RAMBOOT-Home-Router-HOWTO

This HOWTO provides an example of using RAMBOOT for a home router on an inexpensive Intel Atom setup. The RAMBOOT project was actually started specifically for this system.

Components Used

1U rack-mount case Supermicro CSE-502L-200B
Intel Atom D510 system board with dual Gigabit (Intel 82574L) Supermicro MBD-X7SPA-H-O
4GB RAM
8GB low-profile USB flash drive Verbatim Store 'n' Stay

Total cost at the time of purchase (March 2012): $326.36 (including shipping).

Some notes on the hardware configuration:

There is no HDD since the system will use the USB flash to boot and run in-memory from there.
The USB flash was specifically chosen for it's small size. It can make use of the on-board vertical USB slot and still fit within a 1RU case.
The major factor for selection of the Atom system board was finding one with dual on-board Gigabit network interfaces which use an Intel networking chipset. In testing, non-Intel chipsets are often not able to achieve Gigabit performance.
Going with a rack-mount case was one of the major costs for the project ($75). If you don't require a rack-mount solution, you can get a less expensive enclosure.

See Photos at the bottom of this page.

This setup makes use of 4GB RAM, with a 1GB ramdisk and 3GB remaining for the OS.

Installing

Install the latest RAMBOOT release to the USB flash using the instructions on the RAMBOOT website (RAMBOOT-1.0.0-beta1 was used for this HOWTO).

Modify the SYSLINUX.CFG file on the USB flash (in the SYSLINUX directory) to set the correct boot device and ramdisk size:

DISPLAY README.TXT
TIMEOUT 50
TOTALTIMEOUT 9000
ONTIMEOUT core

LABEL memtest
	KERNEL memtest

LABEL core
	KERNEL vmlinuz-3.8.0-34-generic
	INITRD initrd.img-3.8.0-34-generic
	APPEND root=/dev/sda1 boot=ramboot ramdisk_size=1048576K elevator=deadline

Upon first boot, the absence of a config.tar.gz archive will result in the root account being enabled. Login as root (no password is set).

Using apt-get, update packages and install the software desired for your system.

At a minimum:

apt-get update
apt-get dist-upgrade
apt-get install nano
apt-get install sudo
apt-get install ssh
apt-get install iptables
apt-get install vlan
apt-get install bridge-utils
apt-get install iputils-ping
apt-get install ntpdate

You will want to add a non-root user (useradd) and add the user to /etc/sudoers, then disable the root user. You may also want to install a DHCP server and other network services depending on your goals for the OS.

Note that some common packages may not be found by apt-get. If this is the case you may need to edit your APT sources.list and include additional repositories.

You should avoid creating specific configuration files at this stage, since we will be using the state of the OS as a new base image for your RAMBOOT system.

You may want to use a default password for user accounts in this stage as well, as they will be replaced by the configuration package later on.

Next mount the bootflash and run the rebuild_rootfs script from the INSTALL folder.

After this, you should be able to reboot and have a system with the packages you've installed.

Place your system configuration in /etc/rc.local

Here is an example configuration:

#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.

modprobe nf_conntrack
modprobe ip_conntrack

# OUTSIDE inteface
ip addr add 203.0.113.9/24 dev eth0
ip link set up dev eth0
ip route add default via 203.0.113.1 dev eth0 metric 254
echo "nameserver 203.0.113.2" > /etc/resolv.conf

