Linux firewall & router for home server
Hi all
dạo này thấy nhiều anh em hỏi về vấn đề làm router và firewall trên linux thế nào.
Nhân tiện vừa cài demo trên 1 máy wmware post lên anh em tham khảo.
1, hệ điều hành centos 5.1
2, mạng
network card 0: 10.2.14.41/21
network card 1: 10.2.6.254/24
network card 2: 10.2.2.254/24
client 1 10.252.6.1/24
Mục đích: mạng on lớp 2 có thể kết nối đến lớp mạng 10.1.8.0/21 trên cơ sở nat source
Đây chỉ là cơ bản thôi. Từ đây anh em có thể phát triển thêm cho phù hợp với chính sách bảo mật và mạng của mình.
Xin lỗi vì khi làm mình copy ra file txt giờ copy ngược vào thôi :d
Các bước biến linux thành 1 firewall router
centos 5)
Thêm cái này vào .bash_profile
LANG=EN_US
LANGUAGE=EN_US
Kernel bao nhiêu nhỉ
[root@centos ~]# uname -r
2.6.18-53.el5
Dùng các lệnh này để cho foward trafic
Code:
[root@centos ~]#echo 1 >> /proc/sys/net/ipv4/ip_forward
[root@centos ~]#echo “option ip_conntrack ip_conntrack_disable_ve0=0″ >> /etc/modprobe.conf
[root@centos ~]#vi /etc/modprobe.conf
[root@centos ~]#vi /etc/sysctl.conf
Xem state table
Code:
[root@centos ~]#vi /proc/net/ip_conntrack
Muốn làm NAT được với nhiều địa chỉ thì phải add alias interface
Code:
[root@centos ~]# ip address add 10.1.14.42 dev eth0
[root@centos ~]# ip address add 10.1.7.254 dev eth1
Không biết khi reboot có bị mất không nhỉ
Code:
[root@centos ~]# ifconfig
eth0 Link encap:Ethernet HWaddr 00:0C:29:89:F5:B0
inet addr:10.1.14.41 Bcast:10.1.15.255 Mask:255.255.248.0
inet6 addr: fe80::20c:29ff:fe89:f5b0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:71216 errors:0 dropped:0 overruns:0 frame:0
TX packets:6989 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6441233 (6.1 MiB) TX bytes:1235453 (1.1 MiB)
Interrupt:169 Base address:0×2000
eth1 Link encap:Ethernet HWaddr 00:0C:29:89:F5:BA
inet addr:10.1.6.254 Bcast:10.1.6.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe89:f5ba/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:1170 errors:0 dropped:0 overruns:0 frame:0
TX packets:582 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:136229 (133.0 KiB) TX bytes:103174 (100.7 KiB)
Interrupt:177 Base address:0×2080
eth2 Link encap:Ethernet HWaddr 00:0C:29:89:F5:C4
inet addr:10.1.2.254 Bcast:10.1.2.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe89:f5c4/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:632 errors:0 dropped:0 overruns:0 frame:0
TX packets:97 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:89882 (87.7 KiB) TX bytes:17363 (16.9 KiB)
Interrupt:193 Base address:0×2400
Sao không hiện cái ip mới add đó nhỉ
ping thử cái coi nào
Code:
[root@centos ~]# ping 10.1.14.42
PING 10.1.14.42 (10.1.14.42) 56(84) bytes of data.
64 bytes from 10.1.14.42: icmp_seq=1 ttl=64 time=0.573 ms
64 bytes from 10.1.14.42: icmp_seq=2 ttl=64 time=0.297 ms
— 10.1.14.42 ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.297/0.435/0.573/0.138 ms
Vẫn được mà
Khởi động lại mạng cái xem có bị mất không nào
Code:
[root@centos ~]# service network restart
Shutting down interface eth0: [ OK ]
Shutting down interface eth1: [ OK ]
Shutting down interface eth2: [ OK ]
Shutting down loopback interface: [ OK ]
Disabling IPv4 packet forwarding: net.ipv4.ip_forward = 0
[ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0: [ OK ]
Bringing up interface eth1: [ OK ]
Bringing up interface eth2: [ OK ]
Chắc là mất rồi
Thử ping cái cho chắc cú:
Code:
[root@centos ~]# ping 10.1.14.42
PING 10.1.14.42 (10.1.14.42) 56(84) bytes of data.
