Home ›

Linux WAN Routers

Issue 50

From Issue #50
June 1998

Jun 01, 1998  By Tony Mancill
 in
Here's another great use for Linux; Mr. Mancill tells us why his company picked Linux routers over the big names.
Linux in the Production Environment

Another plus for Linux routers is they can run additional services and programs. At your disposal is an entire OS family of services and applications with 20+ years of debugging and fine-tuning. Because UNIX has always promoted a tool box philosophy, the only real limit to what other services your routers can provide is your imagination. Here are some ideas:

  • Deploy secondary services for more redundancy. For example, a router can act as a secondary DNS server or a secondary SMTP gateway.

  • Configure the router for a remote site to act as a slave DNS and a caching HTTP proxy—perhaps even Samba for file and print services.

  • Deploy a “one-stop-shop” Internet router—use the same machine for the external DNS name server, an SMTP mail-exchanger, an NTP server for your site and an Internet firewall.

Linux also provides flexible packet-filtering, SOCKS, proxying solutions, PPTP and IP-masquerading. For those who have special needs, there are modules for shaping traffic patterns (throttling the bandwidth of certain types of traffic or traffic between given hosts).

Deploying multipurpose systems also makes sense in terms of reliability. Having fewer concentrated points of failure typically increases the average uptime of an office, because the possibility of hardware failure is equal to the sum of the possibilities of failure of the individual components. Therefore, fewer multipurpose systems should result in a lower overall chance of failure. Be careful though: lumping services together means that multiple services will be down simultaneously. You should always consider the interaction of the services you are combining and try to combine services that would be useless anyway if the router were to fail.

It is hard to exaggerate the importance of reliability for a routing platform. Unreliable systems do not just cost money: they can utterly kill your business. Worse than that, they can cause you to get paged during non-work-related activities (like sleeping).

Tips for Running Linux in the Production Environment

You might find some of the following tips helpful. Many of them were learned the hard way.

  • Back up your system regularly. (I have had good luck with BRU from EST Software.)

  • /var should be a separate partition because it is going to hold all of your spools and log files.

  • Make a set of rescue floppies. My rescue floppies include Debian rescue disk, bootable DOS disk with the configuration utilities for my Ethernet cards and bootable DOS disk with Sangoma's snooper.exe (a sniffer utility for their communications cards).

  • Keep all of your system scripts in a common location, e.g., /us/local/bin or ~sysacct/bin and use a common header format for all of your scripts that includes a history of changes. This saves you time by reminding you of what you did and when, and helps others who may inherit or need to modify your scripts. The first 2-letter field contains initials, when more than one person has access to your environment. All my scripts start like this:

     #!/usr/bin/ksh
     # name_of_script [cmdline args]
     # [description of script, if needed]
     # modification history:
     # tm970612initial release
     # ls970923added functionality X
     # tm980115most recent edit
     MAIL_TO="tmancill@us.lhsgroup.com"

  • Remain security conscious. Change passwords regularly, and use ssh or a similar program to protect against internal TCP/IP snoopers. Use PGP or a similar program for sharing sensitive information with others.

  • Have spare components available. Linux is tolerant of changing hardware, so you can move the hard drive to a different system without problems. A spare communications adapter and an IDE hard disk loaded with the base OS plus kernel source should suffice.

  • Reboot your system after any (major) configuration changes, e.g., changes to the routing tables specified in the start-up scripts. If this cannot be done right away, schedule a time to do it. This is suggested not because Linux needs to be rebooted for the changes to take effect, but more because it runs so long without needing to be rebooted. The “reboot-test” provides some insurance against Murphy's Law. Otherwise, your system will most likely be rebooted when you are not around, by an NT-administrator trying to log in with CTRL-ALT-DEL six months after you have made any changes to it whatsoever. If it cannot restart without intervention, the NT-administrator will be mucking about on your system until you show up and are confused as to why the system is acting funny because you cannot remember the last changes you made.

  • Understand TCP/IP—ports, routing, variable subnetting, DNS, the differences between TCP and UDP, etc. This cannot be overstated. Downtime statistics for large production environments are alarming in that they often show human-error as the number one cause of failure. (Linux test beds are cheap; practice on a spare system. Because communication adapters under Linux work just like Ethernet devices, you can simulate your WAN environment with extra Ethernet cards and a separate Ethernet segment.)

  • Keep documentation on your systems. It does not have to be much—just note how each system varies from the base OS load.

  • Keep your head when things get hectic.

______________________

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

AWESOME!

sparc86's picture
Submitted by sparc86 (not verified) on Mon, 06/29/2009 - 20:56.

Awesome Ass-Kicking article! :D

I will definitely try it someday!

wonderful!

unixbhaskar's picture
Submitted by unixbhaskar (not verified) on Sat, 10/07/2006 - 00:00.

Thanx a ton man.You r in the same brace like us.thankx again

Re: Linux WAN Routers

Anonymous's picture
Submitted by Anonymous on Thu, 06/10/2004 - 02:00.

Did you know you can disable Ctrl+Alt+Supr in /etc/inittab ? :-)

Re: Linux WAN Routers

matias's picture
Submitted by matias (not verified) on Fri, 05/21/2004 - 02:00.

just an excellent article.

excelllent!!

Anonymous's picture
Submitted by Anonymous (not verified) on Tue, 07/26/2005 - 06:14.

well this one is just the thing i wanted.An excellently written article.
superb one.well supported with examples truly bringin the true picture to ppl.
keep it up!!

Webcast
More Resources
How to Build an Optimal Hadoop Cluster to Store and Maintain Unlimited Amounts of Data Using Microservers

Realizing the promise of Apache® Hadoop® requires the effective deployment of compute, memory, storage and networking to achieve optimal results. With its flexibility and multitude of options, it is easy to over or under provision the server infrastructure, resulting in poor performance and high TCO. Join us for an in depth, technical discussion with industry experts from leading Hadoop and server companies who will provide insights into the key considerations for designing and deploying an optimal Hadoop cluster.

Learn More

Sponsored by AMD

White Paper
More Resources
Red Hat White Paper: Using an Open Source Framework to Catch the Bad Guy

Built-in forensics, incident response, and security with Red Hat Enterprise Linux 6

Every security policy provides guidance and requirements for ensuring adequate protection of information and data, as well as high-level technical and administrative security requirements for a system in a given environment. Traditionally, providing security for a system focuses on the confidentiality of the information on it. However, protecting the data integrity and system and data availability is just as important. For example, when processing United States intelligence information, there are three attributes that require protection: confidentiality, integrity, and availability.

Learn more about catching the bad guy in this free white paper.

Learn More

Sponsored by DLT Solutions