<?xml version="1.0"?>
<?xml-stylesheet type="text/css" href="http://www.duncanbrown.org/skins/common/feed.css?303"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
		<id>http://www.duncanbrown.org/api.php?action=feedcontributions&amp;user=Duncan&amp;feedformat=atom</id>
		<title>DuncanWiki - User contributions [en]</title>
		<link rel="self" type="application/atom+xml" href="http://www.duncanbrown.org/api.php?action=feedcontributions&amp;user=Duncan&amp;feedformat=atom"/>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Special:Contributions/Duncan"/>
		<updated>2012-05-20T08:06:48Z</updated>
		<subtitle>User contributions</subtitle>
		<generator>MediaWiki 1.18.1</generator>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Shell_One_Liners</id>
		<title>Shell One Liners</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Shell_One_Liners"/>
				<updated>2012-05-09T03:13:27Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;These are just simple one-line commands to pull off some of a GNU/Linux machine's cooler features.&lt;br /&gt;
&lt;br /&gt;
=System Rescue Images=&lt;br /&gt;
&lt;br /&gt;
When I buy a retail computer I *always* save an image of the hard drive before I've ever booted the main OS.  I&amp;quot;ll boot the machine off of a CentOS or Scientific Linux rescue disc &amp;amp; drop to the prompt.&lt;br /&gt;
&lt;br /&gt;
This allows you to write a compressed image to a remote machine over ssh, which means you could actually do this over the Internet. &lt;br /&gt;
&lt;br /&gt;
 dd if=/dev/sda | bzip2 | ssh 10.3.2.1 &amp;quot;dd of=/storage/WD2000-1/SystemImages/myShinyNewMachine.img.bz2&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Copying Files=&lt;br /&gt;
&lt;br /&gt;
==Copying to Multiple Targets==&lt;br /&gt;
&lt;br /&gt;
This will recursively copy, preserving permissions, to two separate directories.&lt;br /&gt;
&lt;br /&gt;
 tar cvfp - sourdir/ | tee &amp;gt;(cd /storage/WD2000-1/ ; tar xfp -) | (cd /storage/WD2000-2 ; tar xfp -)&lt;br /&gt;
&lt;br /&gt;
You can add more destinations by adding additional '''tee &amp;gt;(cd $dest ; tar xfp)''' sections.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Shell_One_Liners</id>
		<title>Shell One Liners</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Shell_One_Liners"/>
				<updated>2012-05-08T02:26:39Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: Created page with &amp;quot;=Copying Files=  ==Copying to Multiple Targets==  This will recursively copy, preserving permissions, to two separate directories.   tar cvfp - sourdir/ | tee &amp;gt;(cd /storage/WD...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Copying Files=&lt;br /&gt;
&lt;br /&gt;
==Copying to Multiple Targets==&lt;br /&gt;
&lt;br /&gt;
This will recursively copy, preserving permissions, to two separate directories.&lt;br /&gt;
&lt;br /&gt;
 tar cvfp - sourdir/ | tee &amp;gt;(cd /storage/WD2000-1/ ; tar xfp -) | (cd /storage/WD2000-2 ; tar xfp -)&lt;br /&gt;
&lt;br /&gt;
You can add more destinations by adding additional '''tee &amp;gt;(cd $dest ; tar xfp)''' sections.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/My_Computers</id>
		<title>My Computers</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/My_Computers"/>
				<updated>2012-04-10T21:47:14Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a list of computers I physically interact with on a fairly daily basis sorted by relative horsepower.&lt;br /&gt;
&lt;br /&gt;
I name most of my computers after characters frim [[MST3k]].  You can find all of these names at http://mst3k.wikia.com.&lt;br /&gt;
&lt;br /&gt;
=Apple Machines=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;tab sep=comma head=top&amp;gt;&lt;br /&gt;
name,make/model,location,use,cpu,ram,storage,os&lt;br /&gt;
Brainguy,Apple iMac,Home,Workstation,2.8GHz i3,16GB,1TB,OS X 10.7&lt;br /&gt;
Pearl,Apple MacBook Air,Home,Laptop,1.7GHz i5,4GB,128GB,OS X 10.7&lt;br /&gt;
Peanut,Apple Mac Mini,Home,Server,1.4GHz G4,512MB,580GB,OS X 10.5&lt;br /&gt;
Frank,Apple Mac Mini,Home,HDTV,2.4GHz Core 2 Duo,2GB,500GB,OS X 10.7&lt;br /&gt;
&amp;lt;/tab&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Linux Machines=&lt;br /&gt;
&amp;lt;tab sep=comma head=top&amp;gt;&lt;br /&gt;
name,make/model,location,use,cpu,ram,storage,os&lt;br /&gt;
Gypsy,Dell PowerEdge T100,Home,Server,2.4GHz Xeon X3220,8GB,12TB,Scientific Linux 6&lt;br /&gt;
Cerberus,Asus EEE Box,Home,Firewall/VPN/Proxy,1.6GHz Atom N270,1GB,320GB,Scientific Linux 6 &amp;amp; http://hotpastrami.org&lt;br /&gt;
Torgo,HP Pavillion,Home,Server,3GHz AMD Athlon II X2 250,8GB,640GB,Scientific Linux 6&lt;br /&gt;
Crow,Custom,Home,Gaming,2.9GHz AMD A8-3850,16GB,500GB,Scientific Linux 6/Win7&lt;br /&gt;
Krankor,Custom 2U,Home,New Firewall/VPN/Proxy,2.6GHz i3-2120T,16GB,120GB SSD,Scientific Linux 6 &amp;amp; http://hotpastrami.org&lt;br /&gt;
&amp;lt;/tab&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Virtual Machines=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
! name&lt;br /&gt;
! make/model&lt;br /&gt;
! location&lt;br /&gt;
! use&lt;br /&gt;
! cpu&lt;br /&gt;
! ram&lt;br /&gt;
! storage&lt;br /&gt;
! o/s&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Professor Bobo|Bobo]]&lt;br /&gt;
| [[Wikipedia:Virtual machine|Virtual Machine]]&lt;br /&gt;
| [http://tektonic.net/ CO-LO]&lt;br /&gt;
| [[Wikipedia:Server (computing)|Server]]&lt;br /&gt;
| 2.4GHz Core 2 Quad (Shared)&lt;br /&gt;
| 368MB&lt;br /&gt;
| 20GB&lt;br /&gt;
| [http://centos.org CentOS 5]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
[[Category:Computing]]&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Mystery_Science_Theater_3000_(MST3K)</id>
		<title>Mystery Science Theater 3000 (MST3K)</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Mystery_Science_Theater_3000_(MST3K)"/>
				<updated>2012-04-10T21:44:28Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* My Collection */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Mystery Science Theater is one of the best television shows ever produced, at least that's this reporter's stance.&lt;br /&gt;
&lt;br /&gt;
=Where Are They Now=&lt;br /&gt;
&lt;br /&gt;
There's [[Wikipedia:Cinematic Titanic|Cinematic Titanic]], [[Wikipedia:Rifftrax|Rifftrax]], [[Wikipedia:The Film Crew|The Film Crew]], [[Wikipedia:AFHV|America's Funniest Home Videos]] &amp;amp; probably a lot of other stuff I have no idea about.&lt;br /&gt;
&lt;br /&gt;
=Fan Made Episodes=&lt;br /&gt;
&lt;br /&gt;
I have two from cheepnis, and there are more to be had.  I just need to save up my lunch money. =]&lt;br /&gt;
&lt;br /&gt;
=My Collection=&lt;br /&gt;
&lt;br /&gt;
Others may consider this ''sad'', but I'm pretty proud of everything I have that's related to this show.&lt;br /&gt;
&lt;br /&gt;
* MST3K The Movie :&lt;br /&gt;
** First DVD release ($9 at CD Spins, suckers!)&lt;br /&gt;
** Laserdisc (framed and signed by almost everyone, of course)&lt;br /&gt;
** On VHS, but my ex-wife never gave it back&lt;br /&gt;
&lt;br /&gt;
* Every MST3K DVD release, including the original season 10 &amp;amp; 10.2 as well as the 20th anniversary&lt;br /&gt;
&lt;br /&gt;
* Every single available MST3K episode either on VHS, DVD or 'other'&lt;br /&gt;
&lt;br /&gt;
* All 4 Film Crew DVDs&lt;br /&gt;
&lt;br /&gt;
==KTMA==&lt;br /&gt;
&lt;br /&gt;
 K04 : gamera vs barugon&lt;br /&gt;
 K05 : gamera&lt;br /&gt;
 K06 : gamera vs gaos&lt;br /&gt;
 K07 : gamera vs zigra&lt;br /&gt;
 K08 : gamera vs guiron&lt;br /&gt;
 K09 : phase iv&lt;br /&gt;
 K10 : cosmic princess&lt;br /&gt;
 K11 : humanoid woman&lt;br /&gt;
 K12 : fugitive alien&lt;br /&gt;
 K13 : sst death flight&lt;br /&gt;
 K14 : mighty jack&lt;br /&gt;
 K15 : superdome&lt;br /&gt;
 K16 : city on fire&lt;br /&gt;
 K17 : time of the apes&lt;br /&gt;
 K18 : the million eyes of sumuru&lt;br /&gt;
 K19 : hangar eighteen&lt;br /&gt;
 K20 : the last chase&lt;br /&gt;
 K21 : legend of the dinosaur&lt;br /&gt;
&lt;br /&gt;
==Season 1==&lt;br /&gt;
&lt;br /&gt;
 0101 : the crawling eye&lt;br /&gt;
 0102 : the robot vs the aztec mummy&lt;br /&gt;
 0103 : mad monster&lt;br /&gt;
 0104 : women of the prehistoric planet&lt;br /&gt;
 0105 : the corpse vanishes&lt;br /&gt;
 0107 : robot monster&lt;br /&gt;
 0108 : the slime people&lt;br /&gt;
 0109 : project moonbase&lt;br /&gt;
 0110 : robot holocaust&lt;br /&gt;
 0111 : moon zero two&lt;br /&gt;
 0112 : untamed youth&lt;br /&gt;
 0113 : the black scorpion&lt;br /&gt;
&lt;br /&gt;
==Season 2==&lt;br /&gt;
&lt;br /&gt;
 0201 : rocketship x-m&lt;br /&gt;
 0202 : sidehackers&lt;br /&gt;
 0203 : jungle goddess&lt;br /&gt;
 0204 : catalina caper&lt;br /&gt;
 0205 : rocket attack usa&lt;br /&gt;
 0206 : ring of terror&lt;br /&gt;
 0207 : wild rebels&lt;br /&gt;
 0208 : lost continent&lt;br /&gt;
 0209 : the hellcats&lt;br /&gt;
 0210 : king dinosaur&lt;br /&gt;
 0211 : first spaceship on venus&lt;br /&gt;
 0212 : godzilla vs megalon&lt;br /&gt;
 0213 : godzilla vs the sea monster&lt;br /&gt;
&lt;br /&gt;
==Season 3==&lt;br /&gt;
&lt;br /&gt;
 0302 : gamera&lt;br /&gt;
 0304 : gamera vs barugon&lt;br /&gt;
 0305 : stranded in space&lt;br /&gt;
 0306 : time of the apes&lt;br /&gt;
 0307 : daddy-o&lt;br /&gt;
 0308 : gamera vs gaos&lt;br /&gt;
 0309 : the amazing colossal man&lt;br /&gt;
 0310 : fugitive alien&lt;br /&gt;
 0311 : it conquered the world&lt;br /&gt;
 0312 : gamera vs guiron&lt;br /&gt;
 0313 : earth vs the spider&lt;br /&gt;
 0314 : mighty jack&lt;br /&gt;
 0315 : teenage caveman&lt;br /&gt;
 0316 : gamera vs zigra&lt;br /&gt;
 0317 : viking women vs the sea serpent&lt;br /&gt;
 0318 : star force (fugitive alien 2)&lt;br /&gt;
 0319 : war of the colossal beast&lt;br /&gt;
 0322 : master ninja i&lt;br /&gt;
 0323 : the castle of fu manchu&lt;br /&gt;
 0324 : master ninja ii&lt;br /&gt;
&lt;br /&gt;
==Season 4==&lt;br /&gt;
&lt;br /&gt;
 0401 : space travelers&lt;br /&gt;
 0402 : the giant gila monster&lt;br /&gt;
 0403 : city limits&lt;br /&gt;
 0404 : teenagers from outer space&lt;br /&gt;
 0405 : being from another planet&lt;br /&gt;
 0406 : attack of the giant leeches&lt;br /&gt;
 0407 : attack of the killer shrews&lt;br /&gt;
 0408 : hercules unchained&lt;br /&gt;
 0409 : the indestructible man&lt;br /&gt;
 0410 : hercules against the moon men&lt;br /&gt;
 0411 : the magic sword&lt;br /&gt;
 0412 : hercules and the captive women&lt;br /&gt;
 0413 : manhunt in space&lt;br /&gt;
 0414 : tormented&lt;br /&gt;
 0415 : the beatniks&lt;br /&gt;
 0416 : fire maidens of outer space&lt;br /&gt;
 0417 : crash of the moons&lt;br /&gt;
 0418 : attack of the the eye creatures&lt;br /&gt;
 0419 : the rebel set&lt;br /&gt;
 0420 : the human duplicators&lt;br /&gt;
 0421 : monster a-go-go&lt;br /&gt;
 0422 : the day the earth froze&lt;br /&gt;
 0423 : bride of the monster&lt;br /&gt;
 0424 : manos hands of fate&lt;br /&gt;
&lt;br /&gt;
==Season 5==&lt;br /&gt;
&lt;br /&gt;
 0501 : warrior of the lost world&lt;br /&gt;
 0502 : hercules&lt;br /&gt;
 0503 : swamp diamonds&lt;br /&gt;
 0504 : secret agent super dragon&lt;br /&gt;
 0505 : the magic voyage of sinbad&lt;br /&gt;
 0506 : eegah&lt;br /&gt;
 0507 : i accuse my parents&lt;br /&gt;
 0508 : operation double 007&lt;br /&gt;
 0509 : the girl in lovers lane&lt;br /&gt;
 0510 : the painted hills&lt;br /&gt;
 0511 : gunslinger&lt;br /&gt;
 0512 : mitchell&lt;br /&gt;
 0513 : the brain that wouldn't die&lt;br /&gt;
 0514 : teenage strangler&lt;br /&gt;
 0515 : the wild world of batwoman&lt;br /&gt;
 0516 : alien from la&lt;br /&gt;
 0517 : beginning of the end&lt;br /&gt;
 0518 : the atomic brain&lt;br /&gt;
 0519 : outlaw&lt;br /&gt;
 0520 : radar secret service&lt;br /&gt;
 0521 : santa claus&lt;br /&gt;
 0522 : teenage crime wave&lt;br /&gt;
 0523 : village of the giants&lt;br /&gt;
 0524 : 12 to the moon&lt;br /&gt;
&lt;br /&gt;
==Season 6==&lt;br /&gt;
&lt;br /&gt;
 0601 : girls town&lt;br /&gt;
 0602 : invasion usa&lt;br /&gt;
 0603 : the dead talk back&lt;br /&gt;
 0604 : zombie nightmare&lt;br /&gt;
 0605 : colossus vs the headhunters&lt;br /&gt;
 0606 : the creeping terror&lt;br /&gt;
 0607 : bloodlust&lt;br /&gt;
 0608 : code name diamond head&lt;br /&gt;
 0609 : skydivers&lt;br /&gt;
 0610 : the violent years&lt;br /&gt;
 0611 : last of the wild horses&lt;br /&gt;
 0612 : the starfighters&lt;br /&gt;
 0613 : the sinister urge&lt;br /&gt;
 0614 : san francisco international&lt;br /&gt;
 0615 : kitten with a whip&lt;br /&gt;
 0616 : racket girls&lt;br /&gt;
 0617 : the sword and the dragon&lt;br /&gt;
 0618 : high school big shot&lt;br /&gt;
 0619 : red zone cuba&lt;br /&gt;
 0620 : danger death ray&lt;br /&gt;
 0621 : beast of yucca flats&lt;br /&gt;
 0622 : angels revenge&lt;br /&gt;
 0623 : the amazing transparent man&lt;br /&gt;
 0624 : samson vs the vampire women&lt;br /&gt;
&lt;br /&gt;
==Season 7==&lt;br /&gt;
&lt;br /&gt;
 0701 : night of the blood beast&lt;br /&gt;
 0702 : the brute man&lt;br /&gt;
 0703 : deathstalker and the warriors from hell&lt;br /&gt;
 0704 : the incredible melting man&lt;br /&gt;
 0705 : escape 2000&lt;br /&gt;
 0706 : laserblast&lt;br /&gt;
&lt;br /&gt;
==Season 8==&lt;br /&gt;
&lt;br /&gt;
 0801 : revenge of the creature&lt;br /&gt;
 0802 : the leech woman&lt;br /&gt;
 0803 : the mole people&lt;br /&gt;
 0804 : the deadly mantis&lt;br /&gt;
 0805 : the thing that couldn't die&lt;br /&gt;
 0806 : the undead&lt;br /&gt;
 0807 : terror from the year 5000&lt;br /&gt;
 0808 : the she creature&lt;br /&gt;
 0809 : i was a teenage werewolf&lt;br /&gt;
 0810 : the giant spider invasion&lt;br /&gt;
 0811 : parts the clonus horror&lt;br /&gt;
 0812 : the incredibly strange creatures&lt;br /&gt;
 0813 : jack frost&lt;br /&gt;
 0814 : riding with death&lt;br /&gt;
 0815 : agent for harm&lt;br /&gt;
 0816 : prince of space&lt;br /&gt;
 0817 : horror of party beach&lt;br /&gt;
 0818 : devil doll&lt;br /&gt;
 0819 : invasion of the neptune men&lt;br /&gt;
 0820 : space mutiny&lt;br /&gt;
 0821 : time chasers&lt;br /&gt;
 0822 : overdrawn at the memory bank&lt;br /&gt;
&lt;br /&gt;
==Season 9==&lt;br /&gt;
&lt;br /&gt;
 0901 : the projected man&lt;br /&gt;
 0902 : the phantom planet&lt;br /&gt;
 0903 : puma man&lt;br /&gt;
 0904 : werewolf&lt;br /&gt;
 0905 : the deadly bees&lt;br /&gt;
 0906 : the space children&lt;br /&gt;
 0907 : hobgoblins&lt;br /&gt;
 0908 : the touch of satan&lt;br /&gt;
 0909 : gorgo&lt;br /&gt;
 0910 : the final sacrifice&lt;br /&gt;
 0911 : devil fish&lt;br /&gt;
 0912 : the screaming skull&lt;br /&gt;
 0913 : quest of the delta knights&lt;br /&gt;
&lt;br /&gt;
==Season 10==&lt;br /&gt;
&lt;br /&gt;
 1001 : soultaker&lt;br /&gt;
 1002 : girl in gold boots&lt;br /&gt;
 1003 : merlin's shop of mystical wonders&lt;br /&gt;
 1004 : future war&lt;br /&gt;
 1005 : blood waters of dr z&lt;br /&gt;
 1006 : boggy creek ii&lt;br /&gt;
 1007 : track of the moon beast&lt;br /&gt;
 1008 : final justice&lt;br /&gt;
 1009 : hamlet&lt;br /&gt;
 1010 : it lives by night&lt;br /&gt;
 1011 : the horrors of spider island&lt;br /&gt;
 1012 : squirm&lt;br /&gt;
 1013 : diabolik&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/MST3k</id>
		<title>MST3k</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/MST3k"/>
				<updated>2012-04-10T21:43:47Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: Redirected page to Mystery Science Theater 3000 (MST3K)&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;#REDIRECT[[Mystery Science Theater 3000 (MST3K)]]&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/My_Computers</id>
		<title>My Computers</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/My_Computers"/>
				<updated>2012-04-10T21:43:19Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a list of computers I physically interact with on a fairly daily basis sorted by relative horsepower.&lt;br /&gt;
&lt;br /&gt;
I name most of my computers after characters frim [[MST3k]].  You can find all of these names at http://mst3k.wikia.com.&lt;br /&gt;
&lt;br /&gt;
=Apple Machines=&lt;br /&gt;
&lt;br /&gt;
&amp;lt;tab sep=comma head=top&amp;gt;&lt;br /&gt;
name,make/model,location,use,cpu,ram,storage,os&lt;br /&gt;
Brainguy,Apple iMac,Home,Workstation,2.8GHz i3,16GB,1TB,OS X 10.7&lt;br /&gt;
Pearl,Apple MacBook Air,Home,Laptop,1.7GHz i5,4GB,128GB,OS X 10.7&lt;br /&gt;
Peanut,Apple Mac Mini,Home,Server,1.4GHz G4,512MB,580GB,OS X 10.5&lt;br /&gt;
Frank,Apple Mac Mini,Home,HDTV,2.4GHz Core 2 Duo,2GB,500GB,OS X 10.7&lt;br /&gt;
&amp;lt;/tab&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Linux Machines=&lt;br /&gt;
&amp;lt;tab sep=comma head=top&amp;gt;&lt;br /&gt;
name,make/model,location,use,cpu,ram,storage,os&lt;br /&gt;
Gypsy,Dell PowerEdge T100,Home,Server,2.4GHz Xeon X3220,8GB,12TB,Scientific Linux 6&lt;br /&gt;
Cerberus,Asus EEE Box,Home,Firewall/VPN/Proxy,1.6GHz Atom N270,1GB,320GB,Scientific Linux 6&lt;br /&gt;
