In that post, I was careful to install Squid3 first, so that Webmin would use it (in the management interface) instead of the older Squid 2.x; and that the installation would be smoother. One thing I noticed was that webmin was using an older version of squid:

“…I noticed that webmin (for some strange reason) thought squid 2.6 was installed…”

One of our readers (atass) provided a useful comment in that post:

“The reason is that you have also installed squid3 AND 2.6. 2.6 was installed via webmin because it is not configured by default to find squid3

I think you should correct this procedure so that you correctly configure webmin to use squid3 by going to module configuration and changing to squid3 paths. Avoid installing Squid via webmin cause it will install Squid 2.6 regardless if you have squid 3 installed”

So this needed fixing, here are the settings (below) I changed to get Squid3 going. Above all, remember to back up data or settings before changing anything.

Log into your webmin interface and select “Squid Proxy Server” from the left side navigation menu.
At the top select “Module Config“.
Change the following values:

Full path to squid config file: /etc/squid3/squid.conf
Squid executable: squid3
Full path to squid cache directory: /var/spool/squid3
Full path to squid log directory: /var/log/squid3

Now remember to stop squid and start squid3, via ssh (substituting for your IP address instead of mine):

ssh root@192.168.1.200

sudo /etc/init.d/squid3 restart

sudo /etc/init.d/squid stop

Now try surfing with your web browser configured to use the Squid3 proxy. If you get an error message (like I did):

————————————————————————–

The requested URL could not be retrieved

While trying to retrieve the URL: http://ubuntulinuxhelp.com/

The following error was encountered:

* Access Denied. Access control configuration prevents your request from being allowed at this time. Please contact your service provider if you feel this is incorrect.

Your cache administrator is xxxx@xxxx.com.

Generated Tue, 01 Dec 2009 17:44:31 GMT by squidbox (squid/3.0.STABLE1)

————————————————————————–

Double check your Access Control in the “Squid Proxy Server”, Select the padlock icon that says “Access Control”.

Mirror the original settings you had in the Access Control for the older version of Squid. Then select the “Proxy Restrictions” tab, and again mirror the settings.

Then I restarted Squid3

sudo /etc/init.d/squid3 restart

And tried to surf the web… and everything works!

Big thanks to the reader that pointed out the issue. That’s appreciated!

One thing you’ll notice in this post is that the command line does not use “sudo”. This is because the last post configured the server to permit root logins via SSH. In fact, there is a lot of information in the last post that directly relates to (or effects) what we’ll do in this one, again, please read it: Faster Internet With an Old Laptop – Ubuntu and Squid. Otherwise some of us might get a bit lost trying to complete the hands-on activities in this post. Also a reminder that this is an Ubuntu server 8.04 LTS, if using other versions of Ubuntu (or other Debian based distributions, you’ll probably need to make a few adjustments).

In order to make this old laptop even more useful, in addition to the previously installed Squid proxy server, we’re going to add an Apache webserver with PHP, MySQL database server and Mail server (SMTP/POP3). The mailserver is just for the future in the event it’s needed or any PHP based package requires it (so you can skip that if you don’t need it). More importantly, Apache and MySQL are needed so I can successfully install and use MediaWiki.

First SSH into your server. The command for me is:

ssh root@squid.localdomain (You’ll need to substitute the hostname you chose for your server).

Let’s get some packages for  compiling, zip, perl, ssl, certificates and so on. Remember, because you logged in as root, you don’t have to “sudo”.

aptitude install binutils cpp fetchmail flex gcc libarchive-zip-perl libc6-dev libcompress-zlib-perl libdb4.3-dev libpcre3 libpopt-dev lynx m4 make ncftp nmap openssl perl perl-modules unzip zip zlib1g-dev autoconf automake1.9 libtool bison autotools-dev g++ build-essential

Let’s get the database server installed and configured;

aptitude install mysql-server mysql-client libmysqlclient15-dev

During the installation of MySQL, you’ll be asked to  provide and confirm a new MySQL root password. DO NOT FORGET IT! (as the MySQL root password is not going to be the same as your system root password – Right?) You can use upper case and lower case letters, numbers and special characters. To check that MySQL is listening for connections, use the netstat command:

root@squid:~# netstat -tap | grep mysql
tcp    0      0 localhost.localdo:mysql *:*      LISTEN      28746/mysqld

See how MySQL is only listening on localhost?

For future projects, I don’t want the database server to listen only on the localhost, I want it to listen on any interfaces. This is simple to do when editing the configuration file:

nano /etc/mysql/my.cnf

Look for: bind-address = 127.0.0.1
And comment out (#) that line. The line should now look like this:

# bind-address = 127.0.0.1

Doing this does make it less secure, but this is on an internal network, not a public one. Also, note that the default port is 3306, if you ever need to change the port, this is the file you can edit. However, to keep it simple, leave the default port as is.

When done editing, Ctrl o will save the file and Ctrl x will exit nano.

Restart MySQL so the new setting takes effect:

/etc/init.d/mysql restart

Let’s check to see if our settings work:

netstat -tap | grep mysql

You should see something similar to this:

root@squid:~# netstat -tap | grep mysql
tcp    0   0 *:mysql   *:*   LISTEN      28895/mysqld

Note that there is no mention of localhost!

I like using phpMyAdmin to manage the DB server via Firefox:

aptitude install phpmyadmin

When prompted, select the option “apache2”

After the install, you can visit the URL: squid.localdomain/phpmyadmin (substitute you own URL, which may be different from mine).

Use the login credentials that you created when installing and configuring MySQL:

Username = root
Password = The MySQL password (not the normal root password used to login).

If you’ve forgotten the MySQL root password, you can reset it. Here are the steps to fix the “forgot root MySQL password” issue (this has happened to me a few times):

Stop the DB server:
/etc/init.d/mysql stop

Restart MySQL without it accessing the user information (user tables):
mysql mysqld_safe –skip-grant-table &

Now connect to MySQL using the MySQL root account (you won’t need a password):
mysql -u root

Finally change the password via these commands:
use mysql;
UPDATE user SET password=PASSWORD(‘enter-new-password-here’) WHERE user = ‘root’;
flush privileges;
exit;

Currently I only intend to run MediaWiki to replace Tomboy notes (which I’ve probably mentioned a few too many  times now), but perhaps I might add a couple other PHP based sites in the future. Some of them may require email connectivity. Let’s put something in place now (Postfix, Courier).

aptitude install postfix procmail

When issuing the above command, I received the following output:

root@squid:~# aptitude install postfix procmail
Reading package lists… Done
Building dependency tree
Reading state information… Done
Reading extended state information
Initializing package states… Done
Building tag database… Done
The following packages are BROKEN:
sendmail
The following packages will be automatically REMOVED:
sendmail-bin
The following packages have been kept back:
apt apt-utils cron dash initscripts libcurl3-gnutls libkrb53 libssl0.9.8
libvolume-id0 linux-image-2.6.24-23-server linux-image-server
linux-server linux-ubuntu-modules-2.6.24-23-server python-apt sudo
sysv-rc sysvutils tasksel tasksel-data tzdata udev update-manager-core
The following NEW packages will be installed:
postfix
The following packages will be REMOVED:
sendmail-bin
0 packages upgraded, 1 newly installed, 1 to remove and 22 not upgraded.
Need to get 1160kB of archives. After unpacking 799kB will be used.
The following packages have unmet dependencies:
sendmail: Depends: sendmail-bin but it is not installable
Resolving dependencies…
The following actions will resolve these dependencies:

Remove the following packages:
sendmail

Score is 121

Accept this solution? [Y/n/q/?]

I selected Y (yes) to remove the (broken) sendmail package and install the remainder. After accepting the above solution, I saw the following (further) output:

Accept this solution? [Y/n/q/?] Y
The following packages are unused and will be REMOVED:
procmail sensible-mda
The following packages will be automatically REMOVED:
sendmail sendmail-bin
The following packages have been kept back:
apt apt-utils cron dash initscripts libcurl3-gnutls libkrb53 libssl0.9.8
libvolume-id0 linux-image-2.6.24-23-server linux-image-server
linux-server linux-ubuntu-modules-2.6.24-23-server python-apt sudo
sysv-rc sysvutils tasksel tasksel-data tzdata udev update-manager-core
The following NEW packages will be installed:
postfix
The following packages will be REMOVED:
sendmail sendmail-bin
0 packages upgraded, 1 newly installed, 4 to remove and 22 not upgraded.
Need to get 1160kB of archives. After unpacking 102kB will be freed.
Do you want to continue? [Y/n/?]

