[ILUG] firewall

[Niall O Broin]

On Monday 26 July 2004, tiger98 at iol.ie (Philip Creevy) wrote:

>I am going to use smoothwall to set up a firewall.
>I was planning on using a via mini-itx system with a 
>flash drive of about 4GB and a 512MB ram drive.

Yo don't need anywhere near that much flash for a smoothwall, unless you're
planning to run Squid out of flash. Here's a df output from a diskful smoothie
I manage:

Filesystem      Type    Size  Used Avail Use% Mounted on
/dev/harddisk4  ext3    7.0G  4.1G  2.9G  59% /
/dev/harddisk1  ext3    7.6M  3.3M  4.3M  43% /boot
/dev/harddisk3  ext3    510M   73M  414M  19% /var/log

Of the 4.1G in /, 4.0G is /var/squid and /var/log usage is:

8.0K    /var/log/dmesg
324K    /var/log/httpd
1.6M    /var/log/iptraf
4.0K    /var/log/lastlog
16K     /var/log/lost+found
0       /var/log/maillog
9.4M    /var/log/messages
0       /var/log/secure
19M     /var/log/snort
0       /var/log/spooler
27M     /var/log/squid
20K     /var/log/wtmp


>The idea is to have a silent system with no moving parts.
>
>The question is what directory's are changed a lot

Just had a look on the above smoothie : /etc & /tmp should nearly cover it
(besides /var, of course) 

>besides VAR also how much data would be generated 
>and how often would they need to be emptyed.

Make guessstimates from the above.

>Will I have a problem if there is no swap drive.

No, as long as you have sufficient RAM. I've 384M on that box, and 180M or so
is used for buffer/cache - so 256M would be enough, even WITH squid.
>If VAR is in the ram drive and I turn off the system
>will I loose any system data.

Yes, yes you will - a smoothie keeps a LOT of system data in /var. Best mount
/var/log on the RAMdisk.
 
>Note: The flash drive can be got from a MUVO, the muvo sells in peats for

Is that flash though? I'm pretty sure that the 4GB muvo uses the same tiny
hard disk as the iPod mini. Mind you from the noise POV it probably hardly
matters - I imagine those disks are rather quiet.



Niall