Torgo,HP Pavillion,Home,Server,3GHz AMD Athlon II X2 250,8GB,640GB,Scientific Linux 6&lt;br /&gt;
Crow,Custom,Home,Gaming,2.9GHz AMD A8-3850,16GB,500GB,Scientific Linux 6/Win7&lt;br /&gt;
Krankor,Custom 2U,Home,New Firewall/VPN/Proxy,2.6GHz i3-2120T,16GB,120GB SSD,Scientific Linux 6&lt;br /&gt;
&amp;lt;/tab&amp;gt;&lt;br /&gt;
&lt;br /&gt;
=Virtual Machines=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
! name&lt;br /&gt;
! make/model&lt;br /&gt;
! location&lt;br /&gt;
! use&lt;br /&gt;
! cpu&lt;br /&gt;
! ram&lt;br /&gt;
! storage&lt;br /&gt;
! o/s&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Professor Bobo|Bobo]]&lt;br /&gt;
| [[Wikipedia:Virtual machine|Virtual Machine]]&lt;br /&gt;
| [http://tektonic.net/ CO-LO]&lt;br /&gt;
| [[Wikipedia:Server (computing)|Server]]&lt;br /&gt;
| 2.4GHz Core 2 Quad (Shared)&lt;br /&gt;
| 368MB&lt;br /&gt;
| 20GB&lt;br /&gt;
| [http://centos.org CentOS 5]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
[[Category:Computing]]&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Main_Page</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Main_Page"/>
				<updated>2012-04-10T21:04:55Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hola!  Over the last 8 years that I've owned this domain it's evolved from a simple image to a growing list of links to a wiki.  For the last few years it's been an ever growing notepad for whatever I'm into. Since that's the case you'll probably find incomplete pages or outdated information.  This site '''cannot''' be counted on as a canonical information source.&lt;br /&gt;
&lt;br /&gt;
* [http://replay.waybackmachine.org/20041210190320/http://duncanbrown.org/ Circa 2004]&lt;br /&gt;
* [http://replay.waybackmachine.org/20061026005117/http://www.duncanbrown.org/ Circa 2006]&lt;br /&gt;
&lt;br /&gt;
=Why Is This Site So *SLOW*?=&lt;br /&gt;
&lt;br /&gt;
There are numerous things working against me :&lt;br /&gt;
* It's a [[Wikipedia:Virtual Machine|Virtual Machine]]&lt;br /&gt;
** 360MB RAM (Apache, Sendmail, Spam Assassin &amp;amp; MySQL don't play well together with that small amount)&lt;br /&gt;
** No swap&lt;br /&gt;
** Shared hardware with probably hundreds of other people&lt;br /&gt;
** The I/O contention on this host is insane&lt;br /&gt;
&lt;br /&gt;
There are just two things working for me :&lt;br /&gt;
* It's only $15/mo&lt;br /&gt;
* '''Unlimited''' bandwidth&lt;br /&gt;
&lt;br /&gt;
=Using This Website=&lt;br /&gt;
&lt;br /&gt;
* While this IS a wiki, it's not open to public editing&lt;br /&gt;
* You're going to find a bunch of unfinished pages all over this wiki that are populated by pages from my old text-only website.  As time goes on everything should look cleaner, but since it's a hobby site you shouldn't really hold your breath =]&lt;br /&gt;
&lt;br /&gt;
=Computery Stuff=&lt;br /&gt;
&lt;br /&gt;
Both my personal laptop and home workstation are Macs but for everything else I'm a GNU/Linux kind of guy.&lt;br /&gt;
&lt;br /&gt;
* [[Get Smarter]] :: Things I need to read up on&lt;br /&gt;
* [[GNU/Linux]] :: Articles and thoughts about GNU/Linux&lt;br /&gt;
* [[Mac OS X]] :: Articles and thoughts about Mac OS X on my [[]] computer&lt;br /&gt;
* [[Projects]] :: My various projects&lt;br /&gt;
* [[My Computers]] :: Computers I work with&lt;br /&gt;
* [[Virtualization]] :: Over the last year I've started to work more with virtual machines&lt;br /&gt;
&lt;br /&gt;
==VPN==&lt;br /&gt;
&lt;br /&gt;
I've recently had the need to run a VPN solution and went through a few different VPN suites before settling on OpenVPN.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN With WRT54GL]] :: You can have a cheap VPN solution at home!&lt;br /&gt;
* [[OpenVPN With CentOS]] :: You can have a MUCH more robust VPN solution at home!&lt;br /&gt;
&lt;br /&gt;
Once you've set up your OpenVPN server you'll need to configure clients to connect to it.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN Clients]]&lt;br /&gt;
&lt;br /&gt;
==Shameful Things==&lt;br /&gt;
&lt;br /&gt;
* [[Windows]] :: I pretty much can't stand it, but I have a page with a little bit of tolerance and software links&lt;br /&gt;
&lt;br /&gt;
=Foody Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Recipes]] :: I love to cook, I'm just not organized enough to do it regularly.&lt;br /&gt;
&lt;br /&gt;
=Entertainmenty Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Music]] :: What I listen to, my collection &amp;amp; where to find new music&lt;br /&gt;
* [[Mystery Science Theater 3000 (MST3K)]] :: I have one of the most complete MST3K collections on the eastern seaboard&lt;br /&gt;
* [[Video Gaming]] :: I've been playing video for as long as I can remember&lt;br /&gt;
* [[Books]] :: What I'm reading, my collection, recommendations &amp;amp; what to avoid&lt;br /&gt;
* [[Movies]] :: I'm an avid consumer of almost all things on the silver &amp;amp; LCD screen&lt;br /&gt;
&lt;br /&gt;
=Toys Toys Toys Toys=&lt;br /&gt;
&lt;br /&gt;
* [[Nerf Guns]] :: Someone started a war at my office &amp;amp; I intend to lose gracefully&lt;br /&gt;
* [[Transformers]] :: Not the new stuff, the old stuff.  PS : hey, you kids.  get off my lawn.&lt;br /&gt;
&lt;br /&gt;
=Video Gamey Stuff=&lt;br /&gt;
&lt;br /&gt;
I've been a rabid gamer since 1980 when someone first placed an [[Atari 2600]] joystick in my tiny 4 year old hands.&lt;br /&gt;
&lt;br /&gt;
==Classic Video Games==&lt;br /&gt;
&lt;br /&gt;
* http://www.tototek.com/&lt;br /&gt;
* http://retrousb.com/&lt;br /&gt;
* http://stoneagegamer.com/&lt;br /&gt;
* Angry Video Game Nerd&lt;br /&gt;
&lt;br /&gt;
==XBox 360==&lt;br /&gt;
&lt;br /&gt;
The XBox systems are the only two Microsoft products I'll ever enjoy, they're a bit of a guilty pleasure... they're my main gaming console at the time.&lt;br /&gt;
&lt;br /&gt;
===XBox Live===&lt;br /&gt;
&lt;br /&gt;
Friend me if you like: livepip &amp;amp; suave blanco&lt;br /&gt;
&lt;br /&gt;
=Othery Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Product Recommendations]]&lt;br /&gt;
* [[Car-less In Cambridge]] :: It's not only possible, it's the only way to live&lt;br /&gt;
* [[Cell Phones]] :: Notes that I've compiled on working with them, including custom ringtones&lt;br /&gt;
&lt;br /&gt;
=About Myself=&lt;br /&gt;
&lt;br /&gt;
A vanity page has been crated at [[User:Duncan]], I'm not sure if it'll ever be worth your time.&lt;br /&gt;
&lt;br /&gt;
=My Other Sites=&lt;br /&gt;
&lt;br /&gt;
* http://files.duncanbrown.org :: A semi-organized collection of files from over the years&lt;br /&gt;
* http://hotpastrami.org :: Not up right now, but maybe one day it'll be back as something real&lt;br /&gt;
* http://notpip.com :: Not much, it's my development box at home&lt;br /&gt;
* http://cd2ogg.sf.net :: Homepage for my *nix CD ripping project, cd2ogg&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;meta name=&amp;quot;description&amp;quot; content=&amp;quot;Duncan Brown, Beachwood's favorite son!&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T20:33:57Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems]].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
=Configuring IP4 Forwarding=&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
=Routing &amp;amp; NAT=&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
=DHCP Server=&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
=Caching DNS=&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -p icmp --icmp-type 8 -j DROP&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
Install squid &amp;amp; ensure it starts on boot.&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Let this run a while as you tail the squid log file.  Browse websites, see if it's working.  Once it's working then you can disable logging since they're fairly verbose.&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=OATH=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
=PPTP=&lt;br /&gt;
&lt;br /&gt;
Details of outgoing PPTP VPN forthcoming.&lt;br /&gt;
&lt;br /&gt;
=OpenVPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
 semodule -i /usr/share/selinux/targeted/openvpn.pp.bz2&lt;br /&gt;
 restorecon -v /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
&lt;br /&gt;
===Install Client===&lt;br /&gt;
&lt;br /&gt;
* Mac OS : http://code.google.com/p/tunnelblick/&lt;br /&gt;
* RHEL &amp;amp; Variants : yum install NetworkManager-openvpn&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T07:31:59Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems]].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -p icmp --icmp-type 8 -j DROP&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
Install squid &amp;amp; ensure it starts on boot.&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Let this run a while as you tail the squid log file.  Browse websites, see if it's working.  Once it's working then you can disable logging since they're fairly verbose.&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=OATH=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
=PPTP=&lt;br /&gt;
&lt;br /&gt;
Details of outgoing PPTP VPN forthcoming.&lt;br /&gt;
&lt;br /&gt;
=OpenVPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
 semodule -i /usr/share/selinux/targeted/openvpn.pp.bz2&lt;br /&gt;
 restorecon -v /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
&lt;br /&gt;
===Install Client===&lt;br /&gt;
&lt;br /&gt;
* Mac OS : http://code.google.com/p/tunnelblick/&lt;br /&gt;
* RHEL &amp;amp; Variants : yum install NetworkManager-openvpn&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T07:27:55Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Transparent Proxy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems]].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -p icmp --icmp-type 8 -j DROP&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
Install squid &amp;amp; ensure it starts on boot.&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Let this run a while as you tail the squid log file.  Browse websites, see if it's working.  Once it's working then you can disable logging since they're fairly verbose.&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=OATH=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
=PPTP=&lt;br /&gt;
&lt;br /&gt;
Details of outgoing PPTP VPN forthcoming.&lt;br /&gt;
&lt;br /&gt;
=OpenVPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
 restorecon -v /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
&lt;br /&gt;
===Install Client===&lt;br /&gt;
&lt;br /&gt;
* Mac OS : http://code.google.com/p/tunnelblick/&lt;br /&gt;
* RHEL &amp;amp; Variants : yum install NetworkManager-openvpn&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T07:24:06Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems]].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -p icmp --icmp-type 8 -j DROP&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=OATH=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
=PPTP=&lt;br /&gt;
&lt;br /&gt;
Details of outgoing PPTP VPN forthcoming.&lt;br /&gt;
&lt;br /&gt;
=OpenVPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
 restorecon -v /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
&lt;br /&gt;
===Install Client===&lt;br /&gt;
&lt;br /&gt;
* Mac OS : http://code.google.com/p/tunnelblick/&lt;br /&gt;
* RHEL &amp;amp; Variants : yum install NetworkManager-openvpn&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/OpenVPN_With_WRT54GL</id>
		<title>OpenVPN With WRT54GL</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/OpenVPN_With_WRT54GL"/>
				<updated>2012-03-25T06:45:17Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;'''This is a work in progress.'''  I just started writing this on 22MAR11 &amp;amp; I've been wrestling with OpenVPN under dd-wrt since 17MAR11.&lt;br /&gt;
&lt;br /&gt;
I've completely dropped this.  Check out [[SL6 Router]] or [[OpenVPN With CentOS]].&lt;br /&gt;
&lt;br /&gt;
=Preface=&lt;br /&gt;
&lt;br /&gt;
The documentation on dd-wrt.com suffers from too many chefs, this causes it to be a complete mess.  I needed a venue to clean up what I read on there and make my results reproducible.&lt;br /&gt;
&lt;br /&gt;
This page assumes you have access to a Mac OS X, Unix or GNU/Linux system and know how to use the command line well enough to run a few canned scripts from the OpenVPN folks to generate certificates.  I have ZERO way to test anything on Windows systems.&lt;br /&gt;
&lt;br /&gt;
This isn't for the faint of heart, but it's not really all that difficult.&lt;br /&gt;
&lt;br /&gt;
I first read up on how to do this via [http://www.dd-wrt.com/wiki/index.php/VPN_%28the_easy_way%29_v24%2B an article on dd-wrt.com].&lt;br /&gt;
&lt;br /&gt;
==How I'm Using It==&lt;br /&gt;
&lt;br /&gt;
I '''LOVE''' my WRT54GL running [http://www.polarcloud.com/tomato Tomato] and i definitely didn't want to get rid of it.  My second WRT54GL running the dd-wrt VPN software is connected with a single network cable from a LAN port ('''not''' the WAN port) to another LAN port on the Tomato router.&lt;br /&gt;
&lt;br /&gt;
I like this because it's sort of a drop-in VPN solution.  Once I have this figured out it'll be easy to configure new WRT54GLs to be set up in a similar way, only they'd be bridges for 2 way communication between networks.  I'd just have them dial home, authenticate &amp;amp; then I can work on my mom's computer (or whatever) over a secure channel.&lt;br /&gt;
&lt;br /&gt;
=My Network=&lt;br /&gt;
&lt;br /&gt;
 [internet]-&amp;gt;-[tomato_router:1194]-&amp;gt;-[dd-wrt_vpn:1194]-&amp;gt;-[intranet]&lt;br /&gt;
&lt;br /&gt;
Everything here is based upon my network settings.  Change to suit your own.&lt;br /&gt;
&lt;br /&gt;
Network : 10.0.1.0/24&lt;br /&gt;
Router  : 10.0.1.1&lt;br /&gt;
DNS     : 10.0.1.1&lt;br /&gt;
DHCP    : 10.0.1.1&lt;br /&gt;
&lt;br /&gt;
VPN Ext : 10.0.1.2 (Internet -&amp;gt; VPN)&lt;br /&gt;
VPN Int : 10.0.1.3 (VPN -&amp;gt; Intranet)&lt;br /&gt;
VPN Net : 172.25.1.0/24 (VPN Client IPs)&lt;br /&gt;
&lt;br /&gt;
DDNS    : notpip.homelinux.org (DynDNS hostname)&lt;br /&gt;
&lt;br /&gt;
=Hardware=&lt;br /&gt;
&lt;br /&gt;
Everything runs on a [http://www.amazon.com/dp/B000BTL0OA?tag=cd2ogcdrippif-20 Linksys WRT54GL] router.  The price fluctuates on Amazon somewhat regularly.  Cheapest I've seen it in 4 years is $40 &amp;amp; the most expensive is $80.&lt;br /&gt;
&lt;br /&gt;
=Software=&lt;br /&gt;
&lt;br /&gt;
I used OpenVPN with dd-wrt-vpn which is at v24-SP2 as of 20110322.&lt;br /&gt;
&lt;br /&gt;
=Installing dd-wrt=&lt;br /&gt;
&lt;br /&gt;
* Download dd-wrt-vpn for the WRT54GL [http://www.dd-wrt.com/site/support/router-database here].&lt;br /&gt;
** Snag both the '''Mini for the Web''' &amp;amp; the '''VPN Generic''' versions.&lt;br /&gt;
* Read both the [http://www.dd-wrt.com/wiki/index.php/Installation#Precautions precautions] &amp;amp; [http://www.dd-wrt.com/wiki/index.php/Installation#.22Flashing.22_Your_Router_with_DD-WRT_Firmware flashing your router] instructions and follow them.&lt;br /&gt;
&lt;br /&gt;
=Generating VPN PKI Files=&lt;br /&gt;
&lt;br /&gt;
The PKI files are used to authenticate the server to the client &amp;amp; the client to the server.  Several files will be generated &amp;amp; it's '''extremely''' important to keep them in a safe place!&lt;br /&gt;
&lt;br /&gt;
Download the OpenVPN software from the OpenVPN website [http://openvpn.net/index.php/open-source/downloads.html here] (This is to generate the certificates).&lt;br /&gt;
&lt;br /&gt;
Read the instructions from the OpenVPN website [http://openvpn.net/index.php/open-source/documentation/howto.html#pki here].&lt;br /&gt;
&lt;br /&gt;
CentOS &amp;amp; Ubuntu both have an '''openvpn''' package that contains the easy-rsa software you need.&lt;br /&gt;
&lt;br /&gt;
If you need to download the easy-rsa software for Mac OS X or any other Unix system you can snag it [http://openvpn.net/index.php/open-source/downloads.html here].  Download the source tarball &amp;amp; you'll find the easy-rsa scripts within.  They're all you really need.&lt;br /&gt;
&lt;br /&gt;
=Configuring VPN Server=&lt;br /&gt;
&lt;br /&gt;
==Administration -&amp;gt; Commands==&lt;br /&gt;
&lt;br /&gt;
===Firewall Commands===&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p tcp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -t nat -I POSTROUTING -o br0 -j MASQUERADE&lt;br /&gt;
 iptables -I FORWARD -i br0 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o br0 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
===Startup Commands===&lt;br /&gt;
&lt;br /&gt;
There's really got to be a better way to handle this. OpenVPN doesn't always start up on boot.  Kind of annoying.&lt;br /&gt;
&lt;br /&gt;
 oD=/tmp/openvpn&lt;br /&gt;
 oC=&amp;quot;openvpn --config $oD/openvpn.conf --route-up $oD/route-up.sh --down $oD/route-down.sh --daemon&amp;quot;&lt;br /&gt;
