Net&FW

Router 

1. ServerA

- Network Adapter 추가 ( Host-only )

1) ens 33  <--------- 외부 통신

- NAT 방식    : 100.100.100.100  ( 공인 IP ) 라고 생각

2) ens 37  <--------- 내부 통신

- Host-only    : 192.169.10.100 ( 사설 IP )

# vi /etc/sysconfig/network-scripts/ifcfg-ens37

--------------------- [ 작 성 ] ------------------------

IPADDR=192.168.10.100

NETMASK=255.255.255.0

GATEWAY=192.168.10.100

DNS1=192.168.10.100

DNS2=192.168.10.101

NAME=ens37

DEVICE=ens37

UUID=<ens37_uuid>    ( # nmcli onnection )  :!nmcli connection

- 네트워크 재시작

# systemctl restart network

- 네트워크 up/down

# ifup < interface_name >

# ifup ens37

# ifdown < interface_name >

3) 방화벽 설정

ens33    :    external ( 외부 )    http

ens37    :    internal  ( 내부 )    dns,dhcp,ftp,nfs,rpd-bind,mountd,samba)

ex) firewall-cmd --change-interface=<inter_name> --zone=<zone_name> --permanent

# firewall-cmd --change-interface=ens33 --zone=external --permanent

# firewall-cmd --change-interface=ens37 --zone=internal --permanent

# firewall-cmd --reload

# firewall-cmd --zone=external --add-service=http --permanent

# firewall-cmd --zone=internal --add-service=dns --permanent

# firewall-cmd --zone=internal --add-service=dhcp --permanent

# firewall-cmd --zone=internal --add-service=ftp --permanent

# firewall-cmd --reload

4) DNS 서버 설정

1.  /etc/named.conf

- any;   <--- 설정할 필요 x

2. /etc/named.rfc1912.zones

zone "korea.com" IN {

:

:

:

allow-update { 192.168.10.101; };  <----------- 수정

3. /var/named/korea.com.zone

100.100.100.100 -----------> 192.168.10.100 <--------- 다 수정

4. 데몬 재시작

# systemctl restart named

5) DHCP 설정

1.  /etc/dhcp/dhcpd.conf     

--------------------------- [ 수 정 ] ----------------------------

     27 subnet 192.168.10.0 netmask 255.255.255.0 {

     28         range 192.168.10.150 192.168.10.200;

     29         option routers 192.168.10.100;

     30         option domain-name-servers 192.168.10.100;

     31         option domain-name "korea.com";

     32         option broadcast-address 192.168.10.255;

     33         default-lease-time 600;

     34         max-lease-time 7200;

     35 }

2. 데몬 재시작

# systemctl restart dhcpd

2. ServerB 

1. ens33

Host-only    192.168.10.101

# vi /etc/sysconfig/network-scripts/ifcfg-ens33

IPADDR=192.168.10.101

NETMASK=255.255.255.0

GATEWAY=192.168.10.100

DNS1=192.168.10.100

DNS2=192.168.10.101

2. DNS 서버

1. /etc/named.conf

any ;

2. /etc/named.rfc1912.zones

zone "korea.com" IN {

:

:

masters { 192.168.10.100; };   <---------- 변경

vmware  -------> network 설정 nat ----> host only

# systemctl restart network

# systemctl restart named

3. Client

vmware  -------> network 설정 nat ----> host only

# systemctl restart network

# ip addr

-------------------------------------------- [ 실 습 ] --------------------------------------------------------

1. ServerA

- 100.100.100.100 <-------- 외부 사용 ip

- 192.168.10.100 <-------- 내부 사용 ip

- 내부 통신

# ping 192.168.10.101

- 외부 통신

# ping 8.8.8.8

# route -n

# route add default gw 100.100.100.2   <-------------- 외부 통신이 안될시

- DNS lookup

# ping www.korea.com

2. ServerB

- 192.168.10.101 ( ens33 )

- 내부 통신 ( vmware )

# ping 192.168.10.100

- 외부 통신

# ping 8.8.8.8

- DNS lookup

# ping www.korea.com

3. 방화벽 설정

1) 마스커레이딩

- 리눅스의 네트워킹 기능 ( 가장하다 )

ex) firewall-cmd --zone=<zone_name> --add-masquerade

# firewall-cmd --zone=external --list-all

- masquerade : yes  <-------- 기본값  이것이 설정되어있기에 외부통신이 가능하다 

2) 포트포워딩

ex) firewall-cmd --zone=<zone_name> -add-forward-port=port=<접근port>:proto=<proto>

:topoer=<연결port>:toaddr=<내부_Host_IP>

ex) 100.100.100.100 8080 포트로 접근이 들어오면 내부 192.168.10.101 80 포트로 연결

# firewall-cmd --zone=external --add-forward-port=port=8080:proto=tcp:toport=80:toaddr=192.168.10.101 --permanent

# firewall-cmd --zone=external --add-port=8080/tcp --permanent

# firewall-cmd --reload

# firewall-cmd --zone=external --list-all

- forward-ports : port=8080:proto=tcp:toport=80:toaddr=192.168.10.101

ex) 포트포워딩 100.100.100.100 4000포트로 -> 192.168.10.101 22 으로 연결

# firewall-cmd --zone=external --add-forward-port=port=4000:proto=tcp:toport=22:toaddr=192.168.10.101 --permanent

# firewall-cmd --zone=external --add-port=4000/tcp --permanent

# firewall-cmd --reload

# firewall-cmd --zone=external --list-all

3) 접근 통제 [ rich-rule ]

ex) firewall-cmd --zone=<zone_name> --add-rich-rule="<rule>"

ex) ssh service에 대해서 100.100.100.0 네트워크 대역대만 허용

rule family="ipv4" source address="100.100.100.0/24" service name="ssh" accept