Some yummy stuff we just made (stir fry). Been a while. That beef got a real kick from all the veggies, ginger, and garlic.
Tuesday, December 23, 2008
Tastes as Good as It Looks
Some yummy stuff we just made (stir fry). Been a while. That beef got a real kick from all the veggies, ginger, and garlic.
Saturday, December 20, 2008
Solved: Sound Issue (Mic Problem) Fedora 10 on Dell Vostro 1400 Laptop
Intro
In my first net install of Fedora 10 to Dell Vostro 1400 pretty much everything worked out of the box. There was a major issue with sound. The ALSA is not recognizing the proper options for snd-hda-intel. Pretty happy with new setup as everything works now.
Solution
I did lots of searching and went through reboot several times. Finally, I settled at the following (still may not mean that it is the right setting 100%, but everything works).
First opent your terminal and run the following command:
su -c 'nano /etc/modprobe.d/modprobe.conf.dist'
You will need to enter your root password here.
Then add a line at the end of the /etc/modprobe.d/modprobe.conf.dist file:
options snd-hda-intel model=d82
Save the file and reboot the system. Once the system is restarted and you login, open the Volume Control:
In Volume Control window click on Preferences button. It will open several options that can be selected. I believe the critical ones here are Digital and Digital Input Source. Make sure you select those two.
Click on close and switch to Recording tab. You should see Digital in that tab.
Then select Switches Options tab. Here make sure that for Digital Input Source you select Digital Mic 1.
Click on Close and you should be ready to use your built-in mic. I tested it with Skype and everything works like it should.
Conclusion
This was the major issue I had with Fedora 10 on my Vostro 1400. I also pushed the MediaDirect button (aka Dell Vostro catastrophy button) and to my pleasant suprise it still worked. I was actually paying attention to that when I was installing Ubuntu before. I made a partition layout that worked out with MediaDirect (had to reinstall Windows and use Dell CDs to do that). This time I completely forgot to pay attention to it (started trusting these new Linux distros a lot). After I finished install I figured that I might have trouble with MediaDirect. I used autopartition with "Remove all Linux partitions" option. So far so good. Hope this works for you.
Update: An useful tip
Use following command:
aplay -L
to get an info on your chip. In this case it is ALC888 (Dell Vostro 200, not the laptop).
Then reference the following page:
http://www.mjmwired.net/kernel/Documentation/sound/alsa/ALSA-Configuration.txt
to get proper model name for your options snd-gda-intel line.
In my first net install of Fedora 10 to Dell Vostro 1400 pretty much everything worked out of the box. There was a major issue with sound. The ALSA is not recognizing the proper options for snd-hda-intel. Pretty happy with new setup as everything works now.
Solution
I did lots of searching and went through reboot several times. Finally, I settled at the following (still may not mean that it is the right setting 100%, but everything works).
First opent your terminal and run the following command:
su -c 'nano /etc/modprobe.d/modprobe.conf.dist'
You will need to enter your root password here.
Then add a line at the end of the /etc/modprobe.d/modprobe.conf.dist file:options snd-hda-intel model=d82
Save the file and reboot the system. Once the system is restarted and you login, open the Volume Control:
In Volume Control window click on Preferences button. It will open several options that can be selected. I believe the critical ones here are Digital and Digital Input Source. Make sure you select those two.
Click on close and switch to Recording tab. You should see Digital in that tab.
Then select Switches Options tab. Here make sure that for Digital Input Source you select Digital Mic 1.
Click on Close and you should be ready to use your built-in mic. I tested it with Skype and everything works like it should.Conclusion
This was the major issue I had with Fedora 10 on my Vostro 1400. I also pushed the MediaDirect button (aka Dell Vostro catastrophy button) and to my pleasant suprise it still worked. I was actually paying attention to that when I was installing Ubuntu before. I made a partition layout that worked out with MediaDirect (had to reinstall Windows and use Dell CDs to do that). This time I completely forgot to pay attention to it (started trusting these new Linux distros a lot). After I finished install I figured that I might have trouble with MediaDirect. I used autopartition with "Remove all Linux partitions" option. So far so good. Hope this works for you.
Update: An useful tip
Use following command:
aplay -L
to get an info on your chip. In this case it is ALC888 (Dell Vostro 200, not the laptop).Then reference the following page:
http://www.mjmwired.net/kernel/Documentation/sound/alsa/ALSA-Configuration.txt
to get proper model name for your options snd-gda-intel line.
