Contents

Preface

If you are linking to the html version of this FAQ, please use the following format: Please link directly to the new Wiki page

This FAQ has being translated into a Wiki. This FAQ will be updated to point to the appropriate Wiki page only.

THIS DOCUMENTATION IS PROVIDED ’AS IS’ AND IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION OR THE ASSOCIATED SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Embedding this document on another site is prohibited. If you are reading this document and do not see a url starting with http://ipcops.com/faq, then report this to ds531 on ipcops.com.

Revision History

Chapter 1
FAQ

1.1 IPCOP Setup Issues

1.1.1 I just downloaded IPCOP but it will not install. Help!

http://www.ipcops.com/wiki/faq:setup:download

1.1.2 I have a Red-Blue-Green setup but I can not access computer on Blue from Green. Help!

http://www.ipcops.com/wiki/faq:setup:subnetoverlap

1.1.3 I have a Red-Orange-Green setup connected by a switch. None of my computers can access the Internet, why?

http://www.ipcops.com/wiki/faq:setup:switchisolation

1.1.4 Is there any way I can disable NAT on IPCOP?

http://www.ipcops.com/wiki/faq:advanced:11nat

1.1.5 IPCOP will not recognize all of my NICs, what do I do?

http://www.ipcops.com/wiki/faq:setup:addnic

1.1.6 How do I SSH into IPCOP?

http://www.ipcops.com/wiki/faq:setup:sshsetup

1.1.7 How can I remotely access the web interface?

http://www.ipcops.com/wiki/faq:setup:remoteaccesssetup

1.1.8 I have enabled remote access to the web interface but I can’t connect. What’s wrong?

http://www.ipcops.com/wiki/faq:setup:remoteaccessfail

1.1.9 How do I change my SSL port for the web interface?

http://www.ipcops.com/wiki/faq:manage:ports

1.1.10 How do I change my setup type after install?

http://www.ipcops.com/wiki/faq:setup:runsetup

1.1.11 My NIC won’t work, what do I do? (PCI IRQ Conflicts)

http://www.ipcops.com/wiki/faq:setup:pciirq

1.1.12 I want to use Gigabit ethernet NICs. Does IPCOP support Gigabit ethernet NICs?

http://www.ipcops.com/wiki/faq:setup:gigabitnic

1.1.13 I have added a second subnet/LAN to IPCOP. How do I get the web proxy to allow web request?

http://www.ipcops.com/wiki/faq:setup:2subnet

1.1.14 How do I setup Dynamic DNS on IPCOP?

http://www.ipcops.com/wiki/faq:setup:ddns

1.2 Administrating IPCOP

1.2.1 What is the difference between Port Forwarding and External Access?

http://www.ipcops.com/wiki/faq:manage:traffic

1.2.2 I just looked at my status page and noticed I am running a web server. What is it and how do I stop it?

http://www.ipcops.com/wiki/faq:manage:webserver

1.2.3 My consumer router has UPNP, how do I enable it on IPCOP?

http://www.ipcops.com/wiki/faq:manage:upnp

1.2.4 My consumer router has Port Triggering, how do I enable it on IPCOP?

http://www.ipcops.com/wiki/faq:manage:triggering

1.2.5 I have multiple IP addresses from my ISP. How do I configure IPCOP to respond to all of them?

http://www.ipcops.com/wiki/faq:manage:multipleip

1.2.6 I have added IP addresses to the Alias page but all of my requests come from one IP address. How do I change this?

http://www.ipcops.com/wiki/faq:manage:alias

1.2.7 How do I copy a file over to IPCOP?

http://www.ipcops.com/wiki/faq:manage:copy

1.2.8 How do I test port forwarding, external access, and/or my firewall for open ports?

http://www.ipcops.com/wiki/faq:manage:testfirewall

1.2.9 When I do a port scan, IPCOP shows port 113 is closed. How do I make port 113 unreplied?

http://www.ipcops.com/wiki/faq:manage:ident

1.2.10 My traffic graphs are not updating, what do I do?

http://www.ipcops.com/wiki/faq:manage:graphs

1.2.11 I am trying to update IPCOP, do I have to apply all patches in order?

http://www.ipcops.com/wiki/faq:manage:patching

1.2.12 How do I edit files on IPCOP?

http://www.ipcops.com/wiki/faq:manage:edit

1.2.13 How do I change the http and https ports IPCOP uses?

http://www.ipcops.com/wiki/faq:manage:ports

1.2.14 How do I set multiple public IP addresses with my PPPoE/PPPoA connection?

http://www.ipcops.com/wiki/faq:manage:ppp

1.2.15 How do I login to IPCOP?

http://www.ipcops.com/wiki/faq:manage:login

1.2.16 How do I change the port IPCOP uses for SSH?

http://www.ipcops.com/wiki/faq:manage:ssh

1.2.17 I am receiving the following error message when trying to change settings in the web GUI: ’Invalid referer: doesn’t match servername!’

