Firwall 5105: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
(Die Seite wurde neu angelegt: „=Erklärung= *XX = Platznummer *Y = Klassensaal =Hostname= *hostnamectl set-hostname fw.it1XX.int =Interfaces= *cat /etc/network/interfaces <pre> source /etc/…“)
 
 
(14 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt)
Zeile 1: Zeile 1:
 
=Erklärung=
 
=Erklärung=
−
*XX = Platznummer
+
*TN = 200 + Platznummer
−
*Y = Klassensaal
+
*HS = Klassensaal
 +
 
 
=Hostname=
 
=Hostname=
−
*hostnamectl set-hostname fw.it1XX.int
+
;Grundkonfiguration
−
 
+
*debian-setup.sh -f fw.it213.int -a 192.168.HS.TN/24 -g 192.168.HS.254. -n 1.1.1.1
−
=Interfaces=
+
*reboot
 +
;Weitere Interfaces
 
*cat /etc/network/interfaces
 
*cat /etc/network/interfaces
 
<pre>
 
<pre>
−
source /etc/network/interfaces.d/*
 
−
 
−
# The loopback network interface
 
 
auto lo
 
auto lo
 
iface lo inet loopback
 
iface lo inet loopback
  
−
# The primary network interface
 
−
#WAN
 
 
auto enp0s3
 
auto enp0s3
 
iface enp0s3 inet static
 
iface enp0s3 inet static
−
  address 192.168.9.1XX/24
+
  address 192.168.HS.TN/24
−
  gateway 192.168.9.254
+
  gateway 192.168.HS.254
−
  post-up ip route add 10.88.0.0/16 via 192.168.Y.88
+
  post-up ip route add 10.88.0.0/16 via 192.168.HS.88
−
post-up /usr/local/sbin/nat.sh
 
  
−
#LAN
 
 
auto enp0s8
 
auto enp0s8
 
iface enp0s8 inet static
 
iface enp0s8 inet static
−
  address 172.16.1XX.1/24
+
  address 172.26.TN.1/24
  
−
#DMZ
 
 
auto enp0s9
 
auto enp0s9
 
iface enp0s9 inet static
 
iface enp0s9 inet static
−
  address 10.88.1XX.1/24
+
  address 10.88.TN.1/24
−
 
 
−
#SERVERS
 
−
auto enp0s10
 
−
iface enp0s10 inet static
 
−
address 10.1XX.1.1/24
 
 
</pre>
 
</pre>
  
−
=Hosts=
 
−
*cat /etc/hosts
 
−
<pre>
 
−
127.0.0.1      localhost
 
−
127.0.1.1      fw.it1XX.int fw
 
−
 
−
# The following lines are desirable for IPv6 capable hosts
 
−
::1    localhost ip6-localhost ip6-loopback
 
−
ff02::1 ip6-allnodes
 
−
ff02::2 ip6-allrouters
 
−
</pre>
 
−
=Resolver=
 
−
*cat /etc/resolv.conf
 
−
search it1XX.int
 
−
nameserver 192.168.Y.88
 
−
=Nat=
 
−
*cat /usr/local/sbin/nat.sh
 
−
<pre>
 
−
#!/bin/bash
 
−
LAN="172.16.1XX.0/24"
 
−
SERVERS="10.1XX.1.0/24"
 
−
DMZ="10.88.1XX.0/24"
 
−
#Nat Regeln flushen
 
−
iptables -t nat -F
 
−
#Nat Regelen setzen
 
−
iptables -t nat -A POSTROUTING -s $DMZ -d 192.168.Y.0/24 -j RETURN
 
−
iptables -t nat -A POSTROUTING -s $DMZ -d 10.88.0.0/16 -j RETURN
 
−
iptables -t nat -A POSTROUTING -s $DMZ -o enp0s3 -j MASQUERADE
 
−
iptables -t nat -A POSTROUTING -s $LAN -o enp0s3 -j MASQUERADE
 
−
iptables -t nat -A POSTROUTING -s $SERVERS -o enp0s3 -j MASQUERADE
 
−
</pre>
 
−
*chmod +x /usr/local/sbin/nat.sh
 
 
=NAT mit nftables=
 
=NAT mit nftables=
 +
*cat /etc/nftables.conf
 
<pre>
 
<pre>
 
#!/usr/sbin/nft -f
 
#!/usr/sbin/nft -f
  
 
# Variablen
 
# Variablen
−
define LAN = 172.16.1XX.0/24
+
define LAN = 172.26.TN.0/24
−
define SERVERS = 10.1XX.1.0/24
+
define DMZ = 10.88.TN.0/24
−
define DMZ = 10.88.1XX.0/24
 
