For those that don’t already know, smoothwall is a very slick and easy way to setup a firewall/nat/dhcp server (and more) at home or in a small office
very quickly even on old computer equipment. I have used Smoothwall 1.0 in the past and liked its features (although at the time, I did have a problem with Snort failing to start after I updated the software with some fixes…). It served on an old Pentium II 400mhz machine with two NICs inside (network cards). One was the ‘green’ interface (more about that later) and the other was the ‘red’ interface. I used that setup for quite a few months, mainly because I wanted to see what alternatives there were to hardware based firewalls (such as DLink gateways/firewalls) that I had been using.
Why did I decide to give Smoothwall a chance ? well quite simply, my dlink firewall/nat/simple router couldnt handle large traffic, and when confronted
with that, would die, stone dead and the only way to fix it was to disconnect the power from it and restart. That’s just about ok if you are beside it, but if you are in Ireland (which I was) and it is in Sweden, then whatever you are hosting is down for as long as you are away.
Smoothwall was recommended to me by a friend who used it to secure his
machines on his home lan, some running game servers, some ftp server and
web. He said it worked great and I should try it, so I did, and dove right
in and used it for approximately 5 months without any problem except for the
afore mentioned SNORT (intrusion detection system) which never ever
restarted itself after I updated smoothwall. I then moved house in September
of last year and brought my smoothwall computer with me, I couldnt get it to
pick up an ip address from my new broadband provider (ADSL based) so I gave
up and re-installed the dlink hardware firewall.
Many months have since past and my interest in smoothwall has re-emerged
with the release of Smoothwall Express 2.0 Final. The software is available
for download right now here, just download the ISO that suits you (I chose the one with inbuilt manuals and it was only 45.5 MB in size) and burn the iso to a CD.
Once you have burned the cd, the next thing you need is a suitable computer
to install it on, I’d suggest something old as the computer itself will only
serve one purpose, running smoothwall. The computer will not need a
keyboard/mouse or monitor once you have it all installed and setup
correctly, but it does require at least two network cards, or one network
card and one modem (who uses modems these days ?). You can remotly manage
Smoothwall from your local network via a web browser interface or via the
To install Smoothwall, just insert the CD and boot from the CD itself,
immediatly you are presented with a nice Smoothwall splash screen announcing
the coming installation, let it boot up and choose CD (obviously) as your
installation media method. The Smoothwall quickstart PDF is available here.
Answer yes or no to the questions that pop up (they are so simple that there
is no point in explaining) and off it goes. The only thing the first time
Smoothwall users may find hard to understand is the ‘naming’ convention of
the lan connections, red, green and orange. To simplify things, if you have
two nics (network cards) and one is connected to the internet (wan – wide
area network) and the other is connected to your local network (lan – local
area network) then you can safely assume that green is your lan, and red is
the wan. Stop and go I guess ;-).
Once you have configured Smoothwall (it was quick, wasn’t it !), you are
prompted if you want to restore previously saved configuration changes, if
you have them, insert your floppy disc and it will restore them, I have not
tested this yet, but I did see that within the web based management
interface you can also backup to floppy or make a floppy img file and back
that up to your local hard disc for later retrieval. After that click ok to
reboot, once it reboots you can configure whether you want to enable the
DHCP server (works great for a home network) and whether or not your RED
(wan) interface has a static or dynamic IP address from your internet
provider. You can also specify what the DHCP server ip range is very easily,
which is nice, you dont have to stick with the default 192.168.0.x range if
you don’t want to.
You will be prompted if you are using an ISDN modem (if not cancel it) and
an ADSL modem (if not cancel it) however, and this is a big however,
Smoothwall’s selection of ADSL modems are all USB based, and both ADSL
modems I have at home are not. There is also no option to manually specify
your ADSL modem, which is a pity, and I hope that the next release of this
software has that ability, not everyone who uses ADSL is using usb based
models I’m sure.
So, to get around that, I had to choose ‘disable ADSL’ and my next step was
to manually assign the IP from my ISP to my RED network card. That worked
for all of approximately 5 minutes. I could surf fine and I thought ‘hey
this is truly cool’ but then my internet went bottoms up. By entering my
ISP’s login IP address in my browser (on a machine connected via the green
network to the Smoothwall server via DHCP) I got up an error message from my
ISP. They didn’t like me manually specifing my IP address, so I digressed
and chose DHCP for my RED interface. To my amazement, this worked, and I
could login to my isp on the ‘normal’ pc and was once again connected to the
internet. This was more like it !
