首页
登录 | 注册

Gentoo下简单路由搭建(做双线接入中的nat)

Gentoo下简单路由搭建(做双线接入中的nat)
1.在http://www.gentoo.org下载livecd

2.使用livecd启动

3.net-setup eth0 配置网络

4.fdisk && mkfs (按自己的需求安排磁盘分区)
 本例分为三个区 /dev/hda1 (/boot) /dev/hda2(swap) /dev/hda3(/)

5.mount /dev/hda3 /mnt/gentoo
  mkdir /mnt/gentoo/boot
  mount /dev/hda1 /mnt/gentoo/boot

6.cd /mnt/gentoo
  links http://www.gentoo.org/main/en/mirrors.xml
  下载最新的 portage-xxx.tar.bz2 , stage3-xxx-xxx.tar.bz2

7.tar xvjpf /mnt/gentoo/stage3-xxx-xxx.tar.bz2
  tar xvjf /mnt/gentoo/portage-xxx.tar.bz2 -C /mnt/gentoo/usr

8.nano -w /mnt/gentoo/etc/make.conf
  加入 USE="-X -gtk -alsa cjk nls zh_CN"
  在编译安装软件是不加入X,gtk,alsa支持(如果该软件有这些部件),加入中日韩语言支持.内码加入zh_CN支持.

9.cp -L /etc/resolv.conf /mnt/gentoo/etc/resolv.conf

10.mount -t proc none /mnt/gentoo/proc
   mount -o bind /dev /mnt/gentoo/dev

11.chroot /mnt/gentoo /bin/bash
    env-update && source /etc/profile
    export PS1="chroot) $PS1"

12.emerge --sync 同步最新的portage

13.echo "sys-libs/glibc userlocales" >> /etc/portage/package.use
   在glibc中加入用户本地化支持.

14.localedef -i en_US -f UTF-8 zh_CN.UTF-8
   nano -w /etc/locales.build
   如下(安排本地化列表):
 en_US/ISO-8859-1
        en_US.UTF-8/UTF-8
        zh_CN/GBK
        zh_CN/GB18030
        zh_CN/GB2312
        zh_CN.UTF-8/UTF-8

15.cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

16.nano -w /etc/env.c/02.locale
   如下(系统默认使用本地化配置):
 LANG="en_US.UTF-8"
        LC_ALL="en_US.UTF-8"

17.env-update && source /etc/profile (更新环境)

18.cd /usr/portage/scripts
   ./bootstrap.sh (从新编译系统工具链)

19.emerge -e system (从新编译系统工具)

20.emerge genkernel (安装Gentoo内核编译工具)

21.links http://www.kernel.org 下载最新内核.
   tar xvjf linux-xxx.tar.bz2 -C /usr/src/
   ln -s /usr/src/linux-xxx /usr/src/linux

22.links http://ftp.netfilter.org/pub/ 下载最新的iptables 和 patch-o-matic-ng
   tar xvjf patch-o-matic-ng-xxx.tar.bz2
   tar xvjf iptables-xxx.tar.bz2
 
23.cd (patch-o-matic-ng-xxx的path)
   KERNEL_DIR=/usr/src/linux IPTABLES_DIR=(iptables的path) ./runme base
   KERNEL_DIR=/usr/src/linux IPTABLES_DIR=(iptables的path) ./runme extra
   按需求选项择相关功能安装
.
24.emerge grub (安装bootloader)

25.genkernel --menuconfig --bootloader=grub all (编译内核)
   Block layer  ---> IO Schedulers  ---> Default I/O scheduler (Anticipatory)
   Processor type and features  --> Timer frequency (100 HZ)
   Processor type and features  --> Preemption Model (No Forced Preemption (Server))
  
   然后根据自己的需求配置Network packet filtering 和 Network options.
   其它内核配置视需求而定.
26. nano -w /etc/fstab
    nano -w /etc/conf.d/hostname
    nano -w /etc/conf.d/domainname
    nano -w /etc/conf.d/net
    如下:
    config_eth0=("192.168.xxx.xxx network 255.255.255.0 brd 192.168.xxx.255")   内网ip
    config_eth1=("xxx.xxx.xxx.xxx network 255.255.255.0 brd xxx.xxx.xxx.255")   外1网ip
    config_eth1=("xxx.xxx.xxx.xxx network 255.255.255.0 brd xxx.xxx.xxx.255")   外2网ip
    不配置默认外关.
    ln -s net.eth0 net.eth1
    ln -s net.eth0 net.eth2
    rc-update add net.eth0 default (使网卡启动时打开)
    rc-update add net.eth1 default
    rc-update add net.eth2 default

