To NAT or not to NAT...

[Paddy]

OK, first some background:

I have a 24/7 512/256kbps ADSL connection with 8static IPs. Now only 6of them are usable. Three are statically assigned to my network, and the remainder are dished out by the router, Netgear DG815, via DHCP.

Machine one: My rig – see sig for specs
Machine two: The ‘girlie’ rig - K6-2 500, G100 running XP Pro.
Machine three: The server - P2 350, G100 running slackware 8.1

Ok, so here’s the dilemma.
I am wanting to set up a MS based http/file server with some VPN action and also a dedicated CounterStrike server for some of my mates.

Now I can just about do that now, but I have to forward enough ports for me to question if it is worth keeping NAT. By enabling NAT I of course loose all of my internet valid IPs. If I disable it, then my entire network is both visible and vulnerable to the outside world – with the exception of the server. Rugger made such a good job in configuring it so that even my computer still refuses to believe that it exists.

I don’t know much about MS security. A quick ‘netstat –a’ is horrifying. If I disable NAT then I need to close some ports or at least hide them with a software firewall. I would also need to do this on all three of my machines.

Have any of you considered doing something similar?
Is it best to keep NAT and configure it properly?
Any advice???

TIA!

[MultimediaMan]

Get NAT32+ or NAT32 Pro...it will do everything you want it to...If you want to build a standalone box with 3 NICs in it, you can get SmoothWall and do something very similar.

[Ribbit]

I would definitely keep the NAT for security reasons, and forward the ports. That way, you're only enabling what you need to enable, rather than running around closing security loopholes as you become aware of them. Windows is not secure at all out of the box, and information on securing it beyond "use this third-party firewall" seems to be quite hard to come by. (Watch Gurm disagree )

[Gurm]

No, I'm using NAT now. Only difference is I bought a router to do it, because I tired of Linux's peculiarities regarding the matter.

- Gurm

[Kooldino]

Hypothetical situation: let's say I have 2 boxes on my NATted network, and I want port X fowarded to both of them. Could I just add both IPs to my list? Would it work?

[R.Carter]

Originally posted by Kooldino
Hypothetical situation: let's say I have 2 boxes on my NATted network, and I want port X fowarded to both of them. Could I just add both IPs to my list? Would it work?

Yes but you'll need more than one "real" IP address.

For example, port 25 on two machines and you have two "real" IP addresses

1.2.3.4:25 -> 192.168.1.4:25
1.2.3.5:25 -> 192.168.1.5:25

So when someone tries to use port 25 on either of the two machines NAT will know which machine to send the traffic to.

If you only have one "real" IP address then you'll need to do the following which isn't what you wanted to do

1.2.3.4:8025 -> 192.168.1.4:25
1.2.3.4:25 -> 192.168.1.5:25

[Brian R.]

Use NAT. Also, if you are going to keep the server behind the router, keep an eye on packet loss. Routers starts introducing packet loss as the data transfer rates get higher. Different routers will start crapping out at different data transfer rates. You may configure your game and number of players to miminize packet loss.

[MultimediaMan]

Brian: This is why you want SmoothWall...it is wildly overkill with a P233MMX; A PC as a dedicated router is better than anything you can buy. I downloaded the Mandrake .ISOs from a Mirror Last night: 2 CDs from one location, another from a different one on two boxes behind the Router...no packet loss, and those were huge DLs...

[Pace]

What level of system would be capable?

486/25? P120? I've got a few systems in that range, next up is P3. I'm planning to stick up servers left, right and centre - if these 'legacy' systems could cope with a fair level of demand it would make my life easier

What kind of Linux distro would I need - would I have to do without X to set them up for instance?

[Pace]

One wonders what marvel at Macromedia thought it a good idea to rename their whole line of products after the bottom line from NVIDIA

[Ribbit]

Originally posted by Pace
What level of system would be capable? 486/25? P120?

I'm using a Cyrix 486Drx2 (386-to-486 upgrade chip) at 50Mhz - it's about as fast as a 486-20. Furthermore, its internal cache is turned off (it seems to cause stability problems). This box is firewall, router, mail server, name server, and sometime DHCP server, and it still spends most of its time sitting around twiddling its thumbs.

[Pace]

And would it cope with Apache/PHP/Tomcat?

[Ribbit]

Hmm... well I'm sure that serving static pages with Apache it would have plenty of time left over even if it was maxing out the ADSL line (it can just about saturate a 10Mbps network doing ftp). I think it would like a bit more memory though - it's only got 16MB, which is the maximum the motherboard can take.

Throwing in PHP/Tomcat, I have no idea. I don't know how demanding they are, and I imagine it greatly depends on how dynamic your site is anyway.

[Brian R.]

Many people (including myself) cannot configure Linux to act as a router. Most people will buy a router (like Paddy's Netgear DG815) and expect it to handle a gameserver. May or may not.

For my server, I used a software firewall on all the PCs without a router so that I could utilize all my WAN IP addresses. True, this requires some horsepower, but cpu cycles are dirt cheap nowadays.

Passing the IPs through the router defeats the purpose in the ones I have tried.

[MultimediaMan]

Brian: I say again, Try SmoothWall: This is not your typical Linux installation...this is a dedicated distribution of Redhat designed to turn the host machine into a Firewall/DHCP server, nothing more, nothing less. Once you get the thing booted, follow the prompts, reboot it, and you're set. (There are a couple of exceptions and provisos - I would recommend setting up each card individually so as to get the cards you want doing what you want.) Administration is done through a webpage that only can be connected to on the private-side of the network. It is fast and easy to set up. Ask questions here if you like, but the documentation is stone-simple to follow.

I am actually looking for a slower/lower performance machine to put it on...I have a couple of AT motherboards with just enough PCI slots to set up a 3 interface SmoothWall (Internet/Private/Public) which will allow my LAN buddies (and Friends) to connect to the internet without exposing my private network to them. And really, that is all that is required.