After setting up hardware and installing the base OS, we can now configure networking. (In the future, I hope Indie Box Project will make this a lot easier with indie-networking.)
My server has two ethernet interfaces, which, surprisingly, aren’t called ethX any more, but enp3s0 and enp4s1. I guess I can live with that.
The outward-facing one needs to obtain a DHCP address from my ISP:
systemctl start dhcpcd@enp3s0 systemctl enable dhcpcd@enp3s0 curl cnn.com
and I see a little HTML file. So we are connected to the internet.
Next is a full system upgrade and the installation of a firewall. I like ufw (“uncomplicated firewall”, something firewalls are in dire need of.)
pacman -Syu pacman -S ufw ufw default deny ufw enable systemctl enable ufw
Rate-limiting for ssh seems like a good idea:
ufw limit SSH
Now for the internal Ethernet interface. It connects to my home Ethernet, which includes a zillion (as it seems) stationary computers, a Skype phone, printers, and a WiFi base station in “bridge” mode (so we don’t have double-NAT traversal for WiFi clients).
I’ll work from an example config file provided by Arch’s netctl:
cp /etc/netctl/examples/ethernet-static /etc/netctl/enp4s1 vi !$
and add my IP network configuration. Then, I activate it and make it permanent:
netctl start enp4s1 netctl enable enp4s1
We need to augment the ufw rules for NAT by adding to /etc/ufw/before.rules at the very beginning:
*nat :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 192.168.138.0/24 -o enp3s0 -j MASQUERADE COMMIT
And we need to allow ufw to forward packets in /etc/default/ufw by changing DEFAULT_FORWARD_POLICY to ACCEPT. For good measure, I also disable IPv6 there.
We also need to tell the kernel about needing IPv4 forwarding, so the box can act as a router. Then, to test everything so far, let’s reboot:
echo net.ipv4.ip_forward=1 > /etc/sysctl.d/30-ipforward.conf shutdown -r now
DHCP and DNS for the home network are next. I haven’t used dnsmasq for reals, but it seems like a good tool for the job. It performs DHCP, local DNS resolution and DNS caching all in one package:
pacman -S dnsmasq vi /etc/dnsmasq.conf systemctl start dnsmasq systemctl enable dnsmasq
In /etc/dnsmasq.conf, I pick the following settings:
domain-needed bogus-priv except-interface=enp3s0 listen-address=192.168.138.1 expand-hosts domain=aviatis.com dhcp-range=192.168.138.100,192.168.138.199,15m dhcp-host=xx:xx:xx:xx:xx:xx,printer,192.168.138.9,15
The last line allows me to assign the same IP addresses and hostnames to devices with a known Mac address. That’s great for things like printers or file servers because I can leave them unconfigured (they default to getting IP addresses by DHCP) while essentially giving them a static IP address.
And because I like to know what’s going on on my network, I deny IP addresses to any client that isn’t known. Of course, that won’t defeat anybody even a bit knowledgeable about IP networking, but it does prevent “casual” additions of new devices to the network by those people in the house that don’t know that they should know better ;-)
dhcp-ignore=tag:!known dhcp-script=/bin/echo
The latter logs everything that happens related to DHCP.
Apparently, according to this page, dhcpcd and dnsmasq tend to fight if left alone, so we do this:
echo "nameserver 192.168.138.1" > /etc/resolv.conf.head
And we need to tell ufw that local network operations are okay, as are DHCP requests:
ufw allow from 192.168.138.0/24 ufw allow from any port 68 to any port 67 proto udp
(This last rule sounds overly broad, but it’s quoted all over the net and works. My attempts to limit it to the local network have failed; somehow then DHCP does not make it through.)
Reboot. Working! Go to step 4.
P.S. So far, the system takes 838MB on disk. Take that, Windows, OSX, or most other Linux distros.
Links to all parts: Step 1: assemble and test hardware; Step 2: install Arch Linux; Step 3: networking; Step 4: make it an Indie Box!; Step 5: deploy Shaarli via Indie Box.