  
 
# Alte Regeln löschen (flush)
 
# Alte Regeln löschen (flush)
−
flush table ip nat
+
flush ruleset
  
 
# NAT-Tabelle erstellen/verwenden
 
# NAT-Tabelle erstellen/verwenden
Zeile 88: Zeile 45:
 
         type nat hook postrouting priority 100; policy accept;
 
         type nat hook postrouting priority 100; policy accept;
 
          
 
          
−
         # DMZ nach 192.168.Y.0/24 - kein NAT (RETURN)
+
         # DMZ nach 192.168.HS.0/24 - kein NAT (RETURN)
−
         ip saddr $DMZ ip daddr 192.168.Y.0/24 return
+
         ip saddr $DMZ ip daddr 192.168.HS.0/24 return
 
          
 
          
 
         # DMZ nach 10.88.0.0/16 - kein NAT (RETURN)
 
         # DMZ nach 10.88.0.0/16 - kein NAT (RETURN)
Zeile 100: Zeile 57:
 
         ip saddr $LAN oif enp0s3 masquerade
 
         ip saddr $LAN oif enp0s3 masquerade
 
          
 
          
−
        # SERVERS nach außen - Masquerade
 
−
        ip saddr $SERVERS oif enp0s3 masquerade
 
 
     }
 
     }
 
}
 
}
 
</pre>
 
</pre>
 +
==Tests==
 +
;Manuelles aktivieren
 +
*nft -f /etc/nftables.conf
 +
;Anzeigen
 +
*nft list ruleset
 +
;Löschen
 +
*nft flush ruleset
 +
==Aktivieren==
 +
*systemctl enable nftables.service
 +
 
=Forward=
 
=Forward=
−
*echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
+
*echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-forward.conf
−
*sysctl -p
+
*sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf
 +
=Resolver=
 +
*cat /etc/resolv.conf
 +
search it213.int
 +
nameserver 192.168.9.88
 
=Reboot=
 
=Reboot=
−
*systemctl reboot
+
*sudo systemctl reboot

Aktuelle Version vom 16. März 2026, 13:14 Uhr

Erklärung

  • TN = 200 + Platznummer
  • HS = Klassensaal

Hostname

Grundkonfiguration
  • debian-setup.sh -f fw.it213.int -a 192.168.HS.TN/24 -g 192.168.HS.254. -n 1.1.1.1
  • reboot
Weitere Interfaces
  • cat /etc/network/interfaces
auto lo
iface lo inet loopback

auto enp0s3
iface enp0s3 inet static
 address 192.168.HS.TN/24
 gateway 192.168.HS.254
 post-up ip route add 10.88.0.0/16 via 192.168.HS.88

auto enp0s8
iface enp0s8 inet static
 address 172.26.TN.1/24

auto enp0s9
iface enp0s9 inet static
 address 10.88.TN.1/24

NAT mit nftables

  • cat /etc/nftables.conf
#!/usr/sbin/nft -f

# Variablen
define LAN = 172.26.TN.0/24
define DMZ = 10.88.TN.0/24

# Alte Regeln löschen (flush)
flush ruleset

# NAT-Tabelle erstellen/verwenden
table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        
        # DMZ nach 192.168.HS.0/24 - kein NAT (RETURN)
        ip saddr $DMZ ip daddr 192.168.HS.0/24 return
        
        # DMZ nach 10.88.0.0/16 - kein NAT (RETURN)
        ip saddr $DMZ ip daddr 10.88.0.0/16 return
        
        # DMZ nach außen (enp0s3) - Masquerade
        ip saddr $DMZ oif enp0s3 masquerade
        
        # LAN nach außen - Masquerade
        ip saddr $LAN oif enp0s3 masquerade
        
    }
}

Tests

Manuelles aktivieren
  • nft -f /etc/nftables.conf
Anzeigen
  • nft list ruleset
Löschen
  • nft flush ruleset

Aktivieren

  • systemctl enable nftables.service

Forward

  • echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-forward.conf
  • sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf

Resolver

  • cat /etc/resolv.conf
search it213.int
nameserver 192.168.9.88

Reboot

  • sudo systemctl reboot
Abgerufen von „http://wiki.ixheim.de/index.php?title=Firwall_5105&oldid=67381“