16195
Commento:
|
16174
|
Le cancellazioni sono segnalate in questo modo. | Le aggiunte sono segnalate in questo modo. |
Linea 82: | Linea 82: |
It is important to note that the names of the network devices above (__'''eth0'''__, __'''eth1'''__, and __'''wlan0'''__) are used as convention. It is very likely that your router will recognize its devices under different names (for example, madwifi calls its wireless device __'''ath0'''__). Please substitute the names of your device accordingly. For information about how to change the names of your network devices, try `man iftab`. == Taking a Backup == |
E' importante notare che i nomi dei dispositivi di (eth0,eth1 e wlan0) sono usati come convenzione. E' molti probabile che il vostro router riconoscera' i suoi dispositivi con nomi diversi (per esempio, madwifi chiama il suo dispositivo wireless ath0). Si prega di sostituire il nome del dispositivo di conseguenza. Per informazioni sul come cambiare il nome delle vostre periferiche di rete, provare con `man iftab`. == Copia di Backup == |
1. Configurare un router su Ubuntu
1.1. Introduzione
Questo articolo nasce a causa della mancanza di informazioni concise o istruzioni facilmente seguibili sull'argomento delle configurazioni di un router per la navigazione via cavo o wireless su Ubuntu. Questo è destinato per gli utenti intermedi e avanzati che devono o a cui piacerebbe configurare un'installazione apposita per Ubuntu del router di casa o nel loro ufficio. Il risultato è un potente router che può fornire funzionalità simili a prodotti popolari (per esempio, il Linksys WRT54G).
1.2. Descrizione tecnica
Il router che sara' creato e' un gateway internet per client via cavo/senza fili che condividono una connessione a banda larga con un solo indirizzo IP.
Le operazioni di base che questo router fornira' sono:
- Un firewall
- port forwarding (opzionale)
- Server DHCP
- Server DNS cache
2. Prerequisiti
2.1. Broadband Connection
La connessione a banda larga richiede un modem via cavo o DSL. Il vostro fornitore di servizi a banda larga devono presentare le necessarie informazioni per configurare il vostro indirizzo IP statico o fornire un indirizzo assegnato dinamicamente tramite DHCP.
2.2. Router Hardware
Tu avrai bisogno di un computer dedicato ad agire in qualità di router. Il computer può usare vecchi hardware e deve avere i requisiti minimi per l'installare di Ubuntu che dovrebbero essere sufficienti. L'autore di questo articolo da girare il suo router su un processore P3 600mhz con 256MB di RAM. Siete invitati ad utilizzare questo come un server per le altre applicazioni, forse con l'installazione di postfix, apache, mysql e/o samba. Questa guida raccomanda un server installato su Ubuntu, ma non c'e' motivo perche' un'installazione desktop non dovrebbe funzionare. Se il tuo piano è abilitato all' accesso da remoto del tuo router, installate SSH prima di procedere.
Le seguenti necessità devono essere fisicamente installate ed il vostro kernel deve essere riconosciuto dal vostro router:
- Un adattatore di rete connesso al modem via cavo o DSL a banda larga
Per una rete cablata,
- Un altro adattatore di rete connesso tramite hub oppure interruttore.
Per una rete wireless,
- Una scheda di rete wireless (che deve essere impostato in "master" mode)
sudo iwconfig <nome dispositibo> mode master non dovrebbe restituire errori
- Se la tua scheda di rete wireless non viene riconosciuto con l'installazione server di Ubuntu, esso forse usa il chipset madwifi (come il D-Link DWL-G520). Per piacere visitare ["Router/Madwifi"] per maggiori informazioni.
- Una scheda di rete wireless (che deve essere impostato in "master" mode)
Per una rete sia cablata che wireless,
- Tutto quanto sopra
Eseguendo ifconfig -a vi mostrerà quali interfacce di rete sono disponibili.
3. Informazioni sulla rete interna
Ecco i valori che verranno utilizzati per configurare la rete interna. Gli utenti esperti prestino particolare attenzione quando fanno delle modifiche poiche' i cambiamenti attuati dovranno essere riflessi in tutta la successiva configurazione del router.
