Topic: Noob needs help with mail config and security decisions.

[ghopper]

I've been reading a fair bit of stuff, but I'm a bit new to 'real' networking where my little network is connected to the real world and I'm having a heck of a time figuring out what to worry about and what to ignore.  I figure someone has to have gone down this road before and I'm hoping people will be willing to give me a hand getting started.

I am trying to figure out how to get to the configuration I need (or think I need) for my home and home office networks.  As a result I’m looking for advice in two different areas: 1) is my plan feasible and advisable? And 2) what specific recommendations are people willing to make about how to go about doing this- i.e. any preferences for hardware or software (where I need to add hardware or software.)

Currently two file servers (business and home), both SME 6.1 that will get upgraded to 7.  

I’ve registered two domain names at GANDI, one for my business, and one for the home site.  For each domain I’d like to add mail service, web hosting, a VPN connection on one server, and allow limited access from the web to certain content on each server (not web pages, actual stuff on the drives).

Ok, time for the stupid admission.  I can't quite figure out how to get things pointed at each other (the domains pointed to the servers, and the services doing what they are supposed to do...) I’m a bit afraid to start plugging in numbers and trying things lest I break something.  I know I need to change something at Gandi to point to one of the 5 static IP addresses, but how do I get each domain pointed at the right server and how does the server know to get the email?

Before someone says "read the manual", I have. I also bought two useless books that just don't really explain that bit between what the registrars provide and what the manual says about configuration of the server.  I also searched the forums but have not found the answer.  Maybe I'm just dumb.

The rough configuration right now is:



Both the home and business systems (Server, printers and workstations for each) are on the same network.  Security on the business server is pretty important

I figure I need to add a better firewall than what is in the cable router.  I also figure I need to move some of the other services off the router, but to where? I’m also wondering if I need a separate router (see below).

I’m using Gandi as my registrar and they offer both primary and secondary DNS as well as a few other services, like being able to register a name server with the registry, but they don’t host anything.  I do have several email addresses on the two domains forwarded to accounts on two separate ‘ISPs’, neither of which I use for access.  One is a backup dialup account and an email address I have had for 17 years.  The other ISP is my old business ISP, and I have maintained an account there just to keep the email open for a while longer until I am sure I don’t need the old address anymore.

The two servers are currently just file servers, #1 for my home (for which I just registered a domain) and #2 for my business.  I have a third box that is the same as these other two that will be upgraded with a pair of larger hard drives, SME server 7 installed and then the files from one will be migrated.  I’ll do the same to the one just vacated (wipe, install 7 and move the second server’s files to the new box.  I have a fourth box (PII 400) that I could put a second Ethernet card in and run smoothwall or monowall or something like that for a firewall.

Do I want to switch the Comcast router to bridge mode and get a separate router behind the software/hardware firewall?

On a related note, I do have an older copy of MS Small Business Server (2000) and was considering putting that up so I could enjoy a shared outlook address book and calendaring among all the workstations as well as a couple of other services unless there was something non-MS that would work with outlook and give a shared or group address book, etc..  Any thoughts on this?

I'm just as glad to be pointed to information sources, as I am to receive specific advice or recommendations.

Thanks for your time!

Grant

[dmay]

Why do you need two servers? IIUC, everything you want could be accomplished on one server.

Your DNS external static ip domain entries including MX record for mail services you set at your DNS provider.

As your cable/router is your firewall, your static external ip to internal ip firewall rules would be set on your cable router.

If your cable/router is your firewall, your SME server set up should be server-only. One nic with one internal IP is all you need. GW/DNS is your cable/router internal ip. Then simply follow the SME manual for a basic server-only deployment.

One final option might be to remove all firewall services from your cable/router and let SME do it. Then simply follow the SME manual for a basic server-gateway deployment.

In summary your focus should be on understanding how to correctly set up your DNS provider and what role you want your cable/router/firewall to play.

Darrell

[bpivk]

You said that you've read the manual. I think that you didn't read it thoroughly.
Listen to dmay's suggestion and browse a little trough the wiki.
And for the dns part... Please search this forum for web cloaking because i had a long discussion about this topic.

[ghopper]

Ok,  That helps.  At least I know I was sorta on the right track.  I can figure what the right routing information is and start getting things plugged in.  Thanks for the search tip too!

Thanks to both of you!

To answer the question, the  two servers are one is for business, and one is personal.  The business one has some particular requirements, the tax man won't let me deduct the cost of the server if it's not business, and when I end up opening an office again, I just wanna move it there with no messing.  One would be easier, but not better.

[andy_wismer]

Hi

If you need help with the DNS and stuff, mail me at:

andy.wismer AT anwi.ch

I don't think the world needs to read about your internal DNS, especially if you're concerned with security.

Regards
Andy Wismer