View source

==Abstract==

VRRPd is an implementation of VRRPv2 as specified in rfc2338. It run in userspace for linux. In short, VRRP is a protocol which elects a master server on a LAN. If the master fails, a backup server takes over. In this setup, we will be implementing the VRRPd protocol in a home installation using an ADSL Internet connection.

==Requirements==

 Two Machines
 Linux with 2.6 Kernel (Gentoo, Fedora, Debian)
 VRRPd
 iptables
 Snort
 rp-pppoe
 ISC: DHCP Server
 Perl with Net::Ping Module


==Installation==

In this configuration, we will be using the Gentoo Linux Distribution. 
Add "-X -doc -gtk ssl ipv6 extensions" to the USE flags in /etc/make.conf 

===Linux Kernel Configuration===

We need to modify the Linux kernel to allow the necessary options to be enabled.

 cd /usr/src/linux; make menuconfig

 Networking options  --->
   [*] TCP/IP networking
      [*] IP: advanced router
   [*] Network packet filtering (replaces ipchains)<br>
    IP: Netfilter Configuration  --->
      [*] Connection tracking (required for masq/NAT)
         [*] FTP protocol support
         [*] IRC protocol support
      [*] IP tables support (required for filtering/masq/NAT)
         [*] IP range match support
         [*] MAC address match support
         [*] Multiple port match support
         [*] Packet filtering
            [*] REJECT target support
            [*] REDIRECT target support
         [*] Full NAT
            [*] MASQUERADE target support
         [*] Packet mangling
            [*] MARK target support
         [*] LOG target support<br>
   QoS and/or fair queueing  --->
      [*] QoS and/or fair queueing
         [*] HTB packet scheduler
         [*] Ingress Qdisc<br>
   [*] PPP (point-to-point protocol) support
      [*] PPP filtering
      [*] PPP support for async serial ports
      [*] PPP support for sync tty ports
      [*] PPP Deflate compression
      [*] PPP BSD-Compress compression
      [*] PPP over Ethernet

After configuring the kernel, we need to compile the changes and copy over the new kernel into /boot.

 make; make modules; make modules_install; cp arch/i386/boot/bzImage /boot/vmlinuz-2.6-router

Modify Grub:

 default 0
 timeout 15
 splashimage=(hd0,0)/boot/grub/splash.xpm.gz<br>
 title=Gentoo Linux 2.6 Router
 root (hd0,0)
 kernel /boot/vmlinuz-2.6-router root=/dev/root device

Reboot machine into new kernel.

===VRRPd===

Download the VRRPd source

 wget http://off.net/~jme/vrrpd/vrrpd-0.4.tgz

Untar, Compile, and Copy into /usr/sbin
 tar xvfz vrrpd-0.4.tgz
 cd vrrpd-0.4
 make
 cp vrrpd /usr/sbin

===iptables===

 emerge -av iptables

===Snort===

 emerge -av snort oinkmaster

===rp-pppoe===

 emerge -av rp-pppoe

===ISC DHCP Server===
 emerge -av dhcp

===Custom Scripts===
 
VRRPd Init Script

Primary Router
 cd /etc/init.d/
 wget http://www.ntxserver.com/scripts/vrrpd_primary
 chmod +x vrrpd_primary
 rc-update add vrrpd_primary default
 
Secondary Router
 cd /etc/init.d/
 wget http://www.ntxserver.com/scripts/vrrpd_secondary
 chmod +x vrrpd_secondary
 rc-update add vrrpd_secondary default

Router Monitor (Note: This script will be executed on the secondary router box.)

 cd /etc
 wget http://www.ntxserver.com/scripts/vrp.pl
 chmod +x vrp.pl

Backup Interface Initializer (Note: This script will be executed on the secondary router box.)

 cd /etc/init.d/
 wget http://www.ntxserver.com/scripts/router
 chmod +x router


==Configuration==

===iptables===

Configuration of iptables to allow NAT and Port Forwarding.

