Firewall-Nat-Linux - Netzwerk und Serveradministration: Unterschied zwischen den Versionen

Aus Xinux Wiki
Zur Navigation springen Zur Suche springen
(Die Seite wurde neu angelegt: „=Interfaces= <pre> source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback # The primary network interface auto en…“)
 
 
(12 dazwischenliegende Versionen von 2 Benutzern werden nicht angezeigt)
Zeile 1: Zeile 1:
 +
=Erklärung=
 +
*XX = Platznummer
 +
*Y = Klassensaal
 +
=Hostname=
 +
*hostnamectl set-hostname fw.it1XX.int
 +
 
=Interfaces=
 
=Interfaces=
 +
*cat /etc/network/interfaces
 
<pre>
 
<pre>
 
source /etc/network/interfaces.d/*
 
source /etc/network/interfaces.d/*
Zeile 8: Zeile 15:
  
 
# The primary network interface
 
# The primary network interface
 +
#WAN
 
auto enp0s3
 
auto enp0s3
 
iface enp0s3 inet static
 
iface enp0s3 inet static
−
  address 192.168.5.1XX/24
+
  address 192.168.9.1XX/24
−
  gateway 192.168.5.254
+
  gateway 192.168.9.254
−
  post-up ip route add 10.88.0.0/16 via 192.168.Y.14
+
  post-up ip route add 10.88.0.0/16 via 192.168.Y.88
 
  post-up /usr/local/sbin/nat.sh
 
  post-up /usr/local/sbin/nat.sh
  
 +
#LAN
 
auto enp0s8
 
auto enp0s8
 
iface enp0s8 inet static
 
iface enp0s8 inet static
 
  address 172.16.1XX.1/24
 
  address 172.16.1XX.1/24
  
 +
#DMZ
 
auto enp0s9
 
auto enp0s9
 
iface enp0s9 inet static
 
iface enp0s9 inet static
 
  address 10.88.1XX.1/24
 
  address 10.88.1XX.1/24
  
−
 
+
#SERVERS
 
auto enp0s10
 
auto enp0s10
 
iface enp0s10 inet static
 
iface enp0s10 inet static
 
  address 10.1XX.1.1/24
 
  address 10.1XX.1.1/24
 
</pre>
 
</pre>
 +
 +
=Hosts=
 +
*cat /etc/hosts
 +
<pre>
 +
127.0.0.1      localhost
 +
127.0.1.1      fw.it1XX.int fw
 +
 +
# The following lines are desirable for IPv6 capable hosts
 +
::1    localhost ip6-localhost ip6-loopback
 +
ff02::1 ip6-allnodes
 +
ff02::2 ip6-allrouters
 +
</pre>
 +
=Resolver=
 +
*cat /etc/resolv.conf
 +
search it1XX.int
 +
nameserver 192.168.Y.88
 +
=Nat=
 +
*cat /usr/local/sbin/nat.sh
 +
<pre>
 +
#!/bin/bash
 +
LAN="172.16.1XX.0/24"
 +
SERVERS="10.1XX.1.0/24"
 +
DMZ="10.88.1XX.0/24"
 +
#Nat Regeln flushen
 +
iptables -t nat -F
 +
#Nat Regelen setzen
 +
iptables -t nat -A POSTROUTING -s $DMZ -d 192.168.Y.0/24 -j RETURN
 +
iptables -t nat -A POSTROUTING -s $DMZ -d 10.88.0.0/16 -j RETURN
 +
iptables -t nat -A POSTROUTING -s $DMZ -o enp0s3 -j MASQUERADE
 +
iptables -t nat -A POSTROUTING -s $LAN -o enp0s3 -j MASQUERADE
 +
iptables -t nat -A POSTROUTING -s $SERVERS -o enp0s3 -j MASQUERADE
 +
</pre>
 +
*chmod +x /usr/local/sbin/nat.sh
 +
=NAT mit nftables=
 +
<pre>
 +
#!/usr/sbin/nft -f
 +
 +
# Variablen
 +
define LAN = 172.16.1XX.0/24
 +
define SERVERS = 10.1XX.1.0/24
 +
define DMZ = 10.88.1XX.0/24
 +
 +
# Alte Regeln löschen (flush)
 +
flush table ip nat
 +
 +
# NAT-Tabelle erstellen/verwenden
 +
table ip nat {
 +
    chain postrouting {
 +
        type nat hook postrouting priority 100; policy accept;
 +
       
