Настройка интернет шлюза для небольшого офиса CentOS, Iptables, NAT, Squid Transparent, Sarg
Прошли времена, когда в нашем офисе было 2 компьютера, и DSL модем на 4 порта с интернетом в 2 мегабита
спасал ситуацию. Сейчас в офисе 5 рабочих машин и 1 сервер для задач разработчиков.
При соединении всех в свич со стандартным Tp Link шлюзом, если кто начинал качать, интернет зависал у всех. Было принято решение создать свой шлюз интернета, с шейпером трафика, DNS, DHCP и статистикой ( squid + sarg) и прокси.
В качестве сервера был выбран DualCore pentium, 4 GB RAM с установленной на борту CentOS 6.4 minimal.
Итак, приступим к конфигурации нашего будущего интернет шлюза.
Задача стоит, настроить:
Раздачу интернета через NAT (iptables, htb), DHCP,DNS, HTTPD, NGINX, SARG
Первый шаг, установка необходимого базового софта
rpm --import http://apt.sw.be/RPM-GPG-KEY.dag.txt rpm -ivh http://packages.sw.be/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm rpm --import https://fedoraproject.org/static/0608B895.txt rpm -ivh http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm rpm --import http://rpms.famillecollet.com/RPM-GPG-KEY-remi rpm -ivh http://rpms.famillecollet.com/enterprise/remi-release-6.rpm yum -y groupinstall "Development tools" yum -y install git mc htop lftp unzip zlib zlib-devel openssl openssl-devel patch libtool re2c bison fprintd-pam subversion sshfs curlftpfs Второй шаг, установка nginx
useradd nginx -s /bin/false -M -U mkdir /var/run/nginx/ chown -R nginx:nginx /var/run/nginx/ mkdir /var/log/nginx/ chown -R nginx:nginx /var/log/nginx/ cd /usr/src wget http://nginx.org/download/nginx-1.4.2.tar.gz tar xvzf nginx* cd nginx* git clone https://github.com/yaoweibin/nginx_tcp_proxy_module.git git clone git://github.com/mikewest/nginx-static-etags.git patch -p1 < nginx_tcp_proxy_module/tcp.patch wget -O release-1.6.29.5-beta.zip https://github.com/pagespeed/ngx_pagespeed/archive/release-1.6.29.5-beta.zip unzip release-1.6.29.5-beta.zip cd ngx_pagespeed-release-1.6.29.5-beta/ wget --no-check-certificate -O 1.6.29.5.tar.gz https://dl.google.com/dl/page-speed/psol/1.6.29.5.tar.gz tar -xzvf 1.6.29.5.tar.gz cd /usr/src/nginx* ./configure --error-log-path=/var/log/nginx/error_log --pid-path=/var/run/nginx/nginx.pid --lock-path=/var/lock/subsys/nginx --add-module=nginx-static-etags --add-module=nginx_tcp_proxy_module --add-module=ngx_pagespeed-release-1.6.29.5-beta --user=nginx --group=nginx --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --without-http_geo_module --without-http_ssi_module --without-http_empty_gif_module --without-http_browser_module --without-mail_pop3_module --without-mail_imap_module --without-mail_smtp_module --with-pcre=/usr/src/pcre-8.33 --without-http_memcached_module --without-http_scgi_module --without-http_uwsgi_module --without-http_fastcgi_module --http-fastcgi-temp-path= --http-uwsgi-temp-path= --prefix=/server/nginx --with-ipv6 make make install cd /server/nginx/conf/ && rm -f fastcgi.conf fastcgi.conf.default fastcgi_params fastcgi_params.default koi-utf koi-win mime.types.default nginx.conf.default scgi_params scgi_params.default uwsgi_params uwsgi_params.default win-utf mkdir /server/nginx/conf/conf.d/ touch /server/nginx/conf/nginx.conf worker_processes 8; events < worker_connections 25000; use epoll; >http < include mime.types; default_type application/octet-stream; sendfile on; tcp_nopush on; gzip on; gzip_min_length 1000; gzip_proxied any; gzip_types text/plain text/xml application/xml application/x-javascript text/javascript text/css text/json; gzip_comp_level 8; client_max_body_size 20M; server < listen 192.168.5.1:80 default_server; stub_status on; location = /apache-stats < proxy_pass http://127.0.0.1:80; >allow 192.168.5.1; deny all; > include conf.d/*.conf; > touch /etc/init.d/nginx chmod +x /etc/init.d/nginx #!/bin/bash # chkconfig: - 58 74 # # Source function library. . /etc/init.d/functions # Source networking configuration. . /etc/sysconfig/network if [ -f /etc/sysconfig/nginx ];then . /etc/sysconfig/nginx fi RETVAL=0 prog="nginx" start() < # Check that networking is up. [ "$NETWORKING" = "no" ] && exit 1 echo -n $"Starting $prog: " daemon /server/nginx/sbin/nginx $OPTIONS RETVAL=$? echo [ $RETVAL -eq 0 ] && touch /var/lock/subsys/nginx return $RETVAL >stop() < echo -n $"Shutting down $prog: " killproc /server/nginx/sbin/nginx RETVAL=$? echo [ $RETVAL -eq 0 ] && rm -f /var/lock/subsys/nginx return $RETVAL ># See how we were called. case "$1" in start) start ;; stop) stop ;; status) status nginx RETVAL=$? ;; restart|reload) stop start RETVAL=$? ;; condrestart) if [ -f /var/lock/subsys/nginx ]; then stop start RETVAL=$? fi ;; *) echo $"Usage: $0 " RETVAL=3 esac exit $RETVAL Третий шаг, установка httpd
