Предположим, провайдер выделил некую подсеть
$ sipcalc 192.0.2.56/29
-[ipv4 : 192.0.2.56/29] - 0
[CIDR]
Host address - 192.0.2.56
Host address (decimal) - 3221226040
Host address (hex) - C0000238
Network address - 192.0.2.56
Network mask - 255.255.255.248
Network mask (bits) - 29
Network mask (hex) - FFFFFFF8
Broadcast address - 192.0.2.63
Cisco wildcard - 0.0.0.7
Addresses in network - 8
Network range - 192.0.2.56 - 192.0.2.63
Usable range - 192.0.2.57 - 192.0.2.62
-
Задача - раздать эти IP адреса
1 способ - использовать коммутатор
Схема сети
Рисунок 1
- использовать некую Unix подобную ОС
Схема сети
Рисунок 2
Используем в качестве примера Debian
Сведения о системе:
$ uname -a; cat /etc/debian_version
Linux gwdeb 2.6.26-2-686 #1 SMP Thu Nov 25 01:53:57 UTC 2010 i686 GNU/Linux
5.0.7Предварительные настройки
$ cat /etc/apt/sources.list
$ su -c "nano /etc/resolv.conf"
nameserver 8.8.8.8
nameserver 8.8.4.4
$ su -c "aptitude update; aptitude install openssh-server -y"
2a Proxy ARP
На GW1
$ su -c "nano /etc/network/interfaces"# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
#allow-hotplug eth0
#iface eth0 inet dhcp
iface eth0 inet manual
post-up ip link set dev eth0 up
post-up ip address add 192.0.2.62/29 dev eth0
post-up ip route del 192.0.2.56/29 dev eth0
# The second network interface
auto eth1
#allow-hotplug eth1
#iface eth1 inet dhcp
iface eth1 inet manual
post-up ip link set dev eth1 up
post-up ip address add 192.0.2.62/29 dev eth1
post-up ip route del 192.0.2.56/29 dev eth1
post-up ip route add 192.0.2.57/32 dev eth0
post-up ip route add 192.0.2.56/29 dev eth1
post-up echo 1 > /proc/sys/net/ipv4/conf/eth0/proxy_arp
post-up echo 1 > /proc/sys/net/ipv4/conf/eth1/proxy_arp
post-up route add default gw 192.0.2.57
post-up sysctl -w net.ipv4.ip_forward=1
$ su -c reboot
На клиенте
$ su -c "nano /etc/resolv.conf"
nameserver 8.8.8.8
nameserver 8.8.4.4
$ su -c "nano /etc/network/interfaces"
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
#allow-hotplug eth0
#iface eth0 inet dhcp
iface eth0 inet static
address 192.0.2.58
netmask 255.255.255.248
gateway 192.0.2.62
Как вариант можно использовать bridge-utils
На GW1
$ su -c "aptitude update; aptitude install bridge-utils -y"$ cat /etc/network/interfaces# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
#allow-hotplug eth0
#iface eth0 inet dhcp
iface eth0 inet manual
# The second network interface
auto eth1
#allow-hotplug eth1
#iface eth1 inet dhcp
iface eth1 inet manual
# Bridge between eth0 and eth1
auto br0
#iface br0 inet dhcp
iface br0 inet static
address 192.0.2.62
netmask 255.255.255.248
network 192.0.2.56
gateway 192.0.2.57
pre-up ifconfig eth0 down
pre-up ifconfig eth1 down
pre-up brctl addbr br0
pre-up brctl addif br0 eth0
pre-up brctl addif br0 eth1
pre-up ifconfig eth0 0.0.0.0
pre-up ifconfig eth1 0.0.0.0
post-down ifconfig eth0 down
post-down ifconfig eth1 down
post-down ifconfig br0 down
post-down brctl delif br0 eth0
post-down brctl delif br0 eth1
post-down brctl delbr br0
$ su -c reboot На клиенте
$ su -c "nano /etc/resolv.conf"
nameserver 8.8.8.8
nameserver 8.8.4.4
$ su -c "nano /etc/network/interfaces"# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
#allow-hotplug eth0
#iface eth0 inet dhcp
iface eth0 inet static
address 192.0.2.58
netmask 255.255.255.248
gateway 192.0.2.57
NAT 1:1
Схема сети
Рисунок 3
$ su -c "nano /etc/network/interfaces"# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
#allow-hotplug eth0
#iface eth0 inet dhcp
iface eth0 inet static
address 192.0.2.58
netmask 255.255.255.248
gateway 192.0.2.57
post-up iptables-restore -c < /var/ipt
post-down iptables-save -c > /var/ipt
post-up sysctl net.ipv4.ip_forward=1
auto eth0:1
iface eth0:1 inet static
address 192.0.2.59
netmask 255.255.255.248
auto eth0:2
iface eth0:2 inet static
address 192.0.2.60
netmask 255.255.255.248
auto eth0:3
iface eth0:3 inet static
address 192.0.2.61
netmask 255.255.255.248
auto eth0:4
iface eth0:4 inet static
address 192.0.2.62
netmask 255.255.255.248
auto eth1
allow-hotplug eth1
iface eth1 inet static
address 172.16.1.1
netmask 255.255.255.248
$ su -iptables -P FORWARD ACCEPT
iptables -P INPUT ACEEPT
iptables -vF
iptables -vF -t nat
iptables -vF -t mangle
iptables -t mangle -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t nat -A PREROUTING -d 192.0.2.59 -j DNAT --to-destination 172.16.1.3
iptables -t nat -A PREROUTING -d 192.0.2.60 -j DNAT --to-destination 172.16.1.4
iptables -t nat -A PREROUTING -d 192.0.2.61 -j DNAT --to-destination 172.16.1.5
iptables -t nat -A PREROUTING -d 192.0.2.62 -j DNAT --to-destination 172.16.1.6
iptables -t nat -A POSTROUTING -s 172.16.1.2 -j SNAT --to-source 192.0.2.58
iptables -t nat -A POSTROUTING -s 172.16.1.3 -j SNAT --to-source 192.0.2.59
iptables -t nat -A POSTROUTING -s 172.16.1.4 -j SNAT --to-source 192.0.2.60
iptables -t nat -A POSTROUTING -s 172.16.1.5 -j SNAT --to-source 192.0.2.61
iptables -t nat -A POSTROUTING -s 172.16.1.6 -j SNAT --to-source 192.0.2.62
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
iptables -A INPUT -i ! lo -m addrtype --src-type LOCAL -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A INPUT -i eth0 -p udp -m udp --sport 67 --dport 68 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -i eth1 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i eth1 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate INVALID -j DROP
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 172.16.1.0/29 -i eth1 -m conntrack --ctstate NEW -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate DNAT -j ACCEPT
iptables -P FORWARD DROP
iptables -P INPUT DROP
iptables-save > /var/ipt
# rebootНа клиенте
$ su -c "nano /etc/resolv.conf"
nameserver 8.8.8.8
nameserver 8.8.4.4
$ su -c "nano /etc/network/interfaces"# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
auto eth0
#allow-hotplug eth0
#iface eth0 inet dhcp
iface eth0 inet static
address 172.16.1.2
netmask 255.255.255.248
gateway 172.16.1.1
Собственно моей фантазии хватит еще только на поставить pppoe сервер
Кто-нибудь более красивые способы может предложить?
Тема: Перечень способов "раздать реальные IP адреса" (Прочитано 5827 раз)
