The Default Gateway is the IP Address of a router or a routing device to which all the packet to a destination for which the server doesn't have a route will be forwarded to. Most of the servers in any network leave the routing job to the routers meaning there will be a default gateway added to the system and very little (if any) static routes added to it. This makes management much easier.

This procedure should work on Redhat Enterprise Linux, Fedora, Centos.

The default gateway in Redhat Enterprise Linux is set in the /etc/network file.

Edit the file and the Default Gateway IP Address as follows:

rhel5# vi /etc/network

Add the following lines

NETWORKING=yes
HOSTNAME=hostname.domain.com
GATEWAY=192.168.1.1

where HOSTNAME – sets the Hostname of the server or system

GATEWAY – sets the IP Address of the Default Gateway

This should add the default gateway to the server. For the changes to take effect, restart the network services as follows

rhel5# service network restart

or to just reread the interface config files

rhel5# service network reload
 

This should help. For information on adding or modifying IP Address click here. To add static routes in Redhat, click here

Adding the IP Address in Redhat Enterprise Linux can be done by using the netconfig tool or by editing the network-scripts or by using the ifconfig command. While this procedure is tested on Redhat Enterprise Linux, I'm sure it should work on CentOS, Fedora and older Redhat versions.

Set IP Address using Netconfig

Netconfig is a utility in Redhat Enterprise Linux which allows you to add/modify the IP Address the system, the Netmask, default gateways and the Name Servers.

Launch Netconfig,

rhel5# /usr/bin/netconfig

This launches a window as follows:

For static IP uncheck the "Use Dynamic IP configuration(BOOTP/DHCP)"

Now, enter the IP Address, netmask, Default Gateway & Primary Name Server.

Once done, restart the networking service

rhel5# service network restart

or to just reread the interface config files

rhel5# service network reload

This should set the IP Address.

Manually edit Interface configuration files

You can also manually edit the interface configuration files and add/modify the IP Address.

The Network interface configuration files are found in the directory

/etc/sysconfig/network-scripts/

Let's say there are 2 interfaces eth0 & eth1. The files to edit will be

ifcfg-eth0 – For interface eth0

ifcfg-eth1 – For interface eth1

To add the IP Address for interface eth0, edit ifcfg-eth0

rhel5# cd /etc/sysconfig/network-scripts

rhel5# vi ifcfg-eth0

Enter the following Parameters

DEVICE=eth0
BOOTPROTO=static
BROADCAST=192.168.1.255
HWADDR=00:0F:1F:2F:3F:4F
IPADDR=192.168.1.10
NETMASK=255.255.255.0
NETWORK=192.168.1.0
ONBOOT=yes
TYPE=Ethernet

Where

DEVICE indicates the interface
BOOTPROTO indicates if it is static IP or uses DHCP/BOOTP

The above sets the IP Address, Broadcast address, Network, Netmask etc.

Once done, save the file and restart the network service for the changes to take effect.

rhel5# service network restart

or to just reread the interface config files

rhel5# service network reload

Using ifconfig

This is dynamic and the change take effect instantly.

rhel5# ifconfig eth0 192.168.1.10 netmask 255.255.255.0 gw 192.168.1.1 up

This sets the IP Address, Netmask and the default gateway on the interface. For information on how to add Static Routes in Redhat Enterprise Linux, click here

Maximum Segment Size (MSS) value advertised by a Server or a System is the preffered size of the segment that it can receive. For an standard packet this is equivalent to the Maximum Transmission unit (MTU) – 40bytes (standard TCP/IP overhead of 40 bytes [20+20]). This is the value that the server advertises and not what we can transmit.

If the MTU is 1500 bytes then the MSS will be 1460 bytes.

In Redhat Linux, if not set manually, the Kernel calculates the MSS simply as MTU-MSS bytes. However, this advertised value of MSS can be manually set for individual networks or hosts by setting them in route commands

To set the MSS Value for a network

ip route add 192.168.1.0/24 dev eth0 advmss 1310

where the "ip route" command sets the static route for the network via ethernet 0 and the part "advmss" sets the MSS value of 1310 bytes.

To set the MSS Value for a Host

ip route add 192.168.1.1 dev eth0 advmss 1310

The above commands set the MSS values at a network / host basis dynamically when the server in use.

The Maximum Transmission Unit (MTU) can be set/modified in real time on Redhat Enterprise Linux or can be set force the value at boot time.

The MTU in simple terms is the maximum size of a packet that can be sent on a Network Interface card. The default MTU size is 1500 bytes.

