海运的博客

Centos编译IPID模块配置TTL防网络尖兵

发布时间:July 30, 2012 // 分类:Iptables // No Comments

Centos自带iptables TTL模块,IPID源码下载地址:http://bbs.chinaunix.net/thread-2102211-1-1.html

#http://www.haiyun.me
yum -y install kernel-devel
wget http://ftp.netfilter.org/pub/iptables/iptables-1.3.5.tar.bz2
tar jxvf iptables-1.3.5.tar.bz2
ln -s iptables-1.3.5 /usr/src/iptables

编译安装IPID:

cd iptables-ipid-2.1
sed -i 's/new_ipid\[i\]/new_ipid\[id\]/g' ipt_IPID.c
make
cp ipt_IPID.ko /lib/modules/2.6.18-308.11.1.el5/kernel/net/ipv4/netfilter/
chmod 744 /lib/modules/2.6.18-308.11.1.el5/kernel/net/ipv4/netfilter/ipt_IPID.ko
cp libipt_IPID.so /lib/iptables/
depmod -a
modprobe ipt_IPID

使用参数:

--ipid-pace [number] 设置每次增加的步调值,如果为0,则数据包的IPID字段应该为一个固定的值。
--ipid-choatic 0 设置随机IPID。0仅仅是填充参数作用。

应用示例:

iptables -t mangle -A PREROUTING  -i pppoe-wan -j TTL --ttl-inc 1
#限制2级路由
iptables -t mangle -A POSTROUTING -o pppoe-wan -j TTL --ttl-set 128
iptables -t mangle -A POSTROUTING -o pppoe-wan -j IPID --ipid-pace 1
#这样路由本机和下级电脑发的数据都修改TTL和IPID信息,修改TTL会导致tracert跟踪不正常。
#如需不影响路由本机tracert可在FORWARD链修改数据包信息

Centos5.7不编译内核安装Iptables Layer7模块

发布时间:July 29, 2012 // 分类:Iptables,Linux基础 // No Comments

Centos查看当前内核、Iptables版本并下载相应源码:

#http://www.haiyun.me
uname -r
2.6.18-274.el5
cd /usr/src/kernels/
wget http://www.kernel.org/pub/linux/kernel/v2.6/linux-2.6.18.tar.gz
iptables -V
iptables v1.3.5
wget http://ftp.netfilter.org/pub/iptables/iptables-1.3.5.tar.bz2

或下载Centos官方内核源码:

useradd test
su -l test
mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
echo '%_topdir %(echo $HOME)/rpmbuild' > ~/.rpmmacros
yum install rpm-build redhat-rpm-config unifdef
rpm -i http://vault.centos.org/5.7/os/SRPMS/kernel-2.6.18-274.el5.src.rpm
cd ~/rpmbuild/SPECS
rpmbuild -bp --target=$(uname -m) kernel.spec
cd ~/rpmbuild/BUILD/kernel*/linux*/ #源码所在目录

下载Layer7模块和规则文件:

wget http://sourceforge.net/projects/l7-filter/files/l7-filter%20kernel%20version/2.18/netfilter-layer7-v2.18.tar.gz
wget http://sourceforge.net/projects/l7-filter/files/Protocol%20definitions/2009-05-28/l7-protocols-2009-05-28.tar.gz

给内核打上Layer7补丁并编译模块:

tar zxvf linux-2.6.18.tar.gz 
tar zxvf netfilter-layer7-v2.18.tar.gz
cd linux-2.6.18
patch -p1 < ../netfilter-layer7-v2.18/for_older_kernels/kernel-2.6.18-2.6.19-layer7-2.9.patch
#查看READ文件根据内核版本选择相应的补丁
yum install -y ncurses-devel 
#安装ncurses库,编译内核需要
make oldconfig
#备份配置文件
make menuconfig
#进入内核编译选项

在以下菜单处理选择将layer7编译为模块:

Networking——Networking options--->Network packet filtering (replaces ipchains)--->Layer 7 match support (EXPERIMENTAL) 

编译内核模块:

#http://www.haiyun.me
make prepare
make modules_prepare
#创建外部模块所需文件,后续可直接编译指定模块
make M=net/ipv4/netfilter/
#仅编译防火墙相关模块

复制编译的layer7.ko模块至系统:

strip --strip-debug net/ipv4/netfilter/ipt_layer7.ko
cp net/ipv4/netfilter/ipt_layer7.ko /lib/modules/2.6.18-274.el5/kernel/net/ipv4/netfilter/
chmod 744 /lib/modules/2.6.18-274.el5/kernel/net/ipv4/netfilter/ipt_layer7.ko 
depmod -a

