Re: Need Linux Router

On Monday, December 14, 2020 at 1:22:13 AM UTC-6, Grant Taylor wrote:
> On 12/10/20 11:00 PM, Leslie Rhorer wrote: 
> > I have a Debian Linux box on a network that needs to act as a simple 
> > router with a couple of extra features. Network A is on the main LAN 
> > interface. LAN A has an internet router whose address is set as the 
> > default gateway for the Linux box. Network B will be on a secondary 
> > LAN interface with a small handful of devices. I need all traffic 
> > between the two LANs to be freely forwarded,
> Okay. 
> 
> What route do the devices on LAN A used to reach the devices on LAN B? 

They will route from LAN A to LAN B through the router.

> Do they rely on the default gateway knowing to route traffic to LAN B 
> via your Debian box?

  Obviously I have to configure a specific route to LAN B on the gateway router, unless I employ NAT on the Linux box, so it could work that way, but the non-internet traffic between LAN A and LAN B is quite limited.  Putting a specific route on those boxes is no big deal.

>  Or do the devices on LAN A have a route to LAN B 
> via your Debian box and thus bypass the default gateway?

That is the intent.  Alternately, I could bridge LAN A and LAN B, rather than routing as separate subnets, or I could employ NAT.  All three are viable solutions.

> > but I need traffic from LAN B to the internet to be completely 
> > restricted to the hours between midnight and 5:30 AM. My client 
> > has a metered internet service that is free between those hours, 
> > but carries a fee outside those hours. 
> > 
> > I need the router not only to restrict all traffic to the internet 
> > between those hours, but to also log any attempts to engage in traffic 
> > outside those hours and to meter all traffic to and from the internet 
> > at all times on LAN B.
> Check out the "time" iptables match extension. man iptables-extensions 
> 
> With the time match, it should be simple enough to construct rule logic 
> to either allow the traffic. Logging can be done via another rule after 
> the previous rule allowing the traffic during the open window. Or you 
> could have another rule very similar to the first rule with the logic 
> inverted and routing the traffic to a log. 

I just want to log the traffic details, including the time, date, and IP addresses.


> Grant. . . . 

Thanks!