亚洲av成人无遮挡网站在线观看,少妇性bbb搡bbb爽爽爽,亚洲av日韩精品久久久久久,兔费看少妇性l交大片免费,无码少妇一区二区三区

Chinaunix

標題: linux下面架設ADSL服務器概敘 [打印本頁]
作者: huzhiwen    時間: 2006-11-04 18:28
標題: linux下面架設ADSL服務器概敘
我使用linux作為上網(wǎng)共享服務器穩(wěn)定運行1年了,基本是不管它,效果還可以,現(xiàn)在把我的架設方式描敘一下,給大家一個參考
機器是塞揚400,128M內(nèi)存,無鍵盤,無顯示器,兩個網(wǎng)卡,安裝好redhat linux后,在開機bios中電源管理中,設置為來電后自動啟動(經(jīng)常停電,無辦法).
設置ADSL按照通常的方法,使用adsl-setup,設置好后,使用adsl-start啟動adsl,然后在本機上是否連上,一般是沒有問題的.
設置機器啟動后自動啟動adsl

rc.local文件設置如下


  3. #!/bin/sh
  4. #
  5. # This script will be executed *after* all the other init scripts.
  6. # You can put your own initialization stuff in here if you don't
  7. # want to do the full Sys V style init stuff.

  9. touch /var/lock/subsys/local
  10. adsl-start #啟動adsl
  11. /root/firewall/firewall.sh #運行防火墻腳本

復制代碼


防火墻腳本基本是采取iptables一樣,但是自己根據(jù)需求小小改了一下

全文如下


  2. #!/bin/sh
  3. #
  4. # rc.firewall - DHCP IP Firewall script for Linux 2.4.x and iptables
  5. #
  6. # Copyright (C) 2001  Oskar Andreasson <bluefluxATkoffeinDOTnet>
  7. #
  8. # This program is free software; you can redistribute it and/or modify
  9. # it under the terms of the GNU General Public License as published by
  10. # the Free Software Foundation; version 2 of the License.
  11. #
  12. # This program is distributed in the hope that it will be useful,
  13. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  14. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15. # GNU General Public License for more details.
  16. #
  17. # You should have received a copy of the GNU General Public License
  18. # along with this program or from the site that you downloaded it
  19. # from; if not, write to the Free Software Foundation, Inc., 59 Temple
  20. # Place, Suite 330, Boston, MA  02111-1307   USA
  21. #

  23. ###########################################################################
  24. #
  25. # 1. Configuration options.
  26. #

  28. #
  29. # 1.1 Internet Configuration.
  30. #
  31. EXT_IP=`ifconfig|sed '/^eth/,/^ppp0/d'|sed '/^ *UP/,/$d/d'|cut -d: -f 2|cut -d ' ' -f 1`
  32. INET_IFACE="ppp0"



  36. #
  37. # 1.1.1 DHCP
  38. #

  40. #
  41. # Information pertaining to DHCP over the Internet, if needed.
  42. #
  43. # Set DHCP variable to no if you don't get IP from DHCP. If you get DHCP
  44. # over the Internet set this variable to yes, and set up the proper IP
  45. # address for the DHCP server in the DHCP_SERVER variable.
  46. #

  48. DHCP="no"
  49. #DHCP_SERVER="192.168.1.1"

  51. #
  52. # 1.1.2 PPPoE
  53. #

  55. # Configuration options pertaining to PPPoE.
  56. #
  57. # If you have problem with your PPPoE connection, such as large mails not
  58. # getting through while small mail get through properly etc, you may set
  59. # this option to "yes" which may fix the problem. This option will set a
  60. # rule in the PREROUTING chain of the mangle table which will clamp
  61. # (resize) all routed packets to PMTU (Path Maximum Transmit Unit).
  62. #
  63. # Note that it is better to set this up in the PPPoE package itself, since
  64. # the PPPoE configuration option will give less overhead.
  65. #

  67. PPPOE_PMTU="no"

  69. #
  70. # 1.2 Local Area Network configuration.
  71. #
  72. # your LAN's IP range and localhost IP. /24 means to only use the first 24
  73. # bits of the 32 bit IP address. the same as netmask 255.255.255.0
  74. #

  76. LAN_IP="192.168.1.1"
  77. LAN_IP_RANGE="192.168.1.0/24"
  78. LAN_BROADCAST_ADDRESS="192.168.1.255"
  79. LAN_IFACE="eth0"