Router |
|
Indirizzo |
192.168.0.1 |
Rete |
192.168.0.0 |
Netmask |
255.255.255.0 |
Broadcast |
192.168.0.255 |
Client |
|
Indirizzi |
192.168.0.2 - 192.168.0.254 |
Netmask |
255.255.255.0 |
Broadcast |
192.168.0.255 |
Gateway |
192.168.0.1 |
4. Impostazioni sula vostra interfaccia di rete
4.1. Tipi comuni di dispositivo
Dispositivo di rete |
Rete interna oppure esterna |
Descrizione |
eth0 |
Esterna |
L'adattatore di rete si connette ad una rete esterna (la vostra connessione a banda larga) |
eth1 |
Interna |
L'adattatore di rete si connette tramite hub oppure interuttore |
wlan0 |
Interla |
Adattatore di rete wireless |
br0 |
Interna |
Bridge di rete fra_eth1_ e _wlan0_ che trattera' i due come un solo dispositivo |
E' importante notare che i nomi dei dispositivi di (eth0,eth1 e wlan0) sono usati come convenzione. E' molti probabile che il vostro router riconoscera' i suoi dispositivi con nomi diversi (per esempio, madwifi chiama il suo dispositivo wireless ath0). Si prega di sostituire il nome del dispositivo di conseguenza. Per informazioni sul come cambiare il nome delle vostre periferiche di rete, provare con man iftab.
4.2. Copia di Backup
Issue the following command to take a backup of your current network configuration:
- {{{sudo cp /etc/network/interfaces /etc/network/interfaces.bak
}}}
4.3. Configuring the External Network Interface
4.3.1. Setting up External Network Interface
Here, we configure the Ubuntu networking system to bring the the local loopback and external network interfaces up by editing /etc/networking/interfaces. The primary goal here is to set up your external network interface (eth0, or whatever you're using in place of it) to be brought up by the networking subsystem. The examples below are only for the most basic setups. If your setup requires additional configuration, for example you need to setup [:ADSLPPPoE:ADSL with PPPoE], adapt the following examples so that the end result is your external network interface connected to the Internet.
4.3.1.1. For Dynamic IP Addresses (DHCP) Only
Open /etc/network/interfaces with your favourite editor. Delete everything and paste in what is below. Follow the commented out instructions carefully.
- {{{# Set up the local loopback interface
auto lo iface lo inet loopback
# Set up the external interface # # Don't forget to change eth0 to the proper name of the external # interface if applicable. # auto eth0 iface eth0 inet dhcp}}}
4.3.1.2. For Static IP Address Only
Open /etc/network/interfaces with your favourite editor. Delete everything and paste in what is below. Follow the commented out instructions carefully.
- {{{# Set up the local loopback interface
auto lo iface lo inet loopback
# Set up the External interface # # For every xxx.xxx.xxx.xxx, enter the numeric address given to you # by your Internet provider. Don't forget to change eth0 to the proper # name of the external interface if applicable. # auto eth0 iface eth0 inet static
- address xxx.xxx.xxx.xxx netmask xxx.xxx.xxx.xxx gateway xxx.xxx.xxx.xxx}}}
Now, set up your DNS servers as given to you by your service provider in /etc/resolv.conf, which should look something like this
- {{{nameserver xxx.xxx.xxx.xxx
nameserver xxx.xxx.xxx.xxx}}}
You can visit the [https://help.ubuntu.com/6.06/ubuntu/serverguide/C/network-configuration.html Ubuntu Server Guide - Network Configuration] documentation for more information
4.3.2. Test Connettività
Reload the network configuration and test for connectivity,
- {{{sudo /etc/init.d/networking restart
ping -c 3 -W 10 ubuntu.com}}} And if all goes well something similar should return:
- {{{PING ubuntu.com (82.211.81.166) 56(84) bytes of data.
64 bytes from signey.ubuntu.com (82.211.81.166): icmp_seq=1 ttl=43 time=99.9 ms 64 bytes from signey.ubuntu.com (82.211.81.166): icmp_seq=2 ttl=43 time=109 ms 64 bytes from signey.ubuntu.com (82.211.81.166): icmp_seq=3 ttl=43 time=100 ms
--- ubuntu.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2001ms rtt min/avg/max/mdev = 99.982/103.450/109.419/4.254 ms}}}
4.4. Configuring the Internal Network Interfaces
4.4.1. Solo Wired
Append the following to /etc/network/interfaces and follow the commented out instructions carefully.
