Linux Routers: A Primer for Network Administrators by Tony Mancill

From the Publisher

Save a fortune: Use Linux to deliver cost-effective, reliable routing services.

Linux routers are inexpensive, flexible, stable, adaptable, expandable, easy to manage, and based on proven technology. In Linux Routers, Second Edition, Tony Mancill shows you exactly how to configure, administer, and troubleshoot Linux routing for today's most common internetworking applications. Thoroughly updated for the latest technologies and version 2.4 of the Linux kernel, this edition includes practical coverage of dynamic routing, Quality of Service (QoS)—even next-generation IPv6 routing. Mancill's step-by-step explanations walk you through:

• Choosing the right Linux software distribution and hardware platform
• Building Ethernet LAN routers, including coverage of the Linux Router Project (LRP)
• Implementing Internet, extranet, and Frame Relay routing
• Creating VPN tunneling routers with iproute2 and FreeS/WAN
• Providing remote access to satellite offices while conserving bandwidth
• Using Linux IP firewalling features to improve network security
• Providing routing services alongside Web and DNS services on a single platform
• Monitoring Linux routers and maximizing availability in production environments

Whether your goal is to reduce network costs, add applications, solve problems you can't solve with "traditional" routers, or simply learn about routing hands-on without investing expensive, proprietary network gear, Linux Routers, Second Edition is all you need to get the job done.

Booknews

Explains how to set up and manage Linux routers based on the author's experience in production environments. Separate chapters describe LAN, extranet, WAN, internet, satellite office, and internet services routers. The second edition adds a chapter on the cesium and xenon tunneling routers, and sections on packet sniffers and netfilter code. Annotation c. Book News, Inc., Portland, OR

Booknews

A hands-on guide to implementing Linux-based routers, walking through a series of production-routing scenarios and offering detailed advice on configuration, problem avoidance, and troubleshooting. Alongside configurations are general discussions on running Linux production, as well as coverage of some applications that help support the network infrastructure, such as traffic analysis and system monitoring. Includes background information for new network administrators. The author is UNIX system administrator with Bank of America. Lacks a subject index. Annotation c. Book News, Inc., Portland, OR (booknews.com)

Product Details

• Table of Contents
• Forewords & Introductions
• Read an Excerpt

Table of Contents

Forewords & Introductions

Introduction

Router configuration has long been an arcane art possessed by the few(and the lucky—at least in the eyes of the interested yet unchosen). One reason for this is that routers were expensive, and requiredspecialized training. They were also found only in small numbers inlarger companies. Unix, while not quite as inaccessible in terms ofcost, has also frequently been considered a black art for the few. Linux, of course, has turned all of this on its ear and delivered aGNU operating system to themasses. There used to be only a few big-city bookstores that had adecent selection of Unix books. Now every mall bookstore has aUnix/Linux section.

Routers, although not quite ubiquitous, are also much more prevalentin recent times too. The explosive growth of the Internet hasevery business, large and small, scrambling to get connected.Even completely nontechnical organizations POP their email fromtheir ISP over a dial-up link several times a day. And peopleuse more networked computers in general nowadays. People evenhave routers in their homes, perhaps to provide Internet connectivityvia a cable modem to multiple computers in the home.

Interestingly (but not surprisingly), Linux delivers a router platformaccessible by the many, almost as easily as it has resurrected the word"Unix." Although what folks think of as "traditional" routers arespecial-purpose hardware running embedded real-time operating systems,there has always been a group using Unix-based operating systems runningon general-purpose hardware. Linux has helped expand this groupimmensely by providing a full-featured and robust TCP/IP stack andhundreds of device drivers-all ofwhich run on commonly availablecomputing hardware. Another important factor is the GNU/Linux community'sbasic tenet of sharing ideas and knowledge instead of hoarding them. The truly amazing part is that all of this is available without expensivelicensing costs or nondisclosure agreements. With these good tools andsome know-how, anyone can build an inexpensive, stable router platformcapable of performing a variety of functions within any organization.

If you're asking yourself, What's a router?, do not despair! Thisbook will cover most topics in enough depth and with enoughreferences that you will not be left stumped. If it fails to do this,please let me know. Traditionally, a router is defined as a layer 3switch. That is, it looks at the layer 3 packet headers and decideswhere to forward them. (Layer 3 refers to the OSI "network" layer.)For TCP/IP networks, the router examines the IP headers to determine thedestination IP address of the packet and the TTL (Time To Live), among otherthings. In this strict definition, the type of packet—TCP, UDP, ICMP,etc.—is immaterial. However, as routers accumulate functionality,they can now take into account the layer 4 (transport layer) headers (aswell as those above layer 4 and below layer 2) when deciding what to do with apacket. Some other things that routers do:

• Transfer traffic between two different types of physical networks. An example of this is forwarding packets from Ethernet to Frame Relay and vice versa, as is done by a WAN router.
• Restrict the flow of traffic to/from certain addresses or networks. This is commonly known as packet filtering. Often the router will examine more than just the IP headers to make filtering decisions. TCP and UDP headers and other layer 4+ packet fields are fair game.
• Rewrite source addresses so that traffic appears to originate from an address other than that of the original sender. Under Linux, this is accomplished through masquerading and network address translation (or NAT). The task includes unmasquerading replies flowing in the other direction.
• Act as a BOOTP or DHCP server issuing IP addresses and other configuration parameters for workstations on your network. Throughout this book we will use Linux routers to perform these tasks and much more.