The install will give you some prompts (questions) to answer. Here’s how I answered them:

General type of mail configuration:
Internet Site

System mail name:
squid.localdomain (Your’s may be different, so make sure you input the correct name).

I noticed that the installation for procmail did not go through, so:

aptitude install procmail

We can always configure postfix later when needed, but let’s do a quick tweak of it now:

dpkg-reconfigure postfix

For “General type of mail configuration”, leave the setting we already made (Internet Site).

Also leave our “System mail name” as the one we just defined (squid.localdomain) – Again, your name may have been different.

For the “Root and postmaster mail recipient”, we don’t want to add any aliases, therefore leave this blank.

In the next prompt we see “Other destination to accept mail for (blank for none)”. It should be pre-populated with something like this:

squid.localdomain, localhost.localdomain, , localhost

Yes, let’s add this (by selecting “ok“).

No, we do not want to “Force synchronous updates on mail queue”.

The next section that asks about “Local Networks”, populating the input fields with something like this:

127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128

Select “ok“.

“Use procmail for local delivery” – Select Yes!

We don’t need a limit on mailbox files. In the next windows make sure the entry is “0” and select “ok“.

“Local address extension character” prepopulated with “+“, leave it as is, select “ok“.

Finally, “Internet protocols to use”, select “all” and “ok“.

Start Postfix with /etc/init.d/postfix start, however if you need to make changes manually (to /etc/postfix/main.cf), remember to reload postfix with /etc/init.d/postfix reload

Installing courier:

aptitude install courier-authdaemon courier-base courier-imap courier-pop gamin libgamin0 libglib2.0-0

During the installation, you’ll receive a prompt asking “Create directories for web-based administration”, select “No“.

Quick tweak: Let’s configure postfix to drop mail to the users Maildir. We can issue the following command to do this:

postconf -e ‘home_mailbox = Maildir/’ && postconf -e ‘mailbox_command =’ && /etc/init.d/postfix restart

Finally let’s get Apache and PHP installed. I’m going to install PHP as a module, not as CGI, because I want to be able to easily change the configuration settings using directives in Apache configuration files (such as httpd.conf) and .htaccess files.

First, let’s get Apache going:

aptitude install apache2 apache2-doc apache2-mpm-prefork apache2-utils libexpat1 ssl-cert

I received some errors in the output:

.
.
.
Get:3 http://ca.archive.ubuntu.com hardy/main libaprutil1 1.2.12+dfsg-3 [70.0kB]
Err http://ca.archive.ubuntu.com hardy-updates/main apache2-utils 2.2.8-1ubuntu0.5
404 Not Found [IP: 91.189.88.46 80]
Err http://security.ubuntu.com hardy-security/main apache2-utils 2.2.8-1ubuntu0.5
404 Not Found
Err http://security.ubuntu.com hardy-security/main apache2.2-common 2.2.8-1ubuntu0.5
404 Not Found
Err http://security.ubuntu.com hardy-security/main apache2-mpm-prefork 2.2.8-1ubuntu0.5
404 Not Found
Err http://security.ubuntu.com hardy-security/main apache2 2.2.8-1ubuntu0.5
404 Not Found
Err http://security.ubuntu.com hardy-security/main apache2-doc 2.2.8-1ubuntu0.5
404 Not Found
Fetched 478kB in 2s (180kB/s)
Selecting previously deselected package libapr1.
.
.
.

If you get this error, try updating the repositiries like this:

aptitude update

The reissue the installation command.

Now that Apache is installed, let’s get PHP and related packages:

aptitude install libapache2-mod-php5 libapache2-php5 php5-common php5-curl php5-dev php5-gd php5-idn php-pear php5-imagick php5-imap php5-mcrypt php5-memcache php5-mhash php5-ming php5-mysql php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl

From dealing with other web servers, I’ve often found that I need to add the appropriate directives to Apache’s dir.conf file (because they will not all be included):

nano /etc/apache2/mods-available/dir.conf

You should see this line:

DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.htm

Change it to this:

DirectoryIndex index.html index.shtml index.xhtml index.htm index.php index.php3 index.pl index.cgi

We also need to enable the rewrite, include and SSL modules:

a2enmod rewrite && a2enmod include && a2enmod ssl

You’ll get a prompt that tells you to run the command:

/etc/init.d/apache2 force-reload

You should get a success message like:

root@squid:~# /etc/init.d/apache2 force-reload
* Reloading web server config apache2   [ OK ]

Side note: If you need to disable a module, the command would be a2dismod, and an example would look something like: a2dismod ssl && /etc/init.d/apache2 force-reload I generally prefer to disable instead of delete as one never know if a module might be needed in the future (or if disabling causes an error). It’s usually a simpler fix to re-enable a module.

Lets get FTP going:

aptitude install proftpd

You’ll see a prompt asking you how to “Run proftpd”. I’m selecting “Standalone” because I want the ability to restart proftpd (or stop it) if needed. It will create the directory /home/ftp on your server. Here’s some of the output of that command:

Adding system user `proftpd’ (UID 114) …
Adding new user `proftpd’ (UID 114) with group `nogroup’ …
Not creating home directory `/var/run/proftpd’.
Adding system user `ftp’ (UID 115) …
Adding new user `ftp’ (UID 115) with group `nogroup’ …
Creating home directory `/home/ftp’ …
`/usr/share/proftpd/templates/welcome.msg’ -> `/home/ftp/welcome.msg.proftpd-new’
ProFTPd is started from inetd/xinetd.

Side note: If you ever need to restart the FTP server (after changing a configuration), the command would usually be: /etc/init.d/proftpd restart

For those who followed on from the original Squid installation post, we now need to access Webmin. For me the Firefox URL is:

http://squid.localdomain:26395/ (remember, use your server’s correct url and port number).

After logging in, select “Refresh Modules” and see an output similar to mine below:

Checking for usable Webmin modules ..
.. found 58 with installed applications, 46 not installed.

Now select “Servers” and you should see that:

Apache Webserver
Fetchmail Mail Retrieval
MySQL Database Server
Postfix Mail Server
ProFTPD Server
Procmail Mail Filter

have been added to the list. (Originally there was only Read User mail, SSH Server and Squid Proxy Server).

Finally, visit the URL of your nifty web server on Ubuntu, my URL would be:

squid.localdomain (once again, substitute the URL of your server).

And you’ll see the “It works!” message.

By default root is denied the ability to log in via FTP. Because this is my local network, I’ll allow root to access FTP. DO NOT do this is a public environment!

Still in Webmin, select “ProFTPD Server” (listed under “Servers“), then select the “Denied FTP Users” icon. This will open /etc/ftpusers, and display the following directives:

# /etc/ftpusers: list of users disallowed FTP access. See ftpusers(5).  root daemon bin sys sync games man lp mail news uucp nobody

Find: root

and remove it from the list. Click “Save“.

Now we’ll need to allow root in the proftpd.conf via our command line, like this:

nano /etc/proftpd/proftpd.conf

Look for:

# Set the user and group that the server normally runs at.
User                proftpd
Group                nogroup

And underneath the above add:

# Permit root logins
RootLogin on

Side note: If you ever need to reconfigure proftpd (to use inetd instead of standalone for example), the command is: dpkg-reconfigure proftpd

In your terminal, restart FTP so that root will now be allowed:

/etc/init.d/proftpd restart

root can now login and transfer files via FTP.

To change pages that Apache serves, you should be uploading files to:

/var/www

Guess what? We’re done!

While in the Webmin interface I noticed that I had to fix an issue from the last post:

Error: The Squid cache manager program /usr/lib/cgi-bin/cachemgr.cgi was not found on your system. Maybe your module configuration is incorrect.

I encountered this error when trying to access the “Cache Manager Statistics” under “Squid Proxy Server”.
/usr/local/squid/etc/squid.conf

Fix:

aptitude install squid-cgi

It’s an older IBM Thinkpad T22, Type 2647 with 256MB of RAM and a 20GB hard drive. A couple years ago, I had 2o of these units, bought from a recycling depot. I sold them all on eBay, and only have a couple left now.

Whilst packing up the stuff to cart off, it occurred to me that I could put this old laptop to work by installing a proxy / caching server on it, and have my we browsers, pull much of the regularly requested web content off a locally cached network server. This means installing Squid. Not sure what Squid is: Squid (software), from their site:

“…Squid is a proxy server and web cache daemon. It has a wide variety of uses, from speeding up a web server by caching repeated requests, to caching web, DNS and other computer network lookups for a group of people sharing network resources, to aiding security by filtering traffic. Although primarily used for HTTP and FTP, Squid includes limited support for several other protocols including TLS, SSL, Internet Gopher and HTTPS. The development version of Squid (3.1) includes IPv6 and ICAP support…”

Needless, as I currently enjoy using Ubuntu, that’s what I used as the OS for this project. Installing a Squid server on the network, provided me with a few important benefits:

• Less bandwidth usage.
• Faster web surfing.
• Network cached copies of pages I regularly visit (if the original server is down).