http://www.ipcops.com/wiki/faq:manage:weberror

1.2.18 I don’t like the builtin graphs, where can I get better graphs?

http://www.ipcops.com/wiki/faq:manage:moregraphs

1.3 Using IPCOP

1.3.1 I just installed IPCOP and I can not get an IP Address from my ISP. Help!

http://www.ipcops.com/wiki/faq:using:ipaddr

1.3.2 IPCOP keeps crashing when I use p2p/bittorrent clients, what do I do?

http://www.ipcops.com/wiki/faq:using:p2p

1.3.3 How do I add a custom host to IPCOP’s DNS?

http://www.ipcops.com/wiki/faq:using:host

1.3.4 How do I use the builtin traffic shaper?

http://www.ipcops.com/wiki/faq:using:shaper

1.3.5 How do I change my MTU settings?

http://www.ipcops.com/wiki/faq:using:mtu

1.3.6 I am getting a Snort ’Oink Oink’ error, how do I fix it?

http://www.ipcops.com/wiki/faq:using:snort

1.3.7 Snort fails after rules update, what do I do?

http://www.ipcops.com/wiki/faq:using:snortupdate

1.3.8 How do I rebuild my Zerina certificates?

http://www.ipcops.com/wiki/faq:using:zerinacerts

1.3.9 How do I run OpenVPN on Vista?

http://www.ipcops.com/wiki/faq:using:openvpnvista

1.3.10 How do I control access for VPN clients to my servers?

http://www.ipcops.com/wiki/faq:using:vpnservers

1.3.11 I have added a computer to Blue but it is not connecting to the Internet. What do I do?

http://www.ipcops.com/wiki/faq:using:bluemantra

1.3.12 How do I use DNS servers with IPCOP (i.e. which to specify for each interface)?

http://www.ipcops.com/wiki/faq:using:dns

1.4 Advanced IPCOP setups

1.4.1 How do I configure IPCOP to work in 1:1 NAT mode?

http://www.ipcops.com/wiki/faq:advanced:11nat

1.4.2 I added a wireless access point to the Blue NIC and I can’t access the web. What’s wrong?

http://www.ipcops.com/wiki/faq:advanced:wirelessap

1.4.3 How do I configure IPCOP to force registration of wireless users before they can access the Internet (a.k.a. I want a Captive Portal on IPCOP)?

