How can I use an extra desktop as a basic home firewall?

Question

I have an extra desktop PC with 2 NICs that I'd like to use as my home firewall. I'll install a linux distro meant to be used as a firewall on the desktop.

I was thinking of placing it in between the cable modem and wireless:

modem <-> desktop_NIC1 <-> (firewall software) <-> desktop_NIC2 <-> wireless router <-> laptops, ipads, etc.

I figure it has to be here in order to filter traffic for my entire network, right? I see a downside in that the firewall won't know what machine to associate traffic with, since it's outside the router's network.

Is this correct? If not, how would you suggest doing it?

Answer 1

For traffic going -out- on the firewall, it keeps track via NAT which machine asked for the connection, so when answer/response traffic returns, the firewall knows where to send it. To make services on an -inside- machine available to outside traffic you must open a port on the firewall.

It sounds like you might also have a router in front of the firewall, is the correct? Firewall might be unnecessary if there is already a router between your internal machines and the public networks/internet.

Answer 2

It looks correct from the way you describe... but I would suggest tweaking your "wireless router" and seeing if it has a "AP" or "Access Point" mode of some sort rather than trying to NAT/Route the traffic. You'll typically see performance gains on the wireless connections... as most wifi-router devices have very limited CPU... and routing/firewalling/NATing consumes what little CPU they have. Sometimes the easiest way to do that is by simply disabling the DHCP server inside of it... set a static LAN address inside your LAN... and plug one of the LAN ports into your LAN (and nothing into WAN).

As far as the firewall goes... it should know very well how to properly NAT traffic from the WAN to the LAN... otherwise it's not a very good software firewall.