Experience with Fedora 10 on Dell Vostro 1400
Intro
Since I was in a mood for experimenting and already messed up my Ubuntu setup. I decided to give Fedora 10 a try. I ran network install CD (5 MB ISO download). It took around an hour or two to perform a desktop install with my DSL connection.
On a first look things look superb. Fedora 10 is cosmetically very nicely done. I was extremely happy with the fact that most of the things worked out of the box:
Sound interface (HDA Intel STAC92xx) appears to be working but not properly recognized as to which volume and properties options to use. With some playing with the controls I got the internal mic to work but with extremely low volume. Mic boost option is never to be found.
I found a variety of comments on the subject: one to edit the modprobe.conf.dist file:
su -c 'nano /etc/modprobe.d/modprobe.conf.dist'
and add the following to the end of the file:
options snd-hda-intel model=dell-stack3
I actually tried all kind of parameters here but I did not get it to work :(
I think the option "model=dell-d82" might be the closest.
On the positive side, analog mic worked. I might keep Fedora on the laptop little longer and use external mic with my Skype.
Bluetooth
Worked out of the box. I have that bult-in interface. The issue I am having with my mouse is that it is nicely connected first time, but Fedora is not connecting to it next time. I had to manually remove it from list of Bluetooth devices and then try to connect it. Not very smooth.
Office and Productivity
I really like the fact that OpenOffice.org3 is pre-installed.
Very fast load and expected better compatibility with MS Office. I installed Adobe Reader, TrueType fonts, Opera, and Skype with no big problems.
Java and Nebeans
I do program i Java and thus prefer to have Sun's JDK. Installed it into /usr/local folder with no issues. Had to adjust alternatives for java command. Downloaded and installed Netbeans 6.5. Works pretty good.
Overall
Spent lots of time trying to configure proper sound device. Sound issue with volume and properties controls turns me off since in Ubuntu 8.04 that worked out of box. I believe in Ubuntu 7.10 a simple change in the model options helped easily, too. Another thing is the stubborn Bluetooth. I did not play with that enough to judge. Might be a minor thing. Due to a fact I can use analog mic I might keep Fedora on for a while. I like the eyecandy and responsivness. It is also a fast boot. Will follow up on the Bluetooth mouse. If you have any input on the sound and internal mic, please reply.
References
http://www.fedoraproject.org
http://www.howtoforge.com/the-perfect-desktop-fedora-10
Since I was in a mood for experimenting and already messed up my Ubuntu setup. I decided to give Fedora 10 a try. I ran network install CD (5 MB ISO download). It took around an hour or two to perform a desktop install with my DSL connection.
On a first look things look superb. Fedora 10 is cosmetically very nicely done. I was extremely happy with the fact that most of the things worked out of the box:- ethernet
- wireles ethernet
- bluetooth, some issues with reconnecting/pairing.
- webcam
- built-in touchpad
- hotkeys
- sound, well almost.
- Dell mediadirect button (still afrad to touch)
Sound interface (HDA Intel STAC92xx) appears to be working but not properly recognized as to which volume and properties options to use. With some playing with the controls I got the internal mic to work but with extremely low volume. Mic boost option is never to be found.
I found a variety of comments on the subject: one to edit the modprobe.conf.dist file:
su -c 'nano /etc/modprobe.d/modprobe.conf.dist'
and add the following to the end of the file:
options snd-hda-intel model=dell-stack3
I actually tried all kind of parameters here but I did not get it to work :(
I think the option "model=dell-d82" might be the closest.
On the positive side, analog mic worked. I might keep Fedora on the laptop little longer and use external mic with my Skype.
Bluetooth
Worked out of the box. I have that bult-in interface. The issue I am having with my mouse is that it is nicely connected first time, but Fedora is not connecting to it next time. I had to manually remove it from list of Bluetooth devices and then try to connect it. Not very smooth.
Office and Productivity
I really like the fact that OpenOffice.org3 is pre-installed.
Very fast load and expected better compatibility with MS Office. I installed Adobe Reader, TrueType fonts, Opera, and Skype with no big problems.Java and Nebeans
I do program i Java and thus prefer to have Sun's JDK. Installed it into /usr/local folder with no issues. Had to adjust alternatives for java command. Downloaded and installed Netbeans 6.5. Works pretty good.
