I would like to configure a basic Debian Wheezy amd64 as a whonix gateway and router for the local network.
Would like the firewall rules (iptables or whatever) as well as the necessary packages to install in order to Torify everything via Tor transparent proxy including DNS so it will be anonymous and also allow hosts to resolve .onion addresses. This should also drop / reject everything non-tcp such as icmp or udp.
since this machine will act as a router also, I would like to have some kind of secure IP allocation (DHCP). The first idea was based on MAC address, but since a MAC address can be spoofed is it better to use switch ports? The goal is to identify each host in the subnet via something and only assign a certain IP address to it, which cannot be changed without the router’s express acceptance.
Last but not least, would like to make all the hosts in the subnet not able to talk to each other and only be able to talk to the router. Let’s assume for simplicity that the router/gateway has the IP 10.0.8.1 and the other hosts in the subnet are 10.0.8.2 and 10.0.8.3 and 10.0.8.4
I want 10.0.8.1 to be able to talk to all the hiosts (1)
all the hosts to be able to talk to 10.0.8.1 (2)
all the hosts NOT to be able to talk to each other, except 10.0.8.1 (e.g. 10.0.8.2 -> 10.0.8.4).
Since we talk about hosts on the same subnet, these packets do not go via the router/gateway so not sure if I can filter them there. How can this be accomplished?