Next thing I did was to fire up my web browser based management of Smoothwall, which by default is located at https://192.168.0.1:441/. After accepting the security certificate, I was presented with a newly designed (and very nice) web based management interface for Smoothwall, much cleaner and better laid out than Smoothwall 1.0.
On the first page of Smoothwall Express Final 2, you will see a whole bunch
of tabs at the top of the screen (very like their web page actually),
clicking on any one will prompt you for username/password to gain access.
Enter your admin details and you are good to go. Once logged in, the front
page will notify you if you need to get an update from Smoothwall, In my
case, I needed one update, which is fairly simple to apply. You must click
on the maintenance tab, and then updates, then click on the update listed,
download it locally, and then use the management interface to browse to the
update file, and upload it to the Smoothwall server. If it sounds difficult
don’t worry – trust me, it’s easy. I do have a suggestion for Smoothwall
about this however, on the home page, instead of merely informing you about
the update, how about linking directly to the updates page (which currently
it does not).
On the subject of updating, the update available for me, was SWP-2004:001
‘updates for smoothwall express to correct linux kernel local security
vulnerabilities’, and seeing as the kernel version that ships by default
with the downloadble ISO is 2.4.22 I started downloading and updated to
2.4.24-final cf (2.1MB download). After applying the update, I was informed
that all was ok, however… the kernel listed in ‘about your smoothie’ under
the ‘advanced’ section was still the old one, so I rebooted. Perhaps it
should have told me to, I don’t know, but from RedHat and previous linux
experience a kernel update means a reboot. To reboot the machine, click on
the ‘shutdown’ link, and the ‘reboot’ button. You will here it beep a few
times while it’s rebooting (doh, ray, me) and that signals that it’s up
again which is handy when you don’t have a monitor connected. After the
reboot, ‘about your smoothie’ reported the correct and updated kernel.
In order to see Intrusion Detection system at work, you need to enable it,
so click on the ‘services’ tab and highlight ‘intrusion detection system’.
Enable it and click save, (note, if you have not configured your red/green
interface properly, it will not start.) After some minutes, check the status
of the IDS by clicking on the ‘logs’ tab. You should see some attempts by
various foreign IPs’ listed in there. Next thing to look at is your
firewall, click on the firewall tab and you can see Source and destination
ports/ips attempting to enter/leave your network. Very nice.
Ok so you’ve got IDS setup and you’ve looked at your firewall and IDS logs,
now what ? well, you can open ports and forward them to specific ips on your
local network (port forwarding). To do this click on the networking tab and
select port forwarding. You can enter the port you wish to forward (for
example port 80) and the destination ip/port you want it to go to (for
example 192.168.0.205:8080). Next choose TCP (or UDP if you wish) and click
Add. The rule will now be added in a list which you can easily later remove
What other cool stuff is there ? well, you can block IP’s, by clicking on
the ip block tab in networking. Just enter your chosen ip (the one you don’t
like) and decide if you want Smoothwall to drop the packet or reject it,
and of course, you can log this. Very cool. You can also configure
Smoothwall to block ICMP ping requests, IGMP, ignore multicast traffic and
lots more. There’s just an awful lot of cool stuff in this OS and the best
way to find out what it offers is to download it and test it.
I successfully connected via a VPN through Smoothwall, and using PcAnywhere,
without any problems. If you feel that perhaps Smoothwall isn’t secure
enough then get another wan ip address and nmap your Smoothwall box, and
watch the output on your firewall/IDS logs, it’s impressive to say the
least. I’m confident that anyone who see’s this will be impressed and will
want to set it up for themselves. It’s not perfect of course, for example
there is the USB ADSL modem issue (I don’t have a USB ADSL modem, mine is a
Zyxel Prestige 600 series), and the PPP settings tab in networking does list
PPP, PPPoA and PPPoE connections, but from the drop down list I could not
pick anything but standard modems on com ports 1 through 4. In other words,
I could not make it autologin my ADSL modem and in the end, had to login via
the web. Smoothwall is free and its a really useful thing to do with old
antiquated hardware, I’m certaintly glad I have it running again on a box at
home protecting one of the two ADSL modems at home, and sharing the internet
to the pcs on that local lan. I am going to run this version of Smoothwall
for a few weeks and see if it does the business, if it does (and I think it
will) I will once again replace the dlink hardware firewall on the other
ADSL connection with this setup that I have now.
I give Smoothwall Express Final 2 a huge thumbs up for improving on the old,
almost tired looking Smoothwall 1.0. Please do yourself a favor, and give it
a try, the 45.5MB download is well worth it.