Overall
Spent lots of time trying to configure proper sound device. Sound issue with volume and properties controls turns me off since in Ubuntu 8.04 that worked out of box. I believe in Ubuntu 7.10 a simple change in the model options helped easily, too. Another thing is the stubborn Bluetooth. I did not play with that enough to judge. Might be a minor thing. Due to a fact I can use analog mic I might keep Fedora on for a while. I like the eyecandy and responsivness. It is also a fast boot. Will follow up on the Bluetooth mouse. If you have any input on the sound and internal mic, please reply.
References
http://www.fedoraproject.org
http://www.howtoforge.com/the-perfect-desktop-fedora-10
Friday, December 19, 2008
Failed to Install CentOS 5.2 on Dell Vostro 1400
Intro
I had some good experience with installing CentOS as a desktop on couple of older machines. Will post the notes from that experience. I decided to go ahead and try the setup on my Dell Vostro 1400.
Not much luck
I ran the network setup and the whole process went smoothly up to the first boot. The laptop did boot and went into the final installation steps (adding user, sound, firewall, etc.). The setup failed to detect sound interface (which was not a problem for Ubuntu 7.10 and 8.04). I went ahead and did the first update.
Brief first impression
There are several things that did not work:
Conclusion
I pretty much gave up on the sound issue. At this time would not recommend unless you want to play with it. I really love CentOS and the whole concept of having stable distro. It could happen that the chipset on Vostro 1400 is too new for it. I am havin g a pretty good experience with CentOS 5.2 as desktop on a Dell Dimension 3000 (P4 with 512M). Any input on CentOS use on Vostro laptops would be appreciated.
I had some good experience with installing CentOS as a desktop on couple of older machines. Will post the notes from that experience. I decided to go ahead and try the setup on my Dell Vostro 1400.
Not much luck
I ran the network setup and the whole process went smoothly up to the first boot. The laptop did boot and went into the final installation steps (adding user, sound, firewall, etc.). The setup failed to detect sound interface (which was not a problem for Ubuntu 7.10 and 8.04). I went ahead and did the first update.
Brief first impression
There are several things that did not work:
- sound card
- wireless network not recognized
- bluetooth interface (was not sure how to tell it to look for my bluetooth mouse)
- did not try webcam, which I was hoping to test it with gspca driver, but other issues turned me off.
Conclusion
I pretty much gave up on the sound issue. At this time would not recommend unless you want to play with it. I really love CentOS and the whole concept of having stable distro. It could happen that the chipset on Vostro 1400 is too new for it. I am havin g a pretty good experience with CentOS 5.2 as desktop on a Dell Dimension 3000 (P4 with 512M). Any input on CentOS use on Vostro laptops would be appreciated.
Being a Vampire....
Could not sleep well last night. Caught a cold or something. Got up around 4:00am. Popped in a DVD from Netflix that was sitting on my shelf for more than a month ("She is the one"). A romantic comedy, a pretty decent one. Kid started sleep walk around 5. Two of them ended up pushing me out of sofa..
Pretty calming effect watching them asleep... recuperating energy for tomorrow's ceiling-walk.
Pretty calming effect watching them asleep... recuperating energy for tomorrow's ceiling-walk.In Search for Perfect Bread (part 7)
This is kind of a sequel of the "part 6". Everything the same except the yeast. Finally tried the same approach with the "regular" not bread machine yeast. It grew like crazy in the dough cycle. Before baking, I punched it down and did some hand kneading for few minutes. Then left it in cold oven to rise again for about 50 minutes. After that, you pull it out and let on your counter top while you pre-heat the oven to 380-400F. Baking took around 25-30 minutes. Last minute or so I did the broil (550F top). This batch was perfect. Nothing wrong there and it tasted right.
Ćurovac - Tara's Canyon Highest Point
Took this picture more than ten years ago. This is a look at the river Tara from the highest point of its canyon. Beautiful mountain Durmitor is. Feeling a bit nostalgic there. The photo surfaced back from some of my old CD's. Hope I will go visit that place some time soon.
