. URLFilter from here: http://www.urlfilter.net/
>
> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>
>
>
>
> -----Original Message-----
> From: ipcop-user-bounces@...
> [mailto:ipcop-user-bounces@...] On Behalf Of Ben Bradley
> Sent: Thursday, June 26, 2008 5:30 AM
> To: ipcop-user@...
> Subject: [IPCop-user] DHCP web admin page... long delay in loading
>
> Hi everyone
>
> A few days ago I turned the DHCP service off on our Exchange server, and
> activated it on IPCop.
> I want IPCop to be handling as much as possible, as we're planning to phase
> out the Exchange server over the next 6 months. We're only a small business
> of 10-15 users.
> I've added a bunch of static leases which correspond to our various
> servers,
> to make sure they don't wander onto different IP addresses.
> Their IP addresses are also set manually in network properties.
> Everything seems to be working perfectly so far, slightly better in fact.
>
> Anyway, I've noticed that when loading the IPCop DHCP admin page I'm
> getting
> a significant delay in the loading. Often of about 1 minute before the page
> completes.
> In firefox it appears to stall at the Current Fixed leases section of the
> DHCP admin page.
>
> Is this due to my really old hardware (Pentium 2, 250MHz) or is this how it
> always happens?
> I guess the delay could be caused by the way IPCop reads/processes the
> information on current DHCP leases, but I don't know enough about IPCop or
> Linux to know what IPCop actually does behind the scenes here to generate
> this information.
>
> Any ideas/suggestions/comments?
>
> Thanks, Ben
>
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> IPCop-user mailing list
> IPCop-user@...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user
>
>
>

Is it ok if I just add in the /var/ipcop/proxy/acl file

at the end of the line:

acl IPCop_networks src __GREEN_IP__ __BLUE_IP__

the network/netmask of the network in location B?


----- Original Message ----- 
From: "Stefanos E. Tsorakis" <ad.ts@...>
To: <ipcop-user@...>
Sent: Wednesday, June 25, 2008 7:16 PM
Subject: [IPCop-user] squid access control lists


> Hi,
>
> I've got a lease line between 2 locations. All web servers reside on the 
> DMZ
> in location A. All access to the webservers from location B is via the
> leased line.
>
> I was using IPCop + BOT + Cop+ for the past 3 years on this setup with no
> issues. However, I re-installed the firewall on location A with 1.4.18 and
> no addons whatsoever. Since the re-installation the PCs on location B when
> trying to access the webservers on the DMZ of location A they get this
> responce from the IPCop on location A:
>
> "Acess Denied
> Access control configuration prevents your request from being allowd at 
> this
> time. Please contact your service provider if you feel this is incorrect."
>
> Proxy on Green on location A is enabled and transparent.
>
> Any ideas?
>
> Stef
>
>
>
>
> -------------------------------------------------------------------------
> Check out the new SourceForge.net Marketplace.
> It's the best place to buy or sell services for
> just about anything Open Source.
> http://sourceforge.net/services/buy/index.php
> _______________________________________________
> IPCop-user mailing list
> IPCop-user@...
> https://lists.sourceforge.net/lists/listinfo/ipcop-user