Linux + iptables + squid Policy Routing implementation
Source: Internet
Author: User
Linux + iptables + squid Policy Routing implementation-Linux Enterprise Application-Linux server application information, the following is a detailed description. Linux + iptables + squid Policy Routing implementation
Linux + iptables + squid Policy Routing implementation
1. Environment
Network Access: 2 lines (1 CT + 1 CNC)
Intranet users: Internet access and other application requirements
5. Process
5.1 install the Operating System
5.1.1. linux: RedHat AS 5 or CentOS 5
5.1.2 check that the following installation packages have been installed
[Root @ off-proxy/] # rpm-qa | grep iptables
Iptables-ipv6-1.3.5-1.2.1
Iptables-1.3.5-1.2.1
LINUX PROXY
CT ROUTE
CNC ROUTE
INTERNET
INTRANET
LINUX PROXY
CT ROUTE
CNC ROUTE
INTERNET
INTRANET
ETH1: 10.10.10.23/24/10 .10.10.254
ETH2: 10.0.0.75/24/10 .0.0.254
ETH0: 192.168.0.X/24/192 .168.0.1
[Root @ off-proxy/] # ping 10.10.10.23
PING 10.10.10.23 (10.10.10.23) 56 (84) bytes of data.
64 bytes from 10.10.10.23: icmp_seq = 1 ttl = 64 time = 0.119 MS
64 bytes from 10.10.10.23: icmp_seq = 2 ttl = 64 time = 0.061 MS
64 bytes from 10.10.10.23: icmp_seq = 3 ttl = 64 time = 0.062 MS
[1] + Stopped ping 10.10.10.23
[Root @ off-proxy/] # ping 10.0.0.75
PING 10.0.0.75 (10.0.0.75) 56 (84) bytes of data.
64 bytes from 10.0.0.75: icmp_seq = 1 ttl = 64 time = 0.062 MS
64 bytes from 10.0.0.75: icmp_seq = 2 ttl = 64 time = 0.061 MS
64 bytes from 10.0.0.75: icmp_seq = 3 ttl = 64 time = 0.062 MS
[2] + Stopped ping 10.0.0.75
[Root @ off-proxy/] # ping 192.168.0.1
PING 192.168.0.1 (192.168.0.1) 56 (84) bytes of data.
64 bytes from 192.168.0.1: icmp_seq = 1 ttl = 64 time = 0.066 MS
64 bytes from 192.168.0.1: icmp_seq = 2 ttl = 64 time = 0.063 MS
[3] + Stopped ping 192.168.0.1
5.3 routing:
[Root @ off-proxy/] # ip route ls
10.0.0.0/24 dev eth2 proto kernel scope link src 10.0.0.75
192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.1
10.10.10.0/24 dev eth1 proto kernel scope link src 10.10.10.23
169.254.0.0/16 dev eth2 scope link
Default via 10.10.10.254 dev eth1 (added)
Command: ip route add default via 10.10.254 dev eth1 .)
Command: [root @ off-proxy/] # ip route add default via 10.0.0.254 dev eth2 table 100
[Root @ off-proxy/] # ip rule ls
0: from all lookup 255
32763: from all to 192.168.183.0/24 lookup CT (added)
32764: from all to 60.0.0.0/13 lookup CT (added)
32765: from 192.168.0.10 lookup CT (added)
32766: from all lookup main
32767: from all lookup default
5.4 route Detection:
[Root @ off-proxy/] # ping 192.168.0.99 (intranet PC)
PING 192.168.0.99 (192.168.0.99) 56 (84) bytes of data.
64 bytes from 192.168.0.99: icmp_seq = 1 ttl = 128 time = 0.316 MS
64 bytes from 192.168.0.99: icmp_seq = 2 ttl = 128 time = 0.325 MS
64 bytes from 192.168.0.99: icmp_seq = 3 ttl = 128 time = 0.322 MS
[6] + Stopped ping 192.168.0.99
[Root @ off-proxy/] # ping 10.10.10.254 (CT gateway)
PING 10.10.10.254 (10.10.10.254) 56 (84) bytes of data.
64 bytes from 10.10.10.254: icmp_seq = 1 ttl = 255 time = 0.704 MS
64 bytes from 10.10.10.254: icmp_seq = 2 ttl = 255 time = 7.83 MS
64 bytes from 10.10.10.254: icmp_seq = 3 ttl = 255 time = 0.706 MS
[7] + Stopped ping 10.10.254
[Root @ off-proxy/] # ping 10.0.0.254 (CNC gateway)
PING 10.0.0.254 (10.0.0.254) 56 (84) bytes of data.
64 bytes from 10.0.0.254: icmp_seq = 1 ttl = 255 time = 12.1 MS
64 bytes from 10.0.0.254: icmp_seq = 2 ttl = 255 time = 1.20 MS
64 bytes from 10.0.0.254: icmp_seq = 3 ttl = 255 time = 1.03 MS
64 bytes from 10.0.0.254: icmp_seq = 4 ttl = 255 time = 9.86 MS
[8] + Stopped ping 10.0.0.254
5.5 IPTABLES settings:
5.5.1 edit scripts
Command: [root @ off-proxy/] # chmod 755/etc/rc. d/firewall. sh (modify the file attribute of firewall)
Command: [root @ off-proxy/] # vi/etc/rc. d/firewall. sh (use the vi command to open the firewall file for editing)
Iptables script content:
#! /Bin/sh
#
/Sbin/modprobe ip_conntrack_ftp
/Sbin/modprobe ip_nat_ftp
/Sbin/iptables-F
/Sbin/iptables-t nat-F
/Sbin/iptables-X
/Sbin/iptables-t nat-X
/Sbin/iptables-t mangle-F
Iptables-a input-I lo-j ACCEPT
Iptables-a output-o lo-j ACCEPT
Iptables-a input-p ICMP -- icmp-type 8-j ACCEPT
Iptables-a input-p ICMP -- icmp-type 11-j ACCEPT
Iptables-a input-m state -- state RELATED, ESTABLISHED-j ACCEPT
Iptables-a input-p udp -- dport 161-j ACCEPT
Echo "1">/proc/sys/net/ipv4/ip_forward
/Sbin/iptables-a input-I eth1-p udp-m multiport -- dports 53-j ACCEPT
/Sbin/iptables-a input-I eth2-p udp-m multiport -- dports 53-j ACCEPT
Iptables-a input-p tcp -- dport 22-j ACCEPT
/Sbin/iptables-t nat-a postrouting-o eth1-j SNAT -- to 10.10.10.23
/Sbin/iptables-t nat-a postrouting-o eth2-j SNAT -- to 10.0.0.75
Ip route add 0/0 via 10.10.10.254
Ip route add 0/0 via 10.0.0.254 table 100
Ip rule add from 192.168.0.10 table 100
Ip rule add to 60.0.0.0/13 table 100
Ip rule add to 192.168.183.0/24 table 100
5.5.2 start script editing
[Root @ off-proxy rc. d] # cat rc. local
#! /Bin/sh
#
# This script will be executed * after * all the other init scripts.
# You can put your own initialization stuff in here if you don't
# Want to do the full Sys V style init stuff.
/Etc/rc. d/firewall. sh (added)
Touch/var/lock/subsys/local
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