— 10.1.14.42 ping statistics —
3 packets transmitted, 0 received, 100% packet loss, time 2001ms
Thôi thêm alias luôn cho nó lành 
Code:
[root@centos ~]# cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth0:1
Kiểm tra cái nào
Code:
vi /etc/sysconfig/network-scripts/ifcfg-eth0:1
# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]
DEVICE=eth0
ONBOOT=yes
BOOTPROTO=static
IPADDR=10.1.14.41
NETMASK=255.255.248.0
GATEWAY=10.1.8.4
HWADDR=00:0c:29:89:f5:b0
TYPE=Ethernet
Sửa thành eth0:1 thôi
Code:
# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]
DEVICE=eth0:1
ONBOOT=yes
BOOTPROTO=static
IPADDR=10.1.14.42
NETMASK=255.255.248.0
#GATEWAY=10.1.8.4
HWADDR=00:0c:29:89:f5:b0
TYPE=Ethernet
Lại phải khởi động lại mạng. Chán quá
Code:
[root@centos ~]# service network restart
Shutting down interface eth0: [ OK ]
Shutting down interface eth1: [ OK ]
Shutting down interface eth2: [ OK ]
Shutting down loopback interface: [ OK ]
Disabling IPv4 packet forwarding: net.ipv4.ip_forward = 0
[ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0: [ OK ]
Bringing up interface eth1: [ OK ]
Bringing up interface eth2: [ OK ]
Ok rồi kiểm tra đi
Code:
[root@centos ~]# ifconfig -a
eth0 Link encap:Ethernet HWaddr 00:0C:29:89:F5:B0
inet addr:10.1.14.41 Bcast:10.1.15.255 Mask:255.255.248.0
inet6 addr: fe80::20c:29ff:fe89:f5b0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:228073 errors:0 dropped:0 overruns:0 frame:0
TX packets:18440 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:29410626 (28.0 MiB) TX bytes:2085369 (1.9 MiB)
Interrupt:169 Base address:0×2000
eth0:1 Link encap:Ethernet HWaddr 00:0C:29:89:F5:B0
inet addr:10.1.14.42 Bcast:10.1.15.255 Mask:255.255.248.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:169 Base address:0×2000
eth1 Link encap:Ethernet HWaddr 00:0C:29:89:F5:BA
inet addr:10.1.6.254 Bcast:10.1.6.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe89:f5ba/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:11452 errors:0 dropped:0 overruns:0 frame:0
TX packets:12587 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1158330 (1.1 MiB) TX bytes:13217785 (12.6 MiB)
Interrupt:177 Base address:0×2080
eth2 Link encap:Ethernet HWaddr 00:0C:29:89:F5:C4
inet addr:10.1.2.254 Bcast:10.1.2.255 Mask:255.255.255.0
inet6 addr: fe80::20c:29ff:fe89:f5c4/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:3214 errors:0 dropped:0 overruns:0 frame:0
TX packets:506 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:410013 (400.4 KiB) TX bytes:80366 (78.4 KiB)
Interrupt:193 Base address:0×2400
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:2414 errors:0 dropped:0 overruns:0 frame:0
TX packets:2414 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:3475889 (3.3 MiB) TX bytes:3475889 (3.3 MiB)
sit0 Link encap:IPv6-in-IPv4
NOARP MTU:1480 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
[root@centos ~]#
[root@centos ~]# ping 10.1.14.42
PING 10.1.14.42 (10.1.14.42) 56(84) bytes of data.