- {{{# Set up the internal wired network
# # Don't forget to change eth1 to the proper name of the internal # wired network interface if applicable. # auto eth1 iface eth1 inet static
- address 192.168.0.1 network 192.168.0.0 netmask 255.255.255.0 broadcast 192.168.0.255}}}
Your internal network interface is: eth1 (or whatever you're using in place of it)
4.4.2. Solo Wireless
If you plan on using WEP, generate a network key,
{{{dd if=/dev/random bs=1 count=13 2>/dev/null | xxd -p
}}}
Append the following to /etc/network/interfaces and follow the commented out instructions carefully.
- {{{# Set up the internal wireless network
# # Don't forget to change wlan0 to the proper name of the internal # wireless network interface if applicable. # # If you would like to use WEP, uncomment the line 'wireless-key' # and replace '<key goes here>' with a WEP key. # # You may also change the network essid and channel. # auto wlan0 iface wlan0 inet static
- wireless-mode master
wireless-essid "UbuntuWireless" wireless-channel 1 #wireless-key <key goes here> address 192.168.0.1 network 192.168.0.0 netmask 255.255.255.0 broadcast 192.168.0.255}}}
Your internal network interface is: wlan0 (or whatever you're using in place of it)
4.4.3. Both Wired and Wireless
First install the necessary tools to create a network bridge,
- {{{sudo apt-get install bridge-utils
}}}
If you plan on using WEP, generate a network key,
{{{dd if=/dev/random bs=1 count=13 2>/dev/null | xxd -p
}}}
Append the following to /etc/network/interfaces and follow the commented out instructions carefully.
- {{{# Set up the internal wireless network
# # Don't forget to change wlan0 to the proper name of the internal # wireless network interface if applicable. # # If you would like to use WEP, uncomment the line 'wireless-key' # and replace '<key goes here>' with a WEP key. # # You may also change the network essid and channel. # auto wlan0 iface wlan0 inet manual
- wireless-mode master
wireless-essid "UbuntuWireless" wireless-channel 1 #wireless-key <key goes here>
# Set up the internal wired network # # It's not necessary to bring this interface up as the bridge # we are about to create does this. Leave these lines commented. # #auto eth1 #iface eth1 inet manual
# Set up the internal wired/wireless network bridge # # Don't forget to change wlan0 and eth1 to the proper name of # the internal wired and wireless interfaces if applicable. # auto br0 iface br0 inet static
- address 192.168.0.1 network 192.168.0.0 netmask 255.255.255.0 broadcast 192.168.0.255 bridge-ports eth1 wlan0}}}
Your internal network interface is: br0
4.5. Riavviare la rete
Now, if the following command is executes successfully, your networking devices have been properly configured.
- {{{sudo /etc/init.d/networking restart
}}}
5. Configurazione del Firewall
5.1. Sfondo
5.2. The Firewall Script
This is a just a rough draft!