The focus of this book is admittedly not on academic definitions, but onhow to accomplish (or at least get started on) a certain task. You mayfind that knowing the correct technical definition for something is notthe same as successfully configuring and administering it in a productionenvironment. If you're just getting started as a network administrator,be confident that a lot of technical know-how can be learned only throughexperience (a.k.a. "the hard way"). Do not be intimidated by the lackof a formal body of knowledge; just admit it to yourself when you don'tknow the answer and strive to figure it out.

From Whence Linux?

http://www.educ.umu.se/ A bjorn/mhonarc-files/obsolete/

This isa thread that features a heated exchange betw Torvalds and AndyTanenbaum, a well-established researcher,professor, father of MINIX, and author ofseveral (good) OS-design books. (I read somewhere that Linus Torvaldsisn't particularly proud of the bravado he displayed in these messages. I find the characteristic of being passionate about something and then later beingable to admit having been caught up in the heat of themoment, and to rise above it, to be magnanimous indeed.)

http://www.educ.umu.se/ A bjorn/linux/misc/linux-history.html

This is a collection ofLinux-relevant postings made tocomp.os.minix about building an OS.

The way I understand the early history of Linux, it boils down to this:Linus Torvalds had an Intel 80386-based PC andsome free time. He set out to write an operating system that wouldcapitalize on the new features of this processor, ignoring backwardcompatibility with the 8088 and the 80286. (Other PC operating systemsof that era were struggling with some design trade-offs that were imposedby the limitations of the 386's predecessors. In all fairness, theydid this to maintain backward compatibility with software written to runon those systems.)

Another incentive for writing his own OS from scratch was to takeadvantage of the large body of excellent "free" software beingdeveloped by the Free Software Foundation. This is the (first) connection between Linux andRichard Stallman, who founded the GNUproject in 1984 and has lent both philosophy and code to the effort. The system software which Linus used for his new kernel is commonlyknown as the GNU toolset. These tools implement most of what iscommonly thought of as standard "Unix" systemtools. Remember, "GNU's Not Unix." This collectionof software had the tremendous advantage of being available insource-code form and being delivered with a license that allowed earlyLinux developers to modify that source and redistribute it.

In the early 1990s, the Internet made the transition from anacademic/scientific tool to the most powerful communicationsmedium ever available to the general public. The ability tocommunicate, collaborate, share, discuss, and debate has never beforebeen available to such a large percentage of the world's population. Whythe sentimentality about the Internet? If Linus Torvalds conceivedLinux, and it spent a while in the "womb" of academia, then theInternet is its home—where it will play, grow, and mature. But Linuxhas become more than a user of the Internet; it has become part of it,and thus is now being used to propagate itself.

Why a Linux Router?

At this point, you may be thinking that this is all well and good andapropos in some sort of cosmic sense—the child has grown up to takecare of the parent, etc., and so on-but what makes a Linux router anybetter or different than other routers? As with most interestingquestions, the answer is: "It depends." Primarily, it depends upon whatyour definition of "better" is.

