# On install, I selected:

ubuntu basic server (but will not next time)

ssh server

STEP 1: NETWORK CONFIGURATION

sudo nano /etc/network/interfaces

# The loopback network interface

auto lo
iface lo inet loopback

# WAN
auto eth0
iface eth0 inet dhcp

# LAN
auto eth1
iface eth1 inet static
address 192.168.20.1
network 192.168.20.0
netmask 255.255.255.0
broadcast 192.168.20.255

sudo nano /etc/init.d/networking restart

STEP 2: UFW CONFIGURATION

sudo ufw allow 22

sudo ufw enable
sudo nano /etc/default/ufw

DEFAULT_FORWARD_POLICY="ACCEPT"

sudo nano /etc/ufw/sysctl.conf

net.ipv4.ip_forward=1

sudo nano /etc/ufw/before.rules

# nat Table rules

*nat
:POSTROUTING ACCEPT [0:0]

# Forward traffic from eth1 through eth0.

-A POSTROUTING -s 192.168.20.0/24 -o eth0 -j MASQUERADE

# don't delete the 'COMMIT' line or these nat table rules won't be
processed
COMMIT

sudo ufw disable && sudo ufw enable

STEP 3: DHCP CONFIGURATION

sudo nano /etc/default/dhcp3-server

INTERFACES="eth1"

sudo nano /etc/dhcp3/dhcpd.conf

# OSS Sinple Router dhcpd.conf version 0 2010/05/01

#
ddns-update-style none;

# option definitions common to all supported networks...

option domain-name "tonytonychopper.homelinux.com";
option domain-name-servers 8.8.8.8, 8.8.4.4;

default-lease-time 600;
max-lease-time 7200;

# If this DHCP server is the official DHCP server for the local
# network, the authoritative directive should be uncommented.
authoritative;

# Use this to send dhcp log messages to a different log file (you also
# have to hack syslog.conf to complete the redirection).
log-facility local7;

# This is a very basic subnet declaration.

subnet 192.168.20.0 netmask 255.255.255.0 {

range 192.168.20.200 192.168.20.210;
option routers 192.168.20.1;
}

STEP 3: DDNS CONFIGURATION

sudo apt-get install ddclinet

STEP 4: SECURITY

sudo apt-get install fail2ban

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/ssh/sshd_config

LogLevel VERBOSE

##add directions to enable http(s)

test with:
sudo fail2ban-regex /var/log/auth.log /etc/fail2ban/filter.d/sshd.conf | more