Bit by bit during self-made mini Router

During the Dragon Boat Festival holiday, a Development Board with a Wi-Fi module was developed for Android terminals. I did not intend to do this, so I used it as a mini router. Of course, I knew in advance that it could easily be embedded into the Linux kernel and applications. Otherwise, it would be enough for me to drink a pot. The so-called a router, the use of Linux to do it is too convenient, compare with the home TP-LINK, nothing more than to achieve the following modules, even do not need to write a line of C code:
1. You can use PHP to add, modify, and delete routes. Of course, you can also use the character interface. However, this does not seem to be a professional solution developed by PHP. We recommend that you use the iproute2 tool set instead of the route command at the underlying layer, because iproute2 can easily configure complex routing policies, such as policy routing and force-onlink routing. Www.2cto.com 2. Use the iptables command at the bottom layer of the firewall module to set the filter table, and then use PHP as a front-end interface. 3. The IP address translation module uses the iptables command to set the nat table at the underlying layer, and then uses PHP as a front-end interface. This module is completely similar to a general home router. This type of router is generally used for accessing the Internet from multiple home machines. Therefore, it is necessary to MASQUERADE the Intranet address to a unique public address. Of course, if you have many public IP addresses and do not want to hide your internal network, you really don't need this.
4. The traffic control module uses the iptables command and tc command at the underlying layer to perform Traffic Control Based on IP addresses, quintuple groups, MAC information, etc., and uses PHP as a front-end configuration interface. 5. I have to say more about the NAT traversal module. After all, if I like to use BT, it is impossible to use it. To be honest, I really want to apply the NAT traversal Technology Based on the hack technology to a self-made router. Later I found it was too difficult to ensure that it could succeed every time, as a matter of fact, I have never caught a cold on this idea, so I want to find another way. NAT traversal can be replaced by another technology, that is, setting up a DNAT. After all, the routers are my own, setting a DNAT is easy, but the question is, what Intranet addresses and ports should I open? If it is all open, it would be better not to set SNAT at the beginning, but not to set SNAT involves sharing public IP addresses... www.2cto.com, so after thinking for a long time, I finally come up with a seemingly good doctrine, that is, let the Intranet host actively inform its IP address and the port to be mapped, And the router always runs a receiving process, after receiving a notification from a host, set the following rules to the vro: iptables-t nat-a prerouting-I Internet port-the only public IP address of the d-the protocol that needs to be mapped to the p-dport-j DNAT -- to-destination address, in this case, you need to place a program for reporting on each host. After thinking about it, it is still very troublesome. It is better to leave the work to the router. That is to say, the router will take the initiative to ask the Intranet to see who needs to map the port, this requires answers from the Intranet host and programming. Therefore, we simply use nmap to scan the well-known P2P ports on the Intranet at intervals, and then dynamically set the "discovered" ports on the vro... it took an afternoon and finally worked out. Then the problem came again, with the question of when to delete these mappings... it is too complicated to maintain a state machine, so I just sit here and can use it anyway.
Why spent the afternoon? I made a low-level mistake. I tested nmap scanning in VMWare and found that the OS was MacOS. That's exactly the problem, because the machines I use for testing are actually running MacOS... in the end, I found that the OS is my VMWare Host, because the NIC mode of Linux in VMWare Is NAT, however, VMWare NAT is implemented by the host in the user mode, and is actually a proxy. Therefore, the nmap result does not show the real information of the target host. Later, I carefully studied the home of the TP-LINK router, found a protocol called uPnP, oh, the original protocol is to implement my function ah, too ignorant... i'm glad to say that my network technology is amazing. As a result, uPnP was directly implemented, and it immediately became perfect. Www.2cto.com 6.IP/ MAC binding module also uses iptables, which is more convenient than this. 7. I basically do not use IPSec for the IPSec traversal module, so ignore it. 8. the Log Module is very important, although I have never known why logs are important... 9. at last, I did not forget to open an SSH service for myself. Otherwise, debugging will be troublesome. Author dog250