Firstly, make sure you’ve installed a copy of Ubuntu 8.04 Server (Hardy) on the old laptop. Not sure how to do that? Here’s a guide: The Perfect Server – Ubuntu Hardy Heron (Ubuntu 8.04 LTS Server). In my case I skipped (did not install) Apache, MySQL, Postfix, BIND9, Proftpd, POP3/IMAP and Webalizer. I don’t need those, I only need the Squid proxy / caching server. I also installed Webmin (see below), so that I can easily manage this server remotely. A word to the wise however, I found out (about 2 years ago) to install Squid first! – That way the Webmin installation goes much smoother (I was using Debian for the server  at that time, and Ubuntu in another instance). Also, for those of you who have been following my blog (and for my welcomed new readers), I also played with Squid and Ubuntu about a year ago, in this post: Speed Up and Improve Web Surfing With an Ubuntu Squid Server. My earlier Ubuntu, Squid post was based on Ubuntu 6.06LTS and Squid 2.6 – Things have changed and applications, etc. have improved, so I though a revisit and reinstallation of the Squid server was in order.

I downloaded and burned a copy of the Ubuntu 8.04 LTS Server from Ubuntu’s official site at: http://www.ubuntu.com/getubuntu/download-server. The bare minimum requirements are:

300 MHz x86 processor
64 MB of system memory (RAM)
At least 4 GB of disk space (for full installation and swap space)
VGA graphics card capable of 640×480 resolution
CD-ROM drive or network card

256MB of RAM, made the install slower than I’m used to. You can find more requirements info for Ubuntu Server (Hardy) at Ubuntu System Requirements.

After downloading, and burning a copy of the ubuntu-8.04.2-server-i386 CD, complete a base install of Ubuntu server (using the howtoforge.com guide above as a reference). I also installed an SSH server so that I could tuck the old laptop away and complete everything else in  comfort,  using my desktop.

sudo aptitude install ssh openssh-server

will get the ssh server up and running for you.

Throughout this post, you’ll need to substitute your IP addresses and names to match those in your own network. After the installation of the base server is complete, open a terminal from your (comfortable) desktop and enter:

ssh root@192.168.1.200

192.168.1.200 is the address of  there server I just installed.

Use the command:

su

to enter root. That way I don’t have to keep typing “sudo”.

Install Squid usingthe command:

aptitude install squid3

After Squid has finished installing and you’ve rebooted the system, you may want to install Webmin, a GUI interface to manage that server, still in terminal, you can download a copy of the webmin package into and directory you like. The command to download is:

wget http://prdownloads.sourceforge.net/webadmin/webmin-1.470.tar.gz

Untar it like this:

tar xzvf webmin-1.470.tar.gz

Webmin needs perl to run, so I installed some packages:

aptitude install install libauthen-pam-perl libnet-ssleay-perl libpam-runtime openssl perl perl-modules

Enter my extracted contents of the webmin-1.470.tar.gz package  by:

cd webmin-1.470

And run the installation for webmin:

./setup.sh

I changed the port number away from 10000 to 26395. I changed the admin account to “root”, and entered a new password.

At the end of the webmin installation, I got the success message that include the URL: http://squid.localdomain:26395/

On my local PC, I had to edit my hosts file like this:

sudo gedit /etc/hosts

Then added the following line:

192.168.1.200 squid.localdoman    squid

Now we want to reboot the squid server using:

shutdown -r now

After rebooting the server and logging back in (via ssh), you can see if the webmin service is running by using the command:

sudo /etc/init.d/webmin status

You should see something like:

webmin (pid 4573) is running

To see if it is listening on the correct port number, the command to check that is:

sudo netstat -tap

You should find a line in the output of the above command that says something like:

tcp    0    0 *:26395    *:*    LISTEN    4573/perl

(Remember, port 26395 was the one we chose to tun webmin on – And webmin uses perl).

Now open a web browser and visit webmin. The URL I would use is:

http://squid.localdomain:26395/

(Again, remember that I added the appropriate information to my hosts file so that the browser can find the URL).

I chose not to enable SSL for logging into webmin (as I don’t need it in this LAN). After logging in, we want to configure squid. Look for something (on the left) that says “Unused Modules” and look for “Squid Proxy Server“, click that link. You will see an option to install the squid (webmin) module. Select that link to install it.

After installing, look on the left side menu and under “Servers” you will see “Squid Proxy Server“. Select “Squid Proxy Server” and then select the “Ports and Networking” option.

Note that squid is running on the default port 3128. Now return back to the squid module page by clicking “Module Index” (at the top of the page). Select the “Access Control” icon and see a button at the bottom of the page that says “Browser Regexp” – That contains a drop down list. Use the drop down list to select “Client Address” then click the button that says “Create new ACL“.

Enter your values in the form. I used the following:

ACL Name: localdomain
From IP: 192.168.1.0
To IP: 192.168.1.255
Netmask: 255.255.255.0

I didn’t change anything else and clicked on “Save”.

Now click the tab (at the top) that says “Proxy restrictions“. Click (at the bottom) “Add proxy restrictions” and look for the new ACL name you just created (mine was called “localdomain”) *** Make sure you are looking under the column that says “Match ACLS” *** and click on that name. Now click the radio button that says “Allow“. Then select “save” at the bottom.

In the new screen that display, use the up arrow to move “localdomain” (or whatever you called your new ACL rule) so that it is just above the line that says “Deny all”. If you don’t, your browsers will not be able to get access.

Now in your ssh window, use the command:

shutdown -r now

This will restart the server and squid3 (along with then new configuration). I noticed that webmin (for some strange reason) thought squid 2.6 was installed. Therefore, webmin was unable to start the server. But after rebooting the system, the “Stop Squid” button appeared – so I assume the webmin module has started working properly (no need for me to play with webmin again, as I’ll use SSH to access and reboot, etc., so I did not try).

As a final step, make sure that you set the proxy server address in your web browser. In my case the information to enter as a proxy server for each web browser is:

192.168.1.200:3128

Update, July 03, 2009: I found a problem when trying to access statistics. Here’s the issue and fix…

Issue:  When trying to access the “Cache Manager Statistics” under “Squid Proxy Server”, the following error displays:

“The Squid cache manager program /usr/lib/cgi-bin/cachemgr.cgi was not found on your system. Maybe your module configuration is incorrect.”

Fix:  aptitude install squid-cgi

Cache manager statistics will now work.

Other sites with related information:

• Howto Block websites using Squid Proxy in Ubuntu Linux
• Howto Block a Port in Squid Proxy , Ubuntu Linux
• [Ubuntu]Installing an HTTP proxy server (Squid)
• Installing Squid Proxy using Webmin on Ubuntu Server 8.04.1
• Paranoid Penguin – Building a Secure Squid Web Proxy, Part I

Enjoy faster web surfing as less external files are requested for pages you commonly visit and local cached copies are delivered to your browser. I hope you ladies and gents have fun playing with this, as I hope this post helps you out. Questions, suggestions, corrections, even additions?…. Please feel free to add them to you comments!

It got me thinking about the old days – When I was on dial-up and we used to “join” two modems together to improve our web surfing speed. This caused a spark as I realized that I could potentially increase my surfing speed by configuring both ethernet ports to appear as one connection (to my applications) – Meaning that the physical ports are combined to appear as one logical (interface) port to applications (such as Firefox, etc). I could also provide load balancing and fault tolerance to my PC’s network functions. Doing so would allow my PC (Ubuntu 8.04) to manage the connection, and my applications to enjoy the faster Internet speeds.

This  logical interface provides more than one benefit:

Fault tolerance, if one port or network (WAN) fails, the other is still working. This occurs in a graceful manner so that you don’t have to tweak or configure settings when the failure occurs.

Load balancing, the OS will ensure that theres an even flow across both physical ethernet ports (via the single logical interface). The key benefit is that you can balance your traffic load between independent WAN networks (like 2 ISPs), even including other WiFi access points (used with the permission of the WiFi subscriber). You could even mix DLS, Cable or dial-up connections. (In my case it’s two different Cable networks I’m connecting to).