 [ ! &amp;quot;$(ps | grep &amp;quot;$oC&amp;quot; | grep -v grep)&amp;quot; ] &amp;amp;&amp;amp; { &lt;br /&gt;
 sleep 30 ; $oC&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
==PKI Files==&lt;br /&gt;
&lt;br /&gt;
For the files generated by the easy-rsa scripts you'll only want to cut &amp;amp; paste the actual CERT/KEY/PARAMETERS sections, including the BEGIN &amp;amp; END markers.&lt;br /&gt;
&lt;br /&gt;
For example :&lt;br /&gt;
&lt;br /&gt;
 -----BEGIN CERTIFICATE-----&lt;br /&gt;
 '''(contents of certificate)'''&lt;br /&gt;
 -----END CERTIFICATE-----&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
|Public Server Cert (CA Cert)||ca.crt&lt;br /&gt;
|-&lt;br /&gt;
|Certificate Revoke List||(EMPTY)&lt;br /&gt;
|-&lt;br /&gt;
|Public Client Cert||server.crt&lt;br /&gt;
|-&lt;br /&gt;
|Private Client Key||server.key&lt;br /&gt;
|-&lt;br /&gt;
|DH PEM||dh1024.pem&lt;br /&gt;
|-&lt;br /&gt;
|OpenVPN Config||The OpenVPN Config&lt;br /&gt;
|-&lt;br /&gt;
|OpenVPN TLS Auth||(EMPTY)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==OpenVPN Config==&lt;br /&gt;
&lt;br /&gt;
* '''port 1194''' : defines the port we're listening on&lt;br /&gt;
* '''push &amp;quot;route&amp;quot;''' : defines the /24 network I have at home.&lt;br /&gt;
* '''push &amp;quot;dhcp-option DNS''' : defines what to use for DNS for the VPN&lt;br /&gt;
* '''push &amp;quot;dhcp-option DOMAIN''' : dictates your searched domains so you don't have to use FQDNs&lt;br /&gt;
* '''server 172.25.1.0''' : dictates that VPN hosts should use the 172.125.1.0/24 network&lt;br /&gt;
* '''dev tun0''' : use tunneling device tun0&lt;br /&gt;
* '''proto udp''' : tells OpenVPN to use UDP for incoming connections&lt;br /&gt;
** This can be changed to '''tcp-server'''&lt;br /&gt;
* '''keepalive 10 120''' : &lt;br /&gt;
* '''ifconfig-pool-persist /tmp/openvpn/ipp.txt''' : where we keep a list of DHCP leases.&lt;br /&gt;
&lt;br /&gt;
 port 1194&lt;br /&gt;
 push &amp;quot;route 192.168.1.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 192.168.1.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN home&amp;quot;&lt;br /&gt;
 server 172.25.1.0 255.255.255.0&lt;br /&gt;
 dev tun0&lt;br /&gt;
 proto udp&lt;br /&gt;
 keepalive 10 120&lt;br /&gt;
 ifconfig-pool-persist /tmp/openvpn/ipp.txt&lt;br /&gt;
 dh /tmp/openvpn/dh.pem&lt;br /&gt;
 ca /tmp/openvpn/ca.crt&lt;br /&gt;
 cert /tmp/openvpn/cert.pem&lt;br /&gt;
 key /tmp/openvpn/key.pem&lt;br /&gt;
 management localhost 5001&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T06:38:38Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems]].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -p icmp --icmp-type 8 -j DROP&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=OATH=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
=PPTP=&lt;br /&gt;
&lt;br /&gt;
Details of outgoing PPTP VPN forthcoming.&lt;br /&gt;
&lt;br /&gt;
=OpenVPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
&lt;br /&gt;
===Install Client===&lt;br /&gt;
&lt;br /&gt;
* Mac OS : http://code.google.com/p/tunnelblick/&lt;br /&gt;
* RHEL &amp;amp; Variants : yum install NetworkManager-openvpn&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T05:43:38Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems]].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=OATH=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
=PPTP=&lt;br /&gt;
&lt;br /&gt;
Details of outgoing PPTP VPN forthcoming.&lt;br /&gt;
&lt;br /&gt;
=OpenVPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
&lt;br /&gt;
===Install Client===&lt;br /&gt;
&lt;br /&gt;
* Mac OS : http://code.google.com/p/tunnelblick/&lt;br /&gt;
* RHEL &amp;amp; Variants : yum install NetworkManager-openvpn&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T05:31:41Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* SELinux */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems]].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=Things to Document=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
* VPN w/OpenVPN&lt;br /&gt;
&lt;br /&gt;
=VPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T05:31:28Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=SELinux=&lt;br /&gt;
&lt;br /&gt;
Everything in this guide is compatible with SELinux being left at '''enforcing'''.  It's just like Biggie said, &amp;quot;[[Wikipedia:Mo Money Mo Problems|Mo Security Less Problems].&amp;quot;&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=Things to Document=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
* VPN w/OpenVPN&lt;br /&gt;
&lt;br /&gt;
=VPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T04:48:46Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Operating System=&lt;br /&gt;
&lt;br /&gt;
Download, burn and install Scientific Linux 6.&lt;br /&gt;
&lt;br /&gt;
* http://ftp.scientificlinux.org/linux/scientific/6rolling/&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=Things to Document=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
* VPN w/OpenVPN&lt;br /&gt;
&lt;br /&gt;
=VPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T04:08:41Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
 sysctl net.ipv4.ip_forward=1&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=Things to Document=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
* VPN w/OpenVPN&lt;br /&gt;
&lt;br /&gt;
=VPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
* /etc/openvpn/openvpn.conf&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.16.0.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.16.0.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN hotpastrami.org&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.16.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn &lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
==Client Configuration==&lt;br /&gt;
&lt;br /&gt;
 remote notpip.homelinux.org 1194&lt;br /&gt;
 client &lt;br /&gt;
 remote-cert-tls server &lt;br /&gt;
 dev tun0 &lt;br /&gt;
 proto udp&lt;br /&gt;
 resolv-retry infinite &lt;br /&gt;
 nobind &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun &lt;br /&gt;
 float &lt;br /&gt;
 &lt;br /&gt;
 #If the pushed routes appear not to be added on windows hosts, add the following:&lt;br /&gt;
 #route-delay 30&lt;br /&gt;
 &lt;br /&gt;
 ca ca.crt &lt;br /&gt;
 cert $rename_to_your_crt.crt &lt;br /&gt;
 key $rename_to_your_key.key&lt;br /&gt;
 &lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T04:02:17Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 http_port 8080 transparent&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Automatically snag all outbound traffic destined for port 80 &amp;amp; pass it through our proxy.&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=Things to Document=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
* VPN w/OpenVPN&lt;br /&gt;
&lt;br /&gt;
=VPN=&lt;br /&gt;
&lt;br /&gt;
As of this writing the easy-rsa scripts won't work with EL's 6 OpenSSL version.&lt;br /&gt;
&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
 chkconfig openvpn on&lt;br /&gt;
&lt;br /&gt;
 cp -Rv /usr/share/openvpn/easy-rsa/2.0/ /etc/openvpn/easy-rsa/&lt;br /&gt;
 cd /etc/openvpn/easy-rsa&lt;br /&gt;
&lt;br /&gt;
 export KEY_COUNTRY=&amp;quot;US&amp;quot;&lt;br /&gt;
 export KEY_PROVINCE=&amp;quot;MA&amp;quot;&lt;br /&gt;
 export KEY_CITY=&amp;quot;Waltham&amp;quot;&lt;br /&gt;
 export KEY_ORG=&amp;quot;HotPastrami.org&amp;quot;&lt;br /&gt;
 export KEY_EMAIL=&amp;quot;duncan@example.com&amp;quot;&lt;br /&gt;
 export KEY_CN=$KEY_ORG&lt;br /&gt;
 export KEY_NAME=cerberus&lt;br /&gt;
 export KEY_OU=HotPastrami&lt;br /&gt;
 export PKCS11_MODULE_PATH=dummy&lt;br /&gt;
 export PKCS11_PIN=dummy&lt;br /&gt;
 &lt;br /&gt;
 export KEY_CONFIG=$(pwd)/openssl-1.0.0.cnf&lt;br /&gt;
&lt;br /&gt;
 . ./vars&lt;br /&gt;
 ./clean-all&lt;br /&gt;
&lt;br /&gt;
 ./build-dh&lt;br /&gt;
&lt;br /&gt;
 ./build-ca &lt;br /&gt;
 ./build-key-server server&lt;br /&gt;
&lt;br /&gt;
 cd keys&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
 chmod -Rc g=,o= /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth1 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth1 -j ACCEPT&lt;br /&gt;
 service iptables save&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/OpenVPN_With_CentOS</id>
		<title>OpenVPN With CentOS</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/OpenVPN_With_CentOS"/>
				<updated>2012-03-25T03:48:01Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* DHCP Leases File */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I'm going to attempt to demonstrate how to easily set up an OpenVPN solution with CentOS.&lt;br /&gt;
&lt;br /&gt;
While this page is reasonably complete PLEASE do not use it as a canonical source of information.&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* 172.26.1.1 : DNS, DHCP, Router (Running Tomato)&lt;br /&gt;
* 172.26.1.56 : IP address of my VPN host&lt;br /&gt;
* 172.26.2.0/24 : VPN client IP space&lt;br /&gt;
&lt;br /&gt;
=Xen=&lt;br /&gt;
&lt;br /&gt;
My VPN machine is running under Xen, read [[CentOS 5 and Xen]] if you're interested in using virtualization for your VPN host.&lt;br /&gt;
&lt;br /&gt;
=Install OpenVPN=&lt;br /&gt;
&lt;br /&gt;
You'll want to add the RHEL EPEL repository to your system and then follow that up with a OpenVPN &amp;amp; LZO (for compression) installation.&lt;br /&gt;
&lt;br /&gt;
 rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-release-5-4.noarch.rpm&lt;br /&gt;
 yum install openvpn lzo&lt;br /&gt;
&lt;br /&gt;
=Configure OpenVPN on the Server=&lt;br /&gt;
&lt;br /&gt;
==PKI Files==&lt;br /&gt;
&lt;br /&gt;
You'll want to follow the steps detailed on the OpenVPN website.&lt;br /&gt;
&lt;br /&gt;
* http://openvpn.net/index.php/open-source/documentation/howto.html#pki&lt;br /&gt;
&lt;br /&gt;
Once that's done you'll want to copy your newly created files to /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
 cp -v ca.crt dh1024.pem server.crt server.key /etc/openvpn&lt;br /&gt;
&lt;br /&gt;
==DHCP Leases File==&lt;br /&gt;
&lt;br /&gt;
This file tracks what certificates are using which IPs.&lt;br /&gt;
&lt;br /&gt;
 touch /etc/openvpn/ipp.txt&lt;br /&gt;
&lt;br /&gt;
==openvpn.conf==&lt;br /&gt;
&lt;br /&gt;
Next you'll want to update /etc/openvpn/openvpn.conf to look like the following, though you'll want to update it to reflect what your network setup is.&lt;br /&gt;
&lt;br /&gt;
 # what ip, port &amp;amp; protocol we should listen with&lt;br /&gt;
 local  172.26.1.56&lt;br /&gt;
 port   1194&lt;br /&gt;
 proto  udp&lt;br /&gt;
 &lt;br /&gt;
 # what device we should create &amp;amp; use for tunneled connections&lt;br /&gt;
 dev tun0&lt;br /&gt;
 &lt;br /&gt;
 # use lzo compression &amp;amp; AES-128 encryption&lt;br /&gt;
 cipher AES-128-CBC&lt;br /&gt;
 comp-lzo&lt;br /&gt;
 &lt;br /&gt;
 # the user &amp;amp; group the VPN should run as&lt;br /&gt;
 user nobody&lt;br /&gt;
 group nobody&lt;br /&gt;
 &lt;br /&gt;
 # routing, dns &amp;amp; domain options we're pushing to the clients&lt;br /&gt;
 push &amp;quot;route 172.26.1.0 255.255.255.0&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DNS 172.26.1.1&amp;quot;&lt;br /&gt;
 push &amp;quot;dhcp-option DOMAIN sgtsavings.com&amp;quot;&lt;br /&gt;
 &lt;br /&gt;
 # our dhcp netblock we're using &amp;amp; where to save our dhcp client list&lt;br /&gt;
 server 172.26.2.0 255.255.255.0&lt;br /&gt;
 ifconfig-pool-persist ipp.txt&lt;br /&gt;
 &lt;br /&gt;
 # the certificates &amp;amp; keys we've created for our vpn&lt;br /&gt;
 key    server.key&lt;br /&gt;
 ca     ca.crt&lt;br /&gt;
 cert   server.crt&lt;br /&gt;
 dh     dh1024.pem&lt;br /&gt;
 &lt;br /&gt;
 keepalive      10 120&lt;br /&gt;
 &lt;br /&gt;
 persist-key&lt;br /&gt;
 persist-tun&lt;br /&gt;
 &lt;br /&gt;
 # logging&lt;br /&gt;
 log-append     openvpn.log&lt;br /&gt;
 verb           3&lt;br /&gt;
 mute 20&lt;br /&gt;
 &lt;br /&gt;
 # this is a file that's updated regularly that displays currently connected users&lt;br /&gt;
 status         openvpn-status.log&lt;br /&gt;
&lt;br /&gt;
=Set iptables Rules=&lt;br /&gt;
&lt;br /&gt;
THIS ALL ASSUMES THAT YOU DON'T HAVE ANY UNSAVED IPTABLES RULES SET.&lt;br /&gt;
&lt;br /&gt;
Now we'll need to add iptables rules that'll handle our routing &amp;amp; create the NAT for our VPN hosts.&lt;br /&gt;
&lt;br /&gt;
First you'll want to save your current iptables configuration in case you need to back out.&lt;br /&gt;
&lt;br /&gt;
 cp -pv /etc/sysconfig/iptables /etc/sysconfig/iptables.bak.$(date +%Y%m%d%H%M%S)&lt;br /&gt;
 iptables-save &amp;gt; /etc/sysconfig/iptables-prevpn&lt;br /&gt;
&lt;br /&gt;
Now we'll reload your previously saved iptables configuration &amp;amp; then append our new rules.&lt;br /&gt;
&lt;br /&gt;
 service iptables restart&lt;br /&gt;
 iptables -I INPUT 1 -p udp --dport 1194 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i eth0 -o tun0 -j ACCEPT&lt;br /&gt;
 iptables -I FORWARD -i tun0 -o eth0 -j ACCEPT&lt;br /&gt;
 iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now you'll want to save your new iptables off to the side &amp;amp; review it.&lt;br /&gt;
&lt;br /&gt;
 iptables-save &amp;gt; /etc/sysconfig/iptables-vpn&lt;br /&gt;
&lt;br /&gt;
If that looks sane to you then you'll want to save it.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
Here's what the output of iptables-save looked like on my VPN host.  I cleaned out all of the comments &amp;amp; the lines starting with ''':'''.  I have a very stripped down set of rules since my VPN lives behind an external firewall.&lt;br /&gt;
&lt;br /&gt;
 *nat&lt;br /&gt;
 -A POSTROUTING -o eth0 -j MASQUERADE&lt;br /&gt;
 COMMIT&lt;br /&gt;
 *filter&lt;br /&gt;
 -A INPUT -i lo -j ACCEPT&lt;br /&gt;
 -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT&lt;br /&gt;
 -A INPUT -p esp -j ACCEPT&lt;br /&gt;
 -A INPUT -p ah -j ACCEPT&lt;br /&gt;
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
 -A INPUT -p udp -m state --state NEW -m udp --dport 1194 -j ACCEPT&lt;br /&gt;
 -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT&lt;br /&gt;
 -A INPUT -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 -A FORWARD -i tun0 -o eth0 -j ACCEPT&lt;br /&gt;
 -A FORWARD -i eth0 -o tun0 -j ACCEPT&lt;br /&gt;
 COMMIT&lt;br /&gt;
&lt;br /&gt;
=Enable IPV4 Packet Forwarding=&lt;br /&gt;
&lt;br /&gt;
First you'll want to tell the kernel to enable it.&lt;br /&gt;
&lt;br /&gt;
 echo 1 &amp;gt; /proc/sys/net/ipv4/ip_forward&lt;br /&gt;
&lt;br /&gt;
To make it permanent you'll update /etc/sysctl.conf :&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
=Start OpenVPN=&lt;br /&gt;
&lt;br /&gt;
Your OpenVPN should be ready to go!&lt;br /&gt;
&lt;br /&gt;
 service openvpn start&lt;br /&gt;
&lt;br /&gt;
=Configuring Clients=&lt;br /&gt;
&lt;br /&gt;
[[OpenVPN Clients]] has everything you need.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-25T00:22:06Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=Commands=&lt;br /&gt;
&lt;br /&gt;
 iptraf -i eth1&lt;br /&gt;
&lt;br /&gt;
=Things to Document=&lt;br /&gt;
&lt;br /&gt;
* I'd like to go Yubikey!&lt;br /&gt;
** http://www.yubico.com/yubikey&lt;br /&gt;
&lt;br /&gt;
* VPN w/OpenVPN&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T22:30:35Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=VPN=&lt;br /&gt;
=OATH=&lt;br /&gt;
&lt;br /&gt;
I'd like to go Yubikey!&lt;br /&gt;
* http://www.yubico.com/yubikey&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T22:26:59Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;br /&gt;
&lt;br /&gt;
=VPN=&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T22:22:22Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Transparent Proxy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 access_log /dev/null squid&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T22:15:42Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Transparent Proxy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
 iptables -t nat -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080 &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T21:48:49Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
 chkconfig dhcpd on&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
 service dhcpd start&lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
 chkconfig dnsmasq on&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
 service dnsmasq start&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
=Transparent Proxy=&lt;br /&gt;
&lt;br /&gt;
 yum install squid&lt;br /&gt;
 chkconfig squid on&lt;br /&gt;
&lt;br /&gt;
 access_log /var/log/squid/access.log squid&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 20000 32 512&lt;br /&gt;
 maximum_object_size 5 GB&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern \.iso$          10080   100%    14400&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        30      50%     60&lt;br /&gt;