Thursday, December 18, 2008
Sinclair QL and Amstrad CPC464
These are two really cool machines that are also part of the collection but have not tried them yet.Sinclair QL was Sinclair's new concept machine that was very advanced at the time. It had 68008 CPU, which was internally 32-bit and externally 8-bit. Motorola 68000 family was very popular for mini systems and had a very powerful instruction set. QL came with BASIC and I believe some built in applications. Its kernel supported multi-tasking. Very cool concept and piece of technology at the time. However, from what I heard the first version of ROM was buggy and there are delays in actual release. It also had infamous microdrive tape system that was not very reliable. Soon, Atari ST and Amiga computers dominated MC 68000 arena. On higer pricing there was Machintosh 128K and 512K. So QL never really made it. One peculiar detail is that the guy who started Linux movement and made Linux (Linus Torvalds) had one of these.
Amstrad CPC464 with built-in tape was a very nice Z80 based system. Amstrad was famous for their integrated and inexpensive systems (hi-fi, audio, computers). They eventually bought Sinclair and they were making late Spectrum versions. CPC464 (there were also versions with built-in 3" floppy, CPC664 and CPC6128) was one of the fastest Z80 8-bit systems. It also had a very nice Locomotive BASIC that was really fast. I remember running some benchmark programs writen in BASIC on my neighbouor's CPC464 and my brothers IBM PC XT clone (4.77MHz 8088) and CPC464 was faster. Also had nice graphics and Amstrad was offering decent monochrome and color monitors. Though, it was a very nice system it also showed little bit late. It was a popular system, but soon people had cheap 16/32 bit systems from Atari and Commodore (ST and Amiga).
Timex Sinclair 2068 (US version of ZX Spectrum)
I got this on eBay some time ago. Still did not have time to test if it runs. I am missing an original power supply and the ones that I found to match with the voltage level did not have a good jack. Never got time to made work on that. When I was a kid I never hear of this home computer. In Europe, Sinclair's ZX Spectrum ruled at the time. Timex Sinclair was selling stuff in the US. I believe this one is fully compatible with ZX Spectrum 48K, but might have an audio chip that was not available in the original Specy.
Wednesday, December 17, 2008
Cambridge (Sinclair) Z88
This one was very cool and promising at the time, but little bit too late. It was a Z80 based "laptop" that sir Clive Sinclair though he could introduce to Europe and world. It had a very nice screen and some cool built-in applications (very much like Palm or or cell-phone organizers). I do not particularly care for its rubberized keyboard (much nicer keyboards are on TRS-80 models 100 and 102), but it has that thin and cool look of a finely designed machine.However, the technology was already leaning towards 16-bit micros and market already had similar machines. Example is Radio Shack's TRS-80 models 100 and 102 (above). Most of the people in the US used those as "laptops" of that era. Believe it or not some people use it even today for its nice keyboard and simplicity.
This particular Z88 has a problem that it would power on only after hard reset. Regular turn on and off do not work. If somebody has any pointer on how to solve that issue please let me know.
Texas Instruments 99 (Silver)
This is a cool looking "old timer" from 80s. Not very rare to get a hold, but they are becoming dinosaurs as well. It was fairly slow one even though claimed to be first 16-bit CPU micro. This one needed some cleaning and the keyboard did not work until I wiped inner membranes with rubbing alcohol. To load software on it you either use ROM cartridges or tapes. Third option was to type in your own BASIC software. Did not have time to play much. My 4-year old one liked the math cartridge. Kept him busy for an hour or so.
Saturday, December 13, 2008
Fiat 124 (Lada VAZ 2101) 1/43
I got this on eBay as Fiat 124. It is completely the same as Lada VAZ 2101. This was very popular and nice car back in late 70s and early 80s. Still some on the road there.
Fiat 128 (Norev 1/43)
This is closest to Zastava 101 or Yugo Scala that was very popular in former Yugoslavia. Zastava was also making Zastava 128 in late 80s early 90s, which was funny since Fiat 128 was European car of the year in 1969 (or 1968).
Then and Now...
My best guess is that this could be 1992. That is my first PC based on Intel 386DX 40MHz with 4MB RAM, 1.2MB 5.25" floppy, and I believe 500MB hard drive. I am thinking it ran DOS 3.30 at the time, but I pretty much went over all early DOS and Windows versions... I gave up my Atari 520ST and old Zastava 101 (earlier, but better version of the worst car Yugo) for that white box. Under that cloth is 9-pin Epson LX800.
This is was November. My dad got a nice AMD 64-bit dual core PC. Only purpose of this machine is to run Skype and local news from time to time. Dad had some issues with Windows freezing when Skype video was on. I put Ubuntu 8.04 on that thing and made a pretty simple desktop setup (one click to run Skype). Everything runs like it is supposed to.I am missing the point now... Cool fact I found these pics of me in same spot... then and now...
