CSA复习5

一.网关设置
1.在真实主机做：

[root@westos westos]# firewall-cmd --permanent --add-masquerade 
success
[root@westos westos]# firewall-cmd --reload 
success
[root@westos westos]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: br0 enp3s0f4u1u1 wlp1s0
  sources: 
  services: cockpit dhcpv6-client dns ssh
  ports: 
  protocols: 
  masquerade: yes
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 

这是开启了地址伪装
2.在虚拟机做：
给网卡的配置文件中写入

GATEWAY=172.25.254.44

或者

[root@chihao2 ~]# vim /etc/sysconfig/network

写入

2.DNS解析设置
在虚拟机中做：

[root@chihao2 ~]# vim /etc/resolv.conf 

写入如图，nameserver 114.114.114.114
做完这两步，随便测试一下

[root@chihao2 ~]# ping www.qq.com
PING ins-r23tsuuf.ias.tencent-cloud.net (101.91.42.232) 56(84) bytes of data.
64 bytes from 101.91.42.232 (101.91.42.232): icmp_seq=2 ttl=49 time=111 ms
64 bytes from 101.91.42.232 (101.91.42.232): icmp_seq=3 ttl=49 time=32.5 ms
64 bytes from 101.91.42.232 (101.91.42.232): icmp_seq=4 ttl=49 time=190 ms
64 bytes from 101.91.42.232 (101.91.42.232): icmp_seq=5 ttl=49 time=42.6 ms
^C
--- ins-r23tsuuf.ias.tencent-cloud.net ping statistics ---
5 packets transmitted, 4 received, 20% packet loss, time 11ms
rtt min/avg/max/mdev = 32.529/94.063/190.153/63.147 ms

最重要的步骤就是配置网关时候的地址伪装
网关就是让虚拟机能够借用真实主机上网，dns解析的意义就是不需要每次上网都需要输入网站的IP

[root@8 ~]# dig www.baidu.com

; <<>> DiG 9.11.13-RedHat-9.11.13-3.el8 <<>> www.baidu.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 38540
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.baidu.com.			IN	A

;; ANSWER SECTION:
www.baidu.com.		493	IN	CNAME	www.a.shifen.com.
www.a.shifen.com.	118	IN	A	14.215.177.38
www.a.shifen.com.	118	IN	A	14.215.177.39

;; Query time: 30 msec
;; SERVER: 114.114.114.114#53(114.114.114.114)
;; WHEN: Thu Apr 22 17:38:35 CST 2021
;; MSG SIZE  rcvd: 101

SERVER一栏会显示由谁来做解析
3.系统默认的本地解析的优先级比dns更高
如何调整？

[root@8 ~]# vim /etc/nsswitch.conf 

将DNS编写到FILENAME之前就可以
4.网卡配置文件中设置DNS

[root@chihao1 Desktop]# vim /etc/sysconfig/network-scripts/ifcfg-enp1s0 
[root@chihao1 Desktop]# nmcli connection reload 
[root@chihao1 Desktop]# nmcli connection down 
apath     filename  id        uuid      
enp1s0    help      path      virbr0    
[root@chihao1 Desktop]# nmcli connection down enp1s0 
Connection 'enp1s0' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/4)
[root@chihao1 Desktop]# nmcli connection up enp1s0 

DNS后面一定要加数字

如果加上以上最后一行的参数，重启网卡以后将不再修改/etc/resolv.conf文件