SoFunction
Updated on 2025-04-11

SmoothWall Firewall Soft Routing Installation + Configuration Detailed Explanation

1. Preface:
I originally searched for DRL but saw no better tutorials about SW, so I made this tutorial for the convenience of everyone.

1. Thanks to Brother Ahui for his software introduction:
SmoothWall is one of the successful Open Source projects in Europe. It can help you turn an obsolete 386,486 machine into a powerful and stable fire-resistant router! It has been used by more than 300,000 users and 21 countries! SmoothWall supports network devices such as ISDN, ASDL/Cable and multi-network cards. The most incredible thing is that all of these can be configured in 5 minutes! Web-based management and support for SSH and DHCP, and complete firewall tools will be provided in its commercial version.

I feel that ordinary users do not need to use the 3.0 commercial version. It is enough for ordinary individuals, small and medium-sized enterprises, and Internet cafes to use this 2.0. Because SmoothWall 2.0 requires low configuration, you can turn your scrap machine into a phoenix. And the installation is very simple, you can see it at a glance. This software continues to be under the Red hat9 linux operating system, and it comes with the Red hat9 linux simple version.

Statement: SW is not a soft router, it is a firewall. NAT is just a feature that comes with it. But it is indeed very powerful.

2. Let’s talk about the configuration of the basic machine, which is actually very casual. The memory is above 32m (it is recommended to use a 64 because it is still necessary to use it if it resists attack); the optical drive (can be removed after installation); the hard disk is greater than 500m (it is recommended to use 2G, because it may save some logs or something). Do not use the SCIS hard disk because this version does not support it; the graphics card (it can be displayed casually); the CPU Pentium or above is enough; it is necessary to install the monitor and keyboard, and it can be removed after installation. That's all, any machine can basically support it. This is the biggest advantage of this software.

3. There are two installation methods: one is CD installation and the other is network installation. It is usually installed using a CD. Go to the official (/Article/UploadFiles/200507/
The partition and system files are installed, and the following configuration is performed. 3 buttons, 1. Automatic search 2. Manual search 3. Cancel, it is recommended to use several commonly used network cards. Because sw is easier to search for drivers

/Article/UploadFiles/200507/
SW found that my network card is AMD, press "OK" to confirm and continue to install

/Article/UploadFiles/200507/
The system installation is complete and you can now remove the floppy disk or CD. What is about to be installed is the configuration of your network and the passwords of the SW 3 users. You can now use the IP: 81 just set and the IP: 441 just set by http:// to perform daily management of SW. What will be done below is advanced configurations, such as intranet network cards, network sharing, etc.

/Article/UploadFiles/200507/
This is the USB ADSL cat's settings, select the model

/Article/UploadFiles/200507/
Here is the model that chooses USB ADSL, I don't, return. Still click "Close ADSL" to continue to the next step

/Article/UploadFiles/200507/
Select the second one to install the driver of the intranet network card

/Article/UploadFiles/200507/
There are three options here, 1. Select this for fixed IP 2. It is a dynamic IP 3. It is an ADSL dialer user
This option is generally used by fixed IP users, such as optical cable users, and enterprise-level users. Write your external network fixed IP and mask code

/Article/UploadFiles/200507/
The installation is prompted to be completed, click "OK" to end the installation. The computer will be started again.

/Article/UploadFiles/200507/
Enter SETUP user and password to enter the commonly used SW configurations. All configurations can be changed when you first installed.

/Article/UploadFiles/200507/
SW's WEB management depends on the address, we need to access it using the intranet address we just set.

/Article/UploadFiles/200507/
Here are all running services displayed by SW.
Logging server (system day to service)
DHCP server (dynamic IP allocation service, which can be enabled if the LAN requires dynamic IP allocation)
DNS proxy server (SW's DNS service, if you want to block some websites, you can use this function to change the IP of the website you want to block.)
Kernel logging server (the firewall log service, this takes up a lot of space, so it is recommended that the small hard disk user close it, and the closing method will be discussed later)
Web proxy (general web proxy service)
Web server (SW's web service, you must use this service to manage pages)
Secure shell server (security shell service, don't know what)
Intrusion Detection System (Intrusion protection system, can play some precautions for small attacks.)
CRON server (Time service, you can automatically proofread the time by choosing a region. But there is no Asia, Beijing, but Shanghai, the same is true.)
VPN (virtual private network service, which is generally used for enterprise users.)

