FC4 & Proxy & etc...

[fatal_error]

Hi,

before I begin I should explain that I'm familiar with setting up and maintaining smaller, heterogeneous networks (<= 10 hosts). I plan to "rearrange" my home network, just for the fun of playing with technology ;)

The avaiable boxes are:

- AMD 64 3500+, dual boot Windows XP and FC4 ("M1")
- AMD 2800+ Windows XP only ("M2")
- Intel Pentium 4 Go Laptop, FC4 ("M3")
- AMD TB 1.400 Mhz ("M4"), which is not installed with FC4 yet. This machine should serve as a router.

I see 2 possible setups:

Setup1: M4 is configured as a router, It will be the machine which directly connects to my DSL modem. iptables will be installed, NAT will be configured so there only will be one public IP. I also plan to install M4 as a little file server, and remote login via ssh should be configured.

Setup2: M4 will be configured as a proxy (using squid2). iptables, NAT, sshd etc will be installed and configured.

---------------------

Now comes the really *really* dumb question to which I was not able to find any answer:

Concerning my little home net with the setups as describes above, where's the difference between using either a proxy or a router? (leaving out the proxie's caching ability). I mean, when using lets say an HTTP proxy, ALL HTTP connections from well-configured clients must be routed over the proxy. Thats the case for ALL connections since there only is one public interface which is directly attached to the router !? I got a little confused, so any help/hints are appreciated!

greetz

[kg4cbk]

There is not that much difference. :)

A typical setup however would have the router/firewall dedicated to that purpose. The proxy system would sit behind the router/firewall and would in effect be the only device allowed to go directly to the Internet via the router. It simplifies your firewall rules and adds another choke point in your network which in theory should improve your security.

As a general rule you want to keep the number of packages/services that your firewall/router has on it to a minimum. Just enough to get the firewall/routing job done. This makes for a more secure system since you have less code running on it.

You may find that you have a little more control using a proxy than just iptables.

Hopefully that does not muddy the waters to much. :)

[fatal_error]

Thanks for the provided information, it now makes sense ;)