• Linux routers are inexpensive. For about $500 plus a meagerly equipped PC, you have a WAN router capable of running several different protocols at T1 (1.5Mbps) speeds and higher. For a bit more, you can route multiple T3s. License costs are typically nil. Ongoing hardware maintenance costs are nil to minimal. Linux runs on an amazing variety of hardware platforms, from the latest low-cost commodity gear to systems that haven't been manufactured in a decade.
• Linux routers are flexible. Try running a copy of Apache (the world's most popular HTTP daemon) on a "traditional" router, or integrating a "traditional" router into your in-house-developed security infrastructure. At best, you will pay your router vendors handsomely for the privilege of letting them port your code to their systems. Otherwise, you're probably out of luck.
• Linux routers are stable. Whereas the TCP/IP implementation of many others has been reviewed by, at most, a few hundred capable programmers, Linux's TCP/IP stack has been reviewed by literally thousands. (It even has its own book; see TCP/IP and Linux Protocol Implementation in the Bibliography.) And because Linux is a "labor of love" for most of its contributors, its quality is based on pride and technical excellence, not hampered by deadlines and office politics.
• Linux routers are easy to administer. If you can navigate a shell (you can pick the shell of your choice), you have already completed level one of your router training. With other solutions, you need to learn a new command environment and set of tools. Linux is the same whether it's acting as a web server, workstation, or router.
• Linux routers are based on proven, widely available technology. Because the system hardware and adapters are being produced for such an enormous market, costs are low and time-to-market cycles are as short as possible.
• Linux routers provide investment protection beyond that of their "traditional" counterparts. If you've worked in computer support for any length of time, you've probably experienced discontinuing a product line, phasing out support for a particular version, failing to add features that you desperately need, or simply not responding to bug reports. With Linux, there is no vendor who can strong-arm you into accepting any of these frustrations. You always have the option of modifying the source yourself or choosing not to upgrade and remaining at the version which suits you best.
• Linux routers are expandable. Because you can use almost anything that you can attach to a general-purpose computer, you never have to worry about whether or not your router chassis can support a third BRI ISDN adapter. Just add a serial expansion card and attach the third adapter.
• Linux routers are adaptable. One thing the computer industry has shown us by now (or taught us the hard way) is to expect change. Where is IBM's MCA? Whatever happened to 100VG-LAN? Did VoIP (Voice over IP) really ever catch on? The next big thing to hit the market will be ?? Since a Linux router is not a proprietary "point-in-time" solution, you can retrofit to meet your technology needs without replacing your entire router hardware.

Goals of This Book

This book aims to promote Linux as a router by telling you how to set upand manage your own Linux router based on my experiences using them inproduction environments. Different "types" of routers are illustratedthrough a series of examples, each of which introduces the functionalityand configuration of that router. For instance,Chapter 3 describes a router used to route trafficbetween two LAN subnets, while Chapter 5 details theconfiguration of a Frame Relay (WAN) router. Because the fine detailsof "ho change continually, every attempt is made to maintain a levelof detail that will be useful for more than just the next point-releaseof the kernel. (However, the specific examples in this, the secondedition of the book, are for the 2.4.x kernel series. SeeChapter 10 for information on prior kernels.)

Alongside the configurations are general discussions about running Linuxin production, as well as coverage of some applications that help supportthe network infrastructure (like traffic analysis and systemmonitoring). For me, Linux is about enabling people to do things thatthey would not have been able to do or afford to do otherwise. Really. I mean that quite sincerely. Sometimes "afford" means more than havingsufficient money—it means having sufficient time. Linux can help youcraft tailor-made solutions by building on the work of others. The bookalso contains some background information suited for "newbie"administrators who have never done network administration. While thisinformation will be familiar to experienced network administrators, Ifeel that it's important, because technical elegance is pointless withoutsound administration practices, or if you don't even know where to start.

To exhibit what I believe is the "true spirit" of Linux—sharinginformation, ideas, and accomplishments instead of hidingthem—references to publicly available resources will be madewhenever I am aware of such sources. Several of these arecollected as a list of links in Appendix . Much ofwhat you read in this book is made possible by the existence of openlyavailable documentation. Another element of this spirit is theattitude that "whatever it is I need to accomplish, Linux is asufficient toolset to succeed." Having faith in your toolset and inyour ability to use it effectively to solve business problems iscrucial to your performing your work well and enjoying it, too. Thisbook aims to help you establish some faith in the toolset by offeringknowledge about how to use it. It will help you find ways in whichyou can:

• Reduce the total cost of ownership (TCO) of your current environment. Very few businesses are so wealthy that they disregard the bottom line.
• Deploy Linux routers in organizations which might not be able to afford the "traditional" hardware or the associated license and maintenance costs.
• Solve problems not addressed by "traditional" routers.
• Keep your Linux production environment healthy, saving yourself time and unexpected trips into the office.

The Linux Documentation Project

The LinuxDocumentation Project, or LDP as it's commonly known, is an invaluable resource for Linuxdocumentation. The project aims to make high-quality documentationfreely available to all. This means not only covering a wide range oftopics at various depths and skill levels, but also making sure thatthe documentation is current and correct.

This documentation covers a wide variety of topics, from generalhardware compatibility to specialized software configurations. Thedocumentation takes several forms, from the informal FAQs andmini-HOWTOs to the regular HOWTOs and the longer guides. If you'renot already familiar with this site, bookmark it—I will referthroughout this book to documentation found there.

http://www.linuxdoc.org

Nongoals of This Book

This does not aspire to incite the masses to riot and replace all"traditional" routers with Linux systems. (Throughout this book theterm "traditional" should be taken to mean router product offeringsbased on a closed, proprietary system interfaces or "operatingsystems." This would include the fine family of Cisco products, Nortel,Ascend Communications, et al.) These products have their place, and theyhave paved the way for the existence of Linux andthe Linux router. In many instances, depending upon either the specificapplication or your corporate culture, traditional routers are the rightchoice for your production environment. On the other hand, a soundbusiness principle is to pick the least expensive tool capable ofsatisfying all of the operational requirements—the tool that willresult in the lowest total cost of ownership. Realistically, cost isthe overriding factor for most business ventures, and Linux-basedsolutions will often have the advantage.

