Hybrid NAT and firewall applications in Linux

Article title: NAT and firewall hybrid applications in Linux. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.
【Abstract]
It mainly describes NAT (network address translation) and NAT-based firewall technology in Linux.
First, it is introduced by the installation of the Linux system. it focuses on the NAT network configuration (server and client) in LINUX and the firewall configuration principles.
Secondly, theoretically, we will explain what NAT is and the attack methods on the network.
　　
[Introduction]
LINUX has been popular around the world over the past few years thanks to its stability, security, and code Openness. as a UNIX system, Linux is being applied in all aspects of the Internet, from scientific computing to cash machines, from web services to high-level Oracle database applications. You can see the shadows of linux. Since Linux complies with the GPL protocol (public software license), anyone can obtain and modify its source code, so its security is much higher than other non-open source systems; and it can be downloaded from the network for free. From these two points, he is very suitable for network information locks (soft routing or gateway) and self-built firewalls (in fact, domestic hardware firewall vendors use industrial X86 hardware and linux for their products, although it is not really a hardware firewall ). Nowadays, the school pays too much attention to learning software and development tools on windows and its windows platforms. But the students didn't realize that the UNIX system really supported the internet. from my perspective on Linux, I would like to show you a corner of the UNIX system.
What is NAT?
　　
NAT stands for Network Address Translation, which is an IETF standard that allows an organization (including multiple Network nodes) to appear on the Internet with one Address. NAT converts the addresses of each Lan node into one IP address, and vice versa. It can also be applied to the firewall technology to hide individual IP addresses from external discovery, so that external networks cannot directly access internal network devices. at the same time, it also helps the network to surpass address restrictions, reasonably arrange the use of public and private IP addresses in the network.
　　
Why NAT?
Assume that the campus network provides Internet access services for the campus network. to facilitate management, the IP addresses assigned to campus users by the campus network center are all pseudo IP addresses (internal IP addresses ), however, some users require the establishment of their own WWW server to publish external information. in this case, we can provide such services through NAT. We can bind multiple valid IP addresses or ports to the external network card of the firewall, and then forward packets sent to one of the IP addresses to the internal WWW server of a user through the NAT technology, then, the response packet of the internal WWW server is disguised as the package sent by the legal IP address.
　　
Tutorial environment
All the lab environments used in this article are as follows:
LINUX host (server): dual Nic REDHAT 9.0 host name: host
WINDOWS 98 host (client): Single Nic host name: test
One Lenovo D-link 8 Port 10 M/M switch
　　
[Body]
Topology of the network:
　　
　　
　　
　　 I. Installation and attention of RED HAT 9.0
Linux is an independent operating system, so it cannot be installed in other operating systems. it has its own startup method and can be installed using either of the following methods.
● Installation from CD-ROM
● Install from the FTP server
Since the Linux system is installed (the first method) and there is a random reference manual, it is not very difficult, so we will focus on the installation from ftp.
Create a boot disk before installation:
1. in the windows operating system, place the installation disk into the optical drive;
2. run e: \ dosutils \ rawrite.exe (the e drive is an optical drive)
3. enter e: \ images \ bootnet. img in the running interface.
4. specify the target disk and enter the user's floppy disk:
In this way, the boot disk of the installer is created.
　　　
Use a floppy disk to boot the computer. after entering the blue interface, enter the FTP server address and the ftp user name and password to install it.
The installation interface of red hat 9.0 is Chinese. the installation instructions can be customized. Note that/swap (swap partition) the size is twice the memory size. since it is used as a nat gateway, it is necessary to separate/var (log partition) separately and not less than 500 MB. there is ample space to store logs, it is well documented for future system faults or attacks.
　　
　　 II. LINUX network settings and nat principles
2.1 Network Settings
After the linux system is installed, the entire platform is set up, but the network needs to be set up. before the network is set, or before the linux system is connected to the Internet, we should turn off services unrelated to this server.
You can press "setup" in the command line and press Enter. a text menu is displayed, which contains "system service". you can use the space key to cancel the check box before the service and restart the system.
If you are a skilled UNIX user, you can cancel the service without restarting it.
Psaux
All services running in the background are displayed.
Kill-9
(-9 indicates force killing a process) to kill the process.
Then go to the/etc/sysconfig/network-scripts/directory.
