Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Ok, I've searched for days, maybe you can point me in the right direction.

I have an MPLS scenario with a shared gateway in a multi-domain M$FT AD environment. On the inside of the MPLS all of the doors are open.

I'd like to put an Ubuntu box in between my carrier managed router and my domain within the AD Forest.

I'd like the purpose of this box to be for packet inspection, monitoring traffic inbound and outbound, IPS/IDS alerting (if possible), etc. If there's something fishy going on, I'd like to be able to intervene. I'd also like to keep AD replication, sharing, resource access, emails, etc., all going smoothly.

I'm not looking to serve DNS or DHCP...I don't want NAT. I basically want this to take packets from one end, spit them out on the other, maintaining state, etc., I just want some visibility and, if needed, some control.

Has this been accomplished? Documented? Ideas &/| Thoughts?

share|improve this question
    
Maybe I wasn't entirely clear, but, I wanted to had the IPS/IDS box in between my AD site/domain and the other AD sites/domains on our MPLS connection. Any thoughts? –  ShopliftinCS Nov 20 '12 at 12:55

1 Answer 1

It sounds like what you are looking for is a bridge.

For this, you will need at least 2 network interfaces on your Ubuntu box.

I'll assume that your system has named the two network adapters eth0 and eth1.

First, you will need to install the bridge-utils package. (I'm not sure if you are using a CLI server version or a desktop version that has a GUI installed. So I will tell you how to do stuff CLI because that's lowest common denominator). You can do this by running sudo apt-get install bridge-utils.

You will want to edit /etc/network/interfaces to tell the machine how you want the network configured (including across reboots), so run something like sudo nano /etc/network/interfaces.

Remove any lines related to eth0 or eth1. This includes lines that may be indented under lines like auto eth0 or something like that. (Leave stuff about lo alone, that's the loopback interface, and you want to leave it as it is). Then add a few lines to the end of the file:

auto br0
iface br0 inet static
        bridge_ports eth0 eth1
        address 192.168.1.2 <-- Set the IP address you want the Ubuntu Box to have on the network
        netmask 255.255.255.0
        gateway 192.168.1.1 <-- Set the IP address of the router for the network

That should have you set for IPv4. If you want to set a static IPv6 address, do something like:

auto eth7 iface eth7 inet static dns-nameservers 74.82.42.42 address 192.168.7.1 netmask 255.255.255.0 up /sbin/ifconfig eth7 promisc

iface br0 inet6 static
       address 2001:db8:e89d:9ab6:1:e7c:e7c:e7c
       netmask 64
       gateway 2001:db8:e89d:9ab6:e7c::1

Press Ctrl-X to save, and that should have it set up. Reboot to apply the changes (again, that's the easiest way, not strictly necessary if you manually remove the current config before apply this one, but rebooting is easy. And you get to test that everything works after a restart).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.