The common term for this is called port trunking or link aggregation. According to Wikipedia, this is defined as:

“…Link aggregation or IEEE 802.1AX-2008, is a computer networking term which describes using multiple network cables/ports in parallel to increase the link speed beyond the limits of any one single cable or port, and to increase the redundancy for higher availability…”

The Linux Foundation web site has a lengthy blurb about this because you have to make sure that your Linux kernel is compliled with the “bonding” module. From their site:

“…The Linux bonding driver provides a method for aggregating multiple network interfaces into a single logical bonded interface. The behavior of the bonded interfaces depends upon the mode; generally speaking, modes provide either hot standby or load balancing services. Additionally, link integrity monitoring may be performed…”

But don’t worry, most current Linux distributions have this. You’ll also need the ifenslave package. ifenslave is a tool to attach and detach slave network interfaces to your logical interface.  Don’t forget that this logical (aggregated or “bonded”) interface will behave just like your normal single network connection would do, to the kernel. However, the load balancing will send data packets via the slave (physical) ports using a round-robin scheduler.

Before doing this though, MAKE SURE you have BACKUPS of any settings, configurations, files, etc. This way you are able to revert back to a working system in case something went wrong.

Again most current distributions should have ifenslave. If not it’s simple to install. Mine did not have it installed so the command to do this is:

sudo aptitude install ifenslave

I have two network cards on my system, called eth0 and eth1. After installing ifenslave using the above command, I need to take down both my network cards (so they are not in use). The command to do that was:

sudo ifdown eth0 && sudo ifdown eth1

Now we need to load the bonding module (we use “modprobe” to do that). Here’s the command to do that:

sudo modprobe bonding mode=0 miimon=100

As you can see, two switches are included with the command:

mode=0 specifies that round robin should be used. That way our data is alternated between the two network ports (and therefore routed through the two WANs – Which speeds up the Internet connection as you are now essentially being served through 2 ISP connections). This mode provides load balancing and fault tolerance. There are other modes, but you can tweak this later.

miimon=100 specifies how many milliseconds to wait between each check of the connections. The “check” is to see if the connection has failed. (100 is the default, but you can also change it later)

Now we have to aggregate the ports, in other words create the actual bond. To do this, we can create “bond0″ (that’s bond with  a “zero” after it) using the following  commands:

sudo ifconfig bond0 xxx.xxx.xxx.xxx (Use the correct IP address for your LAN! In other words, change xxx.xxx.xxx.xxx to an appropriate IP address inside your local area network- Usually that’s something like 192.168.1.10, as an example)

ifenslave bond0 eth0

ifenslave bond0 eth1

The above two commands connect physical port eth0 and eth1 to the virtual interface called bond0. Again, ifenslave is just the tool that tool to attaches and detaches slave network devices to a bonding interface.

Your done!

One important thing to keep in mind that connecting to two WANs does NOT double your connection speed! I noticed some speed increase however, so please do not think that this is a way to double your connection speed – It’s not! More importantly the fault tolerance is a bigger benefit for me. If something is not working through the one physical port, it will through the other.

For those interested in tweaking the modes (Google searching will help with that), but below is a basic outline of the other available modes:

mode 1 =  Active backup. This keeps using one port (adapter) until it fails, then switches to the other one.

mode 2 = Balance XOR (“XOR” means “And Or”, tries to balance traffic by splitting up outgoing packets between the adapters, using the same adaptor for each specific destination when possible.

mode 3 = Broadcast mode. This simply sends out (transmits) all traffic on every interface. This is fault tolerant.

mode 4 =  Dynamic link aggregation. This creates grouped adapters using an algorithm to aggregate adapters by their speed and other settings (those that use the same speed and settings).

mode 5 = Adaptive transmit load balancing. This redistributes outgoing traffic dynamically based on current conditions. In other words if one adaptor is overloaded, the traffic is transmitted through the other one.

mode 6 = Adaptive load balancing. This does the same as mode 5 but for inbound traffic.

I’m sure there are tons of “bonding” resources available, but I do hope that this helps some of you put that second ethernet port to good use. If anything, at the very least, is nothing else, I hope  it’s a good exercise to become more familiar with Linux, Linux commands and system configuration.

First off, there some other applications I use, namely:

xVidCap. This facilitates screen capturing video so that I can create tutorial videos. After which ffmpeg can be used to convert the captured video to flv format for web streaming.  If you’re interested, they have a couple instructional videos: Video 1 and Video 2. To install it, the command is:

sudo aptitude install xvidcap

Also, to be able to quickly find the differences between file versions I use TkDiff File Comparison and Meld. Both allow me to open different versions and display where files differ. These are particularly helpful if you access files from different locations and then need to troubleshoot changes. To install:

sudo aptitude install tkdiff

sudo aptitude install meld

In my personal case, this became more useful when I tried out Unison. As explained on the Unison web site:

“…Unison is a file-synchronization tool for Unix and Windows. It allows two replicas of a collection of files and directories to be stored on different hosts (or different disks on the same host), modified separately, and then brought up to date by propagating the changes in each replica to the other…“

While I’m mentioning Unison, I should point out that I had a horrible experience with it (Note: I did not read the manual). In my opinion it’s a great idea, and I am truly waiting for the latest versions, however I did have issues (which I have not been able to resolve yet):

It advertises that synchronization can also occur between Linux and Windows systems (or Linux to Linux systems).

My reality with regards to Windows :

• Linux can connect to Windows, but then the connection is lost with an error message after supplying the correct password.
• Window can connect to Linux and does begin searching for changes, but then the application freezes, becomes unresponsive, network traffic is almost zero and CPU load shoots to 100% if you try to stop.
• For it to work the same version needs to be installed on both machines.
• Compiling from source did not work on Ubuntu 8.04 as it indicated there were errors in the make file (yet the sudo aptitude install unison-gtk command does succeed – So I know all dependencies and libraries are already available)
• Currently it does not work. (However other solutions like rsync etc. work without any issues or much hair pulling).
• There is no option to delete a profile.
• Importantly, the FTP synchronization option is not available.

I really hope I can get this going – But it’s slow as it’s taken me almost 5 hours to try and get it working – to no avail. I wish there would be the same updated versions for all platforms available as packaged binaries (I think this would make things easier).

imgSeek is another useful tool that manages graphic collection and has the unique search capability where you can provide a rough sketch of the image you are looking for – And the results will be returned. No more having to use tags! In my opinion that is a great feature. You can view the screenshot of the search feature.

Many of the other web design and development related tools are also Firefox extensions:

Codetch allows me to edit files right inside Firefox. It’s a little bit like Bluefish.

Copy Plain Text gives you the ability to copy and paste text without all the formatting.

W3C CSS Validator does exactly that – validate that your CSS is formatted to the correct standards.

CSSViewer allows you to hover your mouse around a web page and see a small box that clearly shows all the CSS element in effect for any object or area.

EditCSS allows you to edit the CSS of any web page in real time and see the immediate changes, then you can simply copy and paste the change into your final style.css file.

Firebug is a robust extension that allows you to live debug and monitor CSS, HTML, JavaScript, etc. actions and results. It’s a good tool for troubleshooting issues.

Web Developer provides a tool bar with lots (and lots…) of development tools! If you’re only going to check one of these extensions, this is the one to look at!

Side note: I’ve often been asked what the “Ubuntu Firefox Modifications” extension does (as there is no ability to edit the preferences for it). It’s function is to allow installation of Firefox add ons via the Ubuntu package manager, however I’ve not played with that yet.

Finally, one issue I’ve found very helpful is to tweak how Firefox operates, in other words making it function faster. The video below provides a good guide to tweaking Firefox for speed improvements:

Hopefully the revisit of this topic helps answer questions as well as improving the web developer and designer productivity in an Ubuntu Linux environment.

In some ways I was bothered about this. Why? I work best with Illustrator, Photoshop, After Effects, Dreamweaver, WinSCP, Flash and so on. I felt like I was going to lose all the productivity these applications provided. I enjoy being able to double click media and play it automatically, same goes with DVD movies, etc. In Linux, I’ve often encountered problems with media playback as the media usually includes restricted formats, MP3 for example. On the developer/designer side, I was not looking forward (nor do I have time) to a steep learning curve.

This post (hopefully) will show the desktop user how to enable all the restricted media playbacks (movie DVD, music MP3, etc.)

It will also show web developers and designers some of the issues, applications and work arounds – Or at least the current state of them.

First off, let’s deal with the media issues. I built this PC using Ubuntu 8.04 LTS 64Bit (Hardy). I did try installing 8.10 64Bit but found that the network cards did not properly work. After much investigation, I also discovered out that I would benefit best using a release with LTS “Long Term Support”, as apparently there was better hardware support – So I’m waiting for 9.04 (still in alpha 6 release as of this post).