&lt;br /&gt;
 icp_access allow all&lt;br /&gt;
 visible_hostname 172.16.0.1&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T20:52:14Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Routing &amp;amp; NAT */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | egrep &amp;quot;FORWARD.*REJECT&amp;quot;&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T20:50:51Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Routing &amp;amp; NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | grep FORWARD | grep REJECT&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==DHCP Server==&lt;br /&gt;
&lt;br /&gt;
 yum install dhcp&lt;br /&gt;
&lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
         option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
         default-lease-time 2678400;&lt;br /&gt;
         option routers 172.16.0.1;&lt;br /&gt;
         option domain-name-servers 172.16.0.1;&lt;br /&gt;
         range 172.16.0.100 172.16.0.254;&lt;br /&gt;
 }&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 67 -j ACCEPT &lt;br /&gt;
&lt;br /&gt;
==Caching DNS==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
 iptables -I INPUT -i eth0 -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT &lt;br /&gt;
 iptables -I INPUT -i eth0 -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT &lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T20:45:08Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Building your own fully functioning router using a bare Scientific Linux 6 installation is surprisingly easy for a somewhat seasoned admin.&lt;br /&gt;
&lt;br /&gt;
I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Configuring NAT==&lt;br /&gt;
&lt;br /&gt;
First we want to enable NATing via our external interface.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
&lt;br /&gt;
Now we need to allow inbound traffic associated with outbound traffic back in.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
And now all traffic should be allowed to be forwarded from our internal interface to our external one.&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -I FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
Now we need to check if there are any default rules that'd prevent us from using the FORWARD ruleset.&lt;br /&gt;
&lt;br /&gt;
 iptables-save | grep FORWARD | grep REJECT&lt;br /&gt;
 -A FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Ah, that's terrible!  It applies to all interfaces, so let's remove that rule and add one that only covers our external interface.&lt;br /&gt;
&lt;br /&gt;
 iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
 iptables -I FORWARD -i eth0 -j REJECT --reject-with icmp-host-prohibited&lt;br /&gt;
&lt;br /&gt;
Now we'll save this current ruleset.&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==Configuring DHCP==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 listen-address=172.16.0.1 127.0.0.1&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 # disable responses to DHCP requests&lt;br /&gt;
 no-dhcp-interface=172.16.0.1&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
 # some comment &lt;br /&gt;
 expand-hosts&lt;br /&gt;
 # what domains we should search &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
==SSH==&lt;br /&gt;
&lt;br /&gt;
This bit is completely optional but I feel better when I lock down sshd a little bit.&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T07:43:43Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Configuring DHCP */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Configuring NAT==&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 iptables-save&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==Configuring DHCP==&lt;br /&gt;
&lt;br /&gt;
 yum install dnsmasq&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d  &lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 dhcp-range=172.16.0.100,172.16.0.199,24h&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 &lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
  &lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
  &lt;br /&gt;
 expand-hosts&lt;br /&gt;
  &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 &lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
Comment out sftp&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T07:28:41Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
What I want to use the box for is as follows :&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
* Transparent proxy via Squid&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Configuring NAT==&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 iptables-save&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==Configuring DHCP==&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d  &lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 dhcp-range=172.16.0.100,172.16.0.199,24h&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 &lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
  &lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
  &lt;br /&gt;
 expand-hosts&lt;br /&gt;
  &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 &lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
Comment out sftp&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T07:24:07Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Configuring NAT==&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 iptables-save&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==Configuring DHCP==&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d  &lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 dhcp-range=172.16.0.100,172.16.0.199,24h&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 &lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
  &lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
  &lt;br /&gt;
 expand-hosts&lt;br /&gt;
  &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 &lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;br /&gt;
&lt;br /&gt;
=Securing=&lt;br /&gt;
&lt;br /&gt;
* /etc/ssh/sshd_config&lt;br /&gt;
&lt;br /&gt;
 PermitRootLogin no&lt;br /&gt;
 PasswordAuthentication yes&lt;br /&gt;
 PermitEmptyPasswords no&lt;br /&gt;
&lt;br /&gt;
Comment out sftp&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T06:30:36Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.0.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Configuring NAT==&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 iptables-save&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==Configuring DHCP==&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d  &lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 dhcp-range=172.16.0.100,172.16.0.199,24h&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 &lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
  &lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
  &lt;br /&gt;
 expand-hosts&lt;br /&gt;
  &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 &lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/My_Computers</id>
		<title>My Computers</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/My_Computers"/>
				<updated>2012-03-24T05:56:34Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a list of computers I physically interact with on a fairly daily basis sorted by relative horsepower.&lt;br /&gt;
&lt;br /&gt;
And yes, I *do* consider my Linksys routers to be actual computers, they're runnling [[GNU/Linux]] after all =]&lt;br /&gt;
&lt;br /&gt;
=Physical Machines=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
! name&lt;br /&gt;
! make/model&lt;br /&gt;
! location&lt;br /&gt;
! use&lt;br /&gt;
! cpu&lt;br /&gt;
! ram&lt;br /&gt;
! storage&lt;br /&gt;
! o/s&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Observer (MST3K)|Brainguy]]&lt;br /&gt;
| [[Wikipedia:Apple Inc.|Apple]]/[[Wikipedia:iMac|iMac]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Workstation|Workstation]]&lt;br /&gt;
| 3GHz i3 &lt;br /&gt;
| 16GB&lt;br /&gt;
| 1TB&lt;br /&gt;
| [http://www.apple.com/macosx Mac OS 10.7]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Pearl Forrester|Pearl]]&lt;br /&gt;
| [[Wikipedia:Apple Inc.|Apple]]/[[Wikipedia:MacBook Pro|MacBook Pro]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Laptop|Laptop]]&lt;br /&gt;
| 2.3GHz i5&lt;br /&gt;
| 4GB&lt;br /&gt;
| 320GB&lt;br /&gt;
| [http://www.apple.com/macosx Mac OS 10.7]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Dr. Peanut|Peanut]]&lt;br /&gt;
| [[Wikipedia:Apple Inc.|Apple]]/[[Wikipedia:Mac Mini|Mac Mini]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Server|Printer/Scanner/File Server]]&lt;br /&gt;
| 1.4GHz G4&lt;br /&gt;
| 512MB&lt;br /&gt;
| 580GB&lt;br /&gt;
| [http://www.apple.com/macosx Mac OS 10.5]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Gypsy (MST3K)|Gypsy]]&lt;br /&gt;
| HP&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Server (computing)|Server]]&lt;br /&gt;
| 3GHz AMD Athlon II X2 250&lt;br /&gt;
| 3GB&lt;br /&gt;
| 7TB&lt;br /&gt;
| [http://centos.org/ CentOS 5]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Gizmonic Institute|Gizmonic]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| External [[Wikipedia:Firewall|firewall]] &amp;amp; [[Wikipedia:Router|router]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Deep 13|Deep13]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| Internal [[Wikipedia:Firewall|firewall]] &amp;amp; [[Wikipedia:Router|router]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Tom Servo|Servo]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Wireless bridge|Wireless Bridge]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Crow T. Robot|Crow]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Wireless bridge|Wireless Bridge]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Virtual Machines=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
! name&lt;br /&gt;
! make/model&lt;br /&gt;
! location&lt;br /&gt;
! use&lt;br /&gt;
! cpu&lt;br /&gt;
! ram&lt;br /&gt;
! storage&lt;br /&gt;
! o/s&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Professor Bobo|Bobo]]&lt;br /&gt;
| [[Wikipedia:Virtual machine|Virtual Machine]]&lt;br /&gt;
| [http://tektonic.net/ CO-LO]&lt;br /&gt;
| [[Wikipedia:Server (computing)|Server]]&lt;br /&gt;
| 2.4GHz Core 2 Quad (Shared)&lt;br /&gt;
| 368MB&lt;br /&gt;
| 20GB&lt;br /&gt;
| [http://centos.org CentOS 5]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
[[Category:Computing]]&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T05:51:52Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
Why am I building this from the ground up?  I've been using Tomato on my WRT54GL router for years and I've outgrown the boxen's 200MHz, 16MB ram &amp;amp; 4MB limitations.&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP &amp;amp; cached DNS via dnsmasq&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
&lt;br /&gt;
=Router Configuration=&lt;br /&gt;
&lt;br /&gt;
* eth0, static 172.16.1.1, onboard gigabit, internal network&lt;br /&gt;
* eth1, dhcp, usb ethernet, internet connection&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.0.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring IP4 Forwarding==&lt;br /&gt;
&lt;br /&gt;
* /etc/sysctl.conf&lt;br /&gt;
&lt;br /&gt;
 net.ipv4.ip_forward = 1&lt;br /&gt;
&lt;br /&gt;
==Configuring NAT==&lt;br /&gt;
&lt;br /&gt;
 /sbin/iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth1 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT&lt;br /&gt;
 /sbin/iptables -A FORWARD -i eth0 -o eth1 -j ACCEPT&lt;br /&gt;
&lt;br /&gt;
 iptables-save&lt;br /&gt;
&lt;br /&gt;
 service iptables save&lt;br /&gt;
&lt;br /&gt;
==Configuring DHCP==&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.conf&lt;br /&gt;
&lt;br /&gt;
 interface=eth0&lt;br /&gt;
 conf-dir=/etc/dnsmasq.d  &lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dhcp.conf&lt;br /&gt;
&lt;br /&gt;
 dhcp-range=172.16.0.100,172.16.0.199,24h&lt;br /&gt;
&lt;br /&gt;
* /etc/dnsmasq.d/dns.conf&lt;br /&gt;
&lt;br /&gt;
 # only use external DNS for FQDNs &lt;br /&gt;
 domain-needed&lt;br /&gt;
 &lt;br /&gt;
 # do not forward RFC 1918 IPs &lt;br /&gt;
 bogus-priv&lt;br /&gt;
  &lt;br /&gt;
 # obey the order in /etc/resolv.conf&lt;br /&gt;
 strict-order&lt;br /&gt;
  &lt;br /&gt;
 expand-hosts&lt;br /&gt;
  &lt;br /&gt;
 domain=insbru.com&lt;br /&gt;
 &lt;br /&gt;
 # how many dns results should we cache&lt;br /&gt;
 cache-size=500&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_Router</id>
		<title>SL6 Router</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_Router"/>
				<updated>2012-03-24T04:50:52Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: Created page with &amp;quot;I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.  * VPN via Ope...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;I'm documenting my buildout of a super-router based on Scientific Linux 6.  I'm using my Asus EEE Box and a Cisco/Linksys USB ethernet adapter for a second NIC.&lt;br /&gt;
&lt;br /&gt;
* VPN via OpenVPN&lt;br /&gt;
* DHCP via ISC-DHCP&lt;br /&gt;
* Routing via iptables&lt;br /&gt;
* Cached DNS via [unbound?  dnsmasq?]&lt;br /&gt;
* DYNDNS hostname via noip&lt;br /&gt;
&lt;br /&gt;
=Network Topology=&lt;br /&gt;
&lt;br /&gt;
* Router : 172.16.1.1&lt;br /&gt;
* VPN Clients : 172.16.1.100 - 172.16.1.254&lt;br /&gt;
* Known DHCP Clients : 172.16.0.100 - 172.16.1.199&lt;br /&gt;
* Unknown DHCP Clients : 172.16.0.200 - 172.16.0.254&lt;br /&gt;
&lt;br /&gt;
==Configuring DHCP==&lt;br /&gt;
&lt;br /&gt;
 [root@cerberus etc]# yum install dhcp&lt;br /&gt;
&lt;br /&gt;
 [root@cerberus ~]# cat /etc/sysconfig/dhcpd&lt;br /&gt;
 # Command line options here&lt;br /&gt;
 DHCPDARGS=eth0&lt;br /&gt;
&lt;br /&gt;
 [root@cerberus ~]# cat /etc/dhcp/dhcpd.conf &lt;br /&gt;
 subnet 172.16.0.0 netmask 255.255.255.0 {&lt;br /&gt;
 &lt;br /&gt;
     option domain-name &amp;quot;insbru.com&amp;quot;;&lt;br /&gt;
     option domain-name-servers 172.16.0.1;&lt;br /&gt;
     option routers 172.16.0.1;&lt;br /&gt;
     option broadcast-address 172.16.0.255;&lt;br /&gt;
     option subnet-mask 255.255.255.0;&lt;br /&gt;
 &lt;br /&gt;
     pool {&lt;br /&gt;
         range 172.16.0.100 172.16.0.199;&lt;br /&gt;
         max-lease-time 31557600;&lt;br /&gt;
         deny unknown-clients;&lt;br /&gt;
     }&lt;br /&gt;
 &lt;br /&gt;
     pool {&lt;br /&gt;
         range 172.16.0.200 172.16.0.254;&lt;br /&gt;
         max-lease-time 86400;&lt;br /&gt;
         allow unknown-clients;&lt;br /&gt;
     }&lt;br /&gt;
 }&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Get_Smarter</id>
		<title>Get Smarter</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Get_Smarter"/>
				<updated>2012-03-22T21:21:56Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: Created page with &amp;quot; =Web Services=  Varnish, a web site accelerator * https://www.varnish-cache.org/&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;br /&gt;
=Web Services=&lt;br /&gt;
&lt;br /&gt;
Varnish, a web site accelerator&lt;br /&gt;
* https://www.varnish-cache.org/&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Main_Page</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Main_Page"/>
				<updated>2012-03-22T21:21:25Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Computery Stuff */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hola!  Over the last 7 years that I've owned this domain it's evolved from a simple image to a growing list of links to a wiki.  For the last few years it's been an ever growing notepad for whatever I'm into. Since that's the case you'll probably find incomplete pages or outdated information.  This site '''cannot''' be counted on as a canonical information source.&lt;br /&gt;
&lt;br /&gt;
* [http://replay.waybackmachine.org/20041210190320/http://duncanbrown.org/ Circa 2004]&lt;br /&gt;
* [http://replay.waybackmachine.org/20061026005117/http://www.duncanbrown.org/ Circa 2006]&lt;br /&gt;
&lt;br /&gt;
=Why Is This Site So *SLOW*?=&lt;br /&gt;
&lt;br /&gt;
There are numerous things working against me :&lt;br /&gt;
* It's a [[Wikipedia:Virtual Machine|Virtual Machine]]&lt;br /&gt;
** 360MB RAM (Apache, Sendmail, Spam Assassin &amp;amp; MySQL don't play well together with that small amount)&lt;br /&gt;
** No swap&lt;br /&gt;
** Shared hardware with probably hundreds of other people&lt;br /&gt;
** The I/O contention on this host is insane&lt;br /&gt;
&lt;br /&gt;
There are just two things working for me :&lt;br /&gt;
* It's only $15/mo&lt;br /&gt;
* '''Unlimited''' bandwidth&lt;br /&gt;
&lt;br /&gt;
=Using This Website=&lt;br /&gt;
&lt;br /&gt;
* While this IS a wiki, it's not open to public editing&lt;br /&gt;
