RH9.0 route configuration, transparent proxy, CS1.5 server, hard disk performance optimization!

RH9.0 route configuration, transparent proxy, CS1.5 server, hard disk performance optimization! -- Linux Enterprise Application-Linux server application information. For details, refer to the following section. I am a small network manager for an internet cafe. I have not graduated from high school, and I have learned computer related knowledge by myself. <学习资料来自互联网> To sum up, the level is limited and errors are inevitable. I hope you will correct the mistakes and do not mislead beginners :}.

In the past, the Internet cafe used WIN2003 to provide NAT shared Internet access for Internet cafes, installed the rising firewall, and the IIS6 provided by the system supported ASP. NET. configuring LINUX as a server is only curious for a moment. before that, I will simply install a LINUX :{. let's get down to the truth!

Internet cafe optical fiber access, fixed IP. the server is configured with P4 2.4, 512 m ddr, 845G motherboard, IDE 120G hard drive, D-Link 530Tx dual Nic, and LINUX9 with built-in driver. Therefore, you can use it directly after installation ~ :} Eth0 connected to the Internet, IP: 192.168.1.10 mask: 255.255.255.0 Gateway: 192.168.1.1 eth1 connected to the Intranet, IP: 192.168.2.1 mask: 255.255.255.0, DNS: 202.102.128.68, 202.102.152.3, 218.56.57.58) machine name netserver. linux ssh service is used for configuration. The IP address of the machine is 192.168.2.3. For win2k's system, the two files are named psftp.exeand putty.exe. the Server only provides WEB Services and CS services. Therefore, the open ports are only WWW ports and CS ports 27017, 27015 <1.5 is 27016 PUB server, and 1.6 is Race Server, 27017 is 1.5 Race Server (because of the time relationship, the F of 1.6 has not been done yet: {)>

In linux, the default language is ENGLISH. When selecting a file package, select none of the packages, and then select only the WEB server, PHP, MYSQL options, and SAMBA and SSH. in this way, the total space required is about MB ~ During the installation process, configure the IP address, mask, gateway, and DNS. After the installation, you can use SSH!

First, configure Internet sharing and firewall! <以下内容为转帖,并经过简单修改>

In this example, iptables rejects all packets and opens the packets to be released, which is highly secure.

Vi/bin/firewall. iptables # create a new document in the/bin directory named firewall. iptables


The content is as follows:
#! /Bin/bash
# Load module Load related modules
Modprobe ip_tables
Modprobe ip_nat_ftp
Modprobe ip_conntrack
Modprobe ip_conntrack_ftp
Modprobe ip_conntrack_irc


# Start firewall service with deny all IPTABLES initial setting: reject all packets.
Iptables-F
Iptables-F-t nat
Iptables-X
Iptables-X-t nat
Iptables-P INPUT DROP
Iptables-P FORWARD ACCEPT
Iptables-P OUTPUT DROP

Iptables-a input-I lo-j ACCEPT
Iptables-a output-o lo-j ACCEPT

# Set eth1 as a trusted Device
Iptables-a input-I eth1-j ACCEPT
Iptables-a output-o eth1-j ACCEPT

# ICMP Control the external computer cannot PING this host, but this host can PING the external computer
Iptables-a output-o eth0-p icmp-j ACCEPT
Iptables-a input-I eth0-p icmp -- icmp-type echo-reply-j ACCEPT
Iptables-a input-I eth0-p icmp -- icmp-type echo-request-j DROP

# Outgoing allow WAN packets sent from this host
Iptables-a input-I eth0-p TCP -- sport www-j ACCEPT
Iptables-a output-o eth0-p TCP -- dport www-j ACCEPT
Iptables-a input-I eth0-p UDP -- sport www-j ACCEPT
Iptables-a output-o eth0-p UDP -- dport www-j ACCEPT
Iptables-a input-I eth0-p TCP -- sport 27015-j ACCEPT
Iptables-a output-o eth0-p TCP -- dport 27015-j ACCEPT
Iptables-a input-I eth0-p TCP -- sport 27016-j ACCEPT
Iptables-a output-o eth0-p TCP -- dport 27016-j ACCEPT
Iptables-a input-I eth0-p TCP -- sport 27017-j ACCEPT
Iptables-a output-o eth0-p TCP -- dport 27017-j ACCEPT

# Incoming allow incoming packets from the WAN
Iptables-a input-I eth0-p TCP -- dport www-j ACCEPT
Iptables-a output-o eth0-p TCP -- sport www-j ACCEPT
Iptables-a input-I eth0-p UDP -- dport www-j ACCEPT
Iptables-a output-o eth0-p UDP -- sport www-j ACCEPT
Iptables-a input-I eth0-p TCP -- dport 27015-j ACCEPT
Iptables-a output-o eth0-p TCP -- sport 27015-j ACCEPT
Iptables-a input-I eth0-p TCP -- dport 27016-j ACCEPT
Iptables-a output-o eth0-p TCP -- sport 27016-j ACCEPT
Iptables-a input-I eth0-p TCP -- dport 27017-j ACCEPT
Iptables-a output-o eth0-p TCP -- sport 27017-j ACCEPT

