how-to block ads
|
genewitch
join:2007-09-12
Klamath Falls, OR
 ·Charter Pipeline
·Suddenlink
·Cebridge Connections
| IPCop in VMWare: A How-to
ok folks, i got this running last night and it's currently securing my entire network. It's using a 1 gig flat VMDK and 64 megs of ram in the player.
Here's my setup (and if you know how to use ipcop, modify as needed!)
Green - Red network type in ipcop
2 physical NIC devices inside this computer, one for cable/dsl, one for internal network.
VMware workstation/vmware player (this is possible in Microsoft's implementation of VM as well, i believe, and that's free!)
My host machine has 2 gigs of ram with no virtual memory enabled, so my ram usage was a prime factor with this!
Get you a copy of IPCop from ipcop.org.
Install vmware.
Create a new virtual machine, call it IPCOPAPPLIANCE or whatever you want. Save it on a fast hard drive. (or ROOT partition of your C: drive) when asked to make the hard disc, pick new disc, IDE, 1 gig, allocate now! (this makes caching faster in ipcop) set the ram slider to 64 megs, and 1 processor (if you're on a multi-core system).
You can remove USB support, and audio support if you want, mine came that way.
next, open up the vmware network manager. "manage virtual networks" in your vmware start menu folder.
in the second tab, titled "automatic bridging" uncheck the check-box. go to the next tab.
This next bit is kind of important, so review your network card settings and what they are connected to.
VMNet0 should be your INTERNAL network NIC. meaning this one is "Green" to IPCOP. drop down the menu and pick that card as VMNet0.
VMNet1 should be bridged to your RED NIC, the one connected to your cable modem/dsl.
If VMWare complains that there's a DHCP server running on vmnet1, go into the host virtual adapters tab, and REMOVE all of those NICs.
Hit apply. Go into the DHCP tab, and disable, stop/remove the entries in there. Do the same in the NAT tab if you'd like (i didn't have to)
Then go back to host virtual network mapping (after hitting apply) and set vmnet1 to your RED interface.
Close the virtual network manager program by hitting "OK"
In VMWare workstation, edit the settings for IPCOPAPPLIANCE as follows, map the CDROM to the IPCOP installer ISO (no need to burn it to cd!),
uncheck "connect at startup" on the FLOPPY drive,
Set ethernet to VMNET0 (under the custom radio button, and drop down menu below it)
set Ethernet 2 to VMNET1 (same radio button, same drop-down)
make sure the ram and hard drive are set properly!
Boot!
If you've never used IPCop's setup wizard before, it's fairly straightforward; the only thing you want to do is go into the network config and make sure it's GREEN + RED (and not green + red (modem) or (ISDN)), then go into "drivers and card assignments" and it'll show you eth0 and "unset" for green and red. If it says unset for both, just hit OK and pick green, it will auto-configure eth0, and do the same for RED. press OK until you get back out to the networking menu again, and go to address settings.
If you're on cable and use DHCP, under the "red" settings make sure it says DHCP (and whatever hostname you're required to use, if
any. if you're not, the default of "IPCop" is fine)
If you're on PPPoE, set that. it's fairly straightforward.
drop back one menu, pick GREEN address settings, and set that to something like 192.168.2.1 (or whatever you want, really). just REMEMBER THIS IP address! write it DOWN!, the subnet should say 255.255.255.0 (class C network)
hit okay, and get all the way back out. Set your passwords as they ask, and finish the install. When asked to remove drives, just tell it you did and let it shut down. GO ahead and kill the virtual machine (the stop button up top) and edit the settings so that there's no longer a CD image(you can disconnect the cdrom, or you can tell it to use a physical device, either way).
Go ahead and open your host machine's network configuration screen. i do this by right clicking network neighborhood and selecting "properties"; or you can do it inside the control panel as well.
right click your RED interface NIC (the one going to your DSL modem/cable etc) and select properties. UNCHECK ALL the stuff in there
EXCEPT the VM bridge protocol.
I repeat, uncheck EVERYTHING. including TCP/IP. this prevents your host machine from using that NIC for anything.