  82. #
  83. # 1.3 DMZ Configuration.
  84. #

  86. #
  87. # 1.4 Localhost Configuration.
  88. #

  90. LO_IFACE="lo"
  91. LO_IP="127.0.0.1"

  93. #
  94. # 1.5 IPTables Configuration.
  95. #

  97. IPTABLES="/sbin/iptables"

  99. #
  100. # 1.6 Other Configuration.
  101. #

  103. ###########################################################################
  104. #
  105. # 2. Module loading.
  106. #

  108. #
  109. # Needed to initially load modules
  110. #

  112. /sbin/depmod -a

  114. #
  115. # 2.1 Required modules
  116. #

  118. /sbin/modprobe ip_conntrack
  119. /sbin/modprobe ip_tables
  120. /sbin/modprobe iptable_filter
  121. /sbin/modprobe iptable_mangle
  122. /sbin/modprobe iptable_nat
  123. /sbin/modprobe ipt_LOG
  124. /sbin/modprobe ipt_limit
  125. /sbin/modprobe ipt_MASQUERADE

  127. #
  128. # 2.2 Non-Required modules
  129. #

  131. #/sbin/modprobe ipt_owner
  132. #/sbin/modprobe ipt_REJECT
  133. /sbin/modprobe ip_conntrack_ftp
  134. /sbin/modprobe ip_conntrack_irc
  135. /sbin/modprobe ip_nat_ftp
  136. /sbin/modprobe ip_nat_irc

  138. ###########################################################################
  139. #
  140. # 3. /proc set up.
  141. #

  143. #
  144. # 3.1 Required proc configuration
  145. #

  147. echo "1" > /proc/sys/net/ipv4/ip_forward

  149. #
  150. # 3.2 Non-Required proc configuration
  151. #

  153. #echo "1" > /proc/sys/net/ipv4/conf/all/rp_filter
  154. #echo "1" > /proc/sys/net/ipv4/conf/all/proxy_arp
  155. #echo "1" > /proc/sys/net/ipv4/ip_dynaddr

  157. ###########################################################################
  158. #
  159. # 4. rules set up.
  160. #

  162. ######
  163. # 4.1 Filter table
  164. #

  166. #
  167. # 4.1.1 Set policies
  168. #
  169. $IPTABLES  --flush
  170. $IPTABLES -t nat --flush
  171. $IPTABLES -t mangle --flush
  172. $IPTABLES -X
  173. $IPTABLES -P INPUT DROP
  174. $IPTABLES -P OUTPUT DROP
  175. $IPTABLES -P FORWARD DROP

  177. #
  178. # 4.1.2 Create userspecified chains
  179. #

  181. #
  182. # Create chain for bad tcp packets
  183. #

  185. $IPTABLES -N bad_tcp_packets

  187. #
  188. # Create separate chains for ICMP, TCP and UDP to traverse
  189. #

  191. $IPTABLES -N allowed
  192. $IPTABLES -N tcp_packets
  193. $IPTABLES -N udp_packets
  194. $IPTABLES -N icmp_packets

  196. #
  197. # 4.1.3 Create content in userspecified chains
  198. #

  200. #
  201. # bad_tcp_packets chain
  202. #

  204. $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j LOG \
  205. --log-prefix "New not syn:"
  206. $IPTABLES -A bad_tcp_packets -p tcp ! --syn -m state --state NEW -j DROP

  208. #
  209. # allowed chain
  210. #

  212. $IPTABLES -A allowed -p TCP --syn -j ACCEPT
  213. $IPTABLES -A allowed -p TCP -m state --state ESTABLISHED,RELATED -j ACCEPT
  214. $IPTABLES -A allowed -p TCP -j DROP

  216. #
  217. # TCP rules
  218. #

  220. #disable ftp port
  221. $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 21 -j allowed
  222. $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 20 -j allowed

  224. #this is port I use as ssh

  226. $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 9121 -j allowed
  227. #disable http port
  228. $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 80 -j allowed

  230. #disable pop3 port
  231. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport pop3 -j allowed


  234. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 113 -j allowed

  236. #this is smtp port
  237. #$IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 25 -j allowed

  239. #this is minadmin port
  240. $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 9122 -j allowed