http://www.ipcops.com/wiki/faq:advanced:captiveportal

1.4.4 How do I use multiple WAN interfaces with IPCOP?

http://www.ipcops.com/wiki/faq:advanced:multiwan

1.4.5 How do I configure IPCOP to support load balancing?

http://www.ipcops.com/wiki/faq:advanced:loadbalance

1.4.6 How do I setup multiple of the same type of interface?

http://www.ipcops.com/wiki/faq:advanced:multinics

1.4.7 I want to prevent outbound traffic, how do I do this?

http://www.ipcops.com/wiki/faq:advanced:bot

1.4.8 I have blocked port Y but program X can still connect to the Internet. How do I block program X from connecting?

http://www.ipcops.com/wiki/faq:advanced:portblock

1.4.9 What are Cron Jobs/How do I edit IPCOP’s Cron Jobs?

http://www.ipcops.com/wiki/faq:advanced:cron

1.4.10 Multiple NAT routers behind IPCOP

http://www.ipcops.com/wiki/faq:advanced:mnat

1.4.11 How do I block inbound traffic from repeat offenders?

http://www.ipcops.com/wiki/faq:advanced:blocktraffic

1.4.12 How do I allow the ’dial’ user to access more IPCOP web interface pages?

http://www.ipcops.com/wiki/faq:advanced:dial

1.4.13 How do I allow an unauthenticated user to access more IPCOP web interface pages?

http://www.ipcops.com/wiki/faq:advanced:webaccess

1.4.14 I would like to keep track if my LAN computers are online/offline, how do I do that?

http://www.ipcops.com/wiki/faq:advanced:lanonline

1.4.15 How do I setup a HA (High Availability) IPCOP setup?

http://www.ipcops.com/wiki/faq:advanced:ha

1.4.16 I would like to have additional graphs for individual IPs. How do I do this easily?

http://www.ipcops.com/wiki/faq:advanced:ipgraph

1.4.17 I want to regenerate my SSL certificates, what do I do?

http://www.ipcops.com/wiki/faq:advanced:ssl

1.5 Servers behind IPCOP

1.5.1 I have added a server to the DMZ but it is not connecting to the Internet. What do I do?

http://www.ipcops.com/wiki/faq:orange:orangemantra

1.5.2 I can not access server X after installing IPCOP!

http://www.ipcops.com/wiki/faq:orange:accessservice

1.5.3 I moved my server to the DMZ and can no longer access any of the services.

http://www.ipcops.com/wiki/faq:orange:servermoved

1.5.4 I have added port forwarding rules but they don’t seem to work. What do I do?

http://www.ipcops.com/wiki/faq:orange:portforwarding

1.5.5 VOIP Server behind IPCOP

http://www.ipcops.com/wiki/faq:orange:voip

1.5.6 How do I access a Windows Share from over the VPN?

http://www.ipcops.com/wiki/faq:orange:share

1.6 VPNs and IPCOP

1.6.1 I have created a VPN between two IPCOPs but it will not connect. What am I doing wrong?

http://www.ipcops.com/wiki/faq:vpn:connect

1.6.2 I want to have roadwarrior access to IPCOP. How do I set it up?

http://www.ipcops.com/wiki/faq:vpn:roadwarrior

1.6.3 I want to use the builtin Microsoft VPN client. How do I connect to IPCOP?

http://www.ipcops.com/wiki/faq:vpn:msvpn

1.6.4 I have successfully created and connected to IPCOP via a VPN but I can not access any services/computers at the remote location. What’s wrong?

http://www.ipcops.com/wiki/faq:vpn:services

1.6.5 My internet connection is not good and my VPNs will not stay connected. What can I do?

http://www.ipcops.com/wiki/faq:vpn:vpnconnection

1.6.6 How do I browse network shares over a VPN?

http://www.ipcops.com/wiki/faq:vpn:shares

1.6.7 What do each of the debug options do in VPN menu?

http://www.ipcops.com/wiki/faq:vpn:debug

1.6.8 I have OpenVPN installed and I want to be able to access other subnets in addition to Green. What do I need to do?

http://www.ipcops.com/wiki/faq:vpn:openvpn

1.7 Advanced features with IPCOP

1.7.1 The built in traffic shaper for IPCOP is insufficient, what else can I use?

http://www.ipcops.com/wiki/faq:shaping

1.7.2 I want to install service Y to IPCOP. How do I do it?

IPCOP is a firewall. Adding additional services can open security holes which can be used to compromise your firewall. Certain services, such as SAMBA, expose IPCOP to unnecessary risk and should be installed on a separate computer. If you decide to continue and compromise your firewall, don’t complain when it gets hacked.

1.7.3 I want to add service X to IPCOP but it requires make. How do I install it?

IPCOP does not include make for security reasons. Compile the software on another computer and bring the binary over to IPCOP.

1.7.4 I would like to port forward based on hostname not port, how can I do this?

IPCOP does not support forwarding based on hostname. Apache can do a better job at redirecting based on hostname than IPCOP.

1.7.5 I would like to control who can and can’t access website. How do I do this?

Advproxy provides authentication for web browsing and UrlFilter provides the ability to whitelist and blacklist sites.

1.7.6 I have installed an addon to IPCOP. After upgrading IPCOP, the addon no longer works. What do I do?

Some addons created for IPCOP are kernel dependent. Many updates to IPCOP do not change kernel version, but on occasion they do. If you are using addons, read the change log BEFORE updating IPCOP. The makers of addons to IPCOP make the addons when possible. Thus, updates will not be available as soon as IPCOP updates are released. Upgrade with caution. This also applies to addons which utilize components of IPCOP such as AdvProxy (Squid dependent).

1.7.7 How do I determine what ports I need to open for application XYZ?

Most applications have documentation for what ports (both port number and protocol) need to be opened for Internet users to be able to access the application. If the documentation for your application XYZ does not include this information and a online search does not return the required information, you can do the following to determine what ports you need to open:

• Start the application
  • If the server is running on Windows, type ’netstat -a -b -n’ at the command line
  • If the server is running on Linux, type ’netstat -an’ at the command line
• Port forward based on what the output give you

1.7.8 What if I want to run application XYZ in/on Orange?

If you are running an application XYZ on Orange, you need to remember to give the IP address, DNS, and gateway settings. This application will be accessible from Green without any settings changes. For the application to be accessible from the Internet, you will need to add port forwarding rules as required.