27. nano -w /etc/hosts
    nano -w /etc/rc.conf
    UNICODE="yes"

28. emerge syslog-ng vixie-cron slocate rp-pppoe dhcpd (rp-pppoe 及 dhcpd 在拨号接入时安装,/etc/conf.d/net的配置有所不同)
    rc-update add syslog-ng default
    rc-update add vixie-cron default

29. nano -w /boot/grub/grub.conf
    title=Gentoo Linux (2.6.16.11)
        root(hd0,0)
        kernel /kernel-genkernel-xxx root=/dev/ram0 ramdisk=8192  real_root=/dev/hda3 udev
        initrd /initramfs-genkernel-xxx

30.grep -v rootfs /proc/mounts > /etc/mtab
   grub-install /dev/hda

31. cd (iptables的path) && make && make install
32. emerge iproute2 arpd( iprouter2 自带的arpd 不会自动reply arp 请求,arpd 会自动回应)
32. exit && cd && umount /mnt/gentoo/dev && umount /mnt/gentoo/proc && umount /mnt/gentoo/boot && umount /mnt/gentoo
33. reboot
34. nano /etc/conf.d/local.start
    /bin/sysctl.bash
    /bin/router.bash
 
35. 文件sysctl.bash
#!/bin/sh
#
# setproc         This shell script takes care of setting some good basic
#                 security measures by setting some variables in /proc
#                 Some of these are enabled in the default install, but it
#                 is good to make sure that they are being set on boot.
#
#                 Note: the file /etc/sysctl.conf could be used to do this
#                       in a saner way, but this works in cases when sysctl
#                       doesn't exist (some distributions)
#
#                 Note: kernel is not compiled to do ip forwarding or
#                       masquerading so setting options such as
#                       ip_forward, ip_masq_debug is not necessary (it
#                       could be argued that rp_filter doesn't need to be
#                       set either.
#
# For more information on these values, visit:
# http://www.linuxdoc.org/HOWTO/Adv-Routing-HOWTO-13.html
# Micah Jan, 14 2001
# Modified March 31 2002 for sarai -- micah
# Enable always defragging protection in /proc/sys/net/ipv4/ip_always_defrag
#echo "1" > /proc/sys/net/ipv4/ip_always_defrag
# Enable broadcast echo protection
# If you ping the broadcast address of a network, all hosts are supposed to
# respond. This makes for a dandy denial-of-service tool. Setting to 1 will ignore these broadcasts
echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
# Enable bad error message protection - This to ignore ICMP errors caused by hosts in the network
# reacting badly to frames sent to what they perceive to be the broadcast address.
# in /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
echo "1" > /proc/sys/net/ipv4/icmp_ignore_bogus_error_responses
# The following six /proc settings are all nested in one for loop
# because they are in the same directory:
#
# * Enable IP spoofing protection turn in Source Address
# By default, routers route everything, even packets which 'obviously' don't
# belong on your network. A common example is private IP space escaping onto
# the internet. If you have an interface with a route of 195.96.96.0/24 to it,
# you do not expect packets from 212.64.94.1 to arrive there.
# Lots of people will want to turn this feature off, so the kernel hackers
# have made it easy. There are files in /proc where you can tell
# the kernel to do this for you. The method is called "Reverse Path
# Filtering". Basically, if the reply to this packet wouldn't go out the
# interface this packet came in, then this is a bogus packet and should be ignored.
# /proc/sys/net/ipv4/conf/*/rp_filter
#
# * Disable ICMP Redirect Acceptance in
#   /proc/sys/net/ipv4/conf/*/accept_redirects and
#   /proc/sys/net/ipv4/conf/*/send_redirects
#
# * Disable Source Routed Packets in
#   /proc/sys/net/ipv4/conf/*/accept_source_route
#
# * Log Spoofed Packets, Source Routed Packets, Redirect Packets in
#   /proc/sys/net/ipv4/conf/*/log_martians
#
# * Enable ICMP redirect security so that only redirect messages originating
#   from gateways listed in the default gateway list are accepted in
#   /proc/sys/net/ipv4/conf/*/secure_redirects
for device in `ls /proc/sys/net/ipv4/conf`
