To build a Linux-based router and firewall, first choose the appropriate Linux distribution, and it is recommended to use Debian as a starter. 1. Select a lightweight, stable and well-supported system, such as Debian, Alpine Linux or OpenWrt; 2. Configure at least two network interfaces: WAN (connected to the Internet) and LAN (connected to the intranet), and set IP parameters in /etc/network/interfaces; 3. Enable IP forwarding, and enable the system to support routing functions by modifying /etc/sysctl.conf and executing net.ipv4.ip_forward=1; 4. Configure NAT using iptables or nftables to realize that intranet devices share public IP. Key commands include MASQUERADE and FORWARD chain rules, and save configuration; 5. Establish a basic firewall policy to allow loopback, established connections and intranet access, prevent external direct access to the internal network, and open port forwarding if necessary; 6. Optionally deploy DHCP and DNS services, use dnsmasq to automatically allocate IP and resolve domain names to the LAN; 7. Strengthen the router's own security, disable the SSH login of root, enable key authentication, change the default port, install fail2ban brute-proof cracking and keep the system updated; 8. Regularly monitor logs and traffic, use syslog, iftop and other tools to troubleshoot problems, and back up configuration files. By implementing these steps step by step, you can create a secure, controllable, and highly customizable network gateway suitable for learning, experimental or production environments and have the ability to extend QoS, VLAN, or VPN capabilities.

Building a Linux-based router and firewall is a powerful way to gain full control over your network's traffic, security, and performance—without relying on consumer-grade hardware. With Linux, you can turn an old PC or a compact device like a Raspberry Pi or Intel NUC into a robust, customized gateway that routes traffic between networks and enforces security policies using built-in tools like iptables or nftables .

Here's how to set it up effectively.

1. Choose the Right Linux Distribution

Not all Linux distros are built for routing. You want something lightweight, stable, and with strong networking support.

• Debian or Ubuntu Server : Great balance of stability and package availability. Ideal if you're learning or want broad community support.
• Alpine Linux : Extremely lightweight, fast, and secure—perfect for older hardware or embedded systems.
• CentOS Stream or Rocky Linux : Enterprise-grade stability, good for production environments.
• OpenWrt (for small devices) : Specifically designed for routers, runs well on low-resource hardware.

For most DIY setups, Debian is a solid starting point.

2. Set Up Network Interfaces

A basic router needs at least two network interfaces:

• WAN (External) : Connects to the internet (eg, your modem).
• LAN (Internal) : Connects to your local network (eg, switch or Wi-Fi AP).

Example Setup:

 eth0 → WAN (DHCP or static from ISP)
eth1 → LAN (static IP, eg, 192.168.1.1)

Configure /etc/network/interfaces (Debian/Ubuntu):

 auto eth0
iface eth0 inet dhcp

auto eth1
iface eth1 inet static
    address 192.168.1.1
    netmask 255.255.255.0
    network 192.168.1.0

Then restart networking:

 sudo systemctl restart networking

3. Enable IP Forwarding

Linux doesn't forward packets between interfaces by default. Enable it via sysctl:

Edit /etc/sysctl.conf and uncomment or add:

 net.ipv4.ip_forward=1

Apply immediately:

 sudo sysctl -p

Now the system can route packets from LAN to WAN and back.

4. Configure NAT with iptables or nftables

Use Network Address Translation (NAT) so your internal devices can share the single public IP.

With iptables :

 # Replace eth0 with your WAN interface
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
sudo iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

Save rules (Debian/Ubuntu):

 sudo iptables-save > /etc/iptables/rules.v4

On reboot, rules will be restored if you have iptables-persistent installed.

Note : nftables is the modern replacement. If your system uses it, translate these rules accordingly.

5. Set Up a Basic Firewall

Your Linux router should block unwanted traffic while allowing legitimate use.

Common Rules:

• Allow loopback
• Allow established connections
• Allow LAN-to-WAN
• Block WAN-to-LAN unless explicitly allowed (eg, port forwarding)

Example iptables firewall script:

 #!/bin/bash
iptables -F
iptables -t nat -F

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established traffic
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Allow LAN to router (SSH, DNS, DHCP if hosted)
iptables -A INPUT -i eth1 -j ACCEPT

# Block WAN to router unless needed
iptables -A INPUT -i eth0 -j DROP

# NAT and forwarding as before
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT

# Enable forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

Make it executable and run at boot.

6. Optional: Add DHCP and DNS Services

To make your router more functional, run DHCP and DNS services for your LAN.

Use ISC DHCP Server or dnsmasq (lighter, combines DHCP DNS).

Install dnsmasq:

 sudo apt install dnsmasq

Edit /etc/dnsmasq.conf :

 interface=eth1
dhcp-range=192.168.1.100,192.168.1.200,12h
server=8.8.8.8.8
domain-needed
bogus-priv

Restart:

 sudo systemctl restart dnsmasq

Now devices on your LAN can get IPs automatically.

7. Secure the Router Itself

Your router is a high-value target. Harden it:

• Disable root login over SSH
• Use SSH key authentication
• Change default SSH port (optional)
• Install fail2ban to block brute-force attempts
• Keep the system updated

 sudo apt install fail2ban

8. Monitor and Maintain

• Check logs: tail -f /var/log/syslog or journalctl -f
• Monitor traffic: iftop , nethogs
• Test connectivity from client devices
• Backup your config regularly

Building a Linux-based router gives you transparency, flexibility, and control. Whether you're learning networking, setting up a lab, or replacing a flaky consumer router, this approach scales from simple to advanced use cases—like QoS, VLANs, or even a VPN gateway.

It's not plug-and-play, but the payoff in learning and capability is huge.

Basically, start small, test each step, and grow from there.

The above is the detailed content of Building a Linux-based Router and Firewall. For more information, please follow other related articles on the PHP Chinese website!