Hit OK, and then open the properties for your GREEN interface.
In there, you're going to want to go down to TCP/IP, click the properties button. Select the "use the following" radio button, and put in these values (assuming you used the IP i gave you before):
IP ADDRESS: 192.168.2.10
SUBNET: 255.255.255.0
GATEWAY: 192.168.2.1
Primary DNS:192.168.2.1
SecondaryDNS: (this varies, i use 4.2.2.2, call your ISP and ask, or just use Verizon's for now, a future edit will explain how to determine this address from within ipcop!)
go ahead and hit OK to that, and close the properties window and the network connections window.
Now, boot IPCop inside vmware workstation. it should eventually drop you to a "login:" prompt. If so, you're almost done!
If you're very lucky, you're finished. Go to a web browser, and type in »192.168.2.1:81 (exactly like that, if you used the address i gave you earlier for ipcop).
It should ask you to verify a certificate, go ahead and hit OK. You should now be looking at the IPCOP web config screen.
If it says "connected" and has a public IP, you're finished. take some time to familiarize yourself with the layout and options of the ipcop web config platform.
If you don't have an IP, it means one of two things: A) you're using PPPoE, or B) you need to reset your cable modem/dsl, plug it back in, and hit "connect" and wait a spell.
If A) sounds like you, go to the Network tab, it'll drop down three options. Pick "DIALUP" and in there, drop down the menu that has "MODEM" in it, select PPPoE, and click the refresh button to the right. Now you can enter all your gleeful PPPoE settings that your ISP gave you. username, etc. once you're done, press SAVE. (you can set the name, i suggest doing this!) if the screen comes back grey, you're good. if it comes back red, read the little info box at the top left and see why. usually you didn't put in a username or something. but it will tell you.
Click the SYSTEM tab, and select "HOME"; press connect (it should say profile: THENAMEYOUSETBEFORE). If everything is kosher, you'll be connected in no time!
Now, just so you know: this does set up DHCP on your network, so if you have any other devices that do that (all routers) make sure you disable that option in the router or else you'll have machines get vry vry confused. The second thing is, the green interface on your machine probably won't ever be able to lease a DHCP address from itself, that's why we set it by hand. Don't skip that step!
If you have any questions or complains about this quick and dirty how-to, please post here, and if you haven't had a response quickly, try emailing me at genewitch at gmail dot comma.
Thanks for reading!
PS: it is possible to do this (and even recommended) if you only have ONE physical NIC (IE you want to have an awesome firewall, but no home network). This guide will NOT work for that, but i will get something like that working on another machine and post up another guide if anyone asks for it... i know how, I've just not done it all the way through enough to write a quick start guide.
Also, if you bought VMware... you can get the IPCOP appliance from VMWARE themselves, which you'd still follow this guide from start to finish, except instead of installing it and setting options, you'd boot the VM and log in as root with the password "password" and type:
setup
at the prompt. this will give you the exact same configuration menus as the install does. (this part took me a while!!!)
I recommend doing it by hand, though, as this gives you practice on doing it on a REAL machine(As the process is the EXACT same!) | |
genewitch
join:2007-09-12
Klamath Falls, OR
·Charter Pipeline
·Suddenlink
·Cebridge Connections
edit:
February 9th, @01:35AM
| Bump, because i've gotten two emails saying it works like a charm.
Also an edit:
If you're trying to forward stuff to the host's services (like you're running apache on the host that has IPCop running in VMWare, Make sure that your port forwarding and external access settings in IPCOP are pointing to the Host's internal IP, and not IPcops!
IE 192.168.2.10 is the host, 192.168.2.1 is IPCop;
Ports on the host are routed via 192.168.2.10, even though you'd imagine they'd both get there... IPCop is running literally on it's own machine with it's own NIC. I hope this clears up some confusion for people!
