OpenSUSE 11服务器作为路由器

所以，我一直在尝试将服务器设置为本地networking的前端路由器。 这是因为我的服务器有相当多的多媒体下载一个LOT，目前的路由器是不够的。 我不想买一个新的路由器，因为那些可能够用的是相当昂贵的。 幸运的是，我看到了一些服务器作为路由器本身的设置。

我的新安装程序将如下所示：

WAN - IPS -|-> My server -> Home router -> Local computer 1 ^ Local computer 2 '- possibly a switch ... 

我做了一个search，幸运地find了本教程 ，描述了相同的设置 – 作为路由器的OpenSUSE服务器。 不过，我注意到这个教程有点不合适，主要是因为我的服务器上有不同版本的YaST。

但是，我尽我所能，遵循它，使用较低级别的命令（使用terminal）来完成相同的。 花了一点时间，但我认为结果是一样的。

• 指定哪些外部IP地址可以访问端口80
• 赢7networkingconfiguration问题
• 在最低的networking上共享networking打印机
• 我应该阻止任何内部networking的服务？
• 简单的端口转发

不幸的是，它没有工作。

这是我到目前为止所pipe理的：

• 两个网卡，一个是在/ dev / eth0（在板上，在内部）运行的PCI设备，另一个是/ dev / eth1（PCI，外部网卡）。
• eth1被设置为DHCP地址，很容易从ISP获得IP地址（我有一个静态的，所以它总是一样的），并连接。 这一个绝对有效，因为我可以在服务器上使用互联网。
• eth0设置为静态IP 192.168.0.1。
• 在eth0上运行的DHCP服务器工作，连接的计算机可以获得IP地址，即使路由器上的DHCP服务器已closures。

显然现在甚至没有DHCP服务器的作品。 我正在使用这个ISC DHCP服务器，不知道这是不是最好的select。

我需要的最后一部分是以某种方式桥接或连接这两个卡，这样我就可以通过eth1从（通过路由器）连接到eth0的计算机访问Internet。 在教程中，这只是使用“伪装”，或者允许内部区域（eth0）通过外部区域（eth1）访问互联网。 显然这个部分在YaST和我的教程中都是一样的。 不过，我认为这是行不通的。 我试过使用YaST来设置，然后我使用terminal，但没有任何区别。