do
    echo "2" > /proc/sys/net/ipv4/conf/$device/rp_filter
    echo "0" > /proc/sys/net/ipv4/conf/$device/accept_redirects
    echo "0" > /proc/sys/net/ipv4/conf/$device/send_redirects
    echo "1" > /proc/sys/net/ipv4/conf/$device/secure_redirects
    echo "0" > /proc/sys/net/ipv4/conf/$device/accept_source_route
    echo "1" > /proc/sys/net/ipv4/conf/$device/log_martians
done
# Enable TCP SYN Cookie protection in /proc/sys/net/ipv4/tcp_syncookies
echo "1" > /proc/sys/net/ipv4/tcp_syncookies
# stops anyone doing an OS finger print scan on the IP stack, 64 will show as linux, 61 will screw them up
echo 61 > /proc/sys/net/ipv4/ip_default_ttl
# Increase maximum number of files that the system can use
echo "65535" > /proc/sys/fs/file-max
# Incrase maximum inodes that the system can allocate, generally recommended that
# inode-max is set to be four times the value of file-max
#echo "65535" > /proc/sys/fs/inode-max
# Maximal number of remembered connection requests, which still did not
# receive an acknowledgement from connecting client. Default value is 1024 for
# systems with more than 128Mb of memory, and 128 for low memory machines.
echo "4096" > /proc/sys/net/ipv4/tcp_max_syn_backlog
# Number of SYN packets the kernel will send before giving up on the new connection. (def. 10)
echo "5" > /proc/sys/net/ipv4/tcp_syn_retries
echo "512" > /proc/sys/net/ipv4/route/mtu_expires
# How often TCP/IP sends out keepalive messages, default 7200 (2 hours)
echo "7600" > /proc/sys/net/ipv4/tcp_keepalive_time
# The rate at which echo replies are sent to any one destination, helps slow down ping floods
#echo "10" > /proc/sys/net/ipv4/icmp_echoreply_rate
# Time to hold socket in state FIN-WAIT-2, if it was closed by our side. Peer
# can be broken and never close its side, or even died unexpectedly. Default
# value is 60sec. Usual value used in 2.2 was 180 seconds, you may restore it,
# but remember that if your machine is even underloaded WEB server, you risk
# to overflow memory with kilotons of dead sockets, FIN-WAIT-2 sockets are
# less dangerous than FIN-WAIT-1, because they eat maximum 1.5K of memory, but
# they tend to live longer. Cf. tcp_max_orphans.
# echo "360" > /proc/sys/net/ipv4/tcp_fin_timeout
# This enables a fix for 'time-wait assassination hazards in tcp', described
# in RFC 1337. If enabled, this causes the kernel to drop RST packets for
# sockets in the time-wait state.
echo "1" > /proc/sys/net/ipv4/tcp_rfc1337
# Set this if you want to disable Path MTU discovery - a technique to
# determine the largest Maximum Transfer Unit possible on your path. 0 by default
echo "0" > /proc/sys/net/ipv4/ip_no_pmtu_disc
# If a router decides that you are using it for a wrong purpose (ie, it needs
# to resend your packet on the same interface), it will send us a ICMP
# Redirect. This is a slight security risk however, so you may want to turn it
# off, or use secure redirects.
echo 0 > /proc/sys/net/ipv4/conf/all/accept_redirects
# Set timeout on kernel panics (auto reboots after # seconds):
echo 5 >  /proc/sys/kernel/panic
echo 5 >  /proc/sys/kernel/panic_on_oops
 
 
36.文件router.bash
  
#!/bin/bash
echo "8376320" > /proc/sys/net/ipv4/ip_conntrack_max
echo "1" > /proc/sys/net/ipv4/ip_forward
killall arpd
echo "1" > /proc/sys/net/ipv4/conf/eth1/proxy_arp
echo "1" > /proc/sys/net/ipv4/conf/eth2/proxy_arp
arpd -i eth1 xxx.xxx.xxx.xxx/x
arpd -i eth2 xxx.xxx.xxx.xxx/x
iptables -t nat -F
#edu-net
iptables -A POSTROUTING -t nat -s 192.168.xxx.xxx -p all -o eth2 -j SNAT --to xxx.xxx.xxx.xxx
iptables -A PREROUTING -t nat -d xxx.xxx.xxx.xxx -p all -i eth2 -j DNAT --to 192.168.xxx.xxx
(以上为静态nat,xxx.xxx.xxx.xxx为外网ip可与eth2地址不同)
iptables -A POSTROUTING -t nat -s xxx.xxx.xxx.xxx/x -p all -o eth2 -j SNAT --to xxx.xxx.xxx.xxx-xxx.xxx.xxx.xxx
(以上为动态nat)
#public-net
iptables -A POSTROUTING -t nat -s 192.168.xxx.xxx -p all -o eth1 -j SNAT --to xxx.xxx.xxx.xxx
iptables -A PREROUTING -t nat -d xxx.xxx.xxx.xxx -p all -i eth1 -j DNAT --to 192.168.xxx.xxx