To dynamically change the MTU in real time while the server is in use,

redhatlinux# ip link set dev eth0 mtu 1350

where eth0 is the Ethernet interface and 1350 is the mtu size (1350 bytes)

However, this change is lost when the server or the network interface restarts the next time.

To make the change permanent, edit the interface configuration file (for instance eth0)

/etc/sysconfig/network-scripts/ifcfg-eth0

and add the following line

MTU=1350

so a cat of the file should look something like this

redhatlinux# cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
MTU=1350
BOOTPROTO=dhcp
ONBOOT=yes
TYPE=Ethernet

Once done, simply restart the interface or reboot the server at the next available maintenance window for the changes to take effect.

To restart the Network Interface

redhatlinux# service network restart eth0

To view the updated MTU

redhatlinux# ip link list
1: lo:  mtu 16436 qdisc noqueue
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0:  mtu 1350 qdisc pfifo_fast qlen 1000
    link/ether 00:01:11:12:13:14 brd ff:ff:ff:ff:ff:ff
3: eth1:  mtu 1500 qdisc noop qlen 1000
    link/ether 00:40:f4:98:8e:43 brd ff:ff:ff:ff:ff:ff

or

redhatlinux# ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:01:11:12:13:14
          inet addr:192.168.10.11  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1350  Metric:1
          RX packets:12321 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6610 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:201126104 (194.1 MiB)  TX bytes:78293 (768.8 KiB)
          Interrupt:209 Memory:fb000000-0

Dnsmasq is an opensource light-weight,easy to configure and administer DNS and a DHCP Server. Dnsmasq is ideally suitable for smaller networks like Small Office and Home Office networks (SOHO) and branch office networks. Dnsmasq can be run on old PC and is very easy to configure and administer. Dnsmasq is seen to support upto 1000 nodes on a network.

In essence, Dnsmasq is a Caching nameserver and a DNS forwarder with DHCP enabled on it. Dnsmasq can provide nameservice for local hosts while forwarding the queries for global public resources to a Public DNS Server (like an ISP DNS server). So, small networks which are behind a DSL/ADSL router or even a modem link and share a single internet connection can make the best use of Dnsmasq.

Dnsmasq is included in most of the opensource firewalls and opensource router firmware and in the most common Linux distributions. Some of them include:

Opensource Firewalls:

IPCop / Smoothwall / floppyfw / Firebox / LEAF / m0n0wall / PfSense / Endian Firewall / ClarkConnect

Opensource router firmware:

dd-wrt / openwrt / stock firmware / fli4l

Linux Distributions:

Debian / Gentoo / Slackware / Suse / Fedora / Coyote Linux

*BSD

FreeBSD / OpenBSD / NetBSD

Some of the highlighting features of Dnsmasq are as follows:

• Automatically update the Public DNS Servers through PPP or DHCP connections. So, change in a Public DNS server of an ISP that the network is connected to will be picked up by Dnsmasq
• Caching Nameserver to reduce network traffic and improve performance
• Forwarding to Private DNS servers for specific Domains can be configured
• Nameservice for the localhosts using the /etc/hosts file and for DHCP Client hosts
• Static and Dynamic client leases on DHCP
• Multiple Network and IP Ranges on the DHCP server
• BOOTP support for network booting using a secure read-only TFTP server
• Simple global configuration using the /etc/dnsmasq.conf file
• Supports BOOTP and DHCP Relays
• Caches A records for IPv4 and AAAA records for IPv6 and PTR records
• Supports IPv4 and IPv6 protocols and even can act as a IPv4 toIPv6 and IPv6 to IPv4 forwarder
• Support MX records and SRV records for local machines
• Block DNS redirect websites (like some websites which forward to a link for a website that doesn't exist)

Dnsmasq does the name lookup from its /etc/hosts file and hence its all about maintaining a /etc/hosts file on one computer as against multiple PCs on the LAN. If the host is a DHCP client then even if there isn't an entry for the host in the "hosts" file it can still provide name resolution for the host.

Effectively, all hosts in the LAN will have the dnsmasq server as the nameserver in /etc/resolv.conf file (In windows under network connection) and you dont have to worry about the "hosts" file on the local system.

The /etc/hosts file on the Dnsmasq server can have only the hostname without the domain name (example: host1 instead of host1.mynetwork.com) as the domain name can be appended globally using configurations in the /etc/dnsmasq.conf file.

It's got .deb and rpm packages for Debian, Fedora and other distributions and also can be built from the Source files. For more information and download, click here for dnsmasq home page.

ICMP Redirects Send and Accept are by default enabled on most of the linux flavours including Debian, Ubuntu, Redhat Enterprise Linux, Suse Linux.