  242. #this is named domain
  243. $IPTABLES -A tcp_packets -p TCP -s 0/0 --dport 53 -j allowed

  245. #
  246. # UDP ports
  247. #

  249. $IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
  250. $IPTABLES -A udp_packets -p UDP -s 0/0 --dport 53 -j ACCEPT
  251. if [ $DHCP == "yes" ] ; then
  252. $IPTABLES -A udp_packets -p UDP -s $DHCP_SERVER --sport 67 \
  253. --dport 68 -j ACCEPT
  254. fi

  256. $IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 53 -j ACCEPT
  257. $IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 123 -j ACCEPT
  258. $IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 2074 -j ACCEPT
  259. $IPTABLES -A udp_packets -p UDP -s 0/0 --source-port 4000 -j ACCEPT

  261. #
  262. # In Microsoft Networks you will be swamped by broadcasts. These lines
  263. # will prevent them from showing up in the logs.
  264. #

  266. $IPTABLES -A udp_packets -p UDP -i $INET_IFACE \
  267. --destination-port 135:139 -j DROP

  269. #
  270. # If we get DHCP requests from the Outside of our network, our logs will
  271. # be swamped as well. This rule will block them from getting logged.
  272. #

  274. $IPTABLES -A udp_packets -p UDP -i $INET_IFACE -d 255.255.255.255 \
  275. --destination-port 67:68 -j DROP

  277. #
  278. # ICMP rules
  279. #

  281. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 8 -j ACCEPT
  282. $IPTABLES -A icmp_packets -p ICMP -s 0/0 --icmp-type 11 -j ACCEPT

  284. #
  285. # 4.1.4 INPUT chain
  286. #

  288. #
  289. # Bad TCP packets we don't want.
  290. #

  292. $IPTABLES -A INPUT -p tcp -j bad_tcp_packets

  294. #
  295. # Rules for special networks not part of the Internet
  296. #


  299. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -s $LAN_IP_RANGE -j ACCEPT
  300. $IPTABLES -A INPUT -p ALL -i $LO_IFACE -j ACCEPT
  301. $IPTABLES -A INPUT -p ALL -i $LAN_IFACE -d $LAN_BROADCAST_ADDRESS -j ACCEPT

  303. #
  304. # Special rule for DHCP requests from LAN, which are not caught properly
  305. # otherwise.
  306. #

  308. $IPTABLES -A INPUT -p UDP -i $LAN_IFACE --dport 67 --sport 68 -j ACCEPT
  309. #$IPTABLES -A INPUT -p UDP -i $LAN_IFACE2 --dport 67 --sport 68 -j ACCEPT
  310. $IPTABLES -A INPUT -p UDP -s 0.0.0.0 --sport 68 -d 255.255.255.255 --dport 67  -j ACCEPT

  312. #
  313. # Rules for incoming packets from the internet.
  314. #

  316. $IPTABLES -A INPUT -p ALL -i $INET_IFACE -m state --state ESTABLISHED,RELATED \
  317. -j ACCEPT
  318. $IPTABLES -A INPUT -p TCP -i $INET_IFACE -j tcp_packets
  319. $IPTABLES -A INPUT -p UDP -i $INET_IFACE -j udp_packets
  320. $IPTABLES -A INPUT -p ICMP -i $INET_IFACE -j icmp_packets

  322. #
  323. # If you have a Microsoft Network on the outside of your firewall, you may
  324. # also get flooded by Multicasts. We drop them so we do not get flooded by
  325. # logs
  326. #

  328. $IPTABLES -A INPUT -i $INET_IFACE -d 224.0.0.0/8 -j DROP

  330. #
  331. # Log weird packets that don't match the above.
  332. #

  334. $IPTABLES -A INPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
  335. --log-level DEBUG --log-prefix "IPT INPUT packet died: "

  337. #
  338. # 4.1.5 FORWARD chain
  339. #

  341. #
  342. # Bad TCP packets we don't want
  343. #

  345. #list=`cat /root/firewall/blackdomain.txt`
  346. #for domain in $list
  347. #do
  348. #$IPTABLES -A FORWARD  -d $domain -j DROP
  349. #done