 First we flush our current rules
   iptables -F
   iptables -t nat -F<br>
 Setup default policies to handle unmatched traffic
   iptables -P INPUT ACCEPT
   iptables -P OUTPUT ACCEPT
   iptables -P FORWARD DROP>br>
 Copy and paste these examples ...
   export LAN=eth0
   export WAN=eth1<br>
 Then we lock our services so they only work from the LAN
   iptables -I INPUT 1 -i ${LAN} -j ACCEPT
   iptables -I INPUT 1 -i lo -j ACCEPT
   iptables -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT
   iptables -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT<br>
 (Optional) Allow access to our ssh server from the WAN
   iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT<br>
 Drop TCP / UDP packets to privileged ports
   iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
   iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP<br>
 Finally we add the rules for NAT
   iptables -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
   iptables -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
  iptables -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
   iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
 Tell the kernel that ip forwarding is OK
   echo 1 > /proc/sys/net/ipv4/ip_forward
   for f in /proc/sys/net/ipv4/conf/*/rp_filter ; do echo 1 > $f ; done<br>
 This is so when we boot we don't have to run the rules by hand
   /etc/init.d/iptables save
   rc-update add iptables default
   nano /etc/sysctl.conf
 Add/Uncomment the following lines:
 net.ipv4.ip_forward = 1
 net.ipv4.conf.default.rp_filter = 1

Port Forwarding Rules

 Forward port 2 to ssh on an internal host
   iptables -t nat -A PREROUTING -p tcp --dport 2 -i ${WAN} -j DNAT --to 192.168.0.2<br>
 FTP forwarding to an internal host
   iptables -t nat -A PREROUTING -p tcp --dport 21 -i ${WAN} -j DNAT --to 192.168.0.56<br>
 HTTP forwarding to an internal host
   iptables -t nat -A PREROUTING -p tcp --dport 80 -i ${WAN} -j DNAT --to 192.168.0.56<br>

===Snort===

Set Snort to sniff traffic on the ppp0 interface.

 nano /etc/conf.d/snort

 IFACE="ppp0"

===rp-pppoe===

 nano /etc/ppp/pap-secrets<br> 
 # client    server  secret
 "login@isp.com" * "password"

 
 Note: Primary router address is 192.168.0.1 and Secondary Router is 192.168.0.2<br>
 nano /etc/conf.d/net<br> 
 config_eth0=( "192.168.0.1 broadcast 192.168.0.255 netmask 255.255.255.0" )
 config_eth1=( "adsl" )
 user_eth1=( "login@isp.com" )
 
 rc-update add net.eth0 default
 /etc/init.d/net.eth0 start<br>
 ln -s net.lo /etc/init.d/net.eth1
 rc-update add net.eth1 default
 /etc/init.d/net.eth1 start

 nano w /etc/ppp/pppoe.conf

 ETH=eth1
 USER=login@isp.com
 RETRY_ON_FAILURE=yes

===ISC DHCP Server===

Primary Router

 #
 # /etc/dhcpd.conf for primary DHCP server
 #<br>
 authoritative;
 ddns-update-style none;<br>
 failover peer "dhcp-failover" {
  primary; # declare this to be the primary server
  address 192.168.0.1;
  port 520;
  peer address 192.168.0.2;
  peer port 520;
  max-response-delay 30;
  max-unacked-updates 10;
  load balance max seconds 3;
  mclt 1800;
  split 128;
 }<br>
 subnet 192.168.0.0 netmask 255.255.255.0 {
   option subnet-mask 255.255.255.0;
   option broadcast-address 192.168.0.255;
   option routers 192.168.0.129; #Address assigned using VRRPd
   option domain-name-servers 192.168.200.1;
   pool {
     failover peer "dhcp-failover";
     max-lease-time 1800; # 30 minutes
     range 192.168.0.100 192.168.0.254;
   }
 }

Secondary Router

 #
 # /etc/dhcpd.conf for secondary DHCP server
 #

 authoritative;
 ddns-update-style none;

 failover peer "dhcp-failover" {
   secondary; # declare this to be the secondary server
   address 192.168.0.3;
   port 520;
   peer address 192.168.0.1;
   peer port 520;
   max-response-delay 30;
   max-unacked-updates 10;
   load balance max seconds 3;
 }

 subnet 192.168.200.0 netmask 255.255.255.0 {
   option subnet-mask 255.255.255.0;
   option broadcast-address 192.168.200.255;
   option routers 192.168.0.129; #Address assigned using VRRPd
   option domain-name-servers 192.168.200.1;
   pool {
     failover peer "dhcp-failover";
     max-lease-time 1800; # 30 minutes
     range 192.168.0.100 192.168.0.254;
   }
 }

 rc-update add dhcp default

==Final Steps==

Note: Primary Router must be the first router up on the network.

Primary Router

 /etc/init.d/vrrpd_primary start
 /etc/init.d/dhcp start

Secondary Router
 /etc/init.d/vrrpd_secondary start
 /etc/init.d/dhcp start