* You're going to find a bunch of unfinished pages all over this wiki that are populated by pages from my old text-only website.  As time goes on everything should look cleaner, but since it's a hobby site you shouldn't really hold your breath =]&lt;br /&gt;
&lt;br /&gt;
=Computery Stuff=&lt;br /&gt;
&lt;br /&gt;
Both my personal laptop and home workstation are Macs but for everything else I'm a GNU/Linux kind of guy.&lt;br /&gt;
&lt;br /&gt;
* [[Get Smarter]] :: Things I need to read up on&lt;br /&gt;
* [[GNU/Linux]] :: Articles and thoughts about GNU/Linux&lt;br /&gt;
* [[Mac OS X]] :: Articles and thoughts about Mac OS X on my [[]] computer&lt;br /&gt;
* [[Projects]] :: My various projects&lt;br /&gt;
* [[My Computers]] :: Computers I work with&lt;br /&gt;
* [[Virtualization]] :: Over the last year I've started to work more with virtual machines&lt;br /&gt;
&lt;br /&gt;
==VPN==&lt;br /&gt;
&lt;br /&gt;
I've recently had the need to run a VPN solution and went through a few different VPN suites before settling on OpenVPN.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN With WRT54GL]] :: You can have a cheap VPN solution at home!&lt;br /&gt;
* [[OpenVPN With CentOS]] :: You can have a MUCH more robust VPN solution at home!&lt;br /&gt;
&lt;br /&gt;
Once you've set up your OpenVPN server you'll need to configure clients to connect to it.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN Clients]]&lt;br /&gt;
&lt;br /&gt;
==Shameful Things==&lt;br /&gt;
&lt;br /&gt;
* [[Windows]] :: I pretty much can't stand it, but I have a page with a little bit of tolerance and software links&lt;br /&gt;
&lt;br /&gt;
=Foody Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Recipes]] :: I love to cook, I'm just not organized enough to do it regularly.&lt;br /&gt;
&lt;br /&gt;
=Entertainmenty Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Music]] :: What I listen to, my collection &amp;amp; where to find new music&lt;br /&gt;
* [[Mystery Science Theater 3000 (MST3K)]] :: I have one of the most complete MST3K collections on the eastern seaboard&lt;br /&gt;
* [[Video Gaming]] :: I've been playing video for as long as I can remember&lt;br /&gt;
* [[Books]] :: What I'm reading, my collection, recommendations &amp;amp; what to avoid&lt;br /&gt;
* [[Movies]] :: I'm an avid consumer of almost all things on the silver &amp;amp; LCD screen&lt;br /&gt;
&lt;br /&gt;
=Toys Toys Toys Toys=&lt;br /&gt;
&lt;br /&gt;
* [[Nerf Guns]] :: Someone started a war at my office &amp;amp; I intend to lose gracefully&lt;br /&gt;
* [[Transformers]] :: Not the new stuff, the old stuff.  PS : hey, you kids.  get off my lawn.&lt;br /&gt;
&lt;br /&gt;
=Video Gamey Stuff=&lt;br /&gt;
&lt;br /&gt;
I've been a rabid gamer since 1980 when someone first placed an [[Atari 2600]] joystick in my tiny 4 year old hands.&lt;br /&gt;
&lt;br /&gt;
==Classic Video Games==&lt;br /&gt;
&lt;br /&gt;
* http://www.tototek.com/&lt;br /&gt;
* http://retrousb.com/&lt;br /&gt;
* http://stoneagegamer.com/&lt;br /&gt;
* Angry Video Game Nerd&lt;br /&gt;
&lt;br /&gt;
==XBox 360==&lt;br /&gt;
&lt;br /&gt;
The XBox systems are the only two Microsoft products I'll ever enjoy, they're a bit of a guilty pleasure... they're my main gaming console at the time.&lt;br /&gt;
&lt;br /&gt;
===XBox Live===&lt;br /&gt;
&lt;br /&gt;
Friend me if you like: livepip &amp;amp; suave blanco&lt;br /&gt;
&lt;br /&gt;
=Othery Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Product Recommendations]]&lt;br /&gt;
* [[Car-less In Cambridge]] :: It's not only possible, it's the only way to live&lt;br /&gt;
* [[Cell Phones]] :: Notes that I've compiled on working with them, including custom ringtones&lt;br /&gt;
&lt;br /&gt;
=About Myself=&lt;br /&gt;
&lt;br /&gt;
A vanity page has been crated at [[User:Duncan]], I'm not sure if it'll ever be worth your time.&lt;br /&gt;
&lt;br /&gt;
=My Other Sites=&lt;br /&gt;
&lt;br /&gt;
* http://files.duncanbrown.org :: A semi-organized collection of files from over the years&lt;br /&gt;
* http://hotpastrami.org :: Not up right now, but maybe one day it'll be back as something real&lt;br /&gt;
* http://notpip.com :: Not much, it's my development box at home&lt;br /&gt;
* http://cd2ogg.sf.net :: Homepage for my *nix CD ripping project, cd2ogg&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;meta name=&amp;quot;description&amp;quot; content=&amp;quot;Duncan Brown, Beachwood's favorite son!&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring</id>
		<title>Reverse Proxy for RPM Mirroring</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring"/>
				<updated>2012-02-26T01:15:25Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;At work I needed access to CentOS's vault site (http://vault.centos.org) from an internal network without outside access.  I set a list of requirements for this task:&lt;br /&gt;
&lt;br /&gt;
* Everything should be cached to accelerate subsequent pulls&lt;br /&gt;
* I should be able to hit a web server without specifying a port&lt;br /&gt;
* I wanted to minimize total caches I had to manage&lt;br /&gt;
&lt;br /&gt;
Since I already had a working Squid &amp;amp; Apache installation, I used those.&lt;br /&gt;
&lt;br /&gt;
=Squid Configuration=&lt;br /&gt;
&lt;br /&gt;
I wanted to have Squid use a total of 5GB of space and only cache objects &amp;lt; 500MB in size.  Season to taste.&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 5120 16 256&lt;br /&gt;
 maximum_object_size 512000 KB&lt;br /&gt;
&lt;br /&gt;
Now I need to tell Squid to proxy to vault.centos.org on local port 8080&lt;br /&gt;
&lt;br /&gt;
 http_port 127.0.0.1:8080 accel defaultsite=vault.centos.org&lt;br /&gt;
&lt;br /&gt;
Now we'll set expiration policies.  Keep RPMs around, quickly expire repository data.&lt;br /&gt;
&lt;br /&gt;
 # keep RPMs for 7-10 days, keep repository data for 5-30 minutes&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        5       50%     30&lt;br /&gt;
&lt;br /&gt;
There's probably a better way to do this involving ACLs, but I just use a blanket statement.  Put this at the end of the config file.&lt;br /&gt;
&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart squid.&lt;br /&gt;
&lt;br /&gt;
=Apache Configuration=&lt;br /&gt;
&lt;br /&gt;
You'll need to properly configure VirtualHosts in Apache.  This is as simple as adding the following to /etc/httpd/conf/httpd.conf&lt;br /&gt;
&lt;br /&gt;
 NameVirtualHost *:80&lt;br /&gt;
&lt;br /&gt;
I saved this as '''/etc/httpd/conf.d/vault.conf''' since Apache 2 in RHEL has an include against conf.d/*.conf.  This a very simple VirtualHost that takes advantage of ProxyPass &amp;amp; ProxyPassReverse.  The trailing slash is extremely important.&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;VirtualHost *:80&amp;gt;&lt;br /&gt;
     ServerName vault.duncanbrown.org&lt;br /&gt;
     ServerAlias vault.duncanbrown.org&lt;br /&gt;
     ErrorLog /var/www/vault/logs/error_log&lt;br /&gt;
     CustomLog /var/www/vault/logs/access_log common&lt;br /&gt;
 &lt;br /&gt;
     ProxyPass / http://localhost:8080/&lt;br /&gt;
     ProxyPassReverse / http://localhost:8080/&lt;br /&gt;
 &amp;lt;/VirtualHost&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart Apache.&lt;br /&gt;
&lt;br /&gt;
=Finishing Up=&lt;br /&gt;
&lt;br /&gt;
Once your DNS is configured properly &amp;amp; your domain name resolves everything should work.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring</id>
		<title>Reverse Proxy for RPM Mirroring</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring"/>
				<updated>2012-02-26T01:15:05Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;At work I needed access to CentOS's vault site (http://vault.centos.org) from an internal network without outside access.  I set a list of requirements for this task:&lt;br /&gt;
&lt;br /&gt;
* Everything should be cached to accelerate subsequent pulls&lt;br /&gt;
* I should be able to hit a web server without specifying a port&lt;br /&gt;
* I wanted to minimize total caches I had to manage&lt;br /&gt;
&lt;br /&gt;
Since I already had a working Squid &amp;amp; Apache installation, I used those.&lt;br /&gt;
&lt;br /&gt;
=Squid Configuration=&lt;br /&gt;
&lt;br /&gt;
I wanted to have Squid use a total of 5GB of space and only cache objects &amp;lt; 500MB in size.  Season to taste.&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 5120 16 256&lt;br /&gt;
 maximum_object_size 512000 KB&lt;br /&gt;
&lt;br /&gt;
Now I need to tell Squid to proxy to vault.centos.org on local port 8080&lt;br /&gt;
&lt;br /&gt;
 http_port 127.0.0.1:8080 accel defaultsite=vault.centos.org&lt;br /&gt;
&lt;br /&gt;
Now we'll set expiration policies.  Keep RPMs around, quickly expire repository data.&lt;br /&gt;
&lt;br /&gt;
 # keep RPMs for 7-10 days, keep repository data for 5-30 minutes&lt;br /&gt;
 refresh_pattern \.rpm$          10080   100%    14400&lt;br /&gt;
 refresh_pattern repodata        5       50%     30&lt;br /&gt;
 &lt;br /&gt;
There's probably a better way to do this involving ACLs, but I just use a blanket statement.  Put this at the end of the config file.&lt;br /&gt;
&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart squid.&lt;br /&gt;
&lt;br /&gt;
=Apache Configuration=&lt;br /&gt;
&lt;br /&gt;
You'll need to properly configure VirtualHosts in Apache.  This is as simple as adding the following to /etc/httpd/conf/httpd.conf&lt;br /&gt;
&lt;br /&gt;
 NameVirtualHost *:80&lt;br /&gt;
&lt;br /&gt;
I saved this as '''/etc/httpd/conf.d/vault.conf''' since Apache 2 in RHEL has an include against conf.d/*.conf.  This a very simple VirtualHost that takes advantage of ProxyPass &amp;amp; ProxyPassReverse.  The trailing slash is extremely important.&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;VirtualHost *:80&amp;gt;&lt;br /&gt;
     ServerName vault.duncanbrown.org&lt;br /&gt;
     ServerAlias vault.duncanbrown.org&lt;br /&gt;
     ErrorLog /var/www/vault/logs/error_log&lt;br /&gt;
     CustomLog /var/www/vault/logs/access_log common&lt;br /&gt;
 &lt;br /&gt;
     ProxyPass / http://localhost:8080/&lt;br /&gt;
     ProxyPassReverse / http://localhost:8080/&lt;br /&gt;
 &amp;lt;/VirtualHost&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart Apache.&lt;br /&gt;
&lt;br /&gt;
=Finishing Up=&lt;br /&gt;
&lt;br /&gt;
Once your DNS is configured properly &amp;amp; your domain name resolves everything should work.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring</id>
		<title>Reverse Proxy for RPM Mirroring</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring"/>
				<updated>2012-02-26T01:03:37Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;At work I needed access to CentOS's vault site (http://vault.centos.org) from an internal network without outside access.  I set a list of requirements for this task:&lt;br /&gt;
&lt;br /&gt;
* Everything should be cached to accelerate subsequent pulls&lt;br /&gt;
* I should be able to hit a web server without specifying a port&lt;br /&gt;
* I wanted to minimize total caches I had to manage&lt;br /&gt;
&lt;br /&gt;
Since I already had a working Squid &amp;amp; Apache installation, I used those.&lt;br /&gt;
&lt;br /&gt;
=Squid Configuration=&lt;br /&gt;
&lt;br /&gt;
I wanted to have Squid use a total of 5GB of space and only cache objects &amp;lt; 500MB in size.&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 5120 16 256&lt;br /&gt;
 maximum_object_size 512000 KB&lt;br /&gt;
&lt;br /&gt;
Now I need to tell Squid to proxy to vault.centos.org on local port 8080&lt;br /&gt;
&lt;br /&gt;
 http_port 127.0.0.1:8080 accel defaultsite=vault.centos.org&lt;br /&gt;
&lt;br /&gt;
You'll need to tell squid to be aggressive about expiring repository data files.  Place this prior to all refresh_pattern lines.&lt;br /&gt;
&lt;br /&gt;
 refresh_pattern repodata        5       50%     30&lt;br /&gt;
&lt;br /&gt;
There's probably a better way to do this involving ACLs, but I just use a blanket statement.  Put this at the end of the config file.&lt;br /&gt;
&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart squid.&lt;br /&gt;
&lt;br /&gt;
=Apache Configuration=&lt;br /&gt;
&lt;br /&gt;
You'll need to properly configure VirtualHosts in Apache.  This is as simple as adding the following to /etc/httpd/conf/httpd.conf&lt;br /&gt;
&lt;br /&gt;
 NameVirtualHost *:80&lt;br /&gt;
&lt;br /&gt;
I saved this as '''/etc/httpd/conf.d/vault.conf''' since Apache 2 in RHEL has an include against conf.d/*.conf.  This a very simple VirtualHost that takes advantage of ProxyPass &amp;amp; ProxyPassReverse.  The trailing slash is extremely important.&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;VirtualHost *:80&amp;gt;&lt;br /&gt;
     ServerName vault.duncanbrown.org&lt;br /&gt;
     ServerAlias vault.duncanbrown.org&lt;br /&gt;
     ErrorLog /var/www/vault/logs/error_log&lt;br /&gt;
     CustomLog /var/www/vault/logs/access_log common&lt;br /&gt;
 &lt;br /&gt;
     ProxyPass / http://localhost:8080/&lt;br /&gt;
     ProxyPassReverse / http://localhost:8080/&lt;br /&gt;
 &amp;lt;/VirtualHost&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart Apache.&lt;br /&gt;
&lt;br /&gt;
=Finishing Up=&lt;br /&gt;
&lt;br /&gt;
Once your DNS is configured properly &amp;amp; your domain name resolves everything should work.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring</id>
		<title>Reverse Proxy for RPM Mirroring</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring"/>
				<updated>2012-02-23T20:41:31Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;At work I needed access to CentOS's vault site (http://vault.centos.org) from an internal network without outside access.  I set a list of requirements for this task:&lt;br /&gt;
&lt;br /&gt;
* Everything should be cached to accelerate subsequent pulls&lt;br /&gt;
* I should be able to hit a web server without specifying a port&lt;br /&gt;
* I wanted to minimize total caches I had to manage&lt;br /&gt;
&lt;br /&gt;
Since I already had a working Squid &amp;amp; Apache installation, I used those.&lt;br /&gt;
&lt;br /&gt;
=Squid Configuration=&lt;br /&gt;
&lt;br /&gt;
I wanted to have Squid use a total of 5GB of space and only cache objects &amp;lt; 500MB in size.&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 5120 16 256&lt;br /&gt;
 maximum_object_size 512000 KB&lt;br /&gt;
&lt;br /&gt;
Now I need to tell Squid to proxy to vault.centos.org on local port 8080&lt;br /&gt;
&lt;br /&gt;
 http_port 127.0.0.1:8080 accel defaultsite=vault.centos.org&lt;br /&gt;
&lt;br /&gt;
There's probably a better way to do this involving ACLs, but I just use a blanket statement.&lt;br /&gt;
&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart squid.&lt;br /&gt;
&lt;br /&gt;
=Apache Configuration=&lt;br /&gt;
&lt;br /&gt;
You'll need to properly configure VirtualHosts in Apache.  This is as simple as adding the following to /etc/httpd/conf/httpd.conf&lt;br /&gt;
&lt;br /&gt;
 NameVirtualHost *:80&lt;br /&gt;
&lt;br /&gt;
I saved this as '''/etc/httpd/conf.d/vault.conf''' since Apache 2 in RHEL has an include against conf.d/*.conf.  This a very simple VirtualHost that takes advantage of ProxyPass &amp;amp; ProxyPassReverse.  The trailing slash is extremely important.&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;VirtualHost *:80&amp;gt;&lt;br /&gt;
     ServerName vault.duncanbrown.org&lt;br /&gt;
     ServerAlias vault.duncanbrown.org&lt;br /&gt;
     ErrorLog /var/www/vault/logs/error_log&lt;br /&gt;
     CustomLog /var/www/vault/logs/access_log common&lt;br /&gt;
 &lt;br /&gt;
     ProxyPass / http://localhost:8080/&lt;br /&gt;
     ProxyPassReverse / http://localhost:8080/&lt;br /&gt;
 &amp;lt;/VirtualHost&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart Apache.&lt;br /&gt;
&lt;br /&gt;
=Finishing Up=&lt;br /&gt;
&lt;br /&gt;
Once your DNS is configured properly &amp;amp; your domain name resolves everything should work.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring</id>
		<title>Reverse Proxy for RPM Mirroring</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Reverse_Proxy_for_RPM_Mirroring"/>
				<updated>2012-02-23T20:41:10Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;At work I needed access to CentOS's vault site (http://vault.centos.org) from an internal network without outside access.  I set a list of requirements for this task:&lt;br /&gt;
&lt;br /&gt;
* Everything should be cached to accelerate subsequent pulls&lt;br /&gt;
* I should be able to hit a web server without specifying a port&lt;br /&gt;
* I wanted to minimize total caches I had to manage&lt;br /&gt;
&lt;br /&gt;
Since I already had a working Squid &amp;amp; Apache installation, I used those.&lt;br /&gt;
&lt;br /&gt;
=Squid Configuration=&lt;br /&gt;
&lt;br /&gt;
I wanted to have Squid use a total of 5GB of space and only cache objects &amp;lt; 500MB in size.&lt;br /&gt;
&lt;br /&gt;