One of my favourite tools is aptitude. I used to prefer apt-get, however I found out that aptitude does a better job in removing applications. Aptitude will also remove the dependencies when a package is removed. apt-get will not do that (and I don’t think synaptic will either – someone please correct me if I’m wrong). I almost always use aptitude, this way my system (and hard drive space) is keep cleaner whenever I use aptitude to remove packages.

In order to install some of the applications and enable some of the media formats, we’ll need to edit your sources.list file. You can use nano, gedit, etc. An example terminal command is below:

sudo gedit /etc/apt/sources.list

The above command will open a window with the gedit application containing your sources.list file. MAKE SURE that you have no mistakes (syntax or otherwise) in the file. If you do, you’ll get an error message when using aptitude and will have to edit the file. Therefore, make a BACKUP of the /etc/apt/sources.list file that you can later revert back to BEFORE editing it.

Below is a copy of my sources.list file – As you may see, I’ve added some addresses (sources) to it:

# Main and Restricted
deb http://ca.archive.ubuntu.com/ubuntu/ hardy main restricted
deb http://ca.archive.ubuntu.com/ubuntu/ hardy-security main restricted
deb http://ca.archive.ubuntu.com/ubuntu/ hardy-updates main restricted
deb-src http://ca.archive.ubuntu.com/ubuntu/ hardy main restricted
deb-src http://ca.archive.ubuntu.com/ubuntu/ hardy-security main restricted
deb-src http://ca.archive.ubuntu.com/ubuntu/ hardy-updates main restricted

# Universe
deb http://ca.archive.ubuntu.com/ubuntu/ hardy universe
deb http://ca.archive.ubuntu.com/ubuntu/ hardy-security universe
deb-src http://ca.archive.ubuntu.com/ubuntu/ hardy universe
deb-src http://ca.archive.ubuntu.com/ubuntu/ hardy-security universe

# Multiverse
deb http://ca.archive.ubuntu.com/ubuntu/ hardy multiverse
deb http://ca.archive.ubuntu.com/ubuntu/ hardy-security multiverse
deb-src http://ca.archive.ubuntu.com/ubuntu/ hardy multiverse
deb-src http://ca.archive.ubuntu.com/ubuntu/ hardy-security multiverse

# Canonical
deb http://archive.canonical.com/ubuntu/ hardy partner

# Medibuntu
deb http://packages.medibuntu.org/ hardy free non-free
deb-src http://packages.medibuntu.org/ hardy free non-free

# Third Parties
deb http://download.virtualbox.org/virtualbox/debian hardy non-free

If you have a repository in your sources.list file (that I do not, remember to make sure that you include it!

A couple things about the above edit:

I use ca. within the URL because I’m in Canada. Change the ca. to whatever your country is. Also, Ubuntu Linux 8.04 is called “Hardy”, if you are using 8.10 “Intrepid” (or earlier versions) then change “Hardy” to the name of your distribution.

As seen above, we added the mediabuntu repository source, but we still have to add the public key. If we don’t we’ll get a message from aptitude that indicates the source cannot be verified. Here’s how to add the public key via terminal commands:

Download the key:

wget http://packages.medibuntu.org/medibuntu-key.gpg

Add the key:

sudo apt-key add medibuntu-key.gpg

Now let’s make sure that we update the repositories with this command:

sudo aptitude update

And then let’s upgrade everything:

aptitude full-upgrade

The above command can also be issued as aptitude dist-upgrade (the old name – which still works).

***Warning***
This command will attempt to upgrade packages. It is aggressive with solving dependency problems. It will install and remove packages until all dependencies are satisfied. Because of this, it is possible that undesirable things may happen to your system and/or application. Therefore you should be careful when using it! Back up FIRST.

Now we’re ready to start installing some media playback and file sharing capabilities. Particularly:

• Multimedia Codecs.
• DVD playback.
• Java plugin.
• DVD (and CD) burning.
• Some Compilers.
• File/Printer sharing.

All the following commands are using aptitude via terminal commands.

Let’s start with the codecs:

sudo aptitude install ubuntu-restricted-extras && sudo aptitude install w64codecs

For 32 Bit users, use substitute this codec command:  sudo aptitude install w32codecs

Don’t forget to install the restricted extras:

sudo aptitude install ubuntu-restricted-extras

Now let’s get that DVD movie playing capability working:

sudo aptitude install libdvdcss2 && sudo aptitude install libdvdnav4 && sudo aptitude install gxine && sudo aptitude install libxine-main1 && sudo aptitude install libxine-extracodecs && sudo aptitude install libxine-ffmpeg && sudo aptitude install vlc && sudo aptitude install mplayer

And some DVD/CD burning software. I prefer K3B – But you can substitute any other one you prefer:

sudo aptitude install k3b

Let’s enable compiling:

sudo aptitude install build-essential

(If you want documentation, install it too: sudo aptitude install manpages-dev glibc-doc).

Let’s install a couple extra things like NFS (Network File Sharing), NTP (Network Time Protocol) and NIS (Network Information System) like so:

sudo aptitude install nfs-common && sudo aptitude install ntp && sudo aptitude install nis

Were pretty much done with the multimedia, but there are a couple application related things we’re going to install:

Flash player for Firefox can be obtained from Adobe by  downloading the .deb version (Adobe Flash Player version 10.0.22.87 as of this post). This will allow you to save a file called “install_flash_player_10_linux.deb”. Simply double click the file to begin installation.

While we’re working with Firefox, let’s turn it into a web developer tool with the following extensions:

Installing the Web Developer Toolbar, allows for the inclusion of some productive tools, such as:

• Editing CSS.
• Disabling CSS.
• Outlining images or finding broken ones.
• Displaying ID and Class details.
• View response headers.
• Edit HTML.
• Outline tables, elements, etc.
• And tons more!

Let’s also install Firebug so that you can edit, monitor and debug various web site scripting.

The use of MeasureIt helps in that you use it to  obtain width and height form any element you draw in your browser screen. It’s like a drag and stop (width/height)  ruler.

When developing or editing files displayed in my browser screen, I often copy and paste content. Unfortunately, Firefox will also copy the formating that’s been applied to the text. The extension, Copy Plain Text fixes this for me, now I get exactly what I want – Text only.

I do like using Shutter to capture full web page screen shots, so here’s how we install it according to the Shutter web site like this:

Include the repository and key:

wget -q http://shutter-project.org/shutter-ppa.key -O- | sudo apt-key add -

The above is for the stable releases. For more installation information or other methods you can visit Shutter Downloads.

In terms of development tools, many of them have already been listed in our Top 100 of the Best (Useful) OpenSource Applications post. However, there are a few that I’d particularly mention below.

Blender, Gimp and Inkspace. I’m not suggesting that Gimp or Inkspace are substitutes for Photoshop or Illustrator, rather they are an option. While they can produce the same resulting artwork, I find they require a steeper learning curve. Particularly steep in that the keyboard shortcuts are different, the names of many of the interface tools are different and/or they function in a different way. I’ve found several site with some great tutorials for both Gimp and Inkscape, however I don’t have the time (or motivation) to learn new applications. In my personal opinion, the GIMP interface is a horrid mess, but that is probably because I am used to the Photoshop interface. I think GIMP would be adopted much more readily if they improved the interface to be more intuitive and similar to Photoshop – But that’s simply what I think, I’m not the GIMP expert here.

One tool I use to enable continued use of Photoshop, etc. is VirtualBox. VirtualBox provides a virtual environment in which I can install a Windows based environment and any applications I wish (including Flash, etc.) – Hopefully Adobe will soon release Linux versions of their software as I think it is a huge market for them to tap into. After I’ve configured that environment, I can take a snapshot. If the virtual Windows installation or applications ever fail or become corrupted, I can simply restore the snapshot to bring the environment back to a working state – Voilà a quick 2 minute fix instead of reinstalling everything. Also, the virtual environment facilitates an optional shared directory on the host OS (that’s the Ubuntu Linux installation), so that I can access and store input and output files. If the virtually installed OS crashes, I still have that data within the Linux host installation.

To install VirtualBox, please follow the guide posted here: Installing VirtualBox 2.0.0 On Ubuntu 8.04 Desktop. Or use sudo aptitude install virtualbox as the repository is already in your sources.list file (above).