64 bytes from 10.1.14.42: icmp_seq=1 ttl=64 time=0.115 ms
64 bytes from 10.1.14.42: icmp_seq=2 ttl=64 time=0.112 ms
— 10.1.14.42 ping statistics —
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.112/0.113/0.115/0.010 ms
[root@centos ~]#
Mạng thế là ngon rồi nhỉ
Giờ thì nat cái nào
Thêm 1 rule NAT xem thế nào
Code:
[root@centos ~]#iptables -t nat -A PREROUTING -i eth1 -p tcp –dport 8080 -j DNAT –to 10.1.14.41:22
list các rule ra xem thế nào
Code:
[root@centos ~]#iptables -t nat -L -n
[root@centos ~]#iptables-save > /etc/sysconfig/iptables
Save lại để sau chỉnh cho dễ ta có file iptables từ đây có thể chỉnh sửa trực tiếp trên file
Code:
[root@centos ~]#vi /etc/sysconfig/iptables
# Generated by iptables-save v1.3.5 on Thu Oct 16 09:57:45 2008
*nat
REROUTING ACCEPT [200:21857]
OSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -i eth1 -p tcp -m tcp -d 10.1.7.254 -j DNAT –to-destination 10.1.8.5
-A PREROUTING -i eth1 -p tcp -m tcp –dport 8080 -j DNAT –to-destination 10.1.14.41:22
-A POSTROUTING -o eth0 -p tcp -m tcp –dport 22 -j SNAT –to 10.1.14.41
-A POSTROUTING -o eth0 -p tcp -m tcp –dport 23 -j SNAT –to 10.1.14.41
-A POSTROUTING -o eth0 -p tcp -m tcp -j SNAT –to 10.1.14.42
-A POSTROUTING -o eth0 -p udp -m udp -j SNAT –to 10.1.14.42
-A POSTROUTING -o eth0 -p icmp -m icmp -j SNAT –to 10.1.14.42
#-A POSTROUTING -o eth0 -p tcp -m tcp -s 10.1.6.1 -j SNAT –to 10.1.14.42
#-A POSTROUTING -o eth0 -p udp -m udp -s 10.1.6.1 -j SNAT –to 10.1.14.42
#-A POSTROUTING -o eth0 -p tcp -m tcp –dport 389 -j SNAT –to 10.1.14.41
#-A POSTROUTING -o eth0 -p tcp -m tcp –dport 80 -j SNAT –to 10.1.14.42
#-A POSTROUTING -o eth0 -p tcp -m tcp –dport 3389 -j SNAT –to 10.1.14.42
#-A POSTROUTING -o eth0 -p tcp -m tcp –dport 10002 -j SNAT –to 10.1.14.42
COMMIT
# Completed on Thu Oct 16 09:57:45 2008
# Generated by iptables-save v1.3.5 on Thu Oct 16 09:57:45 2008
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [155:21412]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -i eth1 -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp –icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
#-A RH-Firewall-1-INPUT -j ACCEPT
#-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -j ACCEPT
#-A RH-Firewall-1-INPUT -p udp -m state –state NEW -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 20 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 21 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 23 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 25 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m udp –dport 53 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 80 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 110 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 143 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 161 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 389 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 443 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 3389 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 10002 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT –reject-with icmp-host-prohibited
COMMIT
# Completed on Thu Oct 16 09:57:45 2008
Add thêm static route nào
Code:
vi /etc/sysconfig/static-routes
any host 10.1.2.3 gw 10.1.8.5
any net 10.1.17.0/24gw 10.1.8.5
any net 10.1.19.0/24 gw 10.1.8.5
any net 10.1.20.0/24 gw 10.1.8.5
any net 10.1.3.0/24 gw 10.1.8.5
any net 10.1.16.0/24 gw 10.1.8.2
Khởi động lại network coi nào.