Oh and one more thing:
VMWare player is astounding for this purpose. I set the available memory to the VM @ 64 MB, and boot vmwareplayer with the ipcop install. The super nice thing about VMware is you can back up your install VMDK(disk image) and if you ever want to go back to a known good copy of IPCop, you just swap the VMDKs out and you're as good as new without all the hassle of reinstalling! Also, using vmware player allows you to start the VM upon windows/linux load, thus minimizing network down time.
If anyone needs any clarification, or i get enough replies in here about this, i'll rewrite it using actual page layout technique and bullet lists and such. 
Thanks for trying this, to all of you who have, i hope it helps! | |
sagager
@comcast.net
|  Thank you for the explanation.
Now this is what I may be confused: I want to do the configuration above on a Win2K3 Server. Once all is setup, how will I force my client workstations (WinXPP) to pass all packets through the IP COP? Since the communication with the physical NIC on the server will be disabled (except for the bridging.
Based on the example above, what IP info should I feed the clients IP/SM/GW/DNS?
I am interested mainly in the URL Filter (which I found out how to install) for the client workstations.
TIA | |
Mele20
Premium
join:2001-06-05
Hilo, HI
| reply to genewitch
What is IPCop? I tried to go to Sourceforge but that site will never load. I would not have even tried if I had known that is where this software is located.
I love VMWare Workstation so I was curious about this but it is not easy to follow why I would want this when I can't read anything about IPCop.
I did FINALLY get the download page for IPCop to load but no other pages there would load at all and the download page doesn't tell me anything about IPCop. I have cable broadband and no problems loading most sites.
I am guessing this acts like a firewall? So, you would have to boot this VMWare machine each time after you boot the host? That is a big drawback to VMWare Workstation. Plus, why would anyone want a firewall if they have a router and classic HIPS? That is why I got a router years ago and then ProcessGuard so I didn't need a software firewall...so is that what this is?
I only have one NIC so I couldn't do this anyway. But you have me confused...I have a home network but only one physical NIC....????
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason | |
beerbum
5150
Premium
join:2000-05-06
Here!
·Comcast
| said by Mele20  :What is IPCop? I tried to go to Sourceforge but that site will never load. I would not have even tried if I had known that is where this software is located. this?
»ipcop.org/
IPCop Firewall is a Linux firewall distribution geared towards home and SOHO (Small Office/Home Office) users. The IPCop interface is very user-friendly and task-based. IPCop offers the critical functionality of an expensive network appliance using stock, or even obsolete, hardware and OpenSource Software. | |
koma3504
Advocate
Premium
join:2004-06-22
North Richland Hills, TX | reply to Mele20
doing a trace to the site ip along the way. there appears top be a problem. I also have a problem getting to the site.
10 71 ms 322 ms 866 ms cr1-loopback.sfo.savvis.net [206.24.210.70] | |
genewitch
join:2007-09-12
Klamath Falls, OR
·Charter Pipeline
·Suddenlink
·Cebridge Connections
edit:
February 19th, @12:41PM
| reply to genewitch
ok since there seems to be some confusion, the process explained here in a really short fashion is this:
1) install VMWare (preferably player as well)
2) Install IPCop on VMWare. tell vmware to use 32-48mb of ram if you don't want to use PROXY, 64-96mb of ram if you DO. (adjust to size of your network, small use low numbers, large, use higher!)
3) on the host machine, disable all of one NIC adapter's protocol's except the VM networking one. (ETH1 in ipcop, second bridged network segment in vmware)
4) set the other NIC adapter to a private IP such as 192.168.2.10 - this should be the same subnet as your IPCop's IP address for ETH0 in ipcop, FIRST bridged network in vmware.
5) reboot your dsl modem/cable modem. reboot IPCop at the same time
6) after rebooting, release and renew all network machines. in a web browser, go to »https://192.168.2.1:445/ (or whatever IPCop's IP was set to in the second step
7) if you use PPPoE or whatever, set that up. this isn't meant as a tutorial for IPCop, so you can review the manuals for that.
8) if the "home/status" screen (top left menu, top item) shows you having a public IP address, then you're done.
To anyone who was asking "WHY WOULD YOU DO THIS": it's simple.
