Configurations

Late last year I was researching for platforms to experiment with so I can improve my networking security, NAT, firewall, load balancing, routing interoperability, IPv6 and VPN skill sets. So my search began for a Nortel Contivity router, a Cisco PIX/ASA and a Nortel Alteon 2424. All expensive options. But during my research I stumbled across Vyatta. A Free, open source router and firewall solution that utilizes a standard PCx86 hardware platform. With nothing to lose I downloaded the ISO image, burnt the CD and dusted off an eight year old PC and three 3Com PCI NICs I had laying around. After a quick install of the hardware and the Vyatta software I now had a fully functional 4 port Vyatta v6.1 Core router added into my lab.

To test my new Vyatta router I configured it to replace my Linksys WRT54G home router. It would be an exercise to test the simplicity, ease of use of the Vyatta CLI and to learn some additional key networking principles. It would also double as a functional test because I was loosing faith in my linksys router. To add a small level of complexity to my experiment I added a second vlan on the inside LAN and URL filtering.(see image)

Vyatta Configuration Checklist.

IP interfaces / VLANs

DHCP interface to receive address from TeleCo.

DHCP pools for inside hosts.

NAT

Web filtering

Telnet enabling

Observations and Conclusions:

I was able to research, design, configure and validate the PCx86 router configuration in less than 60 minutes.  Much less time than I expected it would take. The online resources are amazing. Between the Vyatta user forum, the Vyatta documentation (which is spectacular), other blogs and DIY youtube videos you can probably accomplish anything you want with this platform.  I had no hardware issues during the install and initial configuration. I was using an old ASUS AMD 1.67GHz system with 512mb of ram. The router software had no issue discovering the on-board NIC. For the other NICs Vyatta recommends using 10/100 3com PCI nics “the older the better”. Lucky for us PCI NICs grow on trees and you can buy them used online for under $5 each.

The biggest learning curve was learning the new CLI syntax and figuring out that you can’t “Tab key” to complete phrases.  The CLI itself is adequate but not as easy to use as you would find on a Cisco or Avaya/Nortel device. The CLI does have an “Open and Close” bracket structure that is a little annoying to look at. This became more of an annoyance as the complexity of my configuration grew. It sometimes became difficult to make sense of what I was looking at.  It is much cleaner to read if you export it, (see below)

As for value, v6.1 Core is free and the cost of my system is under $40. And the fact that you can configure IP routing (RIP, OSPF, BGP), IPv6, NAT, Stateful Firewalls, URL filtering, VPN, Load-balancing and QoS makes it very attractive.  I would certainly recommend the Core v6.1 platform for the home networking user, hobbyist, and the extremely small business owner.  I am impressed with my initial trial and will certainly continue to experiment with the product’s other features and blog again.

here is my final configuration that I used to replace my Linksys home router.

eth0 is the WAN interface.

eth1 and 2 are the inside LANs with their dedicated DHCP pools.

As well,  I experimented with blocking and allowing Webmail, Porn, gaming sites, facebook etc etc.

vyatta@vyatta:~$ show configuration
interfaces {
ethernet eth0 {
address dhcp
duplex auto
hw-id 00:0e:a6:a4:05:f1
smp_affinity auto
speed auto
}
ethernet eth1 {
address 192.168.2.1/24
duplex auto
hw-id 00:60:08:16:a8:0f
smp_affinity auto
speed auto
}
ethernet eth2 {
address 10.10.10.1/24
duplex auto
hw-id 00:a0:24:cb:7a:32
smp_affinity auto
speed auto
}
ethernet eth3 {
duplex auto
hw-id 00:50:ba:c6:be:34
smp_affinity auto
speed auto
}
loopback lo {
}
}
service {
dhcp-server {
disabled false
shared-network-name POOL1 {
authoritative disable
subnet 192.168.2.0/24 {
default-router 192.168.2.1
dns-server 192.168.2.1
domain-name Leroux.local1
lease 86400
start 192.168.2.50 {
stop 192.168.2.200
}
}
}
shared-network-name POOL2 {
authoritative disable
subnet 10.10.10.0/24 {
default-router 10.10.10.1
dns-server 10.10.10.1
lease 86400
start 10.10.10.105 {
stop 10.10.10.200
}
}
}
}
dns {
forwarding {
cache-size 150
listen-on eth1
listen-on eth2
name-server 8.8.8.8
name-server 8.8.8.4
}
}
nat {
rule 10 {
outbound-interface eth0
source {
address 192.168.2.0/24
}
type masquerade
}
rule 20 {
outbound-interface eth0
source {
address 10.10.10.0/24
}
type masquerade
}
}
telnet {
allow-root
port 23
}
webproxy {
cache-size 100
default-port 3128
listen-address 192.168.2.1 {
}
url-filtering {
squidguard {
allow-category webmail
auto-update {
update-hour 23
}
block-category malware
block-category porn
block-category warez
block-category proxy
block-category games
default-action allow
local-block facebook.com
local-block yahoo.com
local-block-url facebook.com
redirect-url http://www.google.com
}
}
}
}
system {
host-name vyatta
login {
user vyatta {
authentication {
encrypted-password ****************
}
level admin
}
}
ntp-server 0.vyatta.pool.ntp.org
package {
auto-sync 1
repository community {
components main
distribution stable
password ****************
url http://packages.vyatta.com/vyatta
username ""
}
}
syslog {
global {
facility all {
level notice
}
facility protocols {
level debug
}
}
}
time-zone GMT
}
vyatta@vyatta:~$