This book does not attempt to thoroughly teach TCP/IP or fully explainrouting protocols used in TCP/IP networks. Nor does the book thoroughlyaddress firewall configuration or security. These topics are simply beyond thescope of this book, and other people have done fantastic jobs of coveringthem (much better than I could). I do heartily recommend athorough understanding of TCP/IP and networking in general for anyoneconsidering administering a TCP/IP network, regardless of the equipmentused. For an authoritative treatment of networking and routing, seeInterconnections by Radia Perlman. Finally, the book you nowhold covers only routing with TCP/IP (although Linux is capable ofhandling other protocols). If you need to support something other thanIP, know that you are not alone, and that much of the software andhardware specifically supports protocols besides IP.

Layout of This Book

Chapters and discuss topics which aregeneric and applicable to all Linux routers, whileChapters - each cover a type of Linuxrouter as I have used it in production and highlight what I learned inthe process. (There should probably be a chapter called"Franken-router" for the router configurations that did not work-aHOWNOTTO of sorts. Adventurous readers will be able to writethis chapter themselves.... :) ) Of the latter sevenchapters, the first three are basic LAN, extranet, and WAN routers,while the remaining four address more advanced topics suchas connecting to the Internet and making routers do morethan just route.

Within each router chapter, first the router is introduced by itsfunction, and then technical details of configuration are discussed.Throughout the book, several threads of related topics are presented anddeveloped alongside the routers themselves. These topics include choiceof hardware, choice of software, strategies for high availability, TCP/IPniceties of Linux available in the kernel, and monitoring configurationsand software. Different chapters have different components andrequirements, but generally have the following layout:

• hardware
• software required and configuration
• kernel configuration
• support/high availability
• monitoring

The appendices address topics either too general or too specific for themain text, from how to compile the Linux kernel(Appendix ) to using VMware to augment yourtesting strategies ethical considerationsof a network admin. Finally, there may not be a single "flavor" ofrouter presented in this book that fits your application. If that is thecase, do not shy away from combining configurations presented here intosomething new.

A Note to 2.0.x and 2.2.x Kernel Users

Initially, the first edition of this text encompassed the 2.0.x and the2.2.x versions of the kernel. As that book went through various stagesof editing (and time passed), it became clear that the main text shouldappeal to the broadest userbase without forcing the reader to switch backand forth between the details of two different kernel versions. This isparticularly true for the sections on masquerading and firewalling(Chapters 4, 7, and 9).

In the second edition the focus is on the 2.4 kernel, since all of themajor Linux distributions at the time of writing run on 2.4 kernels. However, notes for 2.0 and 2.2 kernel users remain and are scatteredthroughout the text, including many of the first edition materials forthe 2.2.x kernels collected in Chapter 10. If you supportan environment running on an older kernel and need assistance, checkhttp://mancill.com/linuxrouters/

Naming of Chapters

You might have already noticed a common thread in the names of thechapters in this book. Maybe they make you want to check the cover tomake sure that this isn't a science textbook. Selecting a naming motiffor Unix systems is a tradition that seems to have been around for quitea while. Perhaps one of the hacker subculture deities knows its origin.(See The New Hackers Dictionary by Eric Raymond if this sort oftrivia interests you.) If you haven't already guessed, I've named myrouters after elements in the periodic table.

The periodic table has characteristics that render it useful asa system naming scheme. First of all, there is a large pool of names,many of which sound cool. Next, every name has a short yet unique"symbol name" associated with it, e.g., gold is Au, carbon is C. These can be used as a sort of shorthand, alongwith aliases (CNAMEs) in DNS to save keystrokes.

Read an Excerpt

Preface

This book is the culmination of over two years of dodging the obvious: I needed to write a HOWTO to document the things that I was using Linux for in my work, particularly concerning the use of Linux as a router in a variety of scenarios. But the book is not only about routers, it's about running Linux in production and all of the non-technical details which go along with it. This book is not intended to be the authoritative "be-all end-all" of what can be accomplished with Linux routers, but a HOWTO describing what has worked for me and my employers over the past few years. I have tried to record all of the stupid mistakes I have made along with the arbitrary parts of configuring and running a Linux router so that you won't have to learn them on your own. I fully expect you to far exceed the contents of this book as you further the state of the art.

FEEDBACK

As an active professional in the IT industry and an advocate of Linux, I aminterested in your commentary about the contents of this book. Please feel free to contact me by email to provide feedback, contribute ideas, or discuss your criticisms of either the material or my method of presenting it. The following address should find me: tony@mancill.com.

Happy Hacking!