Code:
[root@centos ~]# service network restart
Shutting down interface eth0: [ OK ]
Shutting down interface eth1: [ OK ]
Shutting down interface eth2: [ OK ]
Shutting down loopback interface: [ OK ]
Disabling IPv4 packet forwarding: net.ipv4.ip_forward = 0
[ OK ]
Bringing up loopback interface: [ OK ]
Bringing up interface eth0: [ OK ]
Bringing up interface eth1: [ OK ]
Bringing up interface eth2: [ OK ]
Usage: inet_route [-vF] del {-host|-net} Target[/prefix] [gw Gw] [metric M] [[de v] If]
inet_route [-vF] add {-host|-net} Target[/prefix] [gw Gw] [metric M]
[netmask N] [mss Mss] [window W] [irtt I]
[mod] [dyn] [reinstate] [[dev] If]
inet_route [-vF] add {-host|-net} Target[/prefix] [metric M] reject
inet_route [-FC] flush NOT supported
Lỗi gì thế nhỉ!
Ai biết chỉ tôi cái
show route lên xem thế nào
Code:
[root@centos ~]# netstat -rn
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
10.1.2.3 10.1.8.5 255.255.255.255 UGH 0 0 0 eth0
10.1.2.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2
10.1.3.0 10.1.8.5 255.255.255.0 UG 0 0 0 eth0
10.1.6.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
10.1.8.0 0.0.0.0 255.255.248.0 U 0 0 0 eth0
10.1.16.0 10.1.8.2 255.255.255.0 UG 0 0 0 eth0
10.1.19.0 10.1.8.5 255.255.255.0 UG 0 0 0 eth0
10.1.20.0 10.1.8.5 255.255.255.0 UG 0 0 0 eth0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 eth2
0.0.0.0 10.1.8.4 0.0.0.0 UG 0 0 0 eth0
Vậy là tạm ổn cho 1 firwall router đơn giản nhất rồi đó
![[Rule]](/hvaonline/templates/viet/images/icon_mini_rule.gif "[Rule]"){kind=icon}
![[Home]](/hvaonline/templates/viet/images/icon_mini_groups.gif "[Home]"){kind=icon}
![[Portal]](/hvaonline/templates/viet/images/icon_mini_portal.gif "[Portal]"){kind=icon}
![[Members]](/hvaonline/templates/viet/images/icon_mini_members.gif "[Members]"){kind=icon}
![[Statistics]](/hvaonline/templates/viet/images/icon_mini_stats.gif "[Statistics]"){kind=icon}
![[Search]](/hvaonline/templates/viet/images/icon_mini_search.gif "[Search]"){kind=icon}
![[Reading Room]](/hvaonline/templates/viet/images/icon_mini_book.gif "[Reading Room]"){kind=icon}
![[Register]](/hvaonline/templates/viet/images/icon_mini_register.gif "[Register]"){kind=icon}
Register![[Login]](/hvaonline/templates/viet/images/icon_mini_login.gif "[Login]"){kind=icon}
Login [
Thảo luận hệ điều hành *nix
![[Minus]](/hvaonline/templates/viet/images/minus.gif "[Minus]")
![[Plus]](/hvaonline/templates/viet/images/plus.gif "[Plus]")
![[Profile]](/hvaonline/templates/viet/images/en_US/icon_profile.gif "[Profile]"){kind=icon}
![[PM]](/hvaonline/templates/viet/images/en_US/icon_pm.gif "[PM]"){kind=icon}
![[Up]](/hvaonline/templates/viet/images/en_US/icon_up.gif "[Up]"){kind=icon}
![[Print Copy]](/hvaonline/templates/viet/images/en_US/icon_print.gif "[Print Copy]"){kind=icon}
![[Avatar]](/hvaonline/images/avatar/c1dd3f241f7f9e2439bda4c57ee76f1c.png "[Avatar]")
![[digg]](/hvaonline/templates/viet/images/digg.gif "[digg]")
![[delicious]](/hvaonline/templates/viet/images/delicious.gif "[delicious]")
![[google]](/hvaonline/templates/viet/images/google.gif "[google]")
![[yahoo]](/hvaonline/templates/viet/images/yahoo.gif "[yahoo]")
![[technorati]](/hvaonline/templates/viet/images/technorati.gif "[technorati]")
![[reddit]](/hvaonline/templates/viet/images/reddit.gif "[reddit]")
![[stumbleupon]](/hvaonline/templates/viet/images/stumbleupon.gif "[stumbleupon]")