IPTABLES=/sbin/iptables AWK=/usr/bin/awk IFCONFIG=/sbin/ifconfig # External (Internet-facing) interface EXTIF="eth0" # External IP address (automatically detected) EXTIP="`$IFCONFIG $EXTIF | $AWK /$EXTIF/'{next}//{split($0,a,":");split(a[2],a," ");print a[1];exit}'`" # Internal interface INTIF="br0" # Internal IP address (in CIDR notation) INTIP="192.168.0.1/32" # Internal network address (in CIDR notation) INTNET="192.168.0.0/24" # The address of anything/everything (in CIDR notation) UNIVERSE="0.0.0.0/0" echo "External: [Interface=$EXTIF] [IP=$EXTIP]" echo "Internal: [Interface=$INTIF] [IP=$INTIP] [Network:$INTNET]" echo echo -n "Loading rules..." # Enabling IP forwarding echo 1 > /proc/sys/net/ipv4/ip_forward # Clear any existing rules and set the default policy to DROP $IPTABLES -P INPUT DROP $IPTABLES -F INPUT $IPTABLES -P OUTPUT DROP $IPTABLES -F OUTPUT $IPTABLES -P FORWARD DROP $IPTABLES -F FORWARD $IPTABLES -F -t nat # Delete all User-specified chains $IPTABLES -X # Reset all IPTABLES counters $IPTABLES -Z ################################################### # INPUT: Incoming traffic from various interfaces # ################################################### # Loopback interface is valid $IPTABLES -A INPUT -i lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT # Local interface, local machines, going anywhere is valid $IPTABLES -A INPUT -i $INTIF -s $INTNET -d $UNIVERSE -j ACCEPT # Remote interface, claiming to be local machines, IP spoofing, get lost $IPTABLES -A INPUT -i $EXTIF -s $INTNET -d $UNIVERSE -j REJECT # External interface, from any source, for ICMP traffic is valid $IPTABLES -A INPUT -i $EXTIF -p ICMP -s $UNIVERSE -d $EXTIP -j ACCEPT # Allow any related traffic coming back to the MASQ server in. $IPTABLES -A INPUT -i $EXTIF -s $UNIVERSE -d $EXTIP -m state --state ESTABLISHED,RELATED -j ACCEPT # Internal interface, DHCP traffic accepted $IPTABLES -A INPUT -i $INTIF -p tcp --sport 68 --dport 67 -j ACCEPT $IPTABLES -A INPUT -i $INTIF -p udp --sport 68 --dport 67 -j ACCEPT # External interface, HTTP/HTTPS traffic allowed $IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 80 -j ACCEPT $IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 443 -j ACCEPT # External interface, SSH traffic allowed $IPTABLES -A INPUT -i $EXTIF -m state --state NEW,ESTABLISHED,RELATED -p tcp -s $UNIVERSE -d $EXTIP --dport 22 -j ACCEPT # Catch-all rule, reject anything else $IPTABLES -A INPUT -s $UNIVERSE -d $UNIVERSE -j REJECT #################################################### # OUTPUT: Outgoing traffic from various interfaces # #################################################### # Workaround bug in netfilter $IPTABLES -A OUTPUT -m state -p icmp --state INVALID -j DROP # Loopback interface is valid. $IPTABLES -A OUTPUT -o lo -s $UNIVERSE -d $UNIVERSE -j ACCEPT # Local interfaces, any source going to local net is valid $IPTABLES -A OUTPUT -o $INTIF -s $EXTIP -d $INTNET -j ACCEPT # local interface, MASQ server source going to the local net is valid $IPTABLES -A OUTPUT -o $INTIF -s $INTIP -d $INTNET -j ACCEPT # outgoing to local net on remote interface, stuffed routing, deny $IPTABLES -A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j REJECT # anything else outgoing on remote interface is valid $IPTABLES -A OUTPUT -o $EXTIF -s $EXTIP -d $UNIVERSE -j ACCEPT # Internal interface, DHCP traffic accepted $IPTABLES -A OUTPUT -o $INTIF -p tcp -s $INTIP --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT $IPTABLES -A OUTPUT -o $INTIF -p udp -s $INTIP --sport 67 -d 255.255.255.255 --dport 68 -j ACCEPT # Catch all rule, all other outgoing is denied and logged. $IPTABLES -A OUTPUT -s $UNIVERSE -d $UNIVERSE -j REJECT ########################### # Packet Forwarding / NAT # ########################### # ----- Begin OPTIONAL FORWARD Section ----- #Optionally forward incoming tcp connections on port 1234 to 192.168.0.100 #$IPTABLES -A FORWARD -i $EXTIF -o $INTIF -p tcp --dport 1234 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT #$IPTABLES -A PREROUTING -t nat -p tcp -d $EXTIP --dport 1234 -m state --state NEW,ESTABLISHED,RELATED -j DNAT --to 192.168.0.100:1234 # ----- End OPTIONAL FORWARD Section ----- # Accept solicited tcp packets $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT # Allow packets across the internal interface $IPTABLES -A FORWARD -i $INTIF -o $INTIF -j ACCEPT # Forward packets from the internal network to the Internet $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT # Catch-all REJECT rule $IPTABLES -A FORWARD -j REJECT # IP-Masquerade $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j SNAT --to $EXTIP echo " done."
6. DHCP e DNS
7. Ulteriori risorse
[https://help.ubuntu.com/community/Router Documento originale]