В связи с покупкой лаптопа, возникла необходимость раздавать ему интернет, через домашнюю машину на Gentoo.
На машине в интернет смотрит интерфейс ADSL модема ppp0. Модем воткнут в сетевую карту eth0. Ноутбук общается с машиной посредством wlan0 (На комьютере адаптер в режиме Ad-hoc).
Код: Выделить всё
gentoo dzhon # ifconfig
eth0 Link encap:Ethernet HWaddr 00:04:61:4c:89:c2
inet addr:192.168.0.1 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::204:61ff:fe4c:89c2/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:183429 errors:0 dropped:0 overruns:0 frame:0
TX packets:189995 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:159159684 (151.7 MiB) TX bytes:25394075 (24.2 MiB)
Interrupt:251
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:906411 errors:0 dropped:0 overruns:0 frame:0
TX packets:906411 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:4977115030 (4.6 GiB) TX bytes:4977115030 (4.6 GiB)
ppp0 Link encap:Point-to-Point Protocol
inet addr:77.66.162.149 P-t-P:80.80.111.96 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
RX packets:165435 errors:0 dropped:0 overruns:0 frame:0
TX packets:175694 errors:0 dropped:1433 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:154440407 (147.2 MiB) TX bytes:20665076 (19.7 MiB)
wlan0 Link encap:Ethernet HWaddr 00:1e:58:ac:17:8f
inet addr:192.168.1.13 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::21e:58ff:feac:178f/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:10887995 errors:0 dropped:0 overruns:0 frame:0
TX packets:15835678 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:942039330 (898.3 MiB) TX bytes:19483351414 (18.1 GiB)
wmaster0 Link encap:UNSPEC HWaddr 00-1E-58-AC-17-8F-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)На ноутбуке, соответственно, установлена Windows XP, Беспроводное соединение установлено, IP адрес статический - 192.168.1.13.
Ядро Gentoo сконфигурировано с поддержкой IPTables и для протокола PPP включены все нужные опции.
Код: Выделить всё
gentoo dzhon # cat /proc/sys/net/ipv4/ip_forward
1Код: Выделить всё
gentoo dzhon # sysctl -a | grep forward
error: "Invalid argument" reading key "fs.binfmt_misc.register"
error: permission denied on key 'net.ipv4.route.flush'
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.ppp0.forwarding = 1
net.ipv4.conf.ppp0.mc_forwarding = 0
net.ipv4.conf.wmaster0.forwarding = 1
net.ipv4.conf.wmaster0.mc_forwarding = 0
net.ipv4.conf.wlan0.forwarding = 1
net.ipv4.conf.wlan0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.eth0.forwarding = 0
net.ipv6.conf.ppp0.forwarding = 0
net.ipv6.conf.wmaster0.forwarding = 0
net.ipv6.conf.wlan0.forwarding = 0
error: permission denied on key 'net.ipv6.route.flush'Затем выполняю следующую цепочку команд:
Код: Выделить всё
First we flush our current rules
# iptables -F
# iptables -t nat -F
Setup default policies to handle unmatched traffic
# iptables -P INPUT ACCEPT
# iptables -P OUTPUT ACCEPT
# iptables -P FORWARD DROP
Copy and paste these examples ...
# export LAN=wlan0
# export WAN=ppp0
Then we lock our services so they only work from the LAN
# iptables -I INPUT 1 -i ${LAN} -j ACCEPT
# iptables -I INPUT 1 -i lo -j ACCEPT
# iptables -A INPUT -p UDP --dport bootps -i ! ${LAN} -j REJECT
# iptables -A INPUT -p UDP --dport domain -i ! ${LAN} -j REJECT
(Optional) Allow access to our ssh server from the WAN
# iptables -A INPUT -p TCP --dport ssh -i ${WAN} -j ACCEPT
Drop TCP / UDP packets to privileged ports
# iptables -A INPUT -p TCP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
# iptables -A INPUT -p UDP -i ! ${LAN} -d 0/0 --dport 0:1023 -j DROP
Finally we add the rules for NAT
# iptables -I FORWARD -i ${LAN} -d 192.168.0.0/255.255.0.0 -j DROP
# iptables -A FORWARD -i ${LAN} -s 192.168.0.0/255.255.0.0 -j ACCEPT
# iptables -A FORWARD -i ${WAN} -d 192.168.0.0/255.255.0.0 -j ACCEPT
# iptables -t nat -A POSTROUTING -o ${WAN} -j MASQUERADE
# /etc/init.d/iptables saveПосле чего пытаюсь на ноуте пингануть любой внешний IP, но назначение недостижимо.
До ноутбука же ping идет:
Код: Выделить всё
dzhon@gentoo ~ $ ping 192.168.1.11
PING 192.168.1.11 (192.168.1.11) 56(84) bytes of data.
64 bytes from 192.168.1.11: icmp_seq=1 ttl=128 time=1.32 ms
64 bytes from 192.168.1.11: icmp_seq=2 ttl=128 time=0.765 ms
64 bytes from 192.168.1.11: icmp_seq=3 ttl=128 time=1.89 ms
^C
--- 192.168.1.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 0.765/1.327/1.897/0.463 msНе знаю, что и делать...