J1UAA

               Outlook: look from outside


Day 1. Building gateway
-----------------------

ISO:

  debian 9 mini.iso
  
    http://ftp.nl.debian.org/debian/dists/stretch/main/installer-amd64
      /current/images/netboot/mini.iso

Virtual (VirtualBox) hardware configuration:

  RAM 2048MB NIC1, NIC2 (NAT, Internal Network)

Configure NIC interfaces:
.........................

  # cat /etc/network/interfaces
  
interfaces file contents:

  source /etc/network/interfaces.d/*

  # The loopback network interface
  auto lo
  iface lo inet loopback

  allow-hotplug enp0s3
  iface enp0s3 inet dhcp

  allow-hotplug enp0s8
  iface enp0s8 inet static
          address 10.0.10.1
          netmask 255.255.255.0
          gateway 10.0.10.1
          dns-search google.com
          dns-nameservers 10.0.10.1

EOF

Configure DHCP:

  # apt-get install dnsmasq
  # cat /etc/dnsmasq.conf | grep "^[^#]"
  address=/rate.ee/193.40.160.1
  interface=enp0s8
  dhcp-range=enp0S8,10.0.10.20,10.0.10.25,12h

The last number is how long the DHCP leases are good for.

dns names for local machines:

  # cat /etc/hosts | tail -n ?
  
  ..
  10.0.10.20      ufo0.mars
  10.0.10.21      ufo1.mars
  10.0.10.22      ufo2.mars
  10.0.10.23      ufo3.mars
  10.0.10.24      ufo4.mars
  10.0.10.25      ufo5.mars

  # systemctl restart dnsmasq

Firewall:

I have to admit, that my first attempt to place script here (see below) failed with:

  [FAILED] Failed to start Raise network interfaces.
  See `systemctl status networking.service' for details

Then i run

  # find /etc/network/if-up.d/ -name * -print -exec cat -n {} \;

and made my script more like existing ones.

  # cat /etc/network/if-up.d/00-firewall
  
00-firewall file contents:

  #!/bin/sh
  # Reload the iptables rules and activate forwarding

  set -e

  # Don't bother to restart dnsmasq when lo is configured.
  if [ "$IFACE" = lo ]; then
          exit 0
  fi

  # Only run from ifup.
  if [ "$MODE" != start ]; then
          exit 0
  fi

  # delete all existing rules.
  iptables -Z             # zero counters
  iptables -F             # flush (delete) rules

  iptables -t mangle -F
  iptables -X             # delete all extra chains

  # If you want to clear the chains, then clear the chains:
  iptables --policy INPUT   ACCEPT;
  iptables --policy OUTPUT  ACCEPT;
  iptables --policy FORWARD ACCEPT;

  # Masquerade.
  iptables -t nat -A POSTROUTING -o enp0s3 -j MASQUERADE

  # Enable routing.
  echo 1 > /proc/sys/net/ipv4/ip_forward

  exit 0
  
EOF

Make script executable:

  # cd /etc/network/if-up.d/
  # ls -l 00-firewall
  -rwxr-xr-x 1 root root 479 Mar 30 02:00 00-firewall

Rescue Client .. test connection:

Worst case -- (nothing works)

  % ifconfig enp0s3 10.0.10.100 up
  % route add default gw 10.0.10.1
  % cat /etc/resolv.conf

Best case -- Internet is functional with SystemRescueCD:

  https://netix.dl.sourceforge.net/project/systemrescuecd
    /sysresccd-x86/5.3.2/systemrescuecd-x86-5.3.2.iso

# LINKS
-------

  1. https://medium.com/@cpt_midnight
       /static-ip-in-debian-9-stretch-acb4e5cb7dc1

  2. https://debian-administration.org/article/23
       /Setting_up_a_simple_Debian_gateway
