1, 背景与要求

朋友的办公室用Cable Modem上网,合同上规定只能用一个IP,可是一共有十多台电脑,

结果朋友到ISP那里说明情况补交了一大笔费用．要求都能上网,用一个IP.

2, 硬件&软件

硬件:P90 32 RAM , 两块NIC卡, 一块3Com, 一块D-Link.好处:比较好分辨eth0, eth1.

一块HUB.

软件:RedHat 6.2 Gnome Helix(可以运行FireStarter),最好升级kernel.

3, 安装防火墙

设置IP 伪装 IPChains :

建立 /etc/rc.d/rc.firewall(或者任何文件名任何地方,如果手工运行的话) 如下:

#!/bin/sh

#

# rc.firewall - Initial SIMPLE IP Masquerade test for 2.1.x and 2.2.x kernels

# using IPCHAINS

#

# Needed to initially load modules

#

/sbin/depmod -a

# Supports the proper masquerading of FTP file transfers using the PORT method

#

/sbin/modprobe ip_masq_ftp

# Supports the masquerading of RealAudio over UDP. Without this module,

# RealAudio WILL function but in TCP mode. This can cause a reduction

# in sound quality

#

#/sbin/modprobe ip_masq_raudio 收Real Audio

# Supports the masquerading of IRC DCC file transfers

#

#/sbin/modprobe ip_masq_irc 去掉"#"如果你要玩IRC,我朋友不让,:-)

# 连网打雷神

# Supports the masquerading of Quake and QuakeWorld by default. This modules is

# for for multiple users behind the Linux MASQ server. If you are going to

# play Quake I, II, and III, use the second example.

#

# NOTE: If you get ERRORs loading the QUAKE module, you are running an old

# ----- kernel that has bugs in it. Please upgrade to the newest kernel.

#

#Quake I / QuakeWorld (ports 26000 and 27000)

#/sbin/modprobe ip_masq_quake

#

#Quake I/II/III / QuakeWorld (ports 26000, 27000, 27910, 27960)

#/sbin/modprobe ip_masq_quake 26000,27000,27910,27960# Supports the masquerading of the CuSeeme video conferencing software

#

#/sbin/modprobe ip_masq_cuseeme Cu-SeeMe 视频电话

#Supports the masquerading of the VDO-live video conferencing software

#

#/sbin/modprobe ip_masq_vdoliveVDO-live 视频电话

#CRITICAL: Enable IP forwarding since it is disabled by default since

#

# Redhat Users: you may try changing the options in

# /etc/sysconfig/network from:

#

# FORWARD_IPV4=false

# to

# FORWARD_IPV4=true

#

echo "1" > /proc/sys/net/ipv4/ip_forward

#CRITICAL: Enable automatic IP defragmenting since it is disabled by default

# in 2.2.x kernels. This used to be a compile-time option but the

# behavior was changed in 2.2.12

#

echo "1" > /proc/sys/net/ipv4/ip_always_defrag

# Dynamic IP users: 该ISP用DHCP方法给用户分配IP,启动该项

#

# If you get your IP address dynamically from SLIP, PPP, or DHCP, enable this

# following option. This enables dynamic-ip address hacking in IP MASQ,

# making the life with Diald and similar programs much easier.

#

echo "1" > /proc/sys/net/ipv4/ip_dynaddr

# Enable the LooseUDP patch which some Internet-based games require

#

# If you are trying to get an Internet game to work through your IP MASQ box,

# and you have set it up to the best of your ability without it working, try

# enabling this option (delete the "#" character). This option is disabled

# by default due to possible internal machine UDP port scanning

# vunerabilities.

#

#echo "1" > /proc/sys/net/ipv4/ip_masq_udp_dloose

# MASQ timeouts

#

# 2 hrs timeout for TCP session timeouts

# 10 sec timeout for traffic after the TCP/IP "FIN" packet is received

# 160 sec timeout for UDP traffic (Important for MASQed ICQ users)

#

/sbin/ipchains -M -S 7200 10 160

# DHCP: For people who receive their external IP address from either DHCP or# BOOTP such as ADSL or Cablemodem users, it is necessary to use the

# following before the deny command. The "bootp_client_net_if_name"

# should be replaced the name of the link that the DHCP/BOOTP server

# will put an address on to? This will be something like "eth0",

# "eth1", etc.

#

# This example is currently commented out.

#

# 该ISP用DHCP方法给用户分配IP,启动该项.

/sbin/ipchains -A input -j ACCEPT -i eth0 -s 0/0 67 -d 0/0 68 -p udp

# Enable simple IP forwarding and Masquerading

#

# NOTE: The following is an example for an internal LAN address in the

# 192.168.0.x network with a 255.255.255.0 or a "24" bit subnet mask

# connecting to the Internet on interface eth0.

#

# ** Please change this network number, subnet mask, and your Internet

# ** connection interface name to match your internal LAN setup

#

/sbin/ipchains -P forward DENY

/sbin/ipchains -A forward -i eth0 -s 192.168.0.0/24 -j MASQ

键入 chmod 700 /etc/rc.d/rc.firewall使可执行.

然后加一行/etc/rc.d/rc.firewall到/etc/rc.d/rc.local中,使它启动时运行.

以上防火墙规则使子网(192.168.x.x)所有PC用一个ISP分配的IP上网,禁用IRC,Realplayer,Quake...

4, DHCP Server

为了使其他局域网里的Windows能方便设置网络,顺便安装DHCP Server

到RedHat目录下,rpm -ivh dhcp* 确保全部DHCP包已安装.

touch /var/state/dhcp/dhcpd.leases,建立dhcpd的日志文件

建立 /etc/dhcpd.conf 文件:

# /etc/dhcpd.conf

# Type "route add -host 255.255.255.255 dev eth1 2> /dev/null" , and

# "usr/sbin/dhcpd eth1" to start DHCPD binded with eth1 !

# Don start it with eth0 , conflict with ISPs DHCPD !

#

subnet 192.168.0.0 netmask 255.255.255.0 {

range 192.168.0.10 192.168.0.100;

default-lease-time 1200;

max-lease-time 9200;

option subnet-mask 255.255.255.0;

option broadcast-address 192.168.0.255;option routers 192.168.0.1;

option domain-name-servers xxx.xx.xx.xx, xxx.xx.xxx.x; ISP的DNS server

option domain-name "offfice.net";

}

以上设置自动分配192.168.0.10到192.168.0.100的内部IP.

绑定DHCPD到eth1,否则系统会绑定到eth0,无法启动,也会导致和ISP的DHCPD发生冲突,

编辑/etc/rc.d/init.d/dhcpd,在/usr/sbin/dhcpd后加 eth1.

,为了客户PC可以稳妥取得路由,运行:

route add -host 255.255.255.255 dev eth1 2> /dev/null

5,客户端

很方便,到 startsettingsnetworkTCP/IPObtain an IP automatially.