iptables -A POSTROUTING -t nat -s 192.168.xxx.xxx/x -p all -o eth1 -j SNAT --to  xxx.xxx.xxx.xxx-xxx.xxx.xxx.xxx
#route rule
ip rule add prio 6 from 192.168.xxx.xxx/16 table 6
ip route replace 192.168.xxx.xxx/24 dev eth0  proto  static  src xxx.xxx.xxx.xxx table 6
ip route replace xxx.xxx.xxx.xxx/x dev eth1  proto static  src xxx.xxx.xxx.xxx table 6
ip route replace xxx.xxx.xxx.xxx/x dev eth2  proto static  src xxx.xxx.xxx.xxx table 6
(以上保证网卡所在地址段能正确路由)
ip route replace 192.168.xxx.xxx via 192.168.xxx.xxx dev eth0 proto static table 6
ip route replace xxx.xxx.xxx.xxx/21 via xxx.xxx.xxx.xxx dev eth2 proto static table 6
(以上保证网卡所在网络地址段能正确路由)
ip rule add prio 10 from 192.168.xxx.xxx table 10
ip route replace default via xxx.xxx.xxx.xxx dev eth2 proto static table 10
(此为对外开放服务器所走路由线路,其它对外服务类似)
ip route replace 58.17.0.0/16 proto static nexthop via xxx.xxx.xxx.xxx dev eth1weight 1 nexthop via xxx.xxx.xxx.xxx dev eth2 weight 3
ip route replace 58.19.0.0/16 proto static nexthop via xxx.xxx.xxx.xxx dev eth1weight 1 nexthop via xxx.xxx.xxx.xxx dev eth2 weight 3
...
....
ip route replace 222.248.0.0/16 proto static  via xxx.xxx.xxx.xxx dev eth2
ip route replace  192.168.0.0/16 via 192.168.xxx.xxx dev eth0 proto static (内网默认路由)
ip route replace  xxx.xxx.xxx.xxx/x via xxx.xxx.xxx.xxx dev eth2 proto static (外网1默认路由)
ip route replace default via xxx.xxx.xxx.xxx dev eth1 proto static (默认路由)
ip route flush cache
#iptables-firewall
iptables -F INPUT
iptables  -A INPUT -s 192.168.xxx.xxx/24 -d 192.168.xxx.xxx -p tcp --syn --dport 22 -i eth2 -j ACCEPT
iptables  -A INPUT -d xxx.xxx.xxx.xxx -p tcp --syn --dport 22 -i eth2 -j REJECT
iptables  -A INPUT -d xxx.xxx.xxx.xxx -p tcp --syn --dport 22 -i eth0 -j REJECT
iptables  -A INPUT -d xxx.xxx.xxx.xxx -p tcp --syn --dport 22 -i eth1 -j REJECT
iptables  -A INPUT   -p tcp --syn --dport 4444 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 135 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 136 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 137 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 138 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 139 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 445 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 593 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 3127 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 42 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 1025 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 5554 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 9996 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 389 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 636 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 3268 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 3269 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 1503 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 707 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 1999 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 2001 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 2023 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 2583 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 6129 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 6267 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 6670 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 6671 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 6939 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 6969 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 7306 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 7511 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 7526 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 8011 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 9989 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 19191 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 1029 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 20168 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 23444 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 27374 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 30100 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 31337 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 50766 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 45576 -j DROP
iptables  -A INPUT   -p tcp --syn --dport 61466 -j DROP
iptables  -A INPUT   -p udp  --dport 135 -j DROP
iptables  -A INPUT   -p udp  --dport 136 -j DROP
iptables  -A INPUT   -p udp  --dport 137 -j DROP
iptables  -A INPUT   -p udp  --dport 138 -j DROP
iptables  -A INPUT   -p udp  --dport 139 -j DROP
iptables  -A INPUT   -p udp  --dport 445 -j DROP
iptables  -A INPUT   -p udp  --dport 593 -j DROP
iptables  -A INPUT   -p udp  --dport 1434 -j DROP
37.ipcalc.bash(用于教育网的掩码计算,print 部分可以根据要求改写,可用于生成ip route replace 58.19.0.0/16 proto static nexthop via xxx.xxx.xxx.xxx dev eth1weight 1 nexthop via xxx.xxx.xxx.xxx dev eth2 weight 3 这部分)
#/bin/bash
awk '{  ("ipcalc -p "$1" "$3) | getline var;var=substr(var,8); print $1"/"var}' $1  > $2
 