Snow in Central Texas
First time in 10 years I see snow here. There was actually more than in this picture, but I spent the best part of it at work. The very next day we had like 25 Centigrades (70s Fahrenheit).Another reference on local news:
http://www.kbtx.com/home/headlines/35943234.html
Friday, December 12, 2008
pfSense Makes Perfect Sense
Intro
I started playing with firewall/router distros recently. I tried IPCop, Smoothwall, and pfSense. I learned that there are others, but I was primarily interested in one I can run on an old PC. I have an access to few old PCs and I liked the idea to build a nice firewall with cool features with a hardware I can get for free. I was almost ready to throw some of these PCs away.
Old Setup
I have been using Linksys router BEFSR41 together with Westell 6100 DSL modem. I use dynamic Verizon Internet connection. I had my Westell 6100 set in Bridge mode with DHCP server off and I had Linksys BEFSR41 set to do MAC address cloning (got the addy from Westell). I believe the only reason I needed to clone MAC address is to avoid 2-hour wait needed for Verizon to release my dynamic IP. From what I read Verizon ties the dynamic IP to your hardware MAC address so if you change it you need to wait around two hours to obtain new IP.
http://tp0x45.blogspot.com/2008/04/westell-6100-and-linksys-befsr41-router.html
New Setup
The idea is to combine my Westell 6100 DSL modem in bridge mode with an older PC that will have three network cards dedicated to following:
(Click on picture to enlarge)
Preparing the PC
I decided on using a nice old 500MHz Pentium 2 I had laying around. It had 96MB RAM that I expanded to 192MB. It has 10GB hard drive that is more than enough for this setup. It has an on-board Ethernet interface and I added two additional Ethernet cards to make a total of three Ethernet ports. Also, used the opportunity to vacuum clean fans and CPU cooler.
Another thing to consider is to remove all the hardware you do not need such as sound card, modem, floppy drive (unless you need it for backup), even CD ROM drive can be disconnected after the installation. In BIOS setup a good idea is to change power option to "always on" so if after power loss the firewall machine will boot up again.
Installing pfSense
The setup was little bit more involving but very intuitive. It is BSD based but basically to install it and use it you do not need to warry if you are not familiar with BSD. You download pfSense ISO file, then burn a CD. You booth the prepared machine with that CD and it boots BSD with a text based menu screen. Option 99 lets you install pfSense to the hard drive. It has a very cool feature for testing which NIC is which by letting you connect Ethernet cable to each device and pfSense setup would tell you which card is UP or DOWN. That helped me to easily dedicate connections to WAN, LAN, and OPT1 (which I later renamed to DMZ). Part of the setup is also to designate IP addresses to your interfaces. For WAN I selected DHCP, for LAN I selected 192.168.0.1, for OPT1 I put 192.168.2.1 (please refer to private addressing RFC 1918). You can also enable DHCP server for the LAN subnet here. After hard drive install is done, you reboot the PC without the CD, connect to it via LAN interface with your laptop or other desktop PC. Please note that this other PC will need an IP address on the same subnet 192.168.0.xx that can be set as static with 192.168.0.1 as gateway and DNS address or set to obtain the dynamic IP from the pfSense machine (connection is pfSense PC-->switch hub-->that other PC). pfSense configuration and setup web interface is accessed via http://192.168.0.1.
Please check the following link for more info on initial setup:
http://doc.pfsense.org/index.php/Installing_pfSense
Configuring pfSense
The first screen you get when you access http://192.168.0.1 is actually a setup wizard. It will walk you through the the initial setup of your pfSense firewall. A very nice guide is given at:
http://doc.pfsense.org/smiller/Install_Guide.htm
Please follow those instructions. The only difference I made is used name DMZ instead of WiFi as given in the guide. The guide assume OPT1 being used as WiFi subnet to be connected wireless access point. I dedicated OPT1 to my DMZ subnet with the same idea of DMZ PCs (likewise the WiFi PCs in the guide) not being able to access my LAN subnet.