  351. $IPTABLES -A FORWARD -p tcp -j bad_tcp_packets

  353. #
  354. # Accept the packets we actually want to forward
  355. #

  357. #a type user,100 packages/s
  358. list=`cat /root/firewall/a.txt`
  359. for ip in $list
  360. do
  361. $IPTABLES -A FORWARD  -d $ip/32 -m state --state ESTABLISHED,RELATED -m limit --limit 100/s -j ACCEPT
  362. $IPTABLES -A FORWARD  -d $ip/32 -j DROP
  363. done

  365. #b type user,40 packages/s
  366. list=`cat /root/firewall/b.txt`
  367. for ip in $list
  368. do
  369. $IPTABLES -A FORWARD  -d $ip/32 -m state --state ESTABLISHED,RELATED -m limit --limit 60/s -j ACCEPT
  370. $IPTABLES -A FORWARD  -d $ip/32 -j DROP
  371. done

  373. #c type user,20 packages/s
  374. list=`cat /root/firewall/c.txt`
  375. for ip in $list
  376. do
  377. $IPTABLES -A FORWARD  -d $ip/32 -m state --state ESTABLISHED,RELATED -m limit --limit 20/s -j ACCEPT
  378. $IPTABLES -A FORWARD  -d $ip/32 -j DROP
  379. done


  382. $IPTABLES -A FORWARD  -m state --state ESTABLISHED,RELATED -j ACCEPT



  386. #
  387. # Log weird packets that don't match the above.
  388. #

  390. $IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG \
  391. --log-level DEBUG --log-prefix "IPT FORWARD packet died: "

  393. #
  394. # 4.1.6 OUTPUT chain
  395. #

  397. #
  398. # Bad TCP packets we don't want.
  399. #

  401. $IPTABLES -A OUTPUT -p tcp -j bad_tcp_packets

  403. #
  404. # Special OUTPUT rules to decide which IP's to allow.
  405. #

  407. $IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
  408. $IPTABLES -A OUTPUT -p ALL -s $LAN_IP -j ACCEPT
  409. $IPTABLES -A OUTPUT -p ALL -o $INET_IFACE -j ACCEPT

  411. #
  412. # Log weird packets that don't match the above.
  413. #

  415. $IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
  416. --log-level DEBUG --log-prefix "IPT OUTPUT packet died: "

  418. ######
  419. # 4.2 nat table
  420. #
  421. #flush the nat tables first

  423. iptables --table nat --flush
  424. #
  425. # 4.2.1 Set policies
  426. #

  428. #
  429. # 4.2.2 Create user specified chains
  430. #

  432. #
  433. # 4.2.3 Create content in user specified chains
  434. #

  436. #
  437. # 4.2.4 PREROUTING chain
  438. #

  440. #       $IPTABLES -A PREROUTING -t nat -p tcp --dport 80 -d $EXT_IP -i ppp0 -j DNAT --to 192.168.0.251:80

  442. #       $IPTABLES -A FORWARD -p tcp --dport 80 -d 192.168.0.251  -i ppp0 -o eth0 -j ACCEPT

  444. #        $IPTABLES -A PREROUTING -t nat -p tcp --dport 1600 -d $EXT_IP2 -i ppp1 -j DNAT --to 192.168.0.251:80
  445.                                                                                 
  446. #        $IPTABLES -A FORWARD -p tcp --dport 1600 -d 192.168.0.251  -i ppp1 -o eth0 -j ACCEPT


  449. # $IPTABLES -t nat -A POSTROUTING -s 192.168.0.251  -j SNAT --to $EXT_IP

  451. #
  452. # 4.2.5 POSTROUTING chain
  453. #

  455. if [ $PPPOE_PMTU == "yes" ] ; then
  456. $IPTABLES -t nat -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN \
  457. -j TCPMSS --clamp-mss-to-pmtu
  458. fi
  459. #$IPTABLES -t nat -A POSTROUTING -o $INET_IFACE -j MASQUERADE

  461. list=`cat /root/firewall/a.txt`
  462. for ip in $list
  463. do
  464. iptables --table nat --append POSTROUTING -s $ip/32 --out-interface ppp0 -j MASQUERADE
  465. done

  467. list=`cat /root/firewall/b.txt`
  468. for ip in $list
  469. do
  470. iptables --table nat --append POSTROUTING -s $ip/32 --out-interface ppp0 -j MASQUERADE
  471. done