39.加入本地化支持(在lib与内核中),将来可以使用iptables的string做内容控制.:)
 
40.未尽事宜:使用vlan来减少网卡数量.使用tc做流控,加入radius做认证,加入pppoe,加入vpn等.把以前的实验整合.
41.使用情况:同时在线用户2,000左右,并发最大80,000左右,平均流量110Mbps/s 左右,工作正常.
42.硬件配置:cpu 2.0GHZ, mem 1G.
 
43.补遗,保证数据原路返回的设置.
iptables -t mangle -A PREROUTING -i WAN1dev  -m conntrack  --ctstate NEW  -j CONNMARK --set-mark 0x100
iptables -t mangle -A PREROUTING -i WAN2dev  -m conntrack  --ctstate NEW  -j CONNMARK --set-mark 0x200
iptables -t mangle -A POSTROUTING -o WAN1dev  -m conntrack  --ctstate NEW  -j CONNMARK --set-mark 0x100
iptables -t mangle -A POSTROUTING -o WAN2dev  -m conntrack  --ctstate NEW  -j CONNMARK --set-mark 0x200
iptables -t mangle -A PREROUTING -i Landev  -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
iptables -t mangle -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j CONNMARK --restore-mark
ip rule add prio 100 from  Wan1subnet subnet 100
ip rule add fwmark 0x100 prio 101 table 100
ip route add table 100 to Wan1subnet   dev WAN1dev  proto kernel  scope link
ip route add table 100 to Wan2subnet   dev WAN2dev  proto kernel  scope link
ip route add table 100 to Lansubnet   dev Landev  proto kernel  scope link
ip route add default via GW1 dev WAN1dev table 100
ip rule add  prio 100 from Wan2subnet subnet  200
ip rule add fwmark 0x200 prio 101 table 200
ip route add table 200 to Wan1subnet   dev WAN1dev  proto kernel  scope link
ip route add table 200 to Wan2subnet   dev WAN2dev  proto kernel  scope link
ip route add table 200 to Lansubnet   dev Landev  proto kernel  scope link
ip route add default via GW2 dev WAN2dev table 200
 
44.iproute2要安与内核一致的版本.

相关文章

  • ip此命令的适用范围:RedHat.RHEL.Ubuntu.CentOS.SUSE.openSUSE.Fedora.  .语法 选项]  OBJECT  COMMAND [help] 对象可以是:link,网络设备:addr,设备的协议地址 ...
  • 思路:多实例安装mysql可以遵循.修改my.cnf的配置文件和目录文件结构.在服务器下需要做的操作如下: 1.新建另外一个实例的文件目录 #cd /data/  #mkdir -p /data/mysqldata/{3307/{data, ...
  • iOS,Android和Windows都会为开发人员公开API,为每个人构建可访问的移动应用. 我们很高兴地宣布,我们在Xamarin.Forms中添加了可用性的新API,以便开发人员更轻松地构建可访问的跨平台移动应用程序. 在这篇文章中, ...
  • iptables此命令的适用范围:RedHat.RHEL.Ubuntu.CentOS.SUSE.openSUSE.Fedora.  .语法 iptables [-t table]  -I  chain [rulenum]  rule-spe ...
  • 【原创】hadoop集群搭建
    首先确定hdfs分布式文件系统目前很多大公司都在用,例如百度.腾讯.淘宝等.相信网上也有很多关于这方面的文档,我写这篇文章只是为了自己更加深刻的学习和理解,或者帮助一些不会搭建的童鞋们!以前我搭建的是hadoop-0.20.2.hbase- ...
  • 使用Gitolite搭建轻量级的Git服务器-a
    使用Gitolite搭建轻量级的Git服务器 By Harrison Feng 在Git服务管理工具这个领域,主要有三种流行的方案,它们分别是 Gitosis - 轻量级, 开源项目,使用SSH公钥认证,只能做到库级的权限控制.目前项目已经 ...

2020 unjeep.com webmaster#unjeep.com
12 q. 0.015 s.
京ICP备10005923号