While ICMP Redirects are not the very efficient way to update a hosts Routing table of an optimal route to a target destination, it can cause serious security concerns where a hacker or attacker can send malicously crafted ICMP redirect messages and cause a Denial of Service attack on the network.

If ICMP Redirects are not used in the network for route updates and if the server is not acting as a Router or a Gateway (ICMP Redirect send only) then ICMP Redirect send and accepts should be disabled on the server.

In most of the Linux flavors (tested on Debian,Ubuntu,Redhat Enterprise linux,Suse) ICMP Redirects can be dynamically disabled on the host by using

1. /sbin/sysctl utility which can modify Kernel paramters at runtime

Login as root and run the following command to disable ICMP Redirects Send and Accept

Server# /sbin/sysctl -w net.ipv4.conf.all.accept_redirects = 0
Server# /sbin/sysctl -w net.ipv4.conf.all.send_redirects = 0

Server# /sbin/sysctl -w net.ipv6.conf.all.accept_redirects = 0
Server# /sbin/sysctl -w net.ipv6.conf.all.send_redirects = 0

The above disables ICMP Redirects globally on the server. However, if you want to disable on a per interface basis then in the above command, instead of using "all" use the inerface name (say "eth0")

Server# /sbin/sysctl -w net.ipv4.conf.eth0.accept_redirects = 0
Server# /sbin/sysctl -w net.ipv4.conf.eth0.send_redirects = 0

Server# /sbin/sysctl -w net.ipv6.conf.eth0.accept_redirects = 0
Server# /sbin/sysctl -w net.ipv6.conf.eth0.send_redirects = 0

This will disable ICMP Redirects immediatly.

or even a simpler option would be to

2. Passing appropriate value (0 or 1) to the above kernel variables as follows:

Server# echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects [for IPv4]
Server# echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects [for IPv4]

Server# echo 0 > /proc/sys/net/ipv6/conf/all/accept_redirects [for IPv6]
Server# echo 0 > /proc/sys/net/ipv6/conf/all/send_redirects [for IPv6]

Again this can be used on a per interface basis as

Server# echo 0 > /proc/sys/net/ipv4/conf/eth0/accept_redirects [for IPv4]
Server# echo 0 > /proc/sys/net/ipv4/conf/eth0/send_redirects [for IPv4]

Server# echo 0 > /proc/sys/net/ipv6/conf/eth0/accept_redirects [for IPv6]
Server# echo 0 > /proc/sys/net/ipv6/conf/eth0/send_redirects [for IPv6]

However, these kernel changes made at runtime will be lost when the system reboots. So it is important that these are applied at boot time as well to ensure that the server is secure.

ICMP REDIRECT DISABLE AT BOOT TIME

In order to disable ICMP Redirects at boot time,

1. Edit the /etc/sysctl.conf file

Edit the /etc/sysctl.conf file and add the following lines:

In Debian and Ubuntu Linux:

net/ipv4/conf/all/accept_redirects = 0 [for IPv4]
net/ipv4/conf/all/send_redirects = 0 [for IPv4]

net/ipv6/conf/all/accept_redirects = 0 [for IPv6]
net/ipv6/conf/all/send_redirects = 0 [for IPv6]
 
Again, if you want to control ICMP redirects on a per interface basis then add the following lines (say for eth0):

net/ipv4/conf/eth0/accept_redirects = 0 [for IPv4]
net/ipv4/conf/eth0/send_redirects = 0 [for IPv4]

net/ipv6/conf/eth0/accept_redirects = 0 [for IPv6]
net/ipv6/conf/eth0/send_redirects = 0 [for IPv6]

In Redhat Enterprise Linux and Suse:

net.ipv4.conf.all.accept_redirects = 0 [for IPv4]
net.ipv4.conf.all.send_redirects = 0 [for IPv4]

net.ipv6.conf.all.accept_redirects = 0 [for IPv6]
net.ipv6.conf.all.send_redirects = 0 [for IPv6]
 
Again, if you want to control ICMP redirects on a per interface basis then add the following lines (say for eth0):

net.ipv4.conf.eth0.accept_redirects = 0 [for IPv4]
net.ipv4.conf.eth0.send_redirects = 0 [for IPv4]

net.ipv6.conf.eth0.accept_redirects = 0 [for IPv6]
net.ipv6.conf.eth0.send_redirects = 0 [for IPv6]

This will allow the /etc/sysctl.conf be read by the /sbin/sysctl utility at the startup.