1.7.9 Should I put application XYZ in Green or Orange?

Your situation may fall in one of two situations:

• Application servers and personal computers
  • Run a Green-Orange-Red setup if the application XYZ that you are using is going to be accessible from the Internet as general (i.e. you are running a web server). This will allow you to protect your LAN if your server becomes compromised
  • Run a Green-Red setup if the application XYZ that you are using is only going to be accessible via your LAN and/or VPN.
• Application servers
  • Run a Green-Red setup (no LAN to protect)

1.7.10 Why do some applications (ABC) need a public IP, and how do I fix that?

Some applications require a fully accessible IP address. This can be required for a number of reasons. One example would be having a VPN server that only allows one client to connect from each IP address (Cisco VPN servers have this requirement).

This problem can only be fixed if you have multiple IP addresses. To fix this problem, add your additional IP addresses (via the Network – Alias page). Then install SNATGui. Configure each computer with application ABC to use a different public IP address.

1.7.11 How do I minimize the risk of running service XYZ on my IPCOP?

If you must run a service on IPCOP, you can greatly reduce the risk to IPCOP if you do the following:

• Don’t run the program as root
• Limit access to the program (i.e. only allow LAN to access the service)
• Keep the program updated
• Enable all possible security (i.e. ACL and user groups)

1.7.12 How do I backup IPCOP to Bacula?

http://www.ipcops.com/wiki/mods:start

1.8 Command line options

1.8.1 How do I change the port forwarding settings from the command line?

http://www.ipcops.com/wiki/faq:cli:portforwarding

1.8.2 How do I change the blue access settings from the command line?

http://www.ipcops.com/wiki/faq:cli:blueaccess

1.8.3 How do I change the external access settings from the command line?

http://www.ipcops.com/wiki/faq:cli:externalaccess

1.8.4 Qos_NG is too complex to use. Is there something else I can use?

http://www.ipcops.com/wiki/mods:start

1.8.5 How do I enable SSH access from the command line?

http://www.ipcops.com/wiki/faq:cli:ssh

1.8.6 What text editors are built into IPCOP?

IPCOP comes with vi.

Chapter 2
Forum usage

A few points to remember BEFORE posting to ipcops.com.

1. We’re all Volunteers Here. Except for Milan (who’s crazy enough to fund this site), the rest of the bunch volunteers their time and knowledge.
2. The Noob attitude. Just because you are a noob, newbie, or what ever you want to call yourself, you are not excused from proper forum etiquette. I blame this on the Ubuntu craze. We are not here to baby you.
   1. Not reading the documentation. Time was taken to write the documentation and despite what most novice people think, it does contain answers to common questions.
   2. Not searching the forum. This forum has been around for a long time. Many times you can find answers to your questions just by searching the forum.
   3. Posting duplicate topics/questions. This follows point 2b. Not only does it show that you are a novice, it shows you don’t have any respect for this forum or the people here.
   4. Expecting your question to be answered in five minutes. This forum is completely provided by the community. Most people have a full time job and post when possible, which might be once every few days.
   5. People who can’t seem to spell. Use a spell checker and don’t write in texting (IM) slang.
   6. IPCOPS.COM is NOT IPCOP.ORG. This is a community support forum, not the developers project page. If you want to make a suggestion to the developers, then:
      • You might want to post your ideas on the developers mailing list:
        http://ipcop.org/index.php?module=pnWikka&tag=IPCopSupport
      • Or the feature request tacking list:
        http://sourceforge.net/tracker/?atid=428519&group_id=40604&func=browse
   7. Format for effect only. Post is in all BOLD AND/OR CAPS are inappropriate.
3. Lack of details. Without details, the posts you get will just be guesses. It wastes everyone’s time if you don’t give details. I have had previous posts where I kept asking for one piece of information and when it was finally provided (4 posts later), the problem was quickly solved.
   1. Network Diagram. A picture IS worth a thousand words, so provide a network diagram with all the details (IP address, subnet mask, gateway, dns, etc.).

      Example of acceptable Network Diagram:

      Internet – Cable Modem – Red (DHCP) [IPCOP]

      ..............[IPCOP] Green (192.168.1.1/24) – Switch – LAN Computers

      ..............[IPCOP] Blue (192.168.2.1/24) – Access Point – WLAN Computers

      ..............[IPCOP] Orange (10.1.1.1/24) – Switch – DMZ Computers

      Where 192.168.1.1 is the Green Nic address, 192.168.2.1 is the Blue Nic address, etc.