# Set nat camouflage IP with more to one NAT packet disguise
Echo "1">/proc/sys/net/ipv4/ip_forward
# Iptables-t nat-a prerouting-I eth1-p tcp-s 192.168.2.0/24 -- dport 80-j DNAT -- to 192.168.2.1: 3128
# Iptables-t nat-a prerouting-I eth1-p tcp-s 192.168.2.0/24 -- dport 80-j REDIRECT -- to-port 3128
Iptables-t nat-a postrouting-s 192.168.2.0/24-o eth0-j MASQUERADE

At this point, the firewall. iptables content has ended.

Set firewall. iptables to an executable file
Chmod 700/bin/firewall. iptables

Run firewall. iptables automatically upon startup
Vi/etc/rc. d/rc. local
Add firewall. iptables at the end

For other ort numbers, refer to/etc/services.
Cat/etc/services | less # view/etc/services hot rolling by page down to the next page
# Press Leave
# Run firewall. iptabls
Firewall. iptables
# Generate a firewall rule file under/etc/sysconfig/
Cd/etc/sysconfig
Iptables-save> iptables
Now, the firewall configuration is complete!


Squid proxy settings
The following is my/etc/squid. conf content

Http_port 3128
Cache_mem 64 MB
Cache_swap_low 75
Cache_swap_high 85
Maximum_object_size 4096 KB
Maximum_object_size_in_memory 8 KB
Ipcache_size 1024
Ipcache_low 90
Ipcache_high 95
Fqdncache_size 1024
Cache_dir ufs/var/spool/squid 1000 16 256
Cache_access_log/var/log/squid/access. log
Cache_log/var/log/squid/cache. log
Pid_filename/var/run/squid. pid
Client_netmask 255.255.255.0
Acl all src 0.0.0.0/0.0.0.0
Acl localhost src 127.0.0.0/255.0.0.0
Http_access deny all
Acl our_networks src 192.168.2.0/24
Http_access allow localhost
Cache_mgr awp46@126.com
Cache_inclutive_user squid
Cache_paitive_group squid
Httpd_accel_with_proxy on
Httpd_accel_uses_host_header on
Visible_hostname netserver
Httpd_accel_host virtual
Httpd_accel_port 80


Samba settings
The following is my/etc/samba/smb. conf content

Workgroup = workgroup
Server string = Workgroup
Hosts allow = 192.168.2.3
Guest account = root
Log file =/var/log/samba/% m. log
Security = share
Client code pages = 936
Encrypt passwords = yes
Smb passwd file =/etc/passwd
[Admin]
Path =/
Valid users = root
Public = yes
Writeable = yes
Directory mode = 0777

Note: Because SAMBA is only used by myself, it shares the root directory and has full permissions! I usually turn off the SAMBA service and only enable it when it is used.

WEB Settings
Because PHP, MYSQL, and related items are selected during installation, this configuration is especially easy:}. The following is my/etc/httpd/conf/httpd. changed in conf, but not elsewhere

ServerAdmin awp46@126.com
ServerName 192.168.1.10: 80
DirectoryIndex index. php index.htm
DefaultLanguage zh-cn
Adddefacharcharset GB2312

You need to change the Mysql root Password! I modified phpadmin and deleted all users except root/localhost!

System Service:
Use the ntsysv command to open service settings. The services I open include httpd, iptables, mysqld, network, smb, squid, sshd, and syslog.
You can also use the servies service name stop/start to stop or open the service.
Example: servies httpd stop

Hard Disk Optimization. data must be backed up before optimization. No one can save you! :{
Display hard drive parameters:
Hdparm-v/dev/hda
Test hard drive performance:
Hdparm-Tt/dev/hda
In/etc/rc. d/rc. add the following command in local to automatically optimize the system during startup. you must test it before adding it, and see how to change it to high performance.
Hdparm-c3-d1-k1-m16-a64/dev/hda

CS 1.5 server setup!
The required files hlds_l_3111_full.bin,cs_15_full.tar.gz (read other articles on the Internet and add the cd key-free patch. It's useless if I don't find it, but it can be used in the same way without the CDKEY-free patch ~)
Use the chmod 700 hlds_l_3111_full.bin compressed file! After decompression, A hlds_ldirectory is obtained. Then, extract cs_15_full.tar.gz to the hlds_l directory!
My hlds_l directory/game/hlds_l
Vi/bin/startcs1
Cd/game/hlds_l
./Hlds_run-game cstrike + ip 192.168.1.10 + port 27015 + maxplayers 22 + map de_dust2-nomaster + sv_lan 1 + server1_file server1.cfg + mapcyclefiles mapcycle1.txt + motdfile motd1.txt
Chmod 700/bin/startcs1