•IPCop is a stateful firewall, it's very fast, it's very small, and it probably uses less memory in VMWare player than any windows based firewall solution you can think of.
•it doesn't drain your CPU resources at all (1-2% unless it's doing log rollovers or caching a huge amount of stuff in squid).
•It has a transparent proxy(squid is default) included, that requires no client machine setup.
•Any web traffic is cached on the host machine in the vmware HD, if you so desire.
•IPCop supports intrusion detection, as well as hack detection. (snort, tripwire included by default)
•IPCop supports scanning for viruses on the fly INSIDE THE VM MACHINE, while data is being transferred. does your linksys/dlink router do that?(the answer is no).
•IPCop allows you to set host exclusion on an entire network segment, as opposed to having to edit hosts.lm on every client machine. (ad block, spam block, pornsite block, whatever you want).
•IPCop supports an awesome VPN scheme, allowing up to 4 or 5 networks to connect together as one big network with several subnets.
•IPCop has QOS - you can make web traffic take precedence over every other type of traffic. This means, for instance, if you run any sort of server on your network, that you can guarantee that that server is running on a low latency, high bandwidth connection regardless of how much other data is going through your connection. This is great for VOIP applications and on networks where you want to guarantee certain types of packets always get through.
•IPCop doesn't allow lazy port forwarding, DMZ, Large holes in the firewall. It's all pinhole, 1 port at a time. I haven't run into any applications that have a problem with this scheme, as IPCop is stateful, it can determine if traffic is supposed to go through to a client if the client started the handshake.
i am sure there are other firewall solutions similar to IPCop. I've just been using IPCop since it hit 1.x version, and i love it, and it always works for what i need it for.
To answer the other question, "what if i only have one network adapter" there's two answers. If you're looking at running a LAN, then you need a cable/dsl modem that supports USB. If that's the case, follow my guide to the letter, just substituting the USB NIC as the physical NIC ETH1 in ipcop, and second bridged network in VMWare. If your modem doesn't support usb, and you still want to run a LAN with ipcop, you're out of luck. NICs are cheap, go to salvation army/choc/whatever surplus store you have nearby and pick one up for less than $5. Online you can find them for about the same price for a 10bt NIC (which unless you have FIOS or T3 should suffice for internet traffic).
HOWEVER! if you have 1 computer, and one modem, and you want a complete firewall solution, then IPCop will still work! However since i have not done this i cannot provide you with a walk through. if there is a sincere interest about this particular subject, i will experiment with the software and see what i can come up with! LET ME KNOW!
Any other clarification needed, please ask! (please reply to THIS message instead of the OP, because i accidentally turned off notification for the OP :-( | |
Bubba1
Less is More
Premium
join:2006-09-21
| said by genewitch :1) install VMWare (preferably player as well) Not to change the tenor of this thread over to VMWare, but a quick question about it, please.
At the VMWare site, there exist numerous product offerings. It's "VMWare Workstation" that is targeted for home/SOHO use? If so, it's priced at $189.00. The "VMWare player" is free?
Is there a free VMWare offering that I just overlooked? Or, is purchase required to use "VMWare"?
Are there huge differences between VMWare and the free MS Virtual Machine that make VMWare worth the purchase?
Thanks.
--
"Fast is fine, but accuracy is everything" --Wyatt Earp | |
ironwalker
World Renowned
Premium,MVM
join:2001-08-31
Keansburg, NJ
clubs:
·Optimum Online
| reply to genewitch
I too have been useing IpCop since version 1.
I always had a dedicated box for it....recently upgrading to a 500mhz pc with 1gig ram on a 35g scsi 15000rpm hdd.