As web development is no longer simple HTML pages, but rather full multimedia, below are more of the development tools I’d suggest exploring:

• Bluefish Editor – Script editor – apt:bluefish
• Meld Diff Viewer – apt:meld
• Ardour – Audio editor – apt:ardour
• Audacity – Audio editor – apt:audacity
• Avidmux -Video editor – apt:avidmux
• Kino -Video editor – apt:kino
• Gftp – FTP client – apt:gftp
• Kompozer – Script editor – apt:kompozer
• puTTY – SSH client – apt:putty

The above applications are all available via aptitude or getdeb.net or by clicking the “apt” links above.

Finally, in order to have fonts consistent with Windows (and other) users, we may want to install some of the Windows based fonts like this:

sudo apt-get install msttcorefonts

This will install the True Type Fonts (TTF).

Now simply update the shared font  directories with this command:

sudo fc-cache -f -v

If you’d like CTF (Clear Type Fonts) the How to Install TTF and CTF Fonts in Ubuntu post will help you with that.

This just about covers most everything. These further resources can help you:

Medibuntu.

Converting MP3s to Ogg-Vorbis.

Enabling 5.1 Surround Sound.

Playing Blu-Ray and HD DVD Video.

If you think I’ve missed anything or you’ve an idea, feel free to comment about it! – cheers!

Firewall Builder is packaged with most Linux distributions and is available under “System/Administration” menu.

Accessing Firewall Builder

If it is not there, then it probably needs to be installed on your system. You need to install the package that has supporting the API library libfwbuilder and the package for  fwbuilder that contains the Firewall Builder GUI and policy compilers. Use apt-get or aptitude to find and install them:

# aptitude install libfwbuilder fwbuilder

On FreeBSD and OpenBSD Firewall Builder is part of ports, you can find it in /usr/ports/security/fwbuilder.

Packages shipping with Ubuntu are always one or two minor revisions behind. If you want to try the latest version, you can use the pre-built binary .deb packages offered on the project’s web site or build from source using our online installation instructions. Pre-built binary packages and source code tar.gz archives can be downloaded from this page.

If the system menu item is not there or you have built the program from source, you can always launch it from the command line by just typing “fwbuilder” on the shell prompt:

$ fwbuilder

The program starts and opens the main window and greeting dialog. The dialog provides links to the project web site where you can find more tutorials, FAQ, Firewall Builder CookBoook and other documentation, as well as a bug tracking system and links to user forums and the mailing list. Clicking on the link in the dialog opens corresponding web page in your web browser. This works the same on all supported OS: Linux, Windows and Mac OS X. You can always open this dialog later using an item in the main menu “Help”.

Firewall Builder startup greeting

Lets create our first firewall object. To do this, we’ll use the object creation menu that appears when you click on the icon in the small toolbar right above the object tree. Choose menu item “New Firewall” from the menu that appears.

Setup new firewall

The program presents a wizard-like dialog that will guide you through the process for creation of the new firewall object. In the first page of the wizard you can enter the name for the new firewall object (here it is “guardian”), its platform (“iptables”) and host OS (“Linux”).

There are two ways a new firewall can be created: you can use one of the preconfigured template firewall objects or create it from scratch. This tutorial demonstrates the first method (using template object). To do this, check checkbox “Use preconfigured template firewall objects”. The template can be taken from the library of template objects that comes with the Firewall Builder package or from a file provided by the user. The latter is useful when the administrator wants to distribute a library of predefined templates to other users in the enterprise. We are using one of the standard templates in this guide and therefore leave the standard template library path and name in the “Template file:” input field. Click “Next” to move on to the next page of the wizard.

Note that the template firewall object comes completely configured, including addresses and netmasks of its interfaces and some basic policy and NAT rules. This configuration is intended as a starting point only. You should reconfigure the addresses of interfaces to match those used on your network; and most likely will have to adjust rules to match your security policy.

Configure firewall template

This page of the wizard shows template objects and their configuration. Standard template objects represent firewalls with two or three interfaces, a host with one interface, web server or Cisco router. Choose firewall with three interfaces for this guide. Note that template comes with completely configured firewall objects, including a set of interfaces and their IP addresses – And some basic firewall policy. You will see how addresses can be changed later on in this guide. Click “Finish” to create a new firewall object using the chosen template.

Firewall objects

Here is our new firewall object. Its name is guardian, it appears in the object tree in the left hand side of the main window in the folder Firewalls. When an object is selected in the tree, a brief summary of its properties appears in the panel under the tree. Double-clicking on the object in the tree opens it in the editor panel at the bottom of the right hand side panel of the main window. The editor for the firewall object allows the user to change its name, platform and host OS and also provides buttons that open dialogs for “advanced” settings for the firewall platform and host OS. We will inspect these a little later in this tutorial.

You can always resize the main window to make all columns of the policy view more visible.

Guardian/Policy view

Now would be a good time to save the data to a disk file. This is done in a usual way using main menu File/Save As.

Lets take a little tour of the network and service objects that come standard with the program. You can use these preconfigured objects to build policy and NAT rules for your firewall.

Objects in the tree are orginized in libraries, you can switch between libraries using the interfaces’ drop-down menu above the tree. Firewall Builder comes with a collection of address, network, service and time interval objects in the library called “Standard”. Lets take a look at them. Notice that the background color of the panel that shows objects tree depends on the chosen object library. This makes it easier to keep track of the library currently opened in the program.

The libraries

Folder Objects/Hosts contains few host objects used in standard firewall templates. Folder Objects/Network contains network objects that represent various standard address ranges and blocks, such as multicast, net 127/8, networks defined in RFC1918 and so on.

Network objects

Firewall Builder also comes with extensive collection of TCP, UDP and ICMP service objects that describe commonly used protocols. This image shows some TCP objects (all of them do not fit in the screenshot).

TCP (protocol) objects

Here is an example of a simple TCP service. It defines source and destination port ranges (in this case source port range is not defined and there is only one destination port 80). TCP service object can also define any combination of TCP flags the firewall should inspect and also which ones of them should be set in order for a packet to match this object. In the case of the service “http” we do not need to define any flags.

TCP service

Now lets take a look at the objects created as part of the new firewall object guardian. In order to do this, switch to the library User where this object was created. To open an object in the editor panel to inspect or change it, double click on it in the tree. Also, if you click on an object in the policy rule to select it, it will automatically open in the tree on the left.

Object Guardian in user library

First, the firewall object itself.

Every object in fwbuilder has basic attributes such as its name and comment. Other attributes depend on the object type.

Attributes of the firewall object include platform (can be iptables, pf, ipfilter, etc.), version (platform-depended) and host OS. Buttons Host OS Settings and Firewall Settings open dialogs with many additional attributes that depend on the firewall platform and host OS. More on these later.

Object attributes

Here are the choices for the firewall platform, version (for iptables) and host OS.

Platform choices for the firewall

Interfaces of the firewall are represented by objects located below the Firewall object in the tree. We refer to them as “children” of the firewall object. This image demonstrates properties of the interface eth0. To open it in the editor double click on it in the tree. If editor panel is already open and shows some object, it is sufficient to select new object in the tree to reveal it in the editor panel (no need to double click).

IP and MAC addresses of interfaces are represented by child objects in the tree located below corresponding interface.

Firewall interfaces

Interface object has several attributes that define its function, such as “Management interface”, “external” etc.

• Name: the name of the interface object in Firewall Builder must match exactly the name of the interface of the firewall machine it represents. This will be something like “eth0″, “eth1″, “en0″, “br0″ and so on.
• Label: On most OS this field is not used and serves the purpose of a descriptive label. Firewall Builder GUI uses a label, if it is not blank, to show interfaces in the tree. One of the suggested uses for this field is to mark interfaces to reflect the network topology (’outside’, ’inside’) or the purpose (’web frontend’ or ’backup subnet’). The label is mandatory for Cisco PIX though, where it must reflect the network topology.
• “Management interface”: Sometimes the host has several network interfaces in which case one of them can be marked as the ’manaagement interface’. The management interface is used for all communication between Firewall Builder and the host.
• “External interface (insecure)”: marks an interface that connects to the Internet.
• “Unprotected interface”: marks interface to which fwbuilder should not assign any access lists (used only with Cisco IOS platform)
• “Regular Interface”: Use this option if the interface has an IP address assigned to it manually.
• “Address is assigned dynamically”: Use this option if the interface has a dynamic address (obtained by means of DHCP or PPP or another protocol); in this case an address is unknown at the moment when Firewall Builder generates the firewall policy.
• “Unnumbered interface”: Use this option if the interface can never have an IP address, such as the ethernet interface used to run PPPoE communication on some ADSL connections, tunnel endpoint interface, or an interface on a bridging firewall. See below Section 5.3.1 for more detailed discussion of these different types of interfaces.
• “Bridge port”: this option is used for port of bridged firewall.
• “Security level”: security level of this interface, used only with Cisco PIX (ASA)
• “Network zone”: network zone of this interface, used only with Cisco PIX (ASA). Network zone drop-down list shows all network obejcts and groups of addresses and networks present in the tree. Choose one of them to tell the compiler which networks and blocks of addresses can be reached through this interface. Compiler uses this information to decide which interface each ACL rule should be associated with based on the addresses used in the destination of the rule.