If needed you can restart the setup wizard again by selecting option System->Setup wizard
Please note that in one of the first steps in the wizard you can set the MAC spoofing address. In my case with Verizon that enabled me to connect to Internet immediately after configuration. I connected pfSense box (PC) via WAN port to my Westell DSL modem. My Westell was already configured in bridge mode with DHCP off. LAN port of the pfSense box is now connectoed to a switch hub and all my PCs are now connected to LAN subnet. One of the PCs with Windows XP running Apache and Tomcat I connected to OPT1 (DMZ) port directly. I set its addres to static 192.168.2.99 (please note that DMZ interface addres was previously set to 192.168.2.1) and gateway address I set to 192.168.2.1. Turned everything on and my pfSense box now obtained an IP WAN address directly via Verizon's DHCP. My LAN PCs were all on 192.168.0.xx subnet. Everything worked like charm.
Port Forwarding
To do proper port forwarding one should consult pfSense documentation. For forwarding ports such as 80 (HTTP) or 5900 (VNC) the best way is to go through Firewall->NAT menu:
When you are there select the button with "+" sign to add Port Forward. This opens a detailed form:
Here you can select external port range (in this case VNC port 5900), NAT IP, which is the PC where you are forwarding, and local port address on the destination IP. Another important thing is to keep selected option for Auto-add firewall rule to permit traffic as defined.
Click on Save button and in the new screen click on "Apply changes"
Displayed sequence enabled port forwarding of VNC to my PC on DMZ. Same steps would be needed for example to forward HTTP (port 80). You can check Firewall->Rules menu to erify newly added rule:
Now if you locally try forwarding from a PC on your LAN subnet. It will not work. You need to go to System->Advanced menu and then uncheck "Disable NAT Reflection"
That would let you test your port forwarding from a machine that resides on your pfSense LAN subnet.
DNS Forwarding
Very cool feature. In this example I used it to block Google Talk.
I basically told it to forward DNS requests to 127.0.0.1 address. This in turn disabled Google Talk without disabling Gmail.
Maintenance
Several system maintenance functions are available.
You can also enable SSH access and use your LAN computers to access pfSense box via SSH terminal. I used this only when I wanted to delete some logs. Generally you do not need that.
UPnP Service
I enabled this since I read it is needed for MSN. I am actually not fully sure if I needed, but my understanding is that it could speed up video and file transfer in MSN. Did not have a good chance to test and confirm this. MSN worked (including video and file transfer) without it. Any comment/feedback on this would be appreciated.
Additional Features (Packages)
Several features are available via packages. Examples are web proxy,IM proxy with logging (IMspector), web filter, etc. You can go to System->Packages and all you need is one click to install certain package/feature. So far, I tried IMspector for IM proxy and IM logging.
Other Firewall Distros
I first tried IPCop. Actually I ran it on even older PC with only 32MB RAM with 8GB hard drive. It is a great Firewall distro with lots of fancy features. Me being a newbie, I did not understand all of the features from the beginning but spending some time on rading and playing with it gave me a pretty good idea on what can be done. Really loved the fact I ran it on a very small and slow PC without any problems. At this time I did not use Westell in bridged mode so I did not need to spoof MAC address with IPCop. I am not sure if it has that option. Later, I realized I needed it. However, I loved the fact it ran on that old PC with only 32MB RAM. Will definitively play with IPCop more.
I tried Smoothwall, which is older or younger cousin (forked project) to IPCop. Very nice interface and lots of cool features. Drawback was the fact that I needed to "hack" it to clone MAC address. Had to login to the machine and edit "/etc/rc.d/rc.netaddress.up" script to include an ifconfig line that would change MAC address. It worked with no problems, but I believe that should be accessible through that nice web interface. This distro I ran on the PC I prepared (P2 500MHz 192MB RAM and 10G HDD). Another issue besides missing MAC "spoofing" is that my MSN video did not work. It could be related to squid web proxy, but I did not spend too much time on it.
Conclusion
Definitively a good experience. My network setup is now much better organized for having a secure LAN subnet and my web server on DMZ. Another thing is that my Internet connection appears to be much faster than with Linksys BEFSR41. Have lots of features to try and play with.
A very good use for an old PC you might have laying around. I actually got few machines like this that are in very good condition, just not usable for everyday desktop use.
References
http://www.pfsense.org
http://www.distrowatch.com
http://doc.pfsense.org/index.php/Installing_pfSense
http://doc.pfsense.org/smiller/Install_Guide.htm
http://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense%3F
http://www.ipcop.org
http://www.smoothwall.org
http://tp0x45.blogspot.com/2008/04/westell-6100-and-linksys-befsr41-router.html
http://tp0x45.blogspot.com/2008/11/ipcop-14-linux-based-firewall.html
I started playing with firewall/router distros recently. I tried IPCop, Smoothwall, and pfSense. I learned that there are others, but I was primarily interested in one I can run on an old PC. I have an access to few old PCs and I liked the idea to build a nice firewall with cool features with a hardware I can get for free. I was almost ready to throw some of these PCs away.