Love the plugin options and lots of tweak advice, but, why would one need to run it on vmware? | |
GILXA1226
Premium,MVM
join:2000-12-29
London, OH
clubs:
| reply to Bubba1
said by Bubba1 :said by genewitch :1) install VMWare (preferably player as well) Not to change the tenor of this thread over to VMWare, but a quick question about it, please. At the VMWare site, there exist numerous product offerings. It's "VMWare Workstation" that is targeted for home/SOHO use? If so, it's priced at $189.00. The "VMWare player" is free? Is there a free VMWare offering that I just overlooked? Or, is purchase required to use "VMWare"? Are there huge differences between VMWare and the free MS Virtual Machine that make VMWare worth the purchase? Thanks. Look for VMWare Server, it's their completely free offering. I find it is far superior to MS Virtual Machine. | |
genewitch
join:2007-09-12
Klamath Falls, OR
·Charter Pipeline
·Suddenlink
·Cebridge Connections
| reply to ironwalker
because i don't want to use/have another machine just as a router
And VMWare server is free i guess, the microsoft virtual machine is fine for this application though. I don't know how much the vmware player costs, it came as part of the package i have. | |
mikenolan7
Premium
join:2005-06-07
Torrance, CA
 ·Sprint Mobile Broa..
·RoadRunner Cable
| reply to genewitch
I appreciate the work you have put in to document this. I am also genuinely curious about the advantage you see in creating the IPCop virtual machine over a standalone installation. Is your end goal to add a desktop image, and have it be protected by IPCop, all on one machine, or are there more advantages? I assume you are aware of the many virtual appliances available here:
»www.vmware.com/appliances/
But, of course, since they are binary images they are not as secure as following your instructions. | |
genewitch
join:2007-09-12
Klamath Falls, OR
·Charter Pipeline
·Suddenlink
·Cebridge Connections
| yeah i noted that in another forum, there is an ipcop virtual appliance, but it's hard to customize (hd size for instance). Also these instructions work for the MS VPC as well, so that's one reason.
I mentioned in the post above yours that i run it on my machine because i don't want to dedicate a machine to it. Also, this is the easiest way to firewall/route a network that uses a USB WLAN (cellular, for instance). there's several advantages, including not needing to remote to the ipcop machine, memory usage is negligible, and it's a lot more powerful than a cheap hardware solution (QOS for instance).
mine is a hardware router replacement, so it's working well for me. | |
mikenolan7
Premium
join:2005-06-07
Torrance, CA
·Sprint Mobile Broa..
·RoadRunner Cable
| Have you tried the Linux Vserver? It is much more hardware efficient than VMware (I haven't tried the MS virtual machine). It's great for servers - run a DNS, DHCP server, etc. on different vservers. I tried to create something similar to what you have done on vmware with vservers, but I could not get X11 to work on the virtual desktop. Thanks for sharing your work. | |
genewitch
join:2007-09-12
Klamath Falls, OR | ipcop doesn't require X11 though... or you meant you couldn't get X11 to work on your linux distro? | |
mikenolan7
Premium
join:2005-06-07
Torrance, CA
·Sprint Mobile Broa..
·RoadRunner Cable
| I was using a roll-your-own linux firewall on one vserver "guest", and trying to set up a linux desktop on a second guest, on the same machine. I couldn't get the X11 working on the desktop. Didn't need or want it on the firewall. Vservers are not as flexible as VMware, you only run a single kernel, so you can only run linux. The single kernel is why it is so efficient with resources. It's meant more for servers (surprise), so it's not very friendly to X11. I found some links to get X11 working in a vserver guest, but I couldn't reproduce the results.
The primary security feature in vservers is keeping individual vserver guests in userland. To enable X11 you had to add capabilities to the guest that would make it possible for an attacker to escape the guest and attack the kernel. Kind of defeated the purpose, and I couldn't make it work anyway. I have no problems with X11 in many linux distros, freeBSD, and openBSD, but the vserver eluded me. User error. | |
Mele20
Premium
join:2001-06-05
Hilo, HI
| reply to Bubba1
said by Bubba1 :said by genewitch :1) install VMWare (preferably player as well) Not to change the tenor of this thread over to VMWare, but a quick question about it, please. At the VMWare site, there exist numerous product offerings. It's "VMWare Workstation" that is targeted for home/SOHO use? If so, it's priced at $189.00. The "VMWare player" is free? Is there a free VMWare offering that I just overlooked? Or, is purchase required to use "VMWare"? Are there huge differences between VMWare and the free MS Virtual Machine that make VMWare worth the purchase? Thanks. The 2 major differences are so major for anyone using VMWare to test software and/or so that they don't need to worry about getting a virus because they wanted to walk on the "wild side" for a bit, etc. that I would never consider using the Server.