我猜想伪装本身可能工作，但电脑连接不正确？ 或者这是伪装的错误。 无论如何，使用ping，我可以ping 192.168.0.1与一个非常快速和成功的反应。

我究竟做错了什么？ 请随时提出任何问题（很可能我忘记了一些东西），我很乐意回应。

iptables -L：

 Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state ESTABLISHED ACCEPT icmp -- anywhere anywhere state RELATED input_int all -- anywhere anywhere input_ext all -- anywhere anywhere input_int all -- anywhere anywhere LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-IN-ILL-TARGET ' DROP all -- anywhere anywhere Chain FORWARD (policy DROP) target prot opt source destination TCPMSS tcp -- anywhere anywhere tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU forward_int all -- anywhere anywhere forward_ext all -- anywhere anywhere LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWD-ILL-ROUTING ' DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED LOG all -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-OUT-ERROR ' Chain forward_ext (1 references) target prot opt source destination ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp echo-reply ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp destination-unreachable ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp time-exceeded ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp parameter-problem ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp timestamp-reply ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp address-mask-reply ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp protocol-unreachable ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp redirect ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED DROP all -- anywhere anywhere PKTTYPE = multicast DROP all -- anywhere anywhere PKTTYPE = broadcast LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT ' LOG icmp -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT ' LOG udp -- anywhere anywhere limit: avg 3/min burst 5 state NEW LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT ' DROP all -- anywhere anywhere Chain forward_int (1 references) target prot opt source destination ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp echo-reply ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp destination-unreachable ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp time-exceeded ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp parameter-problem ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp timestamp-reply ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp address-mask-reply ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp protocol-unreachable ACCEPT icmp -- anywhere anywhere state RELATED,ESTABLISHED icmp redirect ACCEPT all -- anywhere anywhere state NEW,RELATED,ESTABLISHED DROP all -- anywhere anywhere PKTTYPE = multicast DROP all -- anywhere anywhere PKTTYPE = broadcast LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT ' LOG icmp -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT ' LOG udp -- anywhere anywhere limit: avg 3/min burst 5 state NEW LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT ' reject_func all -- anywhere anywhere Chain input_ext (1 references) target prot opt source destination DROP all -- anywhere anywhere PKTTYPE = broadcast ACCEPT icmp -- anywhere anywhere icmp source-quench ACCEPT icmp -- anywhere anywhere icmp echo-request LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ftp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp -- anywhere anywhere tcp dpt:ftp LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:ssh flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp -- anywhere anywhere tcp dpt:ssh LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:lm-x flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp -- anywhere anywhere tcp dpt:lm-x LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp dpt:http flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP ' ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT udp -- anywhere anywhere udp dpt:lm-x LOG tcp -- 192.168.0.1 anywhere tcp spt:lm-x dpt:lm-x state NEW limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC ' ACCEPT tcp -- 192.168.0.1 anywhere tcp spt:lm-x dpt:lm-x DROP all -- anywhere anywhere PKTTYPE = multicast DROP all -- anywhere anywhere PKTTYPE = broadcast LOG tcp -- anywhere anywhere limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' LOG icmp -- anywhere anywhere limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' LOG udp -- anywhere anywhere limit: avg 3/min burst 5 state NEW LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT ' DROP all -- anywhere anywhere Chain input_int (2 references) target prot opt source destination ACCEPT all -- anywhere anywhere Chain reject_func (1 references) target prot opt source destination REJECT tcp -- anywhere anywhere reject-with tcp-reset REJECT udp -- anywhere anywhere reject-with icmp-port-unreachable REJECT all -- anywhere anywhere reject-with icmp-proto-unreachable 

iptables -t nat -L：

 Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination MASQUERADE all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination 

DHCP服务器configuration：

 authoritative; subnet 192.168.0.0 netmask 255.255.255.0 { range 192.168.0.100 192.168.0.200; option ip-forwarding on; default-lease-time 7200; max-lease-time 86400; option subnet-mask 255.255.255.0; option broadcast-address 192.168.0.255; option routers 192.168.0.1; option domain-name "domain-local.sk"; # I really don't know what should I put here. option domain-name-servers 192.168.0.1; } 

 #!/bin/bash # saving old iptables-configuration iptables-save > /home/xxusernamexx/iptables-saved.out # delete all existing rules and chains iptables -F iptables -t nat -F iptables -X iptables -Z iptables -t nat -Z # setting up masquerade iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE # forwarding for answer-packages from the internet iptables -A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -o eth1 -j ACCEPT iptables -A FORWARD -j LOG --log-ip-options --log-prefix fwd-drop iptables -A FORWARD -j DROP # allowing loopback and internal connections # uncommend the following line if you want to allow ping from external iptables -A INPUT -s 0.0.0.0/0 -p tcp --dport 80 -j ACCEPT # for your webserver iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # edited iptables -A INPUT -p icmp --icmp-type 8 -i eth1 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i eth0 -j ACCEPT # for connections from lan-nic iptables -A INPUT -s 192.168.0.0/24 -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -j LOG --log-ip-options --log-prefix io-drop iptables -A INPUT -j DROP iptables -A OUTPUT -j ACCEPT # edited iptables -A OUTPUT -p icmp --icmp-type 0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -A OUTPUT -j LOG --log-ip-options --log-prefix io-drop iptables -A OUTPUT -j DROP # just to make sure that routing is enabled echo 1 > /proc/sys/net/ipv4/ip_forward