How to build a high-performance dual-effect firewall for Linux

Article Title: Teach you how to build a high-performance dual-effect firewall for Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

　　System Functions

Package filtering and WEB Proxy are both effective and effective. The iptables is used to implement packet filtering. in Linux, the famous squid and NAT are used to implement transparent WEB Proxy. The performance of SQUID proxy itself is already a leader in proxy servers. The system puts its performance to the extreme level: Through ramdisk technology, SQUID enables the web page cahce to the memory. In this way, the webpage you visit will come from the memory in the future except for the first time you need to retrieve it from the network! The following describes how to implement Redhat.

(1) Select a relatively stable computer with two NICs, MB or MB memory and 10 GB hard disk (Note: The first Nic is connected to the Intranet and the second Nic is connected to the Internet ).

(2) install RedHat, select server mode during installation, and automatically partition.

(3) After about 10-15 minutes, the system is installed. After restarting, enter the system and configure the system.

　　1. enable packet forwarding

Edit/etc/sysctl. conf, set net. ipv4.ip _ forward = 0 to net. ipv4.ip _ forward = 1, and save the modification. The purpose is to allow the Linux kernel to forward IP Packets: Allow IP packets to pass through one network interface to another. Only in this way can the System Act as a packet filtering firewall.

2. Activate RamDisk

Modify/etc/grub. conf:

　　

#boot=/dev/sdadefault=0timeout=10splashimage=(hd0,0)/grub/splash.xpm.gztitle RedHat Linux (2.4.7-10) root (hd0,0) kernel /vmlinuz-2.4.7-10 ro root=/dev/sda6 ramdisk=268435 initrd /initrd-2.4.7-10.img<

Ramdisk = 268435 is the content we want to add. The purpose is to tell the system that the default ramdisk size is 268435KB, that is, 256MB. note that you cannot write 256 MB directly. In this way, the system does not know it. You must replace it with KB! (I have been exploring for several months !), After restart, the system will automatically generate a MB virtual disk. Of course, you need to set this parameter based on your memory size. If you do not run XWINDOWS, it is okay to set half of your total memory, because the Linux system itself does not need a lot of memory.

　　3. Set squid Parameters

Edit/etc/squid. conf and add the following entries to the end:

　　

httpd_accel_host virtualhttpd_accel_port 80httpd_accel_with_proxy onhttpd_accel_uses_host_header onhttp_access allow allcache_dir ufs /squid 256 16 256<

The preceding four parameters enable squid to provide transparent proxy. "Http_access allow all" indicates that all client machines are allowed to access the proxy. Here, we particularly emphasize the last "cache_dir ufs/squid 256 16 256 ", the default cache_dir of squid is "/var/spool/squid". Because we want squid to cache the content to the memory, change it to/squid first, next, you need to shadow ramdisk to the/squid directory.

[1] [2] Next page