Firwall 5105: Unterschied zwischen den Versionen
Zur Navigation springen
Zur Suche springen
| (8 dazwischenliegende Versionen desselben Benutzers werden nicht angezeigt) | |||
| Zeile 5: | Zeile 5: | ||
=Hostname= | =Hostname= | ||
;Grundkonfiguration | ;Grundkonfiguration | ||
| − | *debian-setup -f fw.it213.int -a 192.168.HS.TN/24 -g 192.168.HS.254. -n 1.1.1.1 | + | *debian-setup.sh -f fw.it213.int -a 192.168.HS.TN/24 -g 192.168.HS.254. -n 1.1.1.1 |
*reboot | *reboot | ||
;Weitere Interfaces | ;Weitere Interfaces | ||
| − | *cat/etc/network/interfaces | + | *cat /etc/network/interfaces |
<pre> | <pre> | ||
auto lo | auto lo | ||
| Zeile 17: | Zeile 17: | ||
address 192.168.HS.TN/24 | address 192.168.HS.TN/24 | ||
gateway 192.168.HS.254 | gateway 192.168.HS.254 | ||
| + | post-up ip route add 10.88.0.0/16 via 192.168.HS.88 | ||
auto enp0s8 | auto enp0s8 | ||
| Zeile 24: | Zeile 25: | ||
auto enp0s9 | auto enp0s9 | ||
iface enp0s9 inet static | iface enp0s9 inet static | ||
| − | address 10.88.TN.1 | + | address 10.88.TN.1/24 |
</pre> | </pre> | ||
| + | |||
=NAT mit nftables= | =NAT mit nftables= | ||
| + | *cat /etc/nftables.conf | ||
<pre> | <pre> | ||
#!/usr/sbin/nft -f | #!/usr/sbin/nft -f | ||
# Variablen | # Variablen | ||
| − | define LAN = 172.26. | + | define LAN = 172.26.TN.0/24 |
| − | define DMZ = 10.88. | + | define DMZ = 10.88.TN.0/24 |
# Alte Regeln löschen (flush) | # Alte Regeln löschen (flush) | ||
| − | flush | + | flush ruleset |
# NAT-Tabelle erstellen/verwenden | # NAT-Tabelle erstellen/verwenden | ||
| Zeile 42: | Zeile 45: | ||
type nat hook postrouting priority 100; policy accept; | type nat hook postrouting priority 100; policy accept; | ||
| − | # DMZ nach 192.168. | + | # DMZ nach 192.168.HS.0/24 - kein NAT (RETURN) |
| − | ip saddr $DMZ ip daddr 192.168. | + | ip saddr $DMZ ip daddr 192.168.HS.0/24 return |
# DMZ nach 10.88.0.0/16 - kein NAT (RETURN) | # DMZ nach 10.88.0.0/16 - kein NAT (RETURN) | ||
| Zeile 57: | Zeile 60: | ||
} | } | ||
</pre> | </pre> | ||
| + | ==Tests== | ||
| + | ;Manuelles aktivieren | ||
| + | *nft -f /etc/nftables.conf | ||
| + | ;Anzeigen | ||
| + | *nft list ruleset | ||
| + | ;Löschen | ||
| + | *nft flush ruleset | ||
| + | ==Aktivieren== | ||
| + | *systemctl enable nftables.service | ||
| + | |||
=Forward= | =Forward= | ||
*echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-forward.conf | *echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-forward.conf | ||
*sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf | *sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf | ||
| + | =Resolver= | ||
| + | *cat /etc/resolv.conf | ||
| + | search it213.int | ||
| + | nameserver 192.168.9.88 | ||
=Reboot= | =Reboot= | ||
*sudo systemctl reboot | *sudo systemctl reboot | ||
Aktuelle Version vom 16. März 2026, 13:14 Uhr
Erklärung
- TN = 200 + Platznummer
- HS = Klassensaal
Hostname
- Grundkonfiguration
- debian-setup.sh -f fw.it213.int -a 192.168.HS.TN/24 -g 192.168.HS.254. -n 1.1.1.1
- reboot
- Weitere Interfaces
- cat /etc/network/interfaces
auto lo iface lo inet loopback auto enp0s3 iface enp0s3 inet static address 192.168.HS.TN/24 gateway 192.168.HS.254 post-up ip route add 10.88.0.0/16 via 192.168.HS.88 auto enp0s8 iface enp0s8 inet static address 172.26.TN.1/24 auto enp0s9 iface enp0s9 inet static address 10.88.TN.1/24
NAT mit nftables
- cat /etc/nftables.conf
#!/usr/sbin/nft -f
# Variablen
define LAN = 172.26.TN.0/24
define DMZ = 10.88.TN.0/24
# Alte Regeln löschen (flush)
flush ruleset
# NAT-Tabelle erstellen/verwenden
table ip nat {
chain postrouting {
type nat hook postrouting priority 100; policy accept;
# DMZ nach 192.168.HS.0/24 - kein NAT (RETURN)
ip saddr $DMZ ip daddr 192.168.HS.0/24 return
# DMZ nach 10.88.0.0/16 - kein NAT (RETURN)
ip saddr $DMZ ip daddr 10.88.0.0/16 return
# DMZ nach außen (enp0s3) - Masquerade
ip saddr $DMZ oif enp0s3 masquerade
# LAN nach außen - Masquerade
ip saddr $LAN oif enp0s3 masquerade
}
}
Tests
- Manuelles aktivieren
- nft -f /etc/nftables.conf
- Anzeigen
- nft list ruleset
- Löschen
- nft flush ruleset
Aktivieren
- systemctl enable nftables.service
Forward
- echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-forward.conf
- sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf
Resolver
- cat /etc/resolv.conf
search it213.int nameserver 192.168.9.88
Reboot
- sudo systemctl reboot