NOTE: In Debian and Ubuntu, this will be overiden by any options set in /etc/network/options as the /etc/init.d/networking script which sets the /etc/network/options file kernel paramters at boot time runs after the /etc/init.d/procps script which sets the kernel variable values specified in /etc/sysctl.conf file. It is advisable to make all change to /etc/sysctl.conf file instead of /etc/network/options file as this is being depreciated.

ClarkConnect is an all-in-one Opensource networking suite from Point Clark Networks. It is a full blown security suite on one front with Stateful firewall protection, Intrusion Detection and prevention, Maile Gateway with Antivirus, Anti-spam and Anti-phishing support, proxy & web content filtering, peer to peer connection filtering for web protection while is also a networking suite with IPSec and PPTP support, bandwdith and system monitoring and a server with web-server, Database server support, file & print sharing, mail server, system and mail backup. All built on a cut down redhat linux with a good web interface.

ClarkConnect is an opensource winner with all the features are directly enabled by opensource packages.

The top features of ClarkConnect are

• Statefule Firewall with DMZ interface enabled, NAT and port forwarding support
• Intrusion Detection (Snort) and Preention (snortsam)
• Peer to Peer connection prevention
• MultiWAN support with bandwidth monitoring
• VPN support with IPSec and PPTP support
• Webproxy, Content Filtering, Popup/banner adblocker
• Email Server support (POP, IMAP and SMTP) and webmail support
• Dns, DynDNS, DHCP Support
• Mail Gateway with antispam (spamassasin,Dspam,greylisting), Antivirus (ClamA), phishing filter,  Mail Disclaimer support
• Groupware and Flexshare
• Webserver (LAMP)
• File and Print Sharing, FTP server
• Network Backup

For more detailed listing of features, click here

ClarkConnect comes in three different editions as Enterprise, Office and Community editions. The Community edition is a free edition with no support for the serices and hence is good for Home and Small Office. The Office edition has all of the network and security features enabled with the exception of the Grouware support and the all enabled version is the Enterprise edition. While the Office and Enterprise editions are commercial, the cost is not very pricey.

For a comparision on the versions, click here

A detailed hardware requirement can be found on ClarkConnect website with downloads available here.

A Reader's Toolbox

For 640-802, it is important to qualify both 350-001 as well as 70-291. Still a number of individuals settle for 70-649 too.

If you know there is always going to be a permanent route for a destination then a static route can be a viable option.To add a persistent static route in Redhat Enterprise Linux create a file called route-<int>X in the /etc/sysconfig/network-scripts/ directory

where <int> is the interface number and X is the interface number. As you would expect, these are specified in seperate file for each of the available interface.

Example:

/etc/sysconfig/network-scripts/route-eth0
/etc/sysconfig/network-scripts/route-eth1

Every entry or a route has three entities as follows:

GATEWAY<N>=xxx.xxx.xxx.xxx
NETMASK<N>=yyy.yyy.yyy.yyy
ADDRESS<N>=zzz.zzz.zzz.zzz

As the names implies, they are the gateway IP, Netmask and the IP/Network Address

Note the <N> next to each of the three entities. This number defines the route entry number and should be the same on all the entities.

Example:

GATEWAY0=192.168.1.1
NETMASK0=255.255.255.0
ADDRESS0=10.10.10.0

GATEWAY1=192.168.1.1
NETMASK1=255.255.255.0
ADDRESS1=20.20.20.2

A sample file /etc/sysconfig/static-routes is available for your reference.

Once the file is created, restart the network service as follows:

# service network restart

To view the routes type

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     *               255.255.255.0   U     0      0        0 eth0
192.168.2.0     *               255.255.255.0   U     0      0        0 eth1
10.10.10.0      *               255.255.255.0   U     0      0        0 eth0
20.20.20.2      *               255.255.255.0   U     0      0        0 eth0
169.254.0.0     *               255.255.0.0     U     0      0        0 eth1
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0

or

# ip route show
192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.1
192.168.2.0/24 dev eth1  proto kernel  scope link  src 192.168.2.1
10.10.10.0/24 via 192.168.1.1 dev eth0
20.20.20.2/24 via 192.168.1.1 dev eth0
default via 192.168.1.1 dev eth0

To dynamically add a route, try the folowing:

Syntax:
# ip route add <Net/IP>/<Mask> via <Gateway> dev <Int>X

Example:

# ip route add 10.10.10.0/24 via 192.168.1.1 dev eth0

or

Syntax:

# route add [-net|-host] <IP/Net> netmask <Mask> gw <Gateway IP> dev <Int>X

Example:

# route add -net 10.10.10.0 netmask 255.255.255.0 gw 192.168.1.1 dev eth0

This should help.