The viifcfg-eth0 displays the following
Device = eth0
Onboot = yes
Bootproto = none
IPADDR = 192.168.0.1 # (intranet nic ip address)
Netmask = 255.255.255.0
TYPE = ETHERNET
USERCTL = NO
PEERDNS = NO
NETWORK = 192.168.0.0 (NETWORK number)
Broadcast = 192.168.0.255 (Broadcast number)
The above settings mean: eth0 intranet Nic, IP address: 192.168.0.1, subnet mask: 255.255.255.0;
　　
The viifcfg-eth1 displays the following
Device = eth1
Onboot = yes
Bootproto = none
IPADDR = 202.204.208.5 # (Internet nic ip address)
Netmask = 255.255.255.255.128
TYPE = ETHERNET
USERCTL = NO
PEERDNS = NO
NETWORK = 202.204.208.0 (NETWORK number)
Broadcast = 202.204.208.127 (Broadcast number)
The preceding settings mean that eth1 is an external Internet Nic and the IP address is 202.204.208.5.
The NIC settings are complete.
　　
Add the ip address and name of the nat client
Vi/etc/hosts
Format:
IP address host name
127.0.0.1 host
　　
Intranet gateway
Vi/etc/sysconfig/network
Gateway = 202.204.208.7)
　　
Set DNS server
Vi/etc/resolv. conf
Format:
Nameserver IP address
Nameserver 202.106.196.115
After all settings are complete, restart the system and run
Route-a # check the route table to see if the default gateway is 202.204.208.7
If yes, all network configurations on the server have been completed.
　　
The following figure shows the network configuration of the client.
Because it is a Windows 98 system, only configuration parameters are provided. the configuration method is omitted.
The IP address is 192.168.0.2.
Subnet mask: 255.255.255.0
Domain Name Server: 202.106.196.115
Gateway: 192.168.0.1
All network settings complete
　　
2.2 NAT principles
2.2.1 before entering the NAT settings, we should first discuss how NAT works.
In the introduction section, we have mentioned a NAT application instance. from this instance, we can see that NAT and firewall are integrated. In other words, NAT is a firewall. NAT is a subset of the firewall.
In this section, we will discuss the principles of NAT in depth. to better understand NAT, we will use the RFC3022 document published by the INTERNET standardization organization.
There are three types of NAT: Static NAT, network address and port translation DNAT (destination-NAT), and dynamic address NAT (Pooled NAT ). We mainly discuss the first two types of nat.
The static nat solution is to use an internal address in the internal network and translate the internal address into a valid IP address on the Internet through NAT, the specific method is to replace the address domain in the IP package with a valid IP address. The NAT device maintains a Status Table (route table, so NAT is also called a soft route) to map illegal IP addresses to valid IP addresses. Each packet is translated into a correct IP address in the NAT device and sent to the next level, which means a certain burden on the processor. However, for a general network, this burden is negligible.
The translation of network address ports to NAT is also called reverse NAT. the solution is: in an internal network, a computer with an internal address opens a network service (80, 21, etc ), when an external ip address wants to access these services, NAT gateway translates the external ip address into an internal ip address, that is, it maps the internal services to a valid ip address and port, provided for external access.
If you want to learn more about how NAT works, NAT is actually an IP packet fraud. It can also be said to modify the IP header. See the following table.
4-digit version
Four-digit header length
8-bit service type
16-bit total length (bytes)
16-bit ID
3-digit flag
13-bit offset
8-bit ttl)
8-bit protocol
16-bit header checksum
32-bit source IP address
32-bit destination IP address
Other options
Carrying data
Fields in the IP packet format and header
The NAT Gateway (inside 192.168.0.1) receives the ip address data from the client (192.168.0.2) in the local Lan, first checks whether it is from the local subnet. if it passes, then, the local route table is searched for and forwarded according to her destination IP address. NAT converts the 32-bit source address 192.168.0.1 to 202.204.208.5 before the packet is sent forward. Correspondingly, IP packets are converted based on the same address when going back.
2.2.2 NAT settings
Now that we know the principles of NAT, we can configure NAT. we have mentioned that NAT is a firewall, and the firewall IPTABLS is built under RED HAT9.0.
After configuring the network, if you want to enable the client (win98) to access the Internet through the server (static NAT), you can directly enter
Iptables-t nat-a postrouting-o eth1-j SNAT-to 202.204.208.5
Note:
-T nat: Call the nat table. calling this table indicates that a new connection package is generated.
-A: this command attaches A rule to the end of the chain.
POSTROUTING: specifies the rules to change when a legitimate information package intends to leave the firewall.
-O eth1: the output interface is ETH1.
-J SNAT: a jump is also called a trigger condition. a jump occurs when the Snat rule is met.
The entire statement means that when the firewall encounters a new connection package, it will change its source ip address to 202.204.208.5 when it wants to leave the firewall and send the package out of ETH1.
　　
After specifying a nat rule, you must enable the IP forwarding function:
Echo 1>/proc/sys/net/ipv