Old Setup
I have been using Linksys router BEFSR41 together with Westell 6100 DSL modem. I use dynamic Verizon Internet connection. I had my Westell 6100 set in Bridge mode with DHCP server off and I had Linksys BEFSR41 set to do MAC address cloning (got the addy from Westell). I believe the only reason I needed to clone MAC address is to avoid 2-hour wait needed for Verizon to release my dynamic IP. From what I read Verizon ties the dynamic IP to your hardware MAC address so if you change it you need to wait around two hours to obtain new IP.
http://tp0x45.blogspot.com/2008/04/westell-6100-and-linksys-befsr41-router.html
New Setup
The idea is to combine my Westell 6100 DSL modem in bridge mode with an older PC that will have three network cards dedicated to following:
- WAN connection to Verizon via bridged Westell 6100
- LAN subnet connection to switch hub where most of the PCs will be connected
- DMZ subnet connection to PCs that will run server applications such as web server, database, or VNC. DMZ subnet will have no (or very limited) access to LAN subnet.
(Click on picture to enlarge)Preparing the PC
I decided on using a nice old 500MHz Pentium 2 I had laying around. It had 96MB RAM that I expanded to 192MB. It has 10GB hard drive that is more than enough for this setup. It has an on-board Ethernet interface and I added two additional Ethernet cards to make a total of three Ethernet ports. Also, used the opportunity to vacuum clean fans and CPU cooler.
Another thing to consider is to remove all the hardware you do not need such as sound card, modem, floppy drive (unless you need it for backup), even CD ROM drive can be disconnected after the installation. In BIOS setup a good idea is to change power option to "always on" so if after power loss the firewall machine will boot up again.
Installing pfSense
The setup was little bit more involving but very intuitive. It is BSD based but basically to install it and use it you do not need to warry if you are not familiar with BSD. You download pfSense ISO file, then burn a CD. You booth the prepared machine with that CD and it boots BSD with a text based menu screen. Option 99 lets you install pfSense to the hard drive. It has a very cool feature for testing which NIC is which by letting you connect Ethernet cable to each device and pfSense setup would tell you which card is UP or DOWN. That helped me to easily dedicate connections to WAN, LAN, and OPT1 (which I later renamed to DMZ). Part of the setup is also to designate IP addresses to your interfaces. For WAN I selected DHCP, for LAN I selected 192.168.0.1, for OPT1 I put 192.168.2.1 (please refer to private addressing RFC 1918). You can also enable DHCP server for the LAN subnet here. After hard drive install is done, you reboot the PC without the CD, connect to it via LAN interface with your laptop or other desktop PC. Please note that this other PC will need an IP address on the same subnet 192.168.0.xx that can be set as static with 192.168.0.1 as gateway and DNS address or set to obtain the dynamic IP from the pfSense machine (connection is pfSense PC-->switch hub-->that other PC). pfSense configuration and setup web interface is accessed via http://192.168.0.1.
Please check the following link for more info on initial setup:
http://doc.pfsense.org/index.php/Installing_pfSense
Configuring pfSense
The first screen you get when you access http://192.168.0.1 is actually a setup wizard. It will walk you through the the initial setup of your pfSense firewall. A very nice guide is given at:
http://doc.pfsense.org/smiller/Install_Guide.htm
Please follow those instructions. The only difference I made is used name DMZ instead of WiFi as given in the guide. The guide assume OPT1 being used as WiFi subnet to be connected wireless access point. I dedicated OPT1 to my DMZ subnet with the same idea of DMZ PCs (likewise the WiFi PCs in the guide) not being able to access my LAN subnet.