 cache_dir ufs /var/spool/squid 5120 16 256&lt;br /&gt;
 maximum_object_size 512000 KB&lt;br /&gt;
&lt;br /&gt;
Now I need to tell Squid to proxy to vault.centos.org on local port 8080&lt;br /&gt;
&lt;br /&gt;
 http_port 127.0.0.1:8080 accel defaultsite=vault.centos.org&lt;br /&gt;
&lt;br /&gt;
There's probably a better way to do this involving ACLs, but I just use a blanket statement.&lt;br /&gt;
&lt;br /&gt;
 always_direct allow all&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart squid.&lt;br /&gt;
&lt;br /&gt;
=Apache Configuration=&lt;br /&gt;
&lt;br /&gt;
You'll need to properly configure VirtualHosts in Apache.  This is as simple as adding the following to /etc/httpd/conf/httpd.conf&lt;br /&gt;
&lt;br /&gt;
 NameVirtualHost *:80&lt;br /&gt;
&lt;br /&gt;
I saved this as '''/etc/httpd/conf.d/vault.conf since Apache 2 in RHEL has an include against conf.d/*.conf.  This a very simple VirtualHost that takes advantage of ProxyPass &amp;amp; ProxyPassReverse.  The trailing slash is extremely important.&lt;br /&gt;
&lt;br /&gt;
 &amp;lt;VirtualHost *:80&amp;gt;&lt;br /&gt;
     ServerName vault.duncanbrown.org&lt;br /&gt;
     ServerAlias vault.duncanbrown.org&lt;br /&gt;
     ErrorLog /var/www/vault/logs/error_log&lt;br /&gt;
     CustomLog /var/www/vault/logs/access_log common&lt;br /&gt;
 &lt;br /&gt;
     ProxyPass / http://localhost:8080/&lt;br /&gt;
     ProxyPassReverse / http://localhost:8080/&lt;br /&gt;
 &amp;lt;/VirtualHost&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Now you'll want to restart Apache.&lt;br /&gt;
&lt;br /&gt;
=Finishing Up=&lt;br /&gt;
&lt;br /&gt;
Once your DNS is configured properly &amp;amp; your domain name resolves everything should work.&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/SL6_and_KVM</id>
		<title>SL6 and KVM</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/SL6_and_KVM"/>
				<updated>2012-01-15T21:13:42Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: Created page with &amp;quot;=Generating MAC=  Find a 6 character hex-compatible word you like &amp;amp; generate random MAC addresses based on that.   egrep '^[a-f]{6}$' /usr/share/dict/words  I liked 'deface' so I...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;=Generating MAC=&lt;br /&gt;
&lt;br /&gt;
Find a 6 character hex-compatible word you like &amp;amp; generate random MAC addresses based on that.&lt;br /&gt;
&lt;br /&gt;
 egrep '^[a-f]{6}$' /usr/share/dict/words&lt;br /&gt;
&lt;br /&gt;
I liked 'deface' so I wound up using that.&lt;br /&gt;
&lt;br /&gt;
 printf 'DE:FA:CE:%02X:%02X:%02X\n' $((RANDOM%256)) $((RANDOM%256)) $((RANDOM%256))&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/My_Computers</id>
		<title>My Computers</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/My_Computers"/>
				<updated>2011-10-15T05:23:58Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Here is a list of computers I physically interact with on a fairly daily basis sorted by relative horsepower.&lt;br /&gt;
&lt;br /&gt;
And yes, I *do* consider my Linksys routers to be actual computers, they're runnling [[GNU/Linux]] after all =]&lt;br /&gt;
&lt;br /&gt;
=Physical Machines=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
! name&lt;br /&gt;
! make/model&lt;br /&gt;
! location&lt;br /&gt;
! use&lt;br /&gt;
! cpu&lt;br /&gt;
! ram&lt;br /&gt;
! storage&lt;br /&gt;
! o/s&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Observer (MST3K)|Brainguy]]&lt;br /&gt;
| [[Wikipedia:Apple Inc.|Apple]]/[[Wikipedia:iMac|iMac]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Workstation|Workstation]]&lt;br /&gt;
| 3GHz i3&lt;br /&gt;
| 4GB&lt;br /&gt;
| 1TB&lt;br /&gt;
| [http://www.apple.com/macosx Mac OS 10.7]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Pearl Forrester|Pearl]]&lt;br /&gt;
| [[Wikipedia:Apple Inc.|Apple]]/[[Wikipedia:MacBook Pro|MacBook Pro]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Laptop|Laptop]]&lt;br /&gt;
| 2.3GHz i5&lt;br /&gt;
| 4GB&lt;br /&gt;
| 320GB&lt;br /&gt;
| [http://www.apple.com/macosx Mac OS 10.7]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Dr. Peanut|Peanut]]&lt;br /&gt;
| [[Wikipedia:Apple Inc.|Apple]]/[[Wikipedia:Mac Mini|Mac Mini]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Server|Printer/Scanner/File Server]]&lt;br /&gt;
| 1.4GHz G4&lt;br /&gt;
| 512MB&lt;br /&gt;
| 580GB&lt;br /&gt;
| [http://www.apple.com/macosx Mac OS 10.5]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Gypsy (MST3K)|Gypsy]]&lt;br /&gt;
| HP&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Server (computing)|Server]]&lt;br /&gt;
| 3GHz AMD Athlon II X2 250&lt;br /&gt;
| 3GB&lt;br /&gt;
| 7TB&lt;br /&gt;
| [http://centos.org/ CentOS 5]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Gizmonic Institute|Gizmonic]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| External [[Wikipedia:Firewall|firewall]] &amp;amp; [[Wikipedia:Router|router]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Deep 13|Deep13]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| Internal [[Wikipedia:Firewall|firewall]] &amp;amp; [[Wikipedia:Router|router]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Tom Servo|Servo]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Wireless bridge|Wireless Bridge]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Crow T. Robot|Crow]]&lt;br /&gt;
| [[Wikipedia:Linksys WRT54G series|Linksys WRT54GL]]&lt;br /&gt;
| Home&lt;br /&gt;
| [[Wikipedia:Wireless bridge|Wireless Bridge]]&lt;br /&gt;
| 200MHz Broadcom&lt;br /&gt;
| 16MB&lt;br /&gt;
| 4MB&lt;br /&gt;
| [http://www.polarcloud.com/tomato Tomato]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Virtual Machines=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
! name&lt;br /&gt;
! make/model&lt;br /&gt;
! location&lt;br /&gt;
! use&lt;br /&gt;
! cpu&lt;br /&gt;
! ram&lt;br /&gt;
! storage&lt;br /&gt;
! o/s&lt;br /&gt;
|-&lt;br /&gt;
| [[Wikipedia:Professor Bobo|Bobo]]&lt;br /&gt;
| [[Wikipedia:Virtual machine|Virtual Machine]]&lt;br /&gt;
| [http://tektonic.net/ CO-LO]&lt;br /&gt;
| [[Wikipedia:Server (computing)|Server]]&lt;br /&gt;
| 2.4GHz Core 2 Quad (Shared)&lt;br /&gt;
| 368MB&lt;br /&gt;
| 20GB&lt;br /&gt;
| [http://centos.org CentOS 5]&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
[[Category:Computing]]&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Main_Page</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Main_Page"/>
				<updated>2011-10-05T18:22:01Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Classic Video Games */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hola!  Over the last 7 years that I've owned this domain it's evolved from a simple image to a growing list of links to a wiki.  For the last few years it's been an ever growing notepad for whatever I'm into. Since that's the case you'll probably find incomplete pages or outdated information.  This site '''cannot''' be counted on as a canonical information source.&lt;br /&gt;
&lt;br /&gt;
* [http://replay.waybackmachine.org/20041210190320/http://duncanbrown.org/ Circa 2004]&lt;br /&gt;
* [http://replay.waybackmachine.org/20061026005117/http://www.duncanbrown.org/ Circa 2006]&lt;br /&gt;
&lt;br /&gt;
=Why Is This Site So *SLOW*?=&lt;br /&gt;
&lt;br /&gt;
There are numerous things working against me :&lt;br /&gt;
* It's a [[Wikipedia:Virtual Machine|Virtual Machine]]&lt;br /&gt;
** 360MB RAM (Apache, Sendmail, Spam Assassin &amp;amp; MySQL don't play well together with that small amount)&lt;br /&gt;
** No swap&lt;br /&gt;
** Shared hardware with probably hundreds of other people&lt;br /&gt;
** The I/O contention on this host is insane&lt;br /&gt;
&lt;br /&gt;
There are just two things working for me :&lt;br /&gt;
* It's only $15/mo&lt;br /&gt;
* '''Unlimited''' bandwidth&lt;br /&gt;
&lt;br /&gt;
=Using This Website=&lt;br /&gt;
&lt;br /&gt;
* While this IS a wiki, it's not open to public editing&lt;br /&gt;
* You're going to find a bunch of unfinished pages all over this wiki that are populated by pages from my old text-only website.  As time goes on everything should look cleaner, but since it's a hobby site you shouldn't really hold your breath =]&lt;br /&gt;
&lt;br /&gt;
=Computery Stuff=&lt;br /&gt;
&lt;br /&gt;
Both my personal laptop and home workstation are Macs but for everything else I'm a GNU/Linux kind of guy.&lt;br /&gt;
&lt;br /&gt;
* [[GNU/Linux]] :: Articles and thoughts about GNU/Linux&lt;br /&gt;
* [[Mac OS X]] :: Articles and thoughts about Mac OS X on my [[]] computer&lt;br /&gt;
* [[Projects]] :: My various projects&lt;br /&gt;
* [[My Computers]] :: Computers I work with&lt;br /&gt;
* [[Virtualization]] :: Over the last year I've started to work more with virtual machines&lt;br /&gt;
&lt;br /&gt;
==VPN==&lt;br /&gt;
&lt;br /&gt;
I've recently had the need to run a VPN solution and went through a few different VPN suites before settling on OpenVPN.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN With WRT54GL]] :: You can have a cheap VPN solution at home!&lt;br /&gt;
* [[OpenVPN With CentOS]] :: You can have a MUCH more robust VPN solution at home!&lt;br /&gt;
&lt;br /&gt;
Once you've set up your OpenVPN server you'll need to configure clients to connect to it.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN Clients]]&lt;br /&gt;
&lt;br /&gt;
==Shameful Things==&lt;br /&gt;
&lt;br /&gt;
* [[Windows]] :: I pretty much can't stand it, but I have a page with a little bit of tolerance and software links&lt;br /&gt;
&lt;br /&gt;
=Foody Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Recipes]] :: I love to cook, I'm just not organized enough to do it regularly.&lt;br /&gt;
&lt;br /&gt;
=Entertainmenty Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Music]] :: What I listen to, my collection &amp;amp; where to find new music&lt;br /&gt;
* [[Mystery Science Theater 3000 (MST3K)]] :: I have one of the most complete MST3K collections on the eastern seaboard&lt;br /&gt;
* [[Video Gaming]] :: I've been playing video for as long as I can remember&lt;br /&gt;
* [[Books]] :: What I'm reading, my collection, recommendations &amp;amp; what to avoid&lt;br /&gt;
* [[Movies]] :: I'm an avid consumer of almost all things on the silver &amp;amp; LCD screen&lt;br /&gt;
&lt;br /&gt;
=Toys Toys Toys Toys=&lt;br /&gt;
&lt;br /&gt;
* [[Nerf Guns]] :: Someone started a war at my office &amp;amp; I intend to lose gracefully&lt;br /&gt;
* [[Transformers]] :: Not the new stuff, the old stuff.  PS : hey, you kids.  get off my lawn.&lt;br /&gt;
&lt;br /&gt;
=Video Gamey Stuff=&lt;br /&gt;
&lt;br /&gt;
I've been a rabid gamer since 1980 when someone first placed an [[Atari 2600]] joystick in my tiny 4 year old hands.&lt;br /&gt;
&lt;br /&gt;
==Classic Video Games==&lt;br /&gt;
&lt;br /&gt;
* http://www.tototek.com/&lt;br /&gt;
* http://retrousb.com/&lt;br /&gt;
* http://stoneagegamer.com/&lt;br /&gt;
* Angry Video Game Nerd&lt;br /&gt;
&lt;br /&gt;
==XBox 360==&lt;br /&gt;
&lt;br /&gt;
The XBox systems are the only two Microsoft products I'll ever enjoy, they're a bit of a guilty pleasure... they're my main gaming console at the time.&lt;br /&gt;
&lt;br /&gt;
===XBox Live===&lt;br /&gt;
&lt;br /&gt;
Friend me if you like: livepip &amp;amp; suave blanco&lt;br /&gt;
&lt;br /&gt;
=Othery Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Product Recommendations]]&lt;br /&gt;
* [[Car-less In Cambridge]] :: It's not only possible, it's the only way to live&lt;br /&gt;
* [[Cell Phones]] :: Notes that I've compiled on working with them, including custom ringtones&lt;br /&gt;
&lt;br /&gt;
=About Myself=&lt;br /&gt;
&lt;br /&gt;
A vanity page has been crated at [[User:Duncan]], I'm not sure if it'll ever be worth your time.&lt;br /&gt;
&lt;br /&gt;
=My Other Sites=&lt;br /&gt;
&lt;br /&gt;
* http://files.duncanbrown.org :: A semi-organized collection of files from over the years&lt;br /&gt;
* http://hotpastrami.org :: Not up right now, but maybe one day it'll be back as something real&lt;br /&gt;
* http://notpip.com :: Not much, it's my development box at home&lt;br /&gt;
* http://cd2ogg.sf.net :: Homepage for my *nix CD ripping project, cd2ogg&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;meta name=&amp;quot;description&amp;quot; content=&amp;quot;Duncan Brown, Beachwood's favorite son!&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Main_Page</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Main_Page"/>
				<updated>2011-08-30T22:40:25Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Classic Video Games */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hola!  Over the last 7 years that I've owned this domain it's evolved from a simple image to a growing list of links to a wiki.  For the last few years it's been an ever growing notepad for whatever I'm into. Since that's the case you'll probably find incomplete pages or outdated information.  This site '''cannot''' be counted on as a canonical information source.&lt;br /&gt;
&lt;br /&gt;
* [http://replay.waybackmachine.org/20041210190320/http://duncanbrown.org/ Circa 2004]&lt;br /&gt;
* [http://replay.waybackmachine.org/20061026005117/http://www.duncanbrown.org/ Circa 2006]&lt;br /&gt;
&lt;br /&gt;
=Why Is This Site So *SLOW*?=&lt;br /&gt;
&lt;br /&gt;
There are numerous things working against me :&lt;br /&gt;
* It's a [[Wikipedia:Virtual Machine|Virtual Machine]]&lt;br /&gt;
** 360MB RAM (Apache, Sendmail, Spam Assassin &amp;amp; MySQL don't play well together with that small amount)&lt;br /&gt;
** No swap&lt;br /&gt;
** Shared hardware with probably hundreds of other people&lt;br /&gt;
** The I/O contention on this host is insane&lt;br /&gt;
&lt;br /&gt;
There are just two things working for me :&lt;br /&gt;
* It's only $15/mo&lt;br /&gt;
* '''Unlimited''' bandwidth&lt;br /&gt;
&lt;br /&gt;
=Using This Website=&lt;br /&gt;
&lt;br /&gt;
* While this IS a wiki, it's not open to public editing&lt;br /&gt;
* You're going to find a bunch of unfinished pages all over this wiki that are populated by pages from my old text-only website.  As time goes on everything should look cleaner, but since it's a hobby site you shouldn't really hold your breath =]&lt;br /&gt;
&lt;br /&gt;
=Computery Stuff=&lt;br /&gt;
&lt;br /&gt;
Both my personal laptop and home workstation are Macs but for everything else I'm a GNU/Linux kind of guy.&lt;br /&gt;
&lt;br /&gt;
* [[GNU/Linux]] :: Articles and thoughts about GNU/Linux&lt;br /&gt;
* [[Mac OS X]] :: Articles and thoughts about Mac OS X on my [[]] computer&lt;br /&gt;
* [[Projects]] :: My various projects&lt;br /&gt;
* [[My Computers]] :: Computers I work with&lt;br /&gt;
* [[Virtualization]] :: Over the last year I've started to work more with virtual machines&lt;br /&gt;
&lt;br /&gt;
==VPN==&lt;br /&gt;
&lt;br /&gt;
I've recently had the need to run a VPN solution and went through a few different VPN suites before settling on OpenVPN.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN With WRT54GL]] :: You can have a cheap VPN solution at home!&lt;br /&gt;
* [[OpenVPN With CentOS]] :: You can have a MUCH more robust VPN solution at home!&lt;br /&gt;
&lt;br /&gt;
Once you've set up your OpenVPN server you'll need to configure clients to connect to it.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN Clients]]&lt;br /&gt;
&lt;br /&gt;
==Shameful Things==&lt;br /&gt;
&lt;br /&gt;
* [[Windows]] :: I pretty much can't stand it, but I have a page with a little bit of tolerance and software links&lt;br /&gt;
&lt;br /&gt;
=Foody Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Recipes]] :: I love to cook, I'm just not organized enough to do it regularly.&lt;br /&gt;
&lt;br /&gt;
=Entertainmenty Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Music]] :: What I listen to, my collection &amp;amp; where to find new music&lt;br /&gt;
* [[Mystery Science Theater 3000 (MST3K)]] :: I have one of the most complete MST3K collections on the eastern seaboard&lt;br /&gt;
* [[Video Gaming]] :: I've been playing video for as long as I can remember&lt;br /&gt;
* [[Books]] :: What I'm reading, my collection, recommendations &amp;amp; what to avoid&lt;br /&gt;
* [[Movies]] :: I'm an avid consumer of almost all things on the silver &amp;amp; LCD screen&lt;br /&gt;
&lt;br /&gt;
=Toys Toys Toys Toys=&lt;br /&gt;
&lt;br /&gt;
* [[Nerf Guns]] :: Someone started a war at my office &amp;amp; I intend to lose gracefully&lt;br /&gt;
* [[Transformers]] :: Not the new stuff, the old stuff.  PS : hey, you kids.  get off my lawn.&lt;br /&gt;
&lt;br /&gt;
=Video Gamey Stuff=&lt;br /&gt;
&lt;br /&gt;
I've been a rabid gamer since 1980 when someone first placed an [[Atari 2600]] joystick in my tiny 4 year old hands.&lt;br /&gt;
&lt;br /&gt;
==Classic Video Games==&lt;br /&gt;
&lt;br /&gt;
* http://www.tototek.com/&lt;br /&gt;
* http://retrousb.com/&lt;br /&gt;
* http://stoneagegamer.com/&lt;br /&gt;
&lt;br /&gt;