编译安装Iptables layer7模块:

tar jxvf iptables-1.3.5.tar.bz2 
cd iptables-1.3.5
patch -p1 < ../netfilter-layer7-v2.18/iptables-1.3-for-kernel-pre2.6.20-layer7-2.18.patch 
#给iptables打上layer7补丁,阅读README根据内核及Iptables版本选择相应的补丁
chmod +x extensions/.layer7-test 
make KERNEL_DIR=/usr/src/kernels/linux-2.6.18
make install KERNEL_DIR=/usr/src/kernels/linux-2.6.18

安装Layer7示例脚本:

tar -zxvf l7-protocols-2009-05-28.tar.gz
cd l7-protocols-2009-05-28
make install

应用示例:

modprobe ipt_layer7
/usr/local/sbin/iptables -A FORWARD -m layer7 --l7proto qq -j DROP 

ROS简单队列限速和PCQ动态限速配置/HTB队列树优先级限制

发布时间:July 28, 2012 // 分类:ROS // No Comments

1.ROS网络管理功能十分强大,如需简单对IP或网段进行限速可使用简单队列限速。

queue simple add target-addresses=192.168.0.0/24 limit-at=500000/1000000  max-limit=1000000/2000000 \
burst-threshold=1000000/1000000 burst-limit=1000000/3000000 burst-time=8/8 
#limit-at 限制在此速率
#max-limit 空闲时可用最大速率,未设置等于limit-at
#burst-threshold 速率阀值
#burst-limit 单位时间内速率低于阀值,可突破至此速率
#burst time 突破速率的时间间隔

2.使用简单限速用户较少时会造成带宽的浪费,为此可使用PCQ动态限速。

queue type add name=down-pcq kind=pcq pcq-rate=0 pcq-limit=50 pcq-total-limit=2000 pcq-classifier=dst-address
#PCQ下载队列,针对内部目标IP
#默认情况下仅能容纳50个用户,即2000/50,用户较多时可调整pcq-total-limit或pcq-limit数值
queue type add name=up-pcq kind=pcq pcq-rate=0 pcq-limit=50 pcq-total-limit=2000 pcq-classifier=src-address   
#PCQ上传队列,针对内部源IP
queue simple add name=pcq-queue target-addresses=192.168.1.0/24 max-limit=500000/1000000 queue=up-pcq/down-pcq
#新建简单队列应用PCQ规则

3.基于等级优先级HTB设置,可针对IP、协议进行限制。

ip firewall mangle add chain=forward action=mark-connection new-connection-mark=1.2 src-address=192.168.1.2 passthrough=yes 
ip firewall mangle add chain=forward action=mark-connection new-connection-mark=1.3 src-address=192.168.1.3 passthrough=yes 
#标记特定的连接
ip firewall mangle add chain=forward action=mark-packet new-packet-mark=1.2 connection-mark=1.3 passthrough=no 
ip firewall mangle add chain=forward action=mark-packet new-packet-mark=1.3 connection-mark=1.3 passthrough=no 
#标记特定连接的所有数据包

建立父队列:

queue tree add name=totaldown parent=ether2 limit-at=2000000 max-limit=2000000
queue tree add name=totalup parent=ether1 limit-at=500000 max-limit=500000 
#标记数据LAN为下载,WAN为上传
#Global-in识别Prerouting标记的数据
#Global-out/total能识别pre,forward,post标记的数据

建立子队列:

queue tree add name=pc1.2down parent=totaldown limit-at=2000000 max-limit=2000000 priority=2 
queue tree add name=pc1.2up parent=totalup limit-at=500000 max-limit=5555500000 priority=2 
queue tree add name=pc1.3down parent=totaldown  limit-at=1000000 max-limit=1000000 priority=3 
queue tree add name=pc1.3up parent=totalup  limit-at=500000 max-limit=500000 priority=3 

ROS配置PPTPD VPN服务器

发布时间:July 28, 2012 // 分类:ROS // No Comments

新建PPTP客户端IP池:

ip pool add name=ppptp ranges=192.168.2.2-192.168.2.254  

新建PPTP模板:

ppp profile add name=pptp local-address=ppptp remote-address=ppptp dns-server=192.168.1.1 

新建PPTP用户:

ppp secret add service=pptp name=user password=passwd profile=pptp 

开启PPTP服务器:

interface pptp-server server set enabled=yes 

配置PPTP客户NAT转发:

ip firewall nat add chain=srcnat action=masquerade to-addresses=0.0.0.0 src-address=192.168.2.0/24 out-interface=ether1

PPTP客户端配置:

interface pptp-client add connect-to=192.168.1.22 user=user password=passwd disabled=no

Windows下连接方法略过:

PPP adapter PPTP:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
        Physical Address. . . . . . . . . : 00-53-45-00-00-00
        Dhcp Enabled. . . . . . . . . . . : No
        IP Address. . . . . . . . . . . . : 192.168.2.253
        Subnet Mask . . . . . . . . . . . : 255.255.255.255
        Default Gateway . . . . . . . . . : 192.168.2.253
        DNS Servers . . . . . . . . . . . : 192.168.1.1