 +
        # DMZ nach 192.168.Y.0/24 - kein NAT (RETURN)
 +
        ip saddr $DMZ ip daddr 192.168.Y.0/24 return
 +
       
 +
        # DMZ nach 10.88.0.0/16 - kein NAT (RETURN)
 +
        ip saddr $DMZ ip daddr 10.88.0.0/16 return
 +
       
 +
        # DMZ nach außen (enp0s3) - Masquerade
 +
        ip saddr $DMZ oif enp0s3 masquerade
 +
       
 +
        # LAN nach außen - Masquerade
 +
        ip saddr $LAN oif enp0s3 masquerade
 +
       
 +
        # SERVERS nach außen - Masquerade
 +
        ip saddr $SERVERS oif enp0s3 masquerade
 +
    }
 +
}
 +
</pre>
 +
=Forward=
 +
*echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
 +
*sysctl -p
 +
=Reboot=
 +
*systemctl reboot

Aktuelle Version vom 8. Oktober 2025, 05:57 Uhr

Erklärung

  • XX = Platznummer
  • Y = Klassensaal

Hostname

  • hostnamectl set-hostname fw.it1XX.int

Interfaces

  • cat /etc/network/interfaces
source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
#WAN
auto enp0s3
iface enp0s3 inet static
 address 192.168.9.1XX/24
 gateway 192.168.9.254
 post-up ip route add 10.88.0.0/16 via 192.168.Y.88
 post-up /usr/local/sbin/nat.sh

#LAN
auto enp0s8
iface enp0s8 inet static
 address 172.16.1XX.1/24

#DMZ
auto enp0s9
iface enp0s9 inet static
 address 10.88.1XX.1/24

#SERVERS
auto enp0s10
iface enp0s10 inet static
 address 10.1XX.1.1/24

Hosts

  • cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       fw.it1XX.int fw

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

Resolver

  • cat /etc/resolv.conf
search it1XX.int
nameserver 192.168.Y.88

Nat

  • cat /usr/local/sbin/nat.sh
#!/bin/bash
LAN="172.16.1XX.0/24"
SERVERS="10.1XX.1.0/24"
DMZ="10.88.1XX.0/24"
#Nat Regeln flushen
iptables -t nat -F 
#Nat Regelen setzen
iptables -t nat -A POSTROUTING -s $DMZ -d 192.168.Y.0/24 -j RETURN
iptables -t nat -A POSTROUTING -s $DMZ -d 10.88.0.0/16 -j RETURN
iptables -t nat -A POSTROUTING -s $DMZ -o enp0s3 -j MASQUERADE
iptables -t nat -A POSTROUTING -s $LAN -o enp0s3 -j MASQUERADE
iptables -t nat -A POSTROUTING -s $SERVERS -o enp0s3 -j MASQUERADE
  • chmod +x /usr/local/sbin/nat.sh

NAT mit nftables

#!/usr/sbin/nft -f

# Variablen
define LAN = 172.16.1XX.0/24
define SERVERS = 10.1XX.1.0/24
define DMZ = 10.88.1XX.0/24

# Alte Regeln löschen (flush)
flush table ip nat

# NAT-Tabelle erstellen/verwenden
table ip nat {
    chain postrouting {
        type nat hook postrouting priority 100; policy accept;
        
        # DMZ nach 192.168.Y.0/24 - kein NAT (RETURN)
        ip saddr $DMZ ip daddr 192.168.Y.0/24 return
        
        # DMZ nach 10.88.0.0/16 - kein NAT (RETURN)
        ip saddr $DMZ ip daddr 10.88.0.0/16 return
        
        # DMZ nach außen (enp0s3) - Masquerade
        ip saddr $DMZ oif enp0s3 masquerade
        
        # LAN nach außen - Masquerade
        ip saddr $LAN oif enp0s3 masquerade
        
        # SERVERS nach außen - Masquerade
        ip saddr $SERVERS oif enp0s3 masquerade
    }
}

Forward

  • echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
  • sysctl -p

Reboot

  • systemctl reboot
Abgerufen von „http://wiki.ixheim.de/index.php?title=Firewall-Nat-Linux_-_Netzwerk_und_Serveradministration&oldid=64925“