==XBox 360==&lt;br /&gt;
&lt;br /&gt;
The XBox systems are the only two Microsoft products I'll ever enjoy, they're a bit of a guilty pleasure... they're my main gaming console at the time.&lt;br /&gt;
&lt;br /&gt;
===XBox Live===&lt;br /&gt;
&lt;br /&gt;
Friend me if you like: livepip &amp;amp; suave blanco&lt;br /&gt;
&lt;br /&gt;
=Othery Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Product Recommendations]]&lt;br /&gt;
* [[Car-less In Cambridge]] :: It's not only possible, it's the only way to live&lt;br /&gt;
* [[Cell Phones]] :: Notes that I've compiled on working with them, including custom ringtones&lt;br /&gt;
&lt;br /&gt;
=About Myself=&lt;br /&gt;
&lt;br /&gt;
A vanity page has been crated at [[User:Duncan]], I'm not sure if it'll ever be worth your time.&lt;br /&gt;
&lt;br /&gt;
=My Other Sites=&lt;br /&gt;
&lt;br /&gt;
* http://files.duncanbrown.org :: A semi-organized collection of files from over the years&lt;br /&gt;
* http://hotpastrami.org :: Not up right now, but maybe one day it'll be back as something real&lt;br /&gt;
* http://notpip.com :: Not much, it's my development box at home&lt;br /&gt;
* http://cd2ogg.sf.net :: Homepage for my *nix CD ripping project, cd2ogg&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;meta name=&amp;quot;description&amp;quot; content=&amp;quot;Duncan Brown, Beachwood's favorite son!&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Main_Page</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Main_Page"/>
				<updated>2011-08-30T22:38:08Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Classic Video Games */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hola!  Over the last 7 years that I've owned this domain it's evolved from a simple image to a growing list of links to a wiki.  For the last few years it's been an ever growing notepad for whatever I'm into. Since that's the case you'll probably find incomplete pages or outdated information.  This site '''cannot''' be counted on as a canonical information source.&lt;br /&gt;
&lt;br /&gt;
* [http://replay.waybackmachine.org/20041210190320/http://duncanbrown.org/ Circa 2004]&lt;br /&gt;
* [http://replay.waybackmachine.org/20061026005117/http://www.duncanbrown.org/ Circa 2006]&lt;br /&gt;
&lt;br /&gt;
=Why Is This Site So *SLOW*?=&lt;br /&gt;
&lt;br /&gt;
There are numerous things working against me :&lt;br /&gt;
* It's a [[Wikipedia:Virtual Machine|Virtual Machine]]&lt;br /&gt;
** 360MB RAM (Apache, Sendmail, Spam Assassin &amp;amp; MySQL don't play well together with that small amount)&lt;br /&gt;
** No swap&lt;br /&gt;
** Shared hardware with probably hundreds of other people&lt;br /&gt;
** The I/O contention on this host is insane&lt;br /&gt;
&lt;br /&gt;
There are just two things working for me :&lt;br /&gt;
* It's only $15/mo&lt;br /&gt;
* '''Unlimited''' bandwidth&lt;br /&gt;
&lt;br /&gt;
=Using This Website=&lt;br /&gt;
&lt;br /&gt;
* While this IS a wiki, it's not open to public editing&lt;br /&gt;
* You're going to find a bunch of unfinished pages all over this wiki that are populated by pages from my old text-only website.  As time goes on everything should look cleaner, but since it's a hobby site you shouldn't really hold your breath =]&lt;br /&gt;
&lt;br /&gt;
=Computery Stuff=&lt;br /&gt;
&lt;br /&gt;
Both my personal laptop and home workstation are Macs but for everything else I'm a GNU/Linux kind of guy.&lt;br /&gt;
&lt;br /&gt;
* [[GNU/Linux]] :: Articles and thoughts about GNU/Linux&lt;br /&gt;
* [[Mac OS X]] :: Articles and thoughts about Mac OS X on my [[]] computer&lt;br /&gt;
* [[Projects]] :: My various projects&lt;br /&gt;
* [[My Computers]] :: Computers I work with&lt;br /&gt;
* [[Virtualization]] :: Over the last year I've started to work more with virtual machines&lt;br /&gt;
&lt;br /&gt;
==VPN==&lt;br /&gt;
&lt;br /&gt;
I've recently had the need to run a VPN solution and went through a few different VPN suites before settling on OpenVPN.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN With WRT54GL]] :: You can have a cheap VPN solution at home!&lt;br /&gt;
* [[OpenVPN With CentOS]] :: You can have a MUCH more robust VPN solution at home!&lt;br /&gt;
&lt;br /&gt;
Once you've set up your OpenVPN server you'll need to configure clients to connect to it.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN Clients]]&lt;br /&gt;
&lt;br /&gt;
==Shameful Things==&lt;br /&gt;
&lt;br /&gt;
* [[Windows]] :: I pretty much can't stand it, but I have a page with a little bit of tolerance and software links&lt;br /&gt;
&lt;br /&gt;
=Foody Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Recipes]] :: I love to cook, I'm just not organized enough to do it regularly.&lt;br /&gt;
&lt;br /&gt;
=Entertainmenty Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Music]] :: What I listen to, my collection &amp;amp; where to find new music&lt;br /&gt;
* [[Mystery Science Theater 3000 (MST3K)]] :: I have one of the most complete MST3K collections on the eastern seaboard&lt;br /&gt;
* [[Video Gaming]] :: I've been playing video for as long as I can remember&lt;br /&gt;
* [[Books]] :: What I'm reading, my collection, recommendations &amp;amp; what to avoid&lt;br /&gt;
* [[Movies]] :: I'm an avid consumer of almost all things on the silver &amp;amp; LCD screen&lt;br /&gt;
&lt;br /&gt;
=Toys Toys Toys Toys=&lt;br /&gt;
&lt;br /&gt;
* [[Nerf Guns]] :: Someone started a war at my office &amp;amp; I intend to lose gracefully&lt;br /&gt;
* [[Transformers]] :: Not the new stuff, the old stuff.  PS : hey, you kids.  get off my lawn.&lt;br /&gt;
&lt;br /&gt;
=Video Gamey Stuff=&lt;br /&gt;
&lt;br /&gt;
I've been a rabid gamer since 1980 when someone first placed an [[Atari 2600]] joystick in my tiny 4 year old hands.&lt;br /&gt;
&lt;br /&gt;
==Classic Video Games==&lt;br /&gt;
&lt;br /&gt;
* http://www.tototek.com/&lt;br /&gt;
* http://retrousb.com/&lt;br /&gt;
&lt;br /&gt;
==XBox 360==&lt;br /&gt;
&lt;br /&gt;
The XBox systems are the only two Microsoft products I'll ever enjoy, they're a bit of a guilty pleasure... they're my main gaming console at the time.&lt;br /&gt;
&lt;br /&gt;
===XBox Live===&lt;br /&gt;
&lt;br /&gt;
Friend me if you like: livepip &amp;amp; suave blanco&lt;br /&gt;
&lt;br /&gt;
=Othery Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Product Recommendations]]&lt;br /&gt;
* [[Car-less In Cambridge]] :: It's not only possible, it's the only way to live&lt;br /&gt;
* [[Cell Phones]] :: Notes that I've compiled on working with them, including custom ringtones&lt;br /&gt;
&lt;br /&gt;
=About Myself=&lt;br /&gt;
&lt;br /&gt;
A vanity page has been crated at [[User:Duncan]], I'm not sure if it'll ever be worth your time.&lt;br /&gt;
&lt;br /&gt;
=My Other Sites=&lt;br /&gt;
&lt;br /&gt;
* http://files.duncanbrown.org :: A semi-organized collection of files from over the years&lt;br /&gt;
* http://hotpastrami.org :: Not up right now, but maybe one day it'll be back as something real&lt;br /&gt;
* http://notpip.com :: Not much, it's my development box at home&lt;br /&gt;
* http://cd2ogg.sf.net :: Homepage for my *nix CD ripping project, cd2ogg&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;meta name=&amp;quot;description&amp;quot; content=&amp;quot;Duncan Brown, Beachwood's favorite son!&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/Main_Page</id>
		<title>Main Page</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/Main_Page"/>
				<updated>2011-08-30T22:37:54Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Classic Video Games */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;Hola!  Over the last 7 years that I've owned this domain it's evolved from a simple image to a growing list of links to a wiki.  For the last few years it's been an ever growing notepad for whatever I'm into. Since that's the case you'll probably find incomplete pages or outdated information.  This site '''cannot''' be counted on as a canonical information source.&lt;br /&gt;
&lt;br /&gt;
* [http://replay.waybackmachine.org/20041210190320/http://duncanbrown.org/ Circa 2004]&lt;br /&gt;
* [http://replay.waybackmachine.org/20061026005117/http://www.duncanbrown.org/ Circa 2006]&lt;br /&gt;
&lt;br /&gt;
=Why Is This Site So *SLOW*?=&lt;br /&gt;
&lt;br /&gt;
There are numerous things working against me :&lt;br /&gt;
* It's a [[Wikipedia:Virtual Machine|Virtual Machine]]&lt;br /&gt;
** 360MB RAM (Apache, Sendmail, Spam Assassin &amp;amp; MySQL don't play well together with that small amount)&lt;br /&gt;
** No swap&lt;br /&gt;
** Shared hardware with probably hundreds of other people&lt;br /&gt;
** The I/O contention on this host is insane&lt;br /&gt;
&lt;br /&gt;
There are just two things working for me :&lt;br /&gt;
* It's only $15/mo&lt;br /&gt;
* '''Unlimited''' bandwidth&lt;br /&gt;
&lt;br /&gt;
=Using This Website=&lt;br /&gt;
&lt;br /&gt;
* While this IS a wiki, it's not open to public editing&lt;br /&gt;
* You're going to find a bunch of unfinished pages all over this wiki that are populated by pages from my old text-only website.  As time goes on everything should look cleaner, but since it's a hobby site you shouldn't really hold your breath =]&lt;br /&gt;
&lt;br /&gt;
=Computery Stuff=&lt;br /&gt;
&lt;br /&gt;
Both my personal laptop and home workstation are Macs but for everything else I'm a GNU/Linux kind of guy.&lt;br /&gt;
&lt;br /&gt;
* [[GNU/Linux]] :: Articles and thoughts about GNU/Linux&lt;br /&gt;
* [[Mac OS X]] :: Articles and thoughts about Mac OS X on my [[]] computer&lt;br /&gt;
* [[Projects]] :: My various projects&lt;br /&gt;
* [[My Computers]] :: Computers I work with&lt;br /&gt;
* [[Virtualization]] :: Over the last year I've started to work more with virtual machines&lt;br /&gt;
&lt;br /&gt;
==VPN==&lt;br /&gt;
&lt;br /&gt;
I've recently had the need to run a VPN solution and went through a few different VPN suites before settling on OpenVPN.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN With WRT54GL]] :: You can have a cheap VPN solution at home!&lt;br /&gt;
* [[OpenVPN With CentOS]] :: You can have a MUCH more robust VPN solution at home!&lt;br /&gt;
&lt;br /&gt;
Once you've set up your OpenVPN server you'll need to configure clients to connect to it.&lt;br /&gt;
&lt;br /&gt;
* [[OpenVPN Clients]]&lt;br /&gt;
&lt;br /&gt;
==Shameful Things==&lt;br /&gt;
&lt;br /&gt;
* [[Windows]] :: I pretty much can't stand it, but I have a page with a little bit of tolerance and software links&lt;br /&gt;
&lt;br /&gt;
=Foody Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Recipes]] :: I love to cook, I'm just not organized enough to do it regularly.&lt;br /&gt;
&lt;br /&gt;
=Entertainmenty Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Music]] :: What I listen to, my collection &amp;amp; where to find new music&lt;br /&gt;
* [[Mystery Science Theater 3000 (MST3K)]] :: I have one of the most complete MST3K collections on the eastern seaboard&lt;br /&gt;
* [[Video Gaming]] :: I've been playing video for as long as I can remember&lt;br /&gt;
* [[Books]] :: What I'm reading, my collection, recommendations &amp;amp; what to avoid&lt;br /&gt;
* [[Movies]] :: I'm an avid consumer of almost all things on the silver &amp;amp; LCD screen&lt;br /&gt;
&lt;br /&gt;
=Toys Toys Toys Toys=&lt;br /&gt;
&lt;br /&gt;
* [[Nerf Guns]] :: Someone started a war at my office &amp;amp; I intend to lose gracefully&lt;br /&gt;
* [[Transformers]] :: Not the new stuff, the old stuff.  PS : hey, you kids.  get off my lawn.&lt;br /&gt;
&lt;br /&gt;
=Video Gamey Stuff=&lt;br /&gt;
&lt;br /&gt;
I've been a rabid gamer since 1980 when someone first placed an [[Atari 2600]] joystick in my tiny 4 year old hands.&lt;br /&gt;
&lt;br /&gt;
==Classic Video Games==&lt;br /&gt;
&lt;br /&gt;
* http://www.tototek.com/&lt;br /&gt;
&lt;br /&gt;
==XBox 360==&lt;br /&gt;
&lt;br /&gt;
The XBox systems are the only two Microsoft products I'll ever enjoy, they're a bit of a guilty pleasure... they're my main gaming console at the time.&lt;br /&gt;
&lt;br /&gt;
===XBox Live===&lt;br /&gt;
&lt;br /&gt;
Friend me if you like: livepip &amp;amp; suave blanco&lt;br /&gt;
&lt;br /&gt;
=Othery Stuff=&lt;br /&gt;
&lt;br /&gt;
* [[Product Recommendations]]&lt;br /&gt;
* [[Car-less In Cambridge]] :: It's not only possible, it's the only way to live&lt;br /&gt;
* [[Cell Phones]] :: Notes that I've compiled on working with them, including custom ringtones&lt;br /&gt;
&lt;br /&gt;
=About Myself=&lt;br /&gt;
&lt;br /&gt;
A vanity page has been crated at [[User:Duncan]], I'm not sure if it'll ever be worth your time.&lt;br /&gt;
&lt;br /&gt;
=My Other Sites=&lt;br /&gt;
&lt;br /&gt;
* http://files.duncanbrown.org :: A semi-organized collection of files from over the years&lt;br /&gt;
* http://hotpastrami.org :: Not up right now, but maybe one day it'll be back as something real&lt;br /&gt;
* http://notpip.com :: Not much, it's my development box at home&lt;br /&gt;
* http://cd2ogg.sf.net :: Homepage for my *nix CD ripping project, cd2ogg&lt;br /&gt;
&lt;br /&gt;
&amp;lt;html&amp;gt;&lt;br /&gt;
&amp;lt;meta name=&amp;quot;description&amp;quot; content=&amp;quot;Duncan Brown, Beachwood's favorite son!&amp;quot;&amp;gt;&lt;br /&gt;
&amp;lt;/html&amp;gt;&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/GNU_Screen</id>
		<title>GNU Screen</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/GNU_Screen"/>
				<updated>2011-07-18T19:24:33Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: /* Regions */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;GNU Screen is one of the most useful pieces of software I've ever come across.  It allows you to keep a terminal up and running that you're able to re-connect to remotely, share a terminal with another user, split your terminal into sections &amp;amp; much more.&lt;br /&gt;
&lt;br /&gt;
Apparently there's discussion as to what exactly screen is.  Is it a terminal multiplexer?  Is it a window manager?  I guess it really depends on where you're standing.  People who are using [http://en.wikipedia.org/wiki/GNOME GNOME], [http://en.wikipedia.org/wiki/Kde KDE], [http://en.wikipedia.org/wiki/Mac_os_x Mac OS X], [http://en.wikipedia.org/wiki/Windows Windows] or any other environment where you run a [http://en.wikipedia.org/wiki/Terminal_emulator Terminal Emulator] then it's more of a multiplexer.  If you're just running a machine without a window manager, then I guess screen IS your window manager.&lt;br /&gt;
&lt;br /&gt;
But whatever. &lt;br /&gt;
&lt;br /&gt;
=Configuration=&lt;br /&gt;
&lt;br /&gt;
Configuring screen can be an incredibly tedious process involving hours and hours of reading documentation, or you can just search the web for someone else's .screenrc... like mine.&lt;br /&gt;
&lt;br /&gt;
==My .screenrc==&lt;br /&gt;
&lt;br /&gt;
My .screenrc can be downloaded at http://files.duncanbrown.org/linux/dotfiles/.screenrc&lt;br /&gt;
&lt;br /&gt;
Here is a screen capture of what my current screen session looks like :&lt;br /&gt;
&lt;br /&gt;
[[Image:Screen_Screenshot.png]]&lt;br /&gt;
&lt;br /&gt;
The weather information and current [http://en.wikipedia.org/wiki/Load_(computing) Load Average] are collected by something other than screen, you can find that information on how it works at http://files.duncanbrown.org/linux/dotfiles&lt;br /&gt;
&lt;br /&gt;
==Set The Status Line To Something Useful==&lt;br /&gt;
&lt;br /&gt;
Add this to your .bashrc or .bash_profile&lt;br /&gt;
&lt;br /&gt;
 case $TERM in&lt;br /&gt;
  *screen*) export PROMPT_COMMAND='echo -ne &amp;quot;\033]0;${USER}@${HOSTNAME%%.*}:${PWD/#$HOME/~}\007&amp;quot;'   &lt;br /&gt;
    ;;&lt;br /&gt;
 esac&lt;br /&gt;
&lt;br /&gt;
=Multi-User Mode=&lt;br /&gt;
&lt;br /&gt;
'''This is ripped directly from Gentoo's site, I need to clean it up so it's not a direct plagiary.'''&lt;br /&gt;
&lt;br /&gt;
http://gentoo-wiki.com/HOWTO_Snoop_terminal_session#Screen&lt;br /&gt;
&lt;br /&gt;
Using [[Screen]] in multiuser mode requires screen to be as setuid root. If you know about the potential security implications you can enable it by issuing&lt;br /&gt;
 # chmod u+s `which screen`&lt;br /&gt;
&lt;br /&gt;
We need to configure screen to use multiuser mode and change privileges for the guest.&lt;br /&gt;
Put the following commands into ~/.screenrc. You can also use them in a screen session after pressing '''^A'''&lt;br /&gt;
&lt;br /&gt;
 multiuser on&lt;br /&gt;
 aclchg snoopy -x &amp;quot;?&amp;quot;    #Revoke permission to execute any screen command&lt;br /&gt;
 aclchg snoopy +x &amp;quot;wall&amp;quot; #Allow writing simple messages in the terminal status line&lt;br /&gt;
 aclumask snoopy-wx      #Default permissions to windows&lt;br /&gt;
 acladd snoopy           #Enable user snoopy to access screen session&lt;br /&gt;
&lt;br /&gt;
Start screen:&lt;br /&gt;
 user@localhost $ screen&lt;br /&gt;
&lt;br /&gt;
