CentOS 8 as my new router

I had to rebuild my router, and these are my notes. Hopefully Iwon’t have to look all this up again, in the future. I really feel like I do this more then I should.

IPv4 Forwarding

With two NICs, you’re gonna need to forward some traffic. Firstthing first, forward those packets:

sudo sysctl -w net.ipv4.ip_forward=1
sudo vi /etc/sysctl.d/99-sysctl.conf # put the 'net' in this file

Static IP

Something I always seem to have to figure/google this.

Here is a template to edit: /etc/sysconfig/network-scripts/ifcfg-<interface>

TYPE="Ethernet"
PROXY_METHOD="none"
BROWSER_ONLY="no"
BOOTPROTO="none"
DEFROUTE="yes"
IPV4_FAILURE_FATAL="no"
IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_DEFROUTE="yes"
IPV6_FAILURE_FATAL="no"
IPV6_ADDR_GEN_MODE="stable-privacy"
NAME="<interface>"
DEVICE="<interface>"
ONBOOT="yes"
IPADDR=123.456.789.100
PREFIX=24
GATEWAY=123.456.789.1
DNS1=8.8.8.8

Fail2Ban

Being this is going to be in the internet, you should install fail2ban.

I have take these notes from here.

sudo dnf install -y epel-release fail2ban

Configure the local jail:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Now we need to make necessary changes in jail.local file to create ban rules. Editthis file in your favorite editor and make changes in [DEFAULT] section.

[DEFAULT]

# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator.
ignoreip = 127.0.0.1/8 192.168.1.0/24

# "bantime" is the number of seconds that a host is banned.
bantime = 60m

# A host is banned if it has generated "maxretry" during the last "findtime" seconds. as per below
# settings, 2 minutes
findtime = 5m

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

[ssh-iptables]

enabled = true
filter = sshd
action = iptables[name=SSH, port=22, protocol=tcp]
           sendmail-whois[name=SSH, dest=root, sender=fail2ban@example.com, sendername="Fail2Ban"]
logpath = /var/log/secure
maxretry = 3

Then enable and start the service:

sudo systemctl start fail2ban.service
sudo systemctl enable fail2ban.service

DNSMasq

A lot of these steps were taken from here. Thank you for writing it.

My router is going to be my local DNS server and my DHCP server,there are a ton of options out there, dnsmasq is the easiestto combine the two.

Install dnsmasq, enable and start it:

sudo dnf -y install dnsmasq
sudo systemctl start dnsmasq
sudo systemctl enable dnsmasq

DNS

Edit the configuration file:

sudo vi /etc/dnsmasq.conf

First thing you want to do is edit the listen address fordnsmasq. My network is 172.16.10.0 so my .1 is mymachine.

listen-address=127.0.0.1,172.16.10.1

Next, you want to edit the interface.

interface=ens224

Uncomment expand-hosts to help with the machines thatcome and go. Also set your domain to your domain. :)

expand-hosts
domain=asgharlabs.io

Define the upstream DNS servers:

server=8.8.8.8
server=8.8.4.4

This is how to get the DNS portion up, go ahead and get outof the file and run a sanity check:

sudo dnsmasq --test

dnsmasq uses your resolv.conf as your upstream DNS and yourlocal hosts file as your local DNS entry. Confirm they are setup correctly now.

If you need to make changes, NetworkManager will override yourchanges, so you need to make the file immutable:

sudo chattr +i /etc/resolv.conf
sudo chattr -i /etc/resolv.conf
sudo vi /etc/resolv.conf
sudo chattr +i /etc/resolv.conf
sudo lsattr /etc/resolv.conf

Now that everything is set up, we should restart dnsmasq and addthe firewall changes in:

sudo firewall-cmd --add-service=dns --permanent
sudo firewall-cmd --add-service=dhcp --permanent
sudo firewall-cmd --list-all

DHCP

Now that we have a working dnsmasq instance, lets set up the DHCP part.

Edit the dhcp-range in the /etc/dnsmasq.conf

dhcp-range=172.16.10.100,172.16.10.250,12h

Next, edit the dhcp-leasefile and make it authoritive by uncommenting:

dhcp-leasefile=/var/lib/dnsmasq/dnsmasq.leases
dhcp-authoritative

Restart dnsmasq and you should be good!

sudo systemctl restart dnsmasq

firewalld configuration

Now that you have DNS and DHCP running, you need to make sureyour router actually routes things.

You need to add masquerade to your firewalld chain.

sudo firewall-cmd --add-masquerade --permanent
sudo firewall-cmd --reload

OpenVPN configuration

Now that you have a working router, you probably want to VPNinto your network. Lets get OpenVPN up and running.

First thing you need to do is install git and pull down Nyr’s repofor automaticly configuring openvpn.

cd ~
sudo dnf -y install git
git clone https://github.com/Nyr/openvpn-install.git

Run the installer in the repository:

cd openvpn-install
sudo chmod +x openvpn-install.sh
./openvpn-install.sh

Follow the prompts…

EDIT: It seems I couldn’t get “across” my network, so I had to edit the /etc/openvpn/server/server.confwith the following:

push "route 172.16.10.0 255.255.255.0"

Now I can get to my internal network, which is what I was hoping for.

Congrats! You now have a working router/vpn machine!