Setting up Mandrake 10.1 as a Firewall
As you investigate various Linux Distributions, you will soon notice that some Distributions excel at certain tasks over other Distributions. For example, Novell/Suse provides an excellent authentication/file server with their SLES9 product, Xandros makes for a great desktop for those transitioning from Microsoft Windows, Slackware can't be beat as a terminal client, Debian excels as a general purpose/backup server because of its security team and it's long release cycle, etc.
Mandrake Linux offers one of the best OSS Firewall servers available today. This stems from the fact that Mandrakesoft offers a great product called Multi-Network Firewall (MNF), which was released back in 2002. Mandrakesoft's MNF product offers a gathering of different Open Source Software Projects under a single easy to use web based graphical interface. What is little known, however, is the fact that the functionality of that product has been incorporated into their standard Distribution.
This article will cover installing and configuring Mandrake Linux 10.1 as a Firewall computer. This includes configuring Shorewall for Firewall Services, Named as a caching DNS Server, Squid as a web proxy, Squidguard for web filtering services, along with Snort and Prelude for intrusion detection services. Advanced features, such as Virtual Private Networks and utilizing a Demilitarized Zone are possible using the web interface, but will not be covered here. Note: This article covers setting up Mandrake in a way that is not supported by MandrakeSoft, also there are bugs that I will explain how to work around. If you are not comfortable editing text files on Linux, there are many other firewall distributions available (although IMO this is the best). Proceed at your own risk.
Prerequisites for this install are a Pentium (or higher) based computer with at least 64MB of RAM (mainly for the install), a floppy drive, 2 supported network cards and at least a 1GB hard drive (2GB is recommended if you will use the Squid caching-proxy server). You can also use a single network card and a supported modem if you are going to implement this on a dial-up connection. The firewall computer must also utilize a "supported" video card for the installation routine, as the "text mode" installation will not work properly for our needs.