 user@localhost $ screen -ls&lt;br /&gt;
 There is a screen on:&lt;br /&gt;
         11521.pts-4.hostname      (Multi, attached)&lt;br /&gt;
 1 Socket in /var/run/screen/S-user.&lt;br /&gt;
&lt;br /&gt;
Now the guest can attach to the screen:&lt;br /&gt;
&lt;br /&gt;
 snoopy@localhost $ screen -r user/11521&lt;br /&gt;
&lt;br /&gt;
=Using Screen=&lt;br /&gt;
&lt;br /&gt;
In this section you'll see letters prefaced with '''^''', this translates into CTRL-X.&lt;br /&gt;
&lt;br /&gt;
==Basic Commands==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A ?'''&lt;br /&gt;
| Help.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A a'''&lt;br /&gt;
| Send the command character itself (&amp;quot;^a&amp;quot;) to the program running in the current window.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A t'''&lt;br /&gt;
| Show time, date, hostname, and some other stuff.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A @'''&lt;br /&gt;
| Do nothing.  (Useful when you hit &amp;quot;^a&amp;quot; by mistake.)&lt;br /&gt;
|-&lt;br /&gt;
| '''^A :'''&lt;br /&gt;
| Enter command line mode.  (For example, &amp;quot;^a :number 7&amp;quot; changes the window number of the current window to 7.  See the man page for more details.)&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^Z'''&lt;br /&gt;
| Suspend screen.  (You will be back at the shell you started screen from.)&lt;br /&gt;
|-&lt;br /&gt;
| '''^A d'''&lt;br /&gt;
| Detach screen.  (Do this before you log out -- you will be back at the shell you started screen from.)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Window Navigation &amp;amp; Management==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A ^A'''&lt;br /&gt;
| Switch to the last used window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^N'''&lt;br /&gt;
| Switch to the next window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^P'''&lt;br /&gt;
| Switch to the previous window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A 0'''&lt;br /&gt;
| Switch to window number 0 (works with 0-9).&lt;br /&gt;
|-&lt;br /&gt;
| '''^A &amp;quot;'''&lt;br /&gt;
| Present a list of all windows for selection.  Use the arrow or number keys (or vi- or Emacs-style cursor keys) to highlight a window and press &amp;lt;Enter&amp;gt; to switch to it.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A c'''&lt;br /&gt;
| Create a new window with a shell and switch to that window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A A'''&lt;br /&gt;
| Change the current window's title&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ''''&lt;br /&gt;
| Prompt for a window name/number to switch to&lt;br /&gt;
|-&lt;br /&gt;
| '''^A F'''&lt;br /&gt;
| Resize the window to the current region size&lt;br /&gt;
|-&lt;br /&gt;
| '''^A K'''&lt;br /&gt;
| Kill the current window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A l'''&lt;br /&gt;
| Refresh current window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A i'''&lt;br /&gt;
| Show information on the current window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A N'''&lt;br /&gt;
| Show name &amp;amp; number of current window&lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Copy/Scrollback Mode==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A ['''&lt;br /&gt;
| Enter scrollback mode&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ]'''&lt;br /&gt;
| Send the contents of the paste buffer to the program running in the current window&lt;br /&gt;
|-&lt;br /&gt;
| '''h,j,k,l'''&lt;br /&gt;
| Move cursor left, down, up, right (as in vi/vim).  Regular arrow keys also work.&lt;br /&gt;
|-&lt;br /&gt;
| '''^B'''&lt;br /&gt;
| Page up (&amp;lt;PageUp&amp;gt; key also works).&lt;br /&gt;
|-&lt;br /&gt;
| '''^F'''&lt;br /&gt;
| Page down (&amp;lt;PageDown&amp;gt; key also works).&lt;br /&gt;
|-&lt;br /&gt;
| '''&amp;lt;Space&amp;gt;'''&lt;br /&gt;
| Set mark.  When the second mark is set, the text between the two marks will be put into screen's paste buffer and copy/scrollback mode will be exited.&lt;br /&gt;
|-&lt;br /&gt;
| '''^'''&lt;br /&gt;
| Move to first nonwhitespace character on current line.&lt;br /&gt;
|-&lt;br /&gt;
| '''$'''&lt;br /&gt;
| Move to last nonwhitespace character on current line.&lt;br /&gt;
|-&lt;br /&gt;
| '''0'''&lt;br /&gt;
| Move to leftmost column.&lt;br /&gt;
|-&lt;br /&gt;
| '''c'''&lt;br /&gt;
| Set the left margin for block-mode copying.&lt;br /&gt;
|-&lt;br /&gt;
| '''C'''&lt;br /&gt;
| Set the right margin for block-mode copying.&lt;br /&gt;
|-&lt;br /&gt;
| '''x'''&lt;br /&gt;
| Exchange the first mark with the current cursor position.  This is good for moving an already set mark.&lt;br /&gt;
|-&lt;br /&gt;
| '''&amp;lt;Esc&amp;gt;'''&lt;br /&gt;
| Exit copy/scrollback mode.  (Any key that doesn't have another meaning will do this.)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
[[Image:Split Screen.png|right|thumb|A split screen featuring [[Mac OS X]] on top &amp;amp; [[GNU/Linux]] on the bottom]]&lt;br /&gt;
Regions allow looking at two or more screen windows at the same time.&lt;br /&gt;
&lt;br /&gt;
==Regions==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A S'''&lt;br /&gt;
| Split the current region horizontally.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A |'''&lt;br /&gt;
| Split the current region vertically.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^I'''&lt;br /&gt;
| Switch focus to the next region.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A Q'''&lt;br /&gt;
| Delete all regions but the current one.  (This does not destroy any windows.)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
I need to integrate the info from http://www.mail-archive.com/screen-users@gnu.org/msg01032.html&lt;br /&gt;
&lt;br /&gt;
=Logging=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
|-&lt;br /&gt;
| '''^A h'''&lt;br /&gt;
| Write a hardcopy of current window to '''hardcopy.N'''&lt;br /&gt;
|-&lt;br /&gt;
| '''^A H'''&lt;br /&gt;
| Toggles logging of current window to '''screenlog.N'''&lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Misc=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
|-&lt;br /&gt;
| '''^A '''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=More Stuff=&lt;br /&gt;
&lt;br /&gt;
I've found that GNU Screen can be even more useful when you rotate your X11 display by 90 degrees!  A split screen gives you much more usable real estate than a standard horizontal monitor.  If you're interested, check out [[Rotating X.org Screens]].&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	<entry>
		<id>http://www.duncanbrown.org/index.php/GNU_Screen</id>
		<title>GNU Screen</title>
		<link rel="alternate" type="text/html" href="http://www.duncanbrown.org/index.php/GNU_Screen"/>
				<updated>2011-07-18T19:23:09Z</updated>
		
		<summary type="html">&lt;p&gt;Duncan: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;GNU Screen is one of the most useful pieces of software I've ever come across.  It allows you to keep a terminal up and running that you're able to re-connect to remotely, share a terminal with another user, split your terminal into sections &amp;amp; much more.&lt;br /&gt;
&lt;br /&gt;
Apparently there's discussion as to what exactly screen is.  Is it a terminal multiplexer?  Is it a window manager?  I guess it really depends on where you're standing.  People who are using [http://en.wikipedia.org/wiki/GNOME GNOME], [http://en.wikipedia.org/wiki/Kde KDE], [http://en.wikipedia.org/wiki/Mac_os_x Mac OS X], [http://en.wikipedia.org/wiki/Windows Windows] or any other environment where you run a [http://en.wikipedia.org/wiki/Terminal_emulator Terminal Emulator] then it's more of a multiplexer.  If you're just running a machine without a window manager, then I guess screen IS your window manager.&lt;br /&gt;
&lt;br /&gt;
But whatever. &lt;br /&gt;
&lt;br /&gt;
=Configuration=&lt;br /&gt;
&lt;br /&gt;
Configuring screen can be an incredibly tedious process involving hours and hours of reading documentation, or you can just search the web for someone else's .screenrc... like mine.&lt;br /&gt;
&lt;br /&gt;
==My .screenrc==&lt;br /&gt;
&lt;br /&gt;
My .screenrc can be downloaded at http://files.duncanbrown.org/linux/dotfiles/.screenrc&lt;br /&gt;
&lt;br /&gt;
Here is a screen capture of what my current screen session looks like :&lt;br /&gt;
&lt;br /&gt;
[[Image:Screen_Screenshot.png]]&lt;br /&gt;
&lt;br /&gt;
The weather information and current [http://en.wikipedia.org/wiki/Load_(computing) Load Average] are collected by something other than screen, you can find that information on how it works at http://files.duncanbrown.org/linux/dotfiles&lt;br /&gt;
&lt;br /&gt;
==Set The Status Line To Something Useful==&lt;br /&gt;
&lt;br /&gt;
Add this to your .bashrc or .bash_profile&lt;br /&gt;
&lt;br /&gt;
 case $TERM in&lt;br /&gt;
  *screen*) export PROMPT_COMMAND='echo -ne &amp;quot;\033]0;${USER}@${HOSTNAME%%.*}:${PWD/#$HOME/~}\007&amp;quot;'   &lt;br /&gt;
    ;;&lt;br /&gt;
 esac&lt;br /&gt;
&lt;br /&gt;
=Multi-User Mode=&lt;br /&gt;
&lt;br /&gt;
'''This is ripped directly from Gentoo's site, I need to clean it up so it's not a direct plagiary.'''&lt;br /&gt;
&lt;br /&gt;
http://gentoo-wiki.com/HOWTO_Snoop_terminal_session#Screen&lt;br /&gt;
&lt;br /&gt;
Using [[Screen]] in multiuser mode requires screen to be as setuid root. If you know about the potential security implications you can enable it by issuing&lt;br /&gt;
 # chmod u+s `which screen`&lt;br /&gt;
&lt;br /&gt;
We need to configure screen to use multiuser mode and change privileges for the guest.&lt;br /&gt;
Put the following commands into ~/.screenrc. You can also use them in a screen session after pressing '''^A'''&lt;br /&gt;
&lt;br /&gt;
 multiuser on&lt;br /&gt;
 aclchg snoopy -x &amp;quot;?&amp;quot;    #Revoke permission to execute any screen command&lt;br /&gt;
 aclchg snoopy +x &amp;quot;wall&amp;quot; #Allow writing simple messages in the terminal status line&lt;br /&gt;
 aclumask snoopy-wx      #Default permissions to windows&lt;br /&gt;
 acladd snoopy           #Enable user snoopy to access screen session&lt;br /&gt;
&lt;br /&gt;
Start screen:&lt;br /&gt;
 user@localhost $ screen&lt;br /&gt;
&lt;br /&gt;
 user@localhost $ screen -ls&lt;br /&gt;
 There is a screen on:&lt;br /&gt;
         11521.pts-4.hostname      (Multi, attached)&lt;br /&gt;
 1 Socket in /var/run/screen/S-user.&lt;br /&gt;
&lt;br /&gt;
Now the guest can attach to the screen:&lt;br /&gt;
&lt;br /&gt;
 snoopy@localhost $ screen -r user/11521&lt;br /&gt;
&lt;br /&gt;
=Using Screen=&lt;br /&gt;
&lt;br /&gt;
In this section you'll see letters prefaced with '''^''', this translates into CTRL-X.&lt;br /&gt;
&lt;br /&gt;
==Basic Commands==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A ?'''&lt;br /&gt;
| Help.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A a'''&lt;br /&gt;
| Send the command character itself (&amp;quot;^a&amp;quot;) to the program running in the current window.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A t'''&lt;br /&gt;
| Show time, date, hostname, and some other stuff.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A @'''&lt;br /&gt;
| Do nothing.  (Useful when you hit &amp;quot;^a&amp;quot; by mistake.)&lt;br /&gt;
|-&lt;br /&gt;
| '''^A :'''&lt;br /&gt;
| Enter command line mode.  (For example, &amp;quot;^a :number 7&amp;quot; changes the window number of the current window to 7.  See the man page for more details.)&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^Z'''&lt;br /&gt;
| Suspend screen.  (You will be back at the shell you started screen from.)&lt;br /&gt;
|-&lt;br /&gt;
| '''^A d'''&lt;br /&gt;
| Detach screen.  (Do this before you log out -- you will be back at the shell you started screen from.)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Window Navigation &amp;amp; Management==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A ^A'''&lt;br /&gt;
| Switch to the last used window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^N'''&lt;br /&gt;
| Switch to the next window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^P'''&lt;br /&gt;
| Switch to the previous window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A 0'''&lt;br /&gt;
| Switch to window number 0 (works with 0-9).&lt;br /&gt;
|-&lt;br /&gt;
| '''^A &amp;quot;'''&lt;br /&gt;
| Present a list of all windows for selection.  Use the arrow or number keys (or vi- or Emacs-style cursor keys) to highlight a window and press &amp;lt;Enter&amp;gt; to switch to it.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A c'''&lt;br /&gt;
| Create a new window with a shell and switch to that window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A A'''&lt;br /&gt;
| Change the current window's title&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ''''&lt;br /&gt;
| Prompt for a window name/number to switch to&lt;br /&gt;
|-&lt;br /&gt;
| '''^A F'''&lt;br /&gt;
| Resize the window to the current region size&lt;br /&gt;
|-&lt;br /&gt;
| '''^A K'''&lt;br /&gt;
| Kill the current window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A l'''&lt;br /&gt;
| Refresh current window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A i'''&lt;br /&gt;
| Show information on the current window&lt;br /&gt;
|-&lt;br /&gt;
| '''^A N'''&lt;br /&gt;
| Show name &amp;amp; number of current window&lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
==Copy/Scrollback Mode==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A ['''&lt;br /&gt;
| Enter scrollback mode&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ]'''&lt;br /&gt;
| Send the contents of the paste buffer to the program running in the current window&lt;br /&gt;
|-&lt;br /&gt;
| '''h,j,k,l'''&lt;br /&gt;
| Move cursor left, down, up, right (as in vi/vim).  Regular arrow keys also work.&lt;br /&gt;
|-&lt;br /&gt;
| '''^B'''&lt;br /&gt;
| Page up (&amp;lt;PageUp&amp;gt; key also works).&lt;br /&gt;
|-&lt;br /&gt;
| '''^F'''&lt;br /&gt;
| Page down (&amp;lt;PageDown&amp;gt; key also works).&lt;br /&gt;
|-&lt;br /&gt;
| '''&amp;lt;Space&amp;gt;'''&lt;br /&gt;
| Set mark.  When the second mark is set, the text between the two marks will be put into screen's paste buffer and copy/scrollback mode will be exited.&lt;br /&gt;
|-&lt;br /&gt;
| '''^'''&lt;br /&gt;
| Move to first nonwhitespace character on current line.&lt;br /&gt;
|-&lt;br /&gt;
| '''$'''&lt;br /&gt;
| Move to last nonwhitespace character on current line.&lt;br /&gt;
|-&lt;br /&gt;
| '''0'''&lt;br /&gt;
| Move to leftmost column.&lt;br /&gt;
|-&lt;br /&gt;
| '''c'''&lt;br /&gt;
| Set the left margin for block-mode copying.&lt;br /&gt;
|-&lt;br /&gt;
| '''C'''&lt;br /&gt;
| Set the right margin for block-mode copying.&lt;br /&gt;
|-&lt;br /&gt;
| '''x'''&lt;br /&gt;
| Exchange the first mark with the current cursor position.  This is good for moving an already set mark.&lt;br /&gt;
|-&lt;br /&gt;
| '''&amp;lt;Esc&amp;gt;'''&lt;br /&gt;
| Exit copy/scrollback mode.  (Any key that doesn't have another meaning will do this.)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
[[Image:Split Screen.png|right|thumb|A split screen featuring [[Mac OS X]] on top &amp;amp; [[GNU/Linux]] on the bottom]]&lt;br /&gt;
Regions allow looking at two or more screen windows at the same time.&lt;br /&gt;
&lt;br /&gt;
==Regions==&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
| '''^A S'''&lt;br /&gt;
| Split the current region horizontally.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A |'''&lt;br /&gt;
| Split the current region vertically.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A ^I'''&lt;br /&gt;
| Switch focus to the next region.&lt;br /&gt;
|-&lt;br /&gt;
| '''^A Q'''&lt;br /&gt;
| Delete all regions but the current one.  (This does not destroy any windows.)&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Logging=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
|-&lt;br /&gt;
| '''^A h'''&lt;br /&gt;
| Write a hardcopy of current window to '''hardcopy.N'''&lt;br /&gt;
|-&lt;br /&gt;
| '''^A H'''&lt;br /&gt;
| Toggles logging of current window to '''screenlog.N'''&lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
|&lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=Misc=&lt;br /&gt;
&lt;br /&gt;
{|&lt;br /&gt;
|-&lt;br /&gt;
| '''^A '''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|-&lt;br /&gt;
| ''''''&lt;br /&gt;
| &lt;br /&gt;
|}&lt;br /&gt;
&lt;br /&gt;
=More Stuff=&lt;br /&gt;
&lt;br /&gt;
I've found that GNU Screen can be even more useful when you rotate your X11 display by 90 degrees!  A split screen gives you much more usable real estate than a standard horizontal monitor.  If you're interested, check out [[Rotating X.org Screens]].&lt;/div&gt;</summary>
		<author><name>Duncan</name></author>	</entry>

	</feed>