   2. Provide ALL the details. How many times have problems dragged on and on thru several replies only to finally discover they have another Router somewhere that they didn’t describe with the original post.
   3. Subnet and Subnet Mask are TWO DIFFERENT THINGS. When asked for the subnet, you are being asked for the IP address AND subnet mask associated with it.
   4. Provide configuration files and log details. Providing your configuration files (such as port forwarding settings) and logs details (such as firewall logs) can show if you have incorrectly configured your settings (i.e. port forward the wrong port).
4. Asking for custom programs on/for IPCOP and get angry when asked why you need the program. Sometimes there is an easier way to do exactly what you are looking for, so don’t get angry when you are asked why. As the old saying goes, there is more than one way to skin a cat.
   1. Try the suggestions. Time and again we go thru 30 posts to finally solve the problem with a suggestion that was made at post 4 or 5. If you don’t won’t to try the advice given - why are you posting at all?
   2. Custom addons and support after IPCOP updates/use of addons on untested versions of IPCOP. Some addons created for IPCOP are kernel dependent. Many updates to IPCOP do not change kernel version, but on occasion they do. If you are using addons, read the change log BEFORE updating IPCOP. The makers of addons to IPCOP make the addons when possible. Thus, updates will not be available as soon as IPCOP updates are released. Upgrade with caution.
   3. Attempting to make IPCOP a ’Swiss Army Firewall’. A firewall is designed for one purpose, protecting your network. Adding services to IPCOP which open security holes (such as SAMBA) are a BAD idea.
5. Stay focused. Focused posts make troubleshooting quicker and helps everyone help you.

Chapter 3
Tutorials

This section will provide detailed tutorials which allow the user to just follow along.

3.1 VPN Setup

http://www.ipcops.com/wiki/howto:vpns

3.2 Wireless with a Wireless Router

http://www.ipcops.com/wiki/howto:wireless

3.3 Creating an SSH Tunnel with IPCOP

http://www.ipcops.com/wiki/howto:ssh

3.4 Setting up IPCOP behind another firewall

http://www.ipcops.com/wiki/howto:routers

3.5 How To Setup Modem and IPCOP for DSL PPPoE or PPPoA Internet Connection

http://www.ipcops.com/wiki/howto:dialup

3.6 Basic Networking Guide

http://www.ipcops.com/wiki/howto:basic

3.7 Hardware check tutorial

http://www.ipcops.com/wiki/howto:hardwarecheck

3.8 Copying files to IPCOP

http://www.ipcops.com/wiki/howto:copying

3.9 Running commands on IPCOP

http://www.ipcops.com/wiki/howto:running

3.10 IPCOP and VMware

http://www.ipcops.com/wiki/faq:virtual

3.11 SSH with private keys

http://www.ipcops.com/wiki/howto:ssh

3.12 SNatGUI Setup

http://www.ipcops.com/wiki/howto:snatgui

3.13 Converting Existing Setups to IPCOP

http://www.ipcops.com/wiki/faq:integration

3.14 Securing an existing IPCOP installation

http://www.ipcops.com/wiki/howto:secured

3.15 Bare Metal Recovery

http://www.ipcops.com/wiki/howto:bmr

3.16 Adding additional interfaces to IPCOP (and get them to load correctly)

http://www.ipcops.com/wiki/howto:interfaces

Chapter 4
Basic Network Layouts

http://www.ipcops.com/wiki/faq:integration

Chapter 5
Requested Material

5.1 FAQs

New FAQ items will no longer be added. Please see the Wiki.

5.2 Tutorials

New Tutorial items will no longer be added. Please see the Wiki.

Chapter 6
Getting in contact with the author

6.1 Requesting Material

To request a FAQ and/or Tutorial, please send ds531 or one of the other wiki editors a PM via ipcops.com. As time permits, requested material will be addressed.

6.2 Contributing to this document

This document will no longer be updated. Please see the Wiki.

Acknowledgments

• ds531 (head author)
• 3MAT3 (RedMAC for IPCOP 1.4.13-1.4.15, OpenVPN to remote IPCOP LAN tutorial)
• danab (forum usage section)
• gungaden (MAC Spoof information, IRQ information, basic network layouts, dialup tutorial and basic networking information)
• VonSkippy (forum usage section, hardware check tutorial, and multiple IP addresses with PPPoE/PPPoA)
• weizen_42 (FAQ topic clarification, forum usage section, and catching several typos)
• hagar (SSH with private key tutorial)
• up4fun (Securing an existing IPCOP installation)
• sniper_x (Adding additional interfaces HowTo)