Vi/bin/startcs2
Cd/game/hlds_l
./Hlds_run-game cstrike + ip 192.168.1.10 + port 27016 + maxplayers 12 + map de_dust2-nomaster + sv_lan 1 + server1_file server2.cfg + mapcyclefiles mapcycle2.txt + motdfile motd2.txt
Chmod 700/bin/startcs2

Vi/bin/startcs3
Cd/game/hlds_l
./Hlds_run-game cstrike + ip 192.168.1.10 + port 27017 + maxplayers 12 + map de_dust2-nomaster + sv_lan 1 + server1_file server3.cfg + mapcyclefiles mapcycle3.txt + motdfile motd3.txt
Chmod 700/bin/startcs1

In this way, you can directly enter startcs1 when you want to open the CS server!
If the CS server crashes halfway, you need to manually enter startcs1, which is very troublesome! Use the following method to solve the problem!
Vi/bin/autostartcs1
While true
Do
Startcs1
Done

Vi/bin/autostartcs2
While true
Do
Startcs2
Done

Vi/bin/autostartcs3
While true
Do
Startcs3
Done

When opening the CS server, use autostartcs1! In this way, the CS server is not afraid to be crashed in the middle!
FOR the installation of the CS server plug-in, download the FOR linux version from www.unitedadmins.com and decompress it to hlds_l/cstrike, FOR example, hlds/cstrike/addons/amx.
Remember to add the following to each server. cfg:
Max_queries_sec "5"
Max_queries_sec_global "10"
Max_queries_window "30"
Otherwise, the CS server may be disconnected from each other!
Appendix/hlds_l/cstrike/liblist. gam content
Game "Counter-Strike"
Url_info "www.counter-strike.net"
Url_dl ""
Version 1.5"
Size: 184000000"
Svonly "0"
Secure "0"
Type "multiplayer_only"
Cldll "1"
Hlversion "1110"
Nomodels "1"
Nohimodel "1"
Mpentity "info_player_start"
Gamedll_linux "addons/metamod/dlls/metamod_i386.so"
Trainmap "tr_1"

/Hlds_l/cstrike/addons/metamod/plugins. ini file content
Linux addons/wwcl/dlls/pcawwclconfig_mm_i386.so
Linux addons/booster/booster_mm.so
Linux addons/amx/dlls/amx_mm_i386.so
Linux addons/amx/dlls/fun_ms_i386.so
// Linux addons/amx/dlls/war3_ms_i386.so
// Linux addons/amx/dlls/udp_ms_i386.so
Linux addons/amx/dlls/csstats_ms_i386.so
// Linux addons/hlguard/dlls/hlguard_mm_i586.so
// Linux addons/cdeath/cdmod_i586.so
// Linux addons/chickenmod/dlls/chicken_mm_i386.so
// Linux addons/statsme/dlls/sm_cstrike_mm_i386.so
// Linux addons/clanmod/dlls/clanmod_mm_i586.so

NOTE: If PING occurs, you can change the priority of the program HLDS!
Display process:
Ps-e
.............
3386 pts/0 00:00:00 hlds_run
........
Increase the priority of a process ID to 3386 HLDS
Renice + 1 3386


The configuration is complete! Haha! There are two problems that I know but haven't solved yet:
1. Question about Squid Proxy!
# Iptables-t nat-a prerouting-I eth1-p tcp-s 192.168.2.0/24 -- dport 80-j DNAT -- to 192.168.2.1: 3128
# Iptables-t nat-a prerouting-I eth1-p tcp-s 192.168.2.0/24 -- dport 80-j REDIRECT -- to-port 3128
Iptables-t nat-a postrouting-s 192.168.2.0/24-o eth0-j MASQUERADE
To implement the SQUID transparent proxy, one is to set the squid port to 80, but this is in conflict with the WEB! If you do not want to change the WEB port, you need to use the first or second line of the above command, but I tried, and none of them can be used! Thank you for your advice!


2. PING to the CS Server
In WINDOWS, the default FPS of the CS server is 64. After using the HL-Booster acceleration, it can reach 512 or higher! (Enter stats to view server FPS !)
However, after a linux server uses booster acceleration, it uses stats to check whether the FPS is 50. In this way, even if the server enters the CS server from the LAN, PING will be around 20! PING the CS server in WINDOWS within 10 after acceleration!
Sys_ticrate 10000
Booster_maxsysticrate 10000
Booster_min1_icrate 10000
Adding these parameters to server. cfg does not work :{
Beg for advice from the production experts of the CS server in LINUX!