The Server runs all the time as a Service which makes it potentially open to security issues that Workstation running in User mode doesn't have. Plus, the Server cannot do MULTIPLE snapshots which are ESSENTIAL for those of us who use VMwareWorkstation for beta testing and so that we don't have to worry about getting malware if we are a bit adventuresome in our web surfing. Plus, with Workstation there are not the Security problems that exist with Server running all the time as a service. A VMwareWorkstation computer runs when you boot it up and you shut it down when you are through and that is it. It runs when you want to use it and runs independently of the Host which is not the case with the Server.
You also cannot clone Server machines (unless you pay VMWare for extra software to do that). Cloning is easy and simple in WorkStation. So, with no cloning, no multiple snapshots...for my purposes Server is worthless. You also cannot do shared folder between Host and a virtual machine when using Server like you can with Workstation. You cannot do drag and drop between host and virtual machine with Server either. Nor would you be able to copy/paste a URL, etc. from host to virtual or vice-versa.
I would use Microsoft's program over the Server from VMWare. They made free something that many of wouldn't want. I don't think Server competes at all with Microsoft's free virtual machine. But the problem with Microsoft's offering is that it isn't very good compared to VMWareWorkstation. But it is free and that makes it the first virtualization program to try IMO. In Workstation 6 which I don't have you can take your virtual machines with you on a memory stick ...that would be nice. Can't do that with Server machines.
VMWare Player is free because it is preconfigured and you can get various configured OSes that have been made available that run in Player but you can't change them. You can run Player also within VMWareWorkstation so if you don't know how to install some Linux distro to a new virtual computer you have made, you can use Player within Workstation and run a premade virtual computer that already has some flavor of Linux all set up, configured and ready to go...but you can't change anything.
So, Server vs Workstation depends really on what you want the virtual machine for and on security issues. Server listens on ports that can be hacked but IPcop would fix that if you run it, but if not there is a vulnerability that workstation doesn't have. I want Workstation because it runs in User mode and I very much want to be able to shut down my virtual machines whenever I want and use them only when I want to use them and be able to with one simple click go to a different snapshot. Moving to another snapshot is done in the background and is very fast. I have 29 snapshots for one machine and the ease of making a snapshot before installing beta software, or any new software, and then reverting to that snapshot if the new software borks the computer is priceless and much faster and easier than relying on something like Acronis TI to go back to an earlier image.
--
"The same ferocity that our founders devoted to protect the freedom and independence of the press is now appropriate for our defense of the freedom of the internet. The stakes are the same: the survival of our Republic". Al Gore, The Assault on Reason | |
Grail Knight
Who Dares Wins
Premium
join:2003-05-31
Erie, PA | How much did you pay for VM Workstation Marilyn? | |
sagager
@comcast.net | reply to genewitch
Re: IPCop in VMWare: A How-to setup with just one NIC
Is it possible to do the configuration above on a Windows 2K3 Server with just ONE NIC and offer protection for a network with 5 PCs?
How would I configure the IPs for that single NIC and where do I point my clients IP to? | |
genewitch
join:2007-09-12
Klamath Falls, OR
·Charter Pipeline
·Suddenlink
·Cebridge Connections
| said by sagager :
Is it possible to do the configuration above on a Windows 2K3 Server with just ONE NIC and offer protection for a network with 5 PCs?
How would I configure the IPs for that single NIC and where do I point my clients IP to?
depends on what your internet is coming through. If you can do USB connection, then yes. if it requires ethernet, it might be possible, but i wouldn't hold my breathe over it. You'd really have to kludge stuff that couldn't be scripted, like unplugging computers from a switch that had the ethernet WAN on it or something. Basically, if you can free a NIC and still have internet access on your PC, my guide will work. | |
|