Centos安装Freeradius+daloRADIUS配合ROS PPPOE验证

发布时间:July 27, 2012 // 分类:RADIUS,ROS // 3 Comments

之前有介绍安装Radiusmanager做为ROS验证服务器,不过Radiusmanager为商业软件,喜欢开源软件的可使用daloRADIUS替代,功能同样强大。
LAMP环境安装:

yum -y install httpd httpd-devel mysql mysql-server mysql-devel
yum -y install php php-devel php-mysql php-common php-gd php-mbstring php-mcrypt php-xml
/etc/init.d/httpd start
/etc/init.d/mysqld start
chkconfig httpd on
chkconfig mysqld on
mysqladmin -u root password 'newpassowrd'

Freeradius安装:

yum install freeradius2 freeradius2-mysql freeradius2-utils
/etc/init.d/radiusd start
chkconfig radiusd on

测试Freeradius:

radiusd -X
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel
Listening on proxy address * port 1814
Ready to process requests.

配置Freeradius支持sql:

cat /etc/raddb/radiusd.conf 
$INCLUDE sql.conf #调用sql.conf配置,去除之前的#
cat /etc/raddb/sites-enabled/default #下两段中添加sql
authorize {
    preprocess
    chap
    mschap
    digest
    suffix
    eap {
        ok = return
    }
    files
    sql
    expiration
    logintime
    pap
}
accounting {
    detail
    unix
    radutmp
    sql
    exec
    attr_filter.accounting_response
}

设置Freeradius sql连接信息:

cat /etc/raddb/sql.conf 
    database = "mysql"
    driver = "rlm_sql_${database}"
    server = "localhost"
    #port = 3306
    login = "radius"
    password = "radiupass"
      radius_db = "radius"

安装DaloRADIUS

wget http://downloads.sourceforge.net/project/daloradius/daloradius/daloradius0.9-9/daloradius-0.9-9.tar.gz
tar zxvf daloradius-0.9-9.tar.gz 
mv daloradius-0.9-9 /var/www/html/daloradius
chown -R apache:apache /var/www/html/daloradius

创建数据库并导入:

mysql -u root -p
mysql>create database radius;
mysql>grant all on radius.* to radius@localhost identified by "radpass"; 
mysql>exit;
mysql -uroot -p radius < /var/www/html/daloradius/contrib/db/mysql-daloradius.sql 
mysql -uroot -p radius < /var/www/html/daloradius/contrib/db/fr2-mysql-daloradius-and-freeradius.sql 

配置DaloRADIUS:

cat cat /var/www/html/daloradius/library/daloradius.conf.php
$configValues['CONFIG_DB_ENGINE'] = 'mysql';
$configValues['CONFIG_DB_HOST'] = 'localhost';
$configValues['CONFIG_DB_PORT'] = '3306';
$configValues['CONFIG_DB_USER'] = 'radius';
$configValues['CONFIG_DB_PASS'] = 'radpass';
$configValues['CONFIG_DB_NAME'] = 'radius';
$configValues['CONFIG_PATH_DALO_VARIABLE_DATA'] = '/var/www/daloradius/var'; #如在别目录需修改

添加RADIUS客户端:

cat /etc/raddb/clients.conf
client 192.168.1.21 {
    secret        = root
    shortname    = ROS
}

通过浏览器访问http://www.haiyun.me/daloradius即可登录管理,默认账号:administrator,密码:radius。
Daloradius新建用户测试,ROS端配置RADIUS请参考:安装Radiusmanager做为ROS验证服务器
daloradius添加用户.png
通过Daloradius管理界面可查看在线用户:
daloradius在线用户.png

分类
最新文章
最近回复
  • track: NAT 部分没处理,这块感觉有问题。
  • yu: 查到有用的资料很幸福!
  • boscotsang: 请问下服务器端如何控制权限让通过权限认证的客户端才能连接?现在这样只要有自编译的客户端程序都可...
  • yck932: 大侠,请问哪里有 tunnels 详细参考资料,谢谢
  • bubble: 现在linux 4.9以上的内核有个bbr的参数,用这个bbr比用锐速效果更好,可参考我的博文...
  • wang: openwrt 只有 tmp/etc/miniupnpd.conf 修改后又重置了,其他路径找...
  • wbq: 可以了 只是https透明代理如何做呢?
  • wbq: 你的这个配置需要浏览器设置代理ip+port, 现在假设不设置,只配置客户端网关为Nginx那...
  • wbq: 您好,想用Nginx做个透明代理,客户端机器配置下网关(即Nginx那台机器),客户端dns配...
  • ccc: 可以提供易调用openssl常用函数吗?