0

I have a Raspberry Pi on which I operate DNS, IDS/IPS servers. The way it is connected in the network and configured is as follows:

Internet -> Router -> Pi (eth0)

Pi is further configured as DNS server on the router.

Now, fundamentally this is fine if I were merely using Pi as a DNS server and it also seems to serve limited purpose in its role as an IDS/IPS on the network (since all outbound traffic is routed through Pi).

But I don't think this is the best network positioning for the Pi especially when it does nothing to block an internal threat- one where a compromised machine attacks another local machine.

I would like to configure it as below with the DHCP on the router itself-

Internet -> Router -> Pi -> All machines on the network

What would that setting be in the router to route all packets only through the Pi? Without wanting to expose the Pi to the internet ahead of the router itself, I would like your views on how to best configure the Pi within the network.

0

Assuming that your router runs DHCP you would want to announce the PI as the Gateway for your network. Since your PI is already running other network-critical services you could also consider serving DHCP from the PI and disabling it on the router. Under the assumption that your router performs NAT your PI will not be visible from the internet.

| improve this answer | |
  • Would you have any suggestions on what DHCP server I could host? How would I check for NAT status on the Pi? – JAckBlack854 Jun 30 at 16:39
  • ISC-DHCP is simple to use and configure and widely used. You can check whether your PI is behind NAT (ie the router performing NAT!) if you use one of the many pages that tell you your public IP and compare it to the one assigned to the PI. For the sake of completeness: it might be possible that there is even another layer of NAT provided by your ISP and if you want you can also NAT on the PI using iptables. For your goal I dont think that either is necessary or problematic. – jvda Jun 30 at 22:18
  • Thanks a lot. I think I'm through with setting it up this way. All machines in the network show the same public IP. If I'm running an IPS/IDS, would it still make sense to run a firewall like ufw? I don't think I got a clear answer online. – JAckBlack854 2 days ago
  • This would depend on your IDS and its capabilities. Some IDS will merely give you additional insight into what filtering rules to install others will act as a more dynamic packet filter. My gut feeling is that you definitely want some form of packet filtering like ufw or iptables but to give you a complete answer more information would be needed. Also, it depends on if your router provides filtering, but assuming the PI performs NAT it would be more powerful to do the filtering there since the source IPs would not be masked. – jvda yesterday

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.