NAT 服务器配置 及双网卡通信实验

NAT(Network Address Translation)，本次实验网络拓扑如图。
linux的服务器为vmware上的rhel6，为其配置了两张桥接网卡。其中eth1被用作内网通信。实验中需要实现 主机tom0可tom1可互相ping通。服务器通过路由器接通外网，路由器网关为192.168.31.1。

[root@paly network-scripts]#cp ifcfg-eth0 ifcfg-eth1						#配置新安装的内网网卡
[root@paly network-scripts]#vim ifcfg-eth1									#脚本里不设置网关
[root@paly network-scripts]#service network restart
Shutting down interface eth0:                              [  OK  ]
Shutting down loopback interface:                          [  OK  ]
Bringing up loopback interface:                            [  OK  ]
Bringing up interface eth0:  Determining if ip address 192.168.31.224 is already in use for device eth0...
                                                           [  OK  ]
Bringing up interface eth1:  Determining if ip address 192.168.31.225 is already in use for device eth1...
                                                           [  OK  ]
[root@paly ~]#ifconfig  | grep -A 1 "^eth"								
eth0      Link encap:Ethernet  HWaddr 00:0C:29:FE:FF:63  
          inet addr:192.168.31.224  Bcast:192.168.31.255  Mask:255.255.255.0
--
eth1      Link encap:Ethernet  HWaddr 00:0C:29:FE:FF:6D  
          inet addr:192.168.1.254  Bcast:192.168.1.255  Mask:255.255.255.0
[root@paly network-scripts]#pwd
/etc/sysconfig/network-scripts

若用虚拟机则配置两块桥接虚拟网卡。

vim /etc/sysctl.conf					#开启路由转发 

[root@paly ~]#sysctl -p              #使生效
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 4294967295
kernel.shmall = 268435456

重要：保证外网可ping通内网，内网可ping外网的路由规则。这里主机由会根据网卡配置自动生成下面两条路由。

[root@paly ~]#route add -net 192.168.31.0 netmask 255.255.255.0 dev eth0
[root@paly ~]#route add -net 192.168.1.0 netmask 255.255.255.0 dev eth1 
#route del -net 192.168.31.0 netmask 255.255.255.0

[root@paly network-scripts]#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth1
192.168.31.0    0.0.0.0         255.255.255.0   U     0      0        0 eth0
169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth1
169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth0
0.0.0.0         192.168.31.1    0.0.0.0         UG    0      0        0 eth0						
#G代表使用外部设备作为网关，配置192.168.31.1为外网网关，才可以上网。

[root@paly ~]#ping -I eth0 192.168.1.223
PING 192.168.1.223 (192.168.1.223) from 192.168.31.224 eth0: 56(84) bytes of data.
^C
--- 192.168.1.223 ping statistics ---
11 packets transmitted, 0 received, 100% packet loss, time 10169ms

[root@paly ~]#ping -I eth1 192.168.1.223
PING 192.168.1.223 (192.168.1.223) from 192.168.1.254 eth1: 56(84) bytes of data.
64 bytes from 192.168.1.223: icmp_seq=1 ttl=64 time=0.549 ms
64 bytes from 192.168.1.223: icmp_seq=2 ttl=64 time=0.830 ms
64 bytes from 192.168.1.223: icmp_seq=3 ttl=64 time=0.836 ms
^C
--- 192.168.1.223 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2442ms
rtt min/avg/max/mdev = 0.549/0.738/0.836/0.135 ms
[root@paly ~]#

设置nat的ip分享功能，前提是内核网络参数开启了路由转发。

[root@paly ~]#iptables -F
[root@paly ~]#iptables -A INPUT -i eth1 -j ACCEPT
[root@paly ~]#iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE             


[root@paly network-scripts]#service iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         
1    MASQUERADE  all  --  192.168.1.0/24       0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

---

外网主机通信

这里需要配置网关到192.168.31.224，需关闭之前配置的网关，如果未配置固定网关，也要先删除默认路由 route del default。

在外网主机tom0，配置默认网关到服务器 192.68.31.224（配置后才可连通内网网段）。

外网主机tom0在ping外网时，网关会redirect重新定位到路由器网关192.168.31.1来访问外网。同时tom0可以ping通内网192.168.1.0/24，即ping通tom1主机。

windows下的网络参数配置

netsh int ip set address name="WLAN" source=static  addr=192.168.31.62 mask=255.255.255.0 gateway=192.168.31.223  
netsh int ip set dns name="WLAN"  source=static   addr=202.99.216.113

---

内网主机通信

网络配置

路由配置显示

内网主机tom1可以通过nat server ping通外网主机tom0，但是可以看到在没有配置iptables的ip共规则时，除了局域网eth0分配的网络，无法访问外网。

配置net转发规则后，内网主机可访问外网。