Co tu jest zle albo czego brakuje. Pomozcie.
Korzystam z redhata 7.3 ; jadro skompilowane pod obsluge cbq iproute i oczywiscie iptables. A to co do tej pory zrobilem:
konfig shaperd:
internet_iface=eth0
#ipchains_path=/sbin/ipchains
iptables_path=/sbin/iptables
tc_path=/sbin/tc
# timeout of tcp connection on masquerade
# for kernel 2.2.x (in seconds)
# default:
# timeout_ipchains_22=3600
# for kernel 2.4.x and ipchains (in minutes)
# default:
# timeout_ipchains_24=7200
# for kernel 2.4.x and iptables (in seconds)
# default:
timeout_iptables_24=432000
# older connection on masquerade will be ignored (in seconds)
# default:
# timeout_global=300
# experimental - yes - turn on alternative nat tracking connection.
# Work only with nomasq=no
# default:
# alt_natstat=yes
# new user speed multipler
# if > 0 - then initailly assigned bandwidth is counted: lospeed * start_speed
# if 0 - then initailly assigned bandwidth is counted through straight division
# of quantity of hispeed through quantity of downloading users
# default:
start_speed=0
# if yes - don't recreate speed allocation every cycle but only change it
# default:
continuous_control=yes
# if yes - turn on even division
# default:
even_division=no
# measure total of assigned bandwidth
# default:
check_sum_of_bandwidth=yes
# in percent of total bandwidth speed
firewall wyglada tak
echo "Sciezka do iptables"
IPTABLES="/sbin/iptables"
echo "interfejs zewnetrzny"
EXT_INT="eth0"
EXT_IP="10.0.0.1"
SIEC="10.0.0.0"
MASKA="255.0.0.0"
echo "interfejs lokalny"
LAN_INT="eth1"
LAN_IP="10.0.1.1"
SIEC_IP="10.0.1.0"
SIEC_MASKA="255.255.255.0"
MASQUERADE="YES"
TOSSUPPORT="NO"
HOST1="10.0.1.3"
HOST2="10.0.1.4"
HOST3="10.0.1.5"
HOST4="10.0.1.7"
#uruchmienie przekazywania pakietow
echo "1" > /proc/sys/net/ipv4/ip_forward
echo "1" > /proc/sys/net/ipv4/conf/eth0/proxy_arp
echo "1" > /proc/sys/net/ipv4/conf/eth1/proxy_arp
echo "czyszczenie tablic"
$IPTABLES -F -t nat
$IPTABLES -X -t nat
$IPTABLES -F -t filter
$IPTABLES -X -t filter
echo "brak zezwolenia na filtrowanie pakietow"
$IPTABLES -t filter -P FORWARD DROP
echo "Polityka pakietow wejsciowych"
echo "przepuszczanie pakietow z sieci lub przeznaczone dla sieci"
$IPTABLES -t filter -A FORWARD -s $SIEC/$MASKA -d 0/0 -j ACCEPT
$IPTABLES -t filter -A FORWARD -s 0/0 -d $SIEC/$MASKA -j ACCEPT
$IPTABLES -t filter -A FORWARD -s $SIEC_IP/$SIEC_MASKA -d 0/0 -j ACCEPT
$IPTABLES -t filter -A FORWARD -s 0/0 -d $SIEC_IP/$SIEC_MASKA -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -o $EXT_INT -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -p tcp -o $EXT_INT -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -p udp -o $EXT_INT -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -p icmp -o $EXT_INT -j MASQUERADE
$IPTABLES -t nat -A POSTROUTING -o $LAN_INT -j MASQUERADE
tablica routingu w ktorej nie podoba mi sie maska sieci 10.0.0.1 a ktora system sam uaktualnia na coas takiego a router to ip routera ktory jest zarazem modemem do neo.
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
10.0.0.0 * 255.255.255.0 U 0 0 0 eth0
10.0.1.0 * 255.255.255.0 U 0 0 0 eth1
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
default router 0.0.0.0 UG 0 0 0 eth0
a tak wyglada tablica iptables
Chain INPUT (policy ACCEPT 13826 packets, 1629K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
45539 2033K ACCEPT all -- any any 10.0.0.0/8 anywhere
73008 82M ACCEPT all -- any any anywhere 10.0.0.0/8
0 0 ACCEPT all -- any any 10.0.1.0/24 anywhere
0 0 ACCEPT all -- any any anywhere 10.0.1.0/24
Chain OUTPUT (policy ACCEPT 13640 packets, 1497K bytes)
pkts bytes target prot opt in out source destination
Chain shaout0 (0 references)
pkts bytes target prot opt in out source destination
Chain shaper0 (0 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- any eth1 !10.0.1.0/24 10.0.1.2
0 0 RETURN all -- any eth1 !10.0.1.0/24 10.0.1.3
0 0 RETURN all -- any eth1 !10.0.1.0/24 10.0.1.4
0 0 RETURN all -- any eth1 !10.0.1.0/24 10.0.1.5
I Zrodzil mi sie nastepny problem otoz jak podepne w tagkiej konfiguracji to nic mi nie chodzi: router ---eth0 serwer eth1----switch ---kompy natomist jesli wroce do pierwotnej konf czyli router---switch---kompy w tym eth0 i eth1 podpiete do switcha to nie przyjmuje mi zadnego ip na hostach i cala siec pada. wiem ze to nie poprawnie ale przez jakis czas nie wiem jak ale chodzilo.
pozdrawiam