/Article/UploadFiles/200507/
Home dialing users use this setting, pppoe dialing protocol.
First, you can create a dialing information. It seems that you can create 5 in total and switch at any time, but it doesn’t feel that it’s useful, right? .
ADSL dialing must first select the pppoe protocol;
You can also enable:
1. Persistent connection (disconnection and redial)
2. Connect on SmoothWall restart(automatically dial after sw starts)
3. Automatic reboot if connection down for 5 minutes (automatically restart SW after disconnection for more than 5 minutes)

/Article/UploadFiles/200507/
Advanced Firewall Configuration
Block ICMP ping: ping function is prohibited
Enable SYN cookies: Prevent flood attacks
Block and ignore IGMP packets: block and ignore igmp packets
Block and ignore multicast traffic: block and ignore multicast traffic. (The function to prevent multi-line downloading in the LAN.)
Enable UPnP (Universal Plug and Play) support: Allows upnp (universal plug and play), which may be a function of automatically mapping ports.

[1][2][3] Next page

Article entry: csh     Editor in charge: csh


/Article/UploadFiles/200507/
IP attacks can make some detections on the IP you specified. There are functions of ping and routing tables.

/Article/UploadFiles/200507/
Set your pstn modem and isdn ta in sw. Haven't used it.

/Article/UploadFiles/200507/
Upgrade firmware of usb adsl modem.

/Article/UploadFiles/200507/
Shut down and restart

/Article/UploadFiles/200507/
After setting it, select the update list to show the patch you need to upgrade. Then go to the official patch to upload the file, it's very simple. Upgraded patches will appear in the patched list.


4. The following explains how to turn off the log service (someone asked why you need to turn off the log? Because the log of SW is very detailed and its working conditions occupies a lot of hard disk space. Turn it off 1. Users of small hard disks do not need to worry that the hard disk is too small and cannot use SW; 2. Do not worry that this log has been writing data to the hard disk, which occupies a lot of system resources. Moreover, turning off this log will not delay everyone's viewing the log, so it is recommended to turn it off):
First of all, the next software that can SSH files is very good. I think WinSCP/SSH Secure File Transfer Client is very good.
/Article/UploadFiles/200507/
exist
echo "Starting klogd"
/sbin/klogd
These 2 lines are preceded by "#"
like
#echo "Starting klogd"
#/sbin/klogd
Then click the floppy disk icon above to save, or press Ctrl+s to save
After saving, close this window, restart SW and then take effect.

/Article/UploadFiles/200507/
See? In the current service status, "Kernel logging server" is a stop state, which means that it has been successfully stopped. Small hard drive users no longer have to worry. . .


5. The following is an explanation of the method that can enable SW to support reflow (the original method was first proposed: zhunaoke):
Please follow my method to infer your specific solution. You cannot copy it, but can only reply! !
My example conditions: For example, my external network IP is: 192.168.0.66, the intranet IP is: 192.168.0.88, and the port to be mapped is: "80" target mapping IP address is: 192.168.0.1
Create a file, renamed: "", other names are OK, but the suffix must be ".sh"
Then open the file and enter:
sh <Enter>
iptables -t nat -A PREROUTING -d 192.168.0.66 -p tcp --dport 80 -j DNAT --to 192.168.0.1 <Enter>
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 192.168.0.1 -p tcp --dport 80 -j SNAT --to 192.168.0.88 <Enter>
Note: The above <Enter> is all operations, do not enter it! ! ! !

/Article/UploadFiles/200507/
Then pass this file to the root directory of "root".

/Article/UploadFiles/200507/
Enter the "/etc//" directory and find a file, download it and add a line to the last line of the file: "/root/" save it, and it will be supported after restarting, but the startup speed is a bit slower.


6. Single-line double-ip use smoothwall (original: rumptis from SW forum)
1. Original text:
This has only taken me a Week to figure out. Using this you don't need to do anything with the GUI.

You can add this to the bottom of the "/etc//" Script

# Add more Real World IP Address to your RED interface This shows 2 being added

ifconfig eth1:1 166.138.52.123 broadcast 165.138.52.255 netmask 255.255.255.0
ifconfig eth1:2 166.138.52.124 broadcast 165.138.52.255 netmask 255.255.255.0


# How to forward Ports into your GREEN Network you can do the same port on Multiple Real World IP Address: Here I'm showing Forwarding port 80 to 2 different IP Address on the GREEN Network

. /var/smoothwall/ethernet/settings

# Computer 1
iptables -I PREROUTING -t nat -p tcp --dport 80 -d 166.138.52.123 -j DNAT --to 192.168.13.10
iptables -I FORWARD -p tcp -d 192.168.13.10 --dport 80 -i $RED_DEV -o $GREEN_DEV -j ACCEPT

# Computer 2
iptables -I PREROUTING -t nat -p tcp --dport 80 -d 166.138.52.124 -j DNAT --to 192.168.13.11
iptables -I FORWARD -p tcp -d 192.168.13.11 --dport 80 -i $RED_DEV -o $GREEN_DEV -j ACCEPT