# INSIDE interface
ip addr add 192.168.0.1/24 dev eth1
ip link set up dev eth1

ntpdate 203.0.113.1
hwclock --systohc

echo 1025 65535 > /proc/sys/net/ipv4/ip_local_port_range
echo 1 > /proc/sys/net/ipv4/ip_forward                                  # Enable IP forwarding
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects                   # Don't accept ICMP redirect
echo 0 > /proc/sys/net/ipv4/conf/all/send_redirects                     # Don't send ICMP redirect either
echo 0 > /proc/sys/net/ipv4/conf/all/accept_source_route                # Don't accept source routed packets
echo 1 > /proc/sys/net/ipv4/conf/all/log_martians                       # Log packets dropped by rp_filter
echo 2 > /proc/sys/net/ipv4/ip_dynaddr                                  # Permit and log dynamic source rewriting (required for FW)
echo 0 > /proc/sys/net/ipv4/tcp_ecn                                     # Disable Explicit Congestion Notification
echo 1 > /proc/sys/net/ipv4/conf/all/arp_announce                       # Prefer local subnet IP to respond for ARP source
echo 2 > /proc/sys/net/ipv4/conf/all/arp_ignore                         # Ignore ARP unless its on and from the local subnet
echo 4096 > /proc/sys/net/netfilter/nf_conntrack_expect_max             # Increases the default conntrack expect from 256 to 4096
echo 1 > /proc/sys/net/netfilter/nf_conntrack_tcp_be_liberal            # Don't use TCP window scale as a determinant for packet validity
echo 2048  > /proc/sys/net/ipv4/neigh/default/gc_thresh1                # ARP table minimum before GC
echo 8192  > /proc/sys/net/ipv4/neigh/default/gc_thresh2                # ARP table soft maxium
echo 16384 > /proc/sys/net/ipv4/neigh/default/gc_thresh3                # ARP table hard maxium
echo 300   > /proc/sys/net/ipv4/neigh/default/base_reachable_time       # ARP cache valid minimum of between 150 and 450 seconds (random)
echo 128 > /proc/sys/net/ipv4/igmp_max_memberships                      # IGMP max member groups
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding                         # Enable IPv6 forwarding
echo 0 > /proc/sys/net/ipv6/conf/all/accept_ra                          # Don't accept IPv6 RA from other hosts (rogue IPv6 routers)

# System Firewall Policy:

iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A INPUT -p tcp -m tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p icmp -f -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --set --name DEFAULT --rsource
iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 --name DEFAULT --rsource -j DROP
iptables -A INPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
iptables -A INPUT -i eth1 -m state --state NEW -p udp -m udp --sport 68 --dport 67 -j ACCEPT
iptables -A INPUT -i eth1 -m state --state NEW -p udp -m udp --dport 53 -j ACCEPT
iptables -A INPUT -i eth1 -m state --state NEW -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -i eth1 -m state --state NEW -p udp -m udp --dport 123 -j ACCEPT
iptables -A INPUT -j DROP

iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW -m owner --uid-owner root -j ACCEPT
iptables -A OUTPUT -m state --state NEW -m owner --gid-owner root -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p udp -m udp --dport 53 -j ACCEPT
iptables -A OUTPUT -m state --state NEW -p tcp -m tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -j DROP

iptables -t raw -A PREROUTING -i lo -j NOTRACK

# NAT rules:

iptables -A POSTROUTING -s 192.168.0.0/24 -o eth0 -j MASQUERADE
iptables -A POSTROUTING -s 192.168.0.0/24 -d 192.168.0.0/24 -o eth1 -j MASQUERADE # NAT reflection rule

# Network Firewall Policy:

iptables -A FORWARD -p tcp -m tcp --tcp-flags ALL ALL -j DROP
iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A FORWARD -p tcp -m tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A FORWARD -p tcp -m tcp --tcp-flags ALL NONE -j DROP
iptables -A FORWARD -p icmp -f -j DROP
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT

# Rules to block or allow internal traffic here.

iptables -A FORWARD -i eth1 -m state --state NEW -j ACCEPT
iptables -A FORWARD -j DROP

exit 0

After you have configured your system the way you want, you can save the configuration using the example save script provided in /scripts/config-save

You should then have a functional in-memory router OS.

Any changes should be made to rc.local and the config-save script should be run again for the configuration to persist through a reboot.

Note that this is a very basic example and doesn't include a DHCP client for the outside interface, or DNS and DHCP services for the internal network.

Photos

Here are some photos of the assembled unit:

The USB storage was painted for an artistic touch (Note to self: nail polish isn't a good idea for this ... very long dry time).

The unit powered up and running.

Top view of the system.

Close-up of the USB flash in the system board.

Copyright © 2013, Ray Patrick Soucy
Code examples are licensed under the GNU General Public License version 2 or later. Verbatim copying and distribution of this page is permitted provided this notice is preserved.