View interface

Here is IP address of interface eth0, external interface of the firewall. The address and netmask are attributes of the child object of the type “IPv4 address”. Here the address is “192.0.2.1″ and netmask “255.255.255.0″. Button “DNS Lookup” can be used to determine IP address using DNS. The program runs DNS query for the “A” record for the name of the parent firewall object.

IP address of interface eth0

Lets look at the IP address of the internal interface of the firewall. The address used in the template is “192.168.1.1″ with netmask “255.255.255.0″. This is rather typical address used for small and home networks. Some commercial firewall appliances come preconfigured with this address.

IP addresses of internal interfaces

If address 192.168.1.0/24 matches address of your local network, you can skip this part of the guide and move to the page 4. Otherwise, you need to reconfigure the address of the internal interface of the firewall object that you just created in fwbuilder and also change address object used in the policy rules. Start with changing address attribute (and possibly netmask, if necessary) of the object guardian:eth1:ip as shown in the screenshot:

Change IP address

Now we need to change IP address used in the rules. To do this, we create new Network object with correct address and replace object net-192.168.1.0 in all rules with this new network object.

Use new object menu to create Network object.

Create new network object

New Network object is created with default name ‘New Network’ and IP address 0.0.0.0.

Default network created

Edit object name and address, then hit “Apply”.

Editing network object

Use menu Object / Find to activate search and replace dialog. The Find and Replace dialog opens at the bottom of the right hand side panel in the main window, below the policy rules view.

Searching for objects

Locate object object net-192.168.1.0 in any policy rule where it is used or in its location in the tree in library Standard and drag and drop it to the left object well in the search and replace dialog as shown on the screenshot:

Drag and drop object

Change the scope setting to “Policy of all firewalls”. If you have many firewalls in the tree, use scope “policy of the opened firewall” instead. Locate new Network object you just created in the tree and drag and drop it to the right object well in the search and replace dialog as shown on the screenshot:

Changing scope of all policies

Now hit “Replace all” button. Pop-up dialog should appear and report how many replacements the program had to make in all rules of the firewall. Note that the replacement is done not only in the policy rules, but in NAT rules as well.

Replace all button results

Now that you have created a new object and replaced old network object with new one in all rules, do not forget to save data to a file using menu File/Save

Lets inspect properties of the firewall object. Double click on the firewall “guardian” in the tree to open it in the editor panel, then click “Firewall Settings” button in the editor. This opens new dialog that looks like this. Notice button “Help” in this dialog, clicking this button opens help as shown on the image below.

IP tables advanced settings

Online help explains all attributes and paramaters located in each tab of the firewall settings dialog. I enourage you to explore it as many parameters are important and affect generated iptables script in different ways.

Next few screenshots show other tabs of the firewall settings dialog. You can find detailed explanations of all parameters in the online help.

Detailed explanation screen

This page defines various parameters for the built-in policy installer. Installer uses ssh client (pscp.exe and plink.exe on Windows) to transfer generated script to the firewall machine and activate it there.

Policy installer, script generator

User can define shell commands that will be included in the generated script at the beginning and in the end of it. These commands can do anything you want, such as configure some subsystems, set up routing etc.

Include shell command in script generator

Parameters for logging.

Logging parameter settings

More options for the script generation. Notice that fwbuilder can produce iptables script in two formats: 1) as a shell script that calls iptables utility to add each rule one by one, or 2) it can use iptables-restore script to activate the whole policy at once. Other parameters are explained in the online help.

Further script generation options

Starting with v3.0 Firewall Builder can generate both IPv4 and IPv6 policy. This tab controls the order in which they are added to the script if user defined rules for both address families in the Policy objects of the firewall.

IPv4 and IPv6 support

Lets take a look at the policy of the template firewall. These rules are intended to be an example, a starting point to help you create your own policy quicker. Most likely you will want to modify them to suite your requirements. Explanation of the rules given here is rather brief because the goal of this guide was only to demonstrate how to use Firewall Builder.

• Rule 0: this is an anti-spoofing rule. It block incoming packets with source address that matches addresses of the firewall or internal or DMZ networks. The rule is associated with outside interface and has direction set to “Inbound”.
• Rule 1: this rule permits any packets on loopback interface. This is necessary because many services on the firewall machine communicate back to the same machine via loopback.
• Rule 2: permit ssh access from internal network to the firewall machine. Notice service object “ssh” in the column “Service”. This object can be found in the Standard objects library, folder Services/TCP.

Policy rules template

Policy rules belong to the object “Policy”, which is a child object of the firewall and can be found in the tree right below it. As any other object in Firewall Builder, Policy object has some attributes that you can edit if you double click on it in the tree.

• Policy can be either IPv4, or IPv4 or combined IPv4 and IPv6. In the latter case you can use a mix of IPv4 and IPv6 addess objects in the same policy (in different rules) and Firewall Builder will automatically figure out which one is which and will sort them out.
• Policy can translate to only mangle table, or a combination of filter and mangle tables. Again, in the latter case policy compiler decides which table to use based on the rule action and service object. Some actions, such as “Tag” (translates into iptables target MARK) go into mangle table.
• “Top ruleset” means that compiler will place generated iptables rules into built-in chains INPUT/OUTPUT/FORWARD. If policy is not marked as “top ruleset”, generated rules will go into user-defined chain with the name the same as the name of the policy object.

Policy rules set

Here are preconfigured NAT rules.

• Rule 0: tells the firewall that no address translation should be done for packets coming from network 192.168.2.0 going to 192.168.1.0 (because Translated Source, Translated Destination and Translated Service are left empty)
• Rule 1: packets coming to the firewall from internal and DMZ networks should be translated so that source address will change and become that of the outside interface of the firewall.
• Rule 2: packets coming from the Internet to the interface “outside” will be translated and forwarded to the internal server on DMZ represented by the host object “server on dmz”.

Preconfigured NAT rules

Now we should be ready to compile policy of the firewall guardian and generate iptables script. To do this, select firewall in the tree and click right mouse button. Choose item “Compile” in the pop-up menu. The dialog that appears lists all firewall objects defined in the objects tree and lets you select which ones should be compiled. The firewall guardian has just been created and has never been compiled and dialog shows that. Make sure checkbox next to the firewall object guardian is checked and click button “Next”.

Select firewalls for compilation

Firewall Builder calls policy compiler (which is by the way an external program which can be used on the command line). The next page of the dialog shows compiler progress and result.

Compiler progress

Compiler generates iptables script in the file with the name the same as the name of the firewall object, with extension “.fw”. The file is placed in the same directory where the data file .fwb is located.

$ ls -la test2.fwb guardian.fw
-rwxr-xr-x 1 vadim vadim 11253 2009-02-16 16:41 guardian.fw
-rw-r--r-- 1 vadim vadim 24696 2009-02-16 16:41 test2.fwb

Here is how generated script looks like. This is just a fragment from the middle to show some generated iptables commands.

# ================ IPv4

# ================ Table ‘filter’, automatic rules
$IPTABLES -P OUTPUT  DROP
$IPTABLES -P INPUT   DROP
$IPTABLES -P FORWARD DROP

cat /proc/net/ip_tables_names | while read table; do
$IPTABLES -t $table -L -n | while read c chain rest; do
if test “X$c” = “XChain” ; then
$IPTABLES -t $table -F $chain
fi
done
$IPTABLES -t $table -X
done

$IPTABLES -A INPUT   -m state –state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A OUTPUT  -m state –state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state –state ESTABLISHED,RELATED -j ACCEPT

# ================ Table ‘nat’,  rule set NAT
# NAT compiler errors and warnings:
#
#
# Rule 0 (NAT)
#
echo “Rule 0 (NAT)”
#
# no need to translate
# between DMZ and
# internal net
$IPTABLES -t nat -A POSTROUTING   -s 192.168.2.0/24 -d 172.16.22.0/24 -j ACCEPT
$IPTABLES -t nat -A PREROUTING   -s 192.168.2.0/24 -d 172.16.22.0/24 -j ACCEPT
#

Now you can transfer it to the firewall and execute it there to install iptables rules. However it is much more convenient to use built-in policy installer to do this. To use installer, click right mouse button on the firewall object in the tree and use menu item Install. Firewall Builder will compile the policy if necessary and then open dialog where you can configure parameters of the installer. Here you need to enter password to authenticate to the firewall. Once you click OK, installer will connect to the firewall using ssh client. First, it will copy generated script to the directory /etc on the firewall (or different one, if configured in the Installer tab of firewall settings dialog), then it will run this script and check for errors. Its progress will be visible in the panel of the installer wizard, just like the progress of policy compiler.