If needed you can restart the setup wizard again by selecting option System->Setup wizard
Please note that in one of the first steps in the wizard you can set the MAC spoofing address. In my case with Verizon that enabled me to connect to Internet immediately after configuration. I connected pfSense box (PC) via WAN port to my Westell DSL modem. My Westell was already configured in bridge mode with DHCP off. LAN port of the pfSense box is now connectoed to a switch hub and all my PCs are now connected to LAN subnet. One of the PCs with Windows XP running Apache and Tomcat I connected to OPT1 (DMZ) port directly. I set its addres to static 192.168.2.99 (please note that DMZ interface addres was previously set to 192.168.2.1) and gateway address I set to 192.168.2.1. Turned everything on and my pfSense box now obtained an IP WAN address directly via Verizon's DHCP. My LAN PCs were all on 192.168.0.xx subnet. Everything worked like charm.Port Forwarding
To do proper port forwarding one should consult pfSense documentation. For forwarding ports such as 80 (HTTP) or 5900 (VNC) the best way is to go through Firewall->NAT menu:
When you are there select the button with "+" sign to add Port Forward. This opens a detailed form:
Here you can select external port range (in this case VNC port 5900), NAT IP, which is the PC where you are forwarding, and local port address on the destination IP. Another important thing is to keep selected option for Auto-add firewall rule to permit traffic as defined.
Click on Save button and in the new screen click on "Apply changes"
Displayed sequence enabled port forwarding of VNC to my PC on DMZ. Same steps would be needed for example to forward HTTP (port 80). You can check Firewall->Rules menu to erify newly added rule:
Now if you locally try forwarding from a PC on your LAN subnet. It will not work. You need to go to System->Advanced menu and then uncheck "Disable NAT Reflection"
That would let you test your port forwarding from a machine that resides on your pfSense LAN subnet.DNS Forwarding
Very cool feature. In this example I used it to block Google Talk.
I basically told it to forward DNS requests to 127.0.0.1 address. This in turn disabled Google Talk without disabling Gmail.Maintenance
Several system maintenance functions are available.
You can also enable SSH access and use your LAN computers to access pfSense box via SSH terminal. I used this only when I wanted to delete some logs. Generally you do not need that.
UPnP Service
I enabled this since I read it is needed for MSN. I am actually not fully sure if I needed, but my understanding is that it could speed up video and file transfer in MSN. Did not have a good chance to test and confirm this. MSN worked (including video and file transfer) without it. Any comment/feedback on this would be appreciated.
Additional Features (Packages)
Several features are available via packages. Examples are web proxy,IM proxy with logging (IMspector), web filter, etc. You can go to System->Packages and all you need is one click to install certain package/feature. So far, I tried IMspector for IM proxy and IM logging.
Other Firewall Distros
I first tried IPCop. Actually I ran it on even older PC with only 32MB RAM with 8GB hard drive. It is a great Firewall distro with lots of fancy features. Me being a newbie, I did not understand all of the features from the beginning but spending some time on rading and playing with it gave me a pretty good idea on what can be done. Really loved the fact I ran it on a very small and slow PC without any problems. At this time I did not use Westell in bridged mode so I did not need to spoof MAC address with IPCop. I am not sure if it has that option. Later, I realized I needed it. However, I loved the fact it ran on that old PC with only 32MB RAM. Will definitively play with IPCop more.
I tried Smoothwall, which is older or younger cousin (forked project) to IPCop. Very nice interface and lots of cool features. Drawback was the fact that I needed to "hack" it to clone MAC address. Had to login to the machine and edit "/etc/rc.d/rc.netaddress.up" script to include an ifconfig line that would change MAC address. It worked with no problems, but I believe that should be accessible through that nice web interface. This distro I ran on the PC I prepared (P2 500MHz 192MB RAM and 10G HDD). Another issue besides missing MAC "spoofing" is that my MSN video did not work. It could be related to squid web proxy, but I did not spend too much time on it.
Conclusion
Definitively a good experience. My network setup is now much better organized for having a secure LAN subnet and my web server on DMZ. Another thing is that my Internet connection appears to be much faster than with Linksys BEFSR41. Have lots of features to try and play with.
A very good use for an old PC you might have laying around. I actually got few machines like this that are in very good condition, just not usable for everyday desktop use.
References
http://www.pfsense.org
http://www.distrowatch.com
http://doc.pfsense.org/index.php/Installing_pfSense
http://doc.pfsense.org/smiller/Install_Guide.htm
http://doc.pfsense.org/index.php/How_can_I_forward_ports_with_pfSense%3F
http://www.ipcop.org
http://www.smoothwall.org
http://tp0x45.blogspot.com/2008/04/westell-6100-and-linksys-befsr41-router.html
http://tp0x45.blogspot.com/2008/11/ipcop-14-linux-based-firewall.html
Subscribe to:
Posts (Atom)
