Gateway box
This documents initially setting up an internet gateway for Couchdesign
for these gateways:
"perilin.jones.dk" locally at "192.168.222.1".
"graograman.jones.dk" locally at "192.168.222.2".
Install and initially setup system
Follow the guide at http://box.redpill.dk/ to install image from there.
Run "box-add-tui" to have terminal user-interface (TUI) tools like Midnight Commander.
Run "box-add-gateway" to have DHCP service and network routing setup.
Adapt gateway settings to local network
Edit file /etc/systemd/network/10-eth0.network;
locate this (likely last) line:
DHCP=yes
replacing the line to set fixed address in a /24 subnet,
like this (adapt address to match this system):
Address=192.168.222.2/24
Edit file /etc/dhcp/dhcpd.conf;
locate the (likely almost last) long line starting like this:
subnet 192.168.101.0 ...
add similar line below but with all mentions of network changed to "192.168.222"
and router changed to the address of this system,
like this (adapt address to match this system):
subnet 192.168.222.0 netmask 255.255.255.0 { range 192.168.222.50 192.168.222.250; option routers 192.168.222.2; }
Edit file /etc/default/isc-dhcp-server;
locate this (likely almost last) line:
INTERFACESv4=""
add builtin network interface like this:
INTERFACESv4="eth0"
Install and setup firewall service
Install package firewalld:
apt install firewalld
Adapt firewalld to match our network topology
(press the actual [TAB] key where mentioned, to autocomplete):
firewall-cmd --set-default-zone=external
firewall-cmd --add-interface=en[TAB]
firewall-cmd --add-service=dhcpv6-client
firewall-cmd --add-service=mosh
firewall-cmd --zone=internal --remove-service=samba-client
firewall-cmd --zone=internal --remove-service=dhcpv6-client
firewall-cmd --zone=internal --add-interface=eth0
firewall-cmd --zone=internal --add-service=dhcp
firewall-cmd --zone=internal --add-service=dhcpv6
firewall-cmd --zone=internal --add-service=dns
firewall-cmd --add-forward-port=proto=tcp:toaddr=192.168.222.250:port=80
firewall-cmd --add-forward-port=proto=tcp:toaddr=192.168.222.250:port=443
firewall-cmd --runtime-to-permanent
Edit file /etc/firewalld/firewalld.conf;
locate this (likely almost last) line:
FirewallBackend=iptables
changing the line to use backend "nftables", like this:
FirewallBackend=nftables
Edit file /etc/systemd/network/10-eth0.network;
locate in section [Network] these options
IPMasquerade=yes
IPForward=yes
Remove both options if they exist (handled by firewalld now).
reboot the system.