Install options for firewall 'guardian'

This guide walked you step by step through the process of creating of a firewall object, making some minor changes in its parameters and policy rules, compiling the policy and activating it on the firewall machine. This guide did not touch advanced topics such as built-in revision control system, working with multiple data files, working with multiple firewall objects, IPv6. You can find documentation and guides on these topics and more on our project web site at http://www.fwbuilder.org.

The command is simple:

sudo aptitude install openssh-server

Installing an SSH client? PuTTY:

sudo aptitude install putty

I decided to install the SSH Server via aptitude after LAMP, because I found out (the first time I did this) that updating the SSH Server would cause me to have to update the certificates as well. Doing it this way, saves me extra steps.

Needless to say, this step was very simple, but very powerful in that it allows me to manage the server remotely, in comfort.

1. Download the iso image from: http://www.ubuntu.com/getubuntu/download and burn it to a CD.

2. Order the CD from https://shipit.ubuntu.com/login-server.

Once you have a copy, make sure the BIOS on the PC is set to boot off the CD drive. Put the CD in the drive and simply restart the unit. It should now boot off the CD and display the “select language” screen as seen below.

After you’ve selected the language, you’ll be presented with the installation menu. Simply select “Install Ubuntu Server”, as seen below.

Remember that this is a server, ideally we’d like to have a static IP address for this server. There is a selectable boot option called “F6 – Other Options” where you could enter the following command to disable DHCP:

netcfg/disable_dhcp=true

At which point you will be required to manually configure the network settings. I am going to include that information below. However, for some reason I was not able to set up the network card after the installation (I could not see it) , so I used this work around instead…

I logged into the router and checked the logs so that I could get the MAC address of the network card. I then configured a DHCP reservation in the LAN/DHCP setting of the router so that the MAC address of the network card would always get the same IP address. Because I did not want to install a DNS server (my ISP made me take the DNS server down last time I set it up), I then, simply added the IP to hostname record, into the host file of each unit I wanted to connect to the web server.

During the installation (just follow the prompts it gives you), you will need to provide the following (among other obvious questions/answers):

1. A hostname for your web server (the hostname is independent of whatever domain name you’re going to use. For example, the hostname of this server is “webbox” and the domain I’ll use to access the web server on it is “local.ubuntulinuxhelp.com”).
2. I selected to use the “Guided – use entire disk” when prompted for the partitioning.
3. A username and password that you are going to remember.

You’ll eventually come to a prompt for the type of server (Software Selection), select LAMP, like the image below.

I chose to install the other components later, because I found out it will reduce some of the tweaking and updating later. During the software installation, you will be asked for a MySQL password. Write it down or don’t forget it! (You’ll need it later to use phpMyAdmin). The remainder is very straight forward, but as I mentioned earlier, here’s the static network configuration information. Remember, your network configuration addresses will probably be different from mine.

Because there is no GUI yet, we’ll be using the command line to configure the network.

Login after rebooting.

You can use a simple text editor like nano, vi, etc.

sudo nano /etc/network/interfaces

For those who left DHCP enabled, look for this:

auto eth0
iface eth0 inet dhcp

and change it to this:

auto eth0
iface eth0 inet static

Under the line that says “iface eth0 inet static”, you’ll enter your network information. An example of mine is:

address 72.138.51.130
netmask 255.255.255.0
network 72.138.51.0
broadcast 72.138.51.255
gateway 72.138.50.1

So the file would look something like this:

auto eth0
iface eth0 inet static
address 72.138.51.130
netmask 255.255.255.0
network 72.138.51.0
broadcast 72.138.51.255
gateway 72.138.50.1

Additionally, I made sure the host file contained the following information:

127.0.0.1 localhost webbox
172.138.51.130 local.ubuntulinuxhelp.com webbox

After configuring the network interface, restart the network using the following command:

sudo /etc/init.d/networking restart

The basic LAMP installation should be complete.

To recap, here is the list of hardware used:

Shuttle SN68SG2 Socket AM2 Barebone – NVIDIA 7025, Audio, Video, PCI Express, Gigabit LAN, USB 2.0, Firewire, Serial ATA, 250 Watt Power Supply.

AMD Athlon 64 X2 4200+ Processor ADA4200CUBOX – 2.20GHz, 1MB Cache, 1000MHz (2000 MT/s) FSB, Windsor, Dual-Core, Retail, Socket AM2, Processor with Fan.

Kingston 1024MB PC5400 DDR2 667MHz Memory (2 of these for 2GB).

Western Digital Caviar SE16 500GB Hard Drive – 7200, Browser Problems – Creating a Linux Based Virtual Box – Part 1 of 2 16MB, SATA-300, OEM.

DVD burner: LG GSA H55N Super-Multi Disk Drive 20×20×12

Putting the actual pieces together was very straight forward (use the guide that comes with the Shuttle package). However, I did make one mistake in ordering the hardware…

The Shuttle SN68SG2 comes with it’s own heat sink and cooling system. The metal fins are inserted right behind the fan of the power supply, so that the outbound air blows over the fins and draws heat away from the CPU. (I thought that was an innovative design idea when building such a small-footprint unit). As such, I did not need to order the retail version of the CPU (there’s no use or place, for the fan). Instead, I should have ordered the OEM version of the CPU (without the fan).

Also, after following the instructions that come with the shuttle unit, you may wish to flash the BIOS. I found that I was able to reboot the system with no problem, but whenever I powered it down and then back up (cold start), the PC always tries to boot off the network (until I use the ctrl-alt-del combo to restart it), the shuttle site indicated the fix was BIOS related. It’s probably better to flash the BIOS prior to moving forward (if you’re even interested in fixing this issue). You can fix it with Shuttle’s Flash Utility (awdflash) and the new BIOS (bin file) here: http://global.shuttle.com/download03.jsp?PI=647. Flashing the BIOS is not in the scope of this post, but one guide that gives you the basics of flashing is here: http://howflow.com/tricks/flash_your_award_bios_with_linux. Please remember that flashing a BIOS is serious, if you make a mistake (or power fails while flashing) you might damage the BIOS and have to buy a new motherboard! Be warned! I chose not to flash the bios as (for now) the cold-start issue is just a minor thing.

I didn’t specify a monitor in the list above (I’m sure most would work), but I’ve had no problems using an Acer AL1916W. It’s a 19 inch wide screen (1440 x 900 – 16:10).

Make sure that you have a USB keyboard and USB mouse. I didn’t pay attention the first time and had to exchange the keyboard for a USB one.

During the installation you’ll find two issues:

1. Video may not display clearly (it’s a driver issue).
2. The network card may not work properly (it’s also driver issue).

Here’s one trick I did to resolve this (and make my server install much smoother!)

After putting the hardware together, I did a quick install of Ubuntu 8.04 LTS Desktop Edition (64-bit) as I wanted to see if there were any issues. The most critical one I found was that network card appeared not to be working. By fixing this now, I found out I didn’t have to do it during the server install! I’d suggest (strongly) that you also do a quick desktop OS install as well, just to make sure everything is working as it should. (Besides, I don’t mind doing reinstalls as it helps me prepare and get a bit more exposure to some issues.)

Fixing the Network Drivers:

To get the network card working properly took a bit of searching the learn that it was a Marvell. Once I had this information, I opened a terminal and tried:

sudo modeprobe marvell
sudo modeprobe marvell 88e1116

After (88E1116 was the model) the commands completed, I found the network card was able to connect and I could surf the web. I installed the desktop OS twice more and the server OS three times more (because I messed things up), but I never had to modeprobe the network card again – it always worked.

Fixing the Video Drivers:

Each time you install the OS (Server or Desktop), you’ll need to ensure you install the nVidia driver. To get the video drivers working, in terminal:

sudo apt-get install envyng-gtk

The above will install a tool in your desktop GUI. Use it to install the nVidia drivers. This solution came from: http://www.albertomilone.com/nvidia_scripts1.html

That’s it for this entry. The next post in this 12 part series, will have us rolling our sleeves up and installing the LAMP server software.