Setting up /etc/network/interfaces for sandboxed network with 12.04 LTS

Question

I am trying to set up Ubuntu 12.04 as a router so I can isolate an IP subnet. For the isolated subnet, connections are only allowed via port forwarding. Other than that, neither inbound nor outbound connections will be allowed. (I intend to use Shorewall rather than mess with netfilter and iptables myself, if it matters.)

Yesterday I tried a number of possibilities in my /etc/network/interfaces and couldn't even get the machine to not pause during booting, much less work. I will admit I did enable forwarding in the kernel, but I wouldn't expect that to break this.

Here's what I tried:

auto lo
iface lo inet loopback

#net - Internet and normal CS network
#netmask 255.255.0.0
#explicitly listing this slowed down boot?
auto eth0
iface eth0 inet

#loc - this is the security class network (sandbox)
#For simplicity we set it up as full 172.16.0.0/12
#Took out auto because might be causing delay on boot;  restore when fast.
#iface eth1 static
#      address 172.16.1.1
#      netmask 255.240.0.0
#      broadcast 172.31.255.255

The commented lines show options I tried initially, then dropped when the machine still wouldn't boot without the full minute networking pause. I checked kern.log, and it basically says the network process terminated with status 1, which wasn't terribly helpful.

Should I disable Network Manager? What should I have in my file? Do I even need anything in this file other than the default, or is it just for ifup/ifdown?

A diagram of my network is attached. Sorry about the messiness; it was intended for my own consumption and evolved over time. My Ubuntu machine is the "fw" (firewall) machine in between the networks, and it has a separate NIC on each network. I am now setting up a new machine from scratch in case that's easier.

Answer 1

Ok, I think my main mistake was leaving off the "inet" on the second adapter. The new machine reboots happily. I think there must have been another problem with the original machine that it didn't like the cut-down file above.

Also, a very useful command (for now?) for testing this file is:

sudo bash /etc/init.d/networking restart

This is deprecated; technically I think you're supposed to do ifdown and ifup for each of your interfaces now.

Here is my /etc/network/interfaces:

auto lo
iface lo inet loopback

#net
auto eth0
iface eth0 inet dhcp

#loc
auto eth1
iface eth1 inet static
  address 172.16.1.1
  netmask 255.240.0.0
  broadcast 172.31.255.255
  network 172.16.1.1

I still don't know if this file is actually required or not, especially once I set up shorewall.