Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an extra desktop PC with 2 NICs that I'd like to use as my home firewall. I'll install a linux distro meant to be used as a firewall on the desktop.

I was thinking of placing it in between the cable modem and wireless:

modem <-> desktop_NIC1 <-> (firewall software) <-> desktop_NIC2 <-> wireless router <-> laptops, ipads, etc.

I figure it has to be here in order to filter traffic for my entire network, right? I see a downside in that the firewall won't know what machine to associate traffic with, since it's outside the router's network.

Is this correct? If not, how would you suggest doing it?

share|improve this question

migrated from Jan 6 '12 at 19:11

This question came from our site for system and network administrators.

For traffic going -out- on the firewall, it keeps track via NAT which machine asked for the connection, so when answer/response traffic returns, the firewall knows where to send it. To make services on an -inside- machine available to outside traffic you must open a port on the firewall.

It sounds like you might also have a router in front of the firewall, is the correct? Firewall might be unnecessary if there is already a router between your internal machines and the public networks/internet.

share|improve this answer

It looks correct from the way you describe... but I would suggest tweaking your "wireless router" and seeing if it has a "AP" or "Access Point" mode of some sort rather than trying to NAT/Route the traffic. You'll typically see performance gains on the wireless connections... as most wifi-router devices have very limited CPU... and routing/firewalling/NATing consumes what little CPU they have. Sometimes the easiest way to do that is by simply disabling the DHCP server inside of it... set a static LAN address inside your LAN... and plug one of the LAN ports into your LAN (and nothing into WAN).

As far as the firewall goes... it should know very well how to properly NAT traffic from the WAN to the LAN... otherwise it's not a very good software firewall.

share|improve this answer

You must log in to answer this question.