  473. list=`cat /root/firewall/c.txt`
  474. for ip in $list
  475. do
  476. iptables --table nat --append POSTROUTING -s $ip/32 --out-interface ppp0 -j MASQUERADE
  477. done


  480. #
  481. # 4.2.6 OUTPUT chain
  482. #

  484. ######
  485. # 4.3 mangle table
  486. #

  488. #
  489. # 4.3.1 Set policies
  490. #

  492. #
  493. # 4.3.2 Create user specified chains
  494. #

  496. #
  497. # 4.3.3 Create content in user specified chains
  498. #

  500. #
  501. # 4.3.4 PREROUTING chain
  502. #

  504. #
  505. # 4.3.5 INPUT chain
  506. #

  508. #
  509. # 4.3.6 FORWARD chain
  510. #

  512. #
  513. # 4.3.7 OUTPUT chain
  514. #

  516. #
  517. # 4.3.8 POSTROUTING chain
  518. #

  520. list=`cat /root/firewall/blackdomain.txt`
  521. for domain in $list
  522. do
  523. $IPTABLES -A FORWARD  -d $domain -j DROP
  524. done
  525. $IPTABLES -A FORWARD -i $LAN_IFACE -j ACCEPT
  526. #update: Jan,25,2005,huzhiwen ,we use bash to realize the firewall,so we donot need the perl ,it is too heavy to use
復制代碼



其中對于帶寬分配有幾種模式
a
b
c
每種模式的帶寬不一樣


對于不想用戶使用的黑網(wǎng)站放在
/root/firewall/blackdomain.txt中,使用名字即可

由于還使用了動態(tài)域名(感謝www.3322.org)


  2. [root@linux monitor]# cat monitorip.sh
  3. #!/bin/bash
  4. org_ip=`cat /root/monitor/ip.txt`
  5. now_ip=`ifconfig|sed '/^eth/,/^ppp0/d'|sed '/^ *UP/,/$d/d'|cut -d: -f 2|cut -d ' ' -f 1`
  6. #protect for case where we power off the adsl or the line is off
  7. space=""
  8. if [ "$space" = "$now_ip" ]
  9. then
  10. exit
  11. fi

  13. if [ $org_ip = $now_ip ]
  14. then
  15. echo "donot need update ip of ppp0" >> /dev/null
  16. else
  17. #put the new ip into file ip.txt
  18. ifconfig|sed '/^eth/,/^ppp0/d'|sed '/^ *UP/,/$d/d'|cut -d: -f 2|cut -d ' ' -f 1 > /root/monitor/ip.txt

  20. #update the dns
  21. /root/ez-ipupdate/ez-ipupdate -c /root/ez-ipupdate/qdns.conf
  22. #in order to make the system more stable,do it another 2 more times
  23. sleep 60
  24. /root/ez-ipupdate/ez-ipupdate -c /root/ez-ipupdate/qdns.conf
  25. sleep 60
  26. /root/ez-ipupdate/ez-ipupdate -c /root/ez-ipupdate/qdns.conf

  28. #flush the firewall
  29. /root/firewall/firewall.sh
  30. LOGDATE=`date`
  31. echo "$LOGDATE : IP CHANGE FROM $org_ip to $now_ip " >> /root/monitor/ipchange.log
  32. fi

復制代碼


15分鐘運行一次,如果ip改變了,則更新


防火墻腳本每15分鐘運行一次,以免于防火墻死掉

每小時監(jiān)視adsl看是否當?shù)?br />

  2. [root@linux cron.hourly]# cat monitoradsl.sh
  3. #!/bin/sh
  4. device=`ifconfig|grep ppp0|cut -d ' ' -f 1`
  5. if [ "$device" = "ppp0" ]
  6. then
  7.   exit
  8. else
  9.   adsl-stop
  10.   sleep 5
  11.   adsl-stop
  12.   sleep 5
  13.   adsl-start
  14. fi
復制代碼

每天重啟一次adsl,腳本如下


  2. [root@linux cron.daily]# cat restartadsl.sh
  3. #!/bin/sh
  4. adsl-stop
  5. sleep 5
  6. adsl-stop
  7. sleep 5
  8. adsl-start

復制代碼


基本就是這樣了,由于水平有限,錯誤難免,歡迎大家指正!!



歡迎光臨 Chinaunix (http://www.72891.cn/) Powered by Discuz! X3.2