2. Pictures and texts:
/Article/UploadFiles/200507/

Previous page  [1][2][3] Next page

Article entry: csh     Editor in charge: csh

Enter at the bottom of the file
# Add more Real World IP Address to your RED interface This shows 2 being added

ifconfig eth1:1 166.138.52.123 broadcast 165.138.52.255 netmask 255.255.255.0
ifconfig eth1:2 166.138.52.124 broadcast 165.138.52.255 netmask 255.255.255.0

# How to forward Ports into your GREEN Network you can do the same port on Multiple Real World IP Address: Here I'm showing Forwarding port 80 to 2 different IP Address on the GREEN Network
That's the part I selected. Then save and close

/Article/UploadFiles/200507/
Add the following content to the bottom of the file
# Computer 1
iptables -I PREROUTING -t nat -p tcp --dport 80 -d 166.138.52.123 -j DNAT --to 192.168.13.10
iptables -I FORWARD -p tcp -d 192.168.13.10 --dport 80 -i $RED_DEV -o $GREEN_DEV -j ACCEPT

# Computer 2
iptables -I PREROUTING -t nat -p tcp --dport 80 -d 166.138.52.124 -j DNAT --to 192.168.13.11
iptables -I FORWARD -p tcp -d 192.168.13.11 --dport 80 -i $RED_DEV -o $GREEN_DEV -j ACCEPT

Save Exit and start the machine again. .


7. SW shielded port 25
/Article/UploadFiles/200507/
Add the following information to the last line of the file
#25
iptables -A FORWARD -p tcp --dport 25 -j DROP

Just restart.

8. Forgot your password (author: srsman)
Start smoothwall first
Press the TAB key when the smoothwall launches
The following prompt will appear on the computer

SmoothWall
boot:

At this time, you enter smoothwall single behind boot and press Enter
At this time, the smoothwall enters single user mode
After smoothwall is started, it will automatically enter # prompt mode
Friends who have used linux or UNIX know what to do now :)
Now let's change the root password
enter
passwd root Enter

Then enter the password you want to change twice and it will be OK
If you want to change the password of setup and admin
Then you'd better restart smoothwall first (command: shutdown -r now))
This restart will allow Smoothwall to enter normal mode by itself!
You can use the root password you changed to enter smoothwall
Let's change the password of the setup first
The command is passwd setup
Enter the password you want to change twice the same thing is OK
The password root of admin user and the password change method of setup are a bit different!
Because admin is a web management mode user needs to use the following command
htpasswd /var/smoothwall/auth/users admin
Now the password has been changed! Good luck to everyone!


9. Summary
I feel that SW is simple and easy to learn, and this tutorial is suitable for the novices level. SW2.0 is enough for ordinary home business users. If you are a large enterprise user, you can purchase SW3.0, providing more humanized operations and more complete services.

SW itself does not come with FTP and other services. If you feel that the configuration after SW is installed is particularly troublesome, if your machine configuration is relatively good, you can choose CC. It mainly depends on personal preferences, and I still focus on liking CC.

Thank you: The heroes who expressed various opinions in txwm, thank you Zhuhai Mood Fatty for your guidance on QQ.

Thank you everyone. If you have any wrong feelings about my operation, please point it out. I can only blame me for being a little bitchy... Please give me some advice... Thank you!
  • Sm
  • mo
  • oo
  • ot
  • th
  • hW
  • Wa
  • al
  • ll
  • l Defense
  • Fireproof
  • firewall
  • Soft wall
  • Soft road
  • routing
  • Yuan
  • Install
  • assembly
  • Configuration
  • Details
  • Detailed explanation
  • untie

Related Articles

  • A comprehensive case of Cisco's practical configuration of three-layer exchange

    A comprehensive case of Cisco's actual combat configuration of three-layer exchange...
    2007-09-09
  • Precautions for managing and maintaining broadband routers

    This article mainly introduces the precautions for managing and maintaining broadband routers. The editor thinks it is quite good. I will share it with you now and give you a reference. Let's take a look with the editor
    2007-09-09
  • RAID\Disk Array Body Analysis Error

    RAID\Disk Array Body Analysis Error...
    2007-09-09
  • Necessity for configuring WRED on Cisco routers

    Necessity to configure WRED on Cisco routers...
    2007-09-09
  • The rogue, you have to drive away, and no one is left behind!

    The rogue, you have to drive away, and no one is left behind! ...
    2007-09-09
  • Discussion on VLAN technology in switches and how to configure them

    Discussion on VLAN technology in switches and how to configure...
    2007-09-09
  • Network management tool nstat network status is clear at a glance

    The network status of the network management tool nstat is clear at a glance...
    2007-09-09
  • What are the advantages of using dual-core processors on servers?

    What are the advantages of using dual-core processors on servers? ...
    2007-09-09
  • Routing technology, router and network security

    Routing technology, router and network security...
    2007-09-09
  • An exploration of the appy of the legendary humanoid monster

    This article mainly introduces the exploration of the appy of the legendary humanoid monster.
    2007-09-09

Latest Comments