Для Апача поставим APR, APR-UTIL, PCRE
Установка APR
cd /usr/src wget http://apache.ip-connect.vn.ua//apr/apr-1.5.0.tar.gz tar xvzf apr-1.5.0* cd apr-1.5.0 ./configure --prefix=/server/misc/apr make make install yum -y install openldap-devel nss nss-devel cd /usr/src wget http://apache.ip-connect.vn.ua//apr/apr-util-1.5.3.tar.gz tar xvzf apr-util* cd apr-util-* ./configure --prefix=/server/misc/apr-util --with-apr=/server/misc/apr --with-crypto --with-ldap make make install cd /usr/src wget http://ftp.exim.llorien.org/pcre/pcre-8.33.tar.gz tar xvzf pcre-8.33.tar.gz cd pcre* ./configure --prefix=/server/misc/pcre make make install useradd apache -s /bin/false -M -U mkdir /var/run/httpd/ && chown -R apache:apache /var/run/httpd/ mkdir /var/log/httpd/ && chown -R apache:apache /var/log/httpd/ cd /usr/src wget http://mpm-itk.sesse.net/mpm-itk-2.4.4-04.tar.gz tar xvzf mpm* wget http://archive.apache.org/dist/httpd/httpd-2.4.6.tar.gz tar xvzf httpd* cp -r httpd-2.4.6 httpd-2.4.6.orig cd httpd-2.4.6 patch -p1 < /usr/src/mpm-itk-2.4.4-04/patches/r1389339-pre-htaccess-hook.diff rm -rf /usr/src/httpd-2.4.6.orig ./buildconf --with-apr=/usr/src/apr-1.4.8 --with-apr-util=/usr/src/apr-util-1.5.2 ./configure --prefix=/server/httpd --with-mpm=prefork --with-apr=/server/misc/apr --with-apr-util=/server/misc/apr-util --with-pcre=/server/misc/pcre --disable-version --disable-status --enable-rewrite=static --enable-realip=static --enable-mods-static="authn_file mime authn_core authz_host authz_groupfile authz_user authz_core access_compat auth_basic reqtimeout filter log_config env headers setenvif unixd dir alias realip status info" make make install cd /usr/src/mpm* ./configure --with-apxs=/server/httpd/bin/apxs make make install mkdir -p /server/httpd/conf/conf.d/sites/ rm -rf /server/httpd/man rm -rf /server/httpd/manual rm -rf /server/httpd/icons rm -rf /server/httpd/cgi-bin rm -rf /server/httpd/logs rm -rf /server/httpd/conf/extra rm -rf /server/httpd/conf/original mkdir /var/www chown root:root /var/www chown -R apache:apache /server/httpd ServerRoot "/server/httpd" Listen 127.0.0.1:80 LoadModule mpm_itk_module modules/mpm_itk.so LoadModule remoteip_module modules/mod_remoteip.so User apache Group apache ServerAdmin webmaster@ ServerName DirectoryIndex index.html Require all denied ErrorLog "/var/log/httpd/error_log" LogLevel warn PidFile /var/run/httpd/httpd.pid LogFormat "%h %l %u %t \"%r\" %>s %b \"%i\" \"%i\"" combined LogFormat "%h %l %u %t \"%r\" %>s %b" common CustomLog "/var/log/httpd/access_log" common #CustomLog "/var/log/httpd/logs/access_log" combined ScriptAlias /cgi-bin/ "/server/httpd/cgi-bin/" AllowOverride None Options None Require all granted TypesConfig conf/mime.types AddType application/x-compress .Z AddType application/x-gzip .gz .tgz StartServers 6 MinSpareServers 5 MaxSpareServers 10 ServerLimit 256 MaxClients 256 MaxRequestsPerChild 10000 ServerName 127.0.0.1 IncludeOptional conf/conf.d/*.conf IncludeOptional conf/conf.d/sites/*.conf # Timeout: The number of seconds before receives and sends time out. Timeout 60 # KeepAlive: Whether or not to allow persistent connections (more than one request per connection). Set to "Off" to deactivate. KeepAlive On # MaxKeepAliveRequests: The maximum number of requests to allow during a persistent connection. Set to 0 to allow an unlimited amount. We recommend you leave this number high, for maximum performance. MaxKeepAliveRequests 100 # KeepAliveTimeout: Number of seconds to wait for the next request from the same client on the same connection. KeepAliveTimeout 5 # Set to one of: Full | OS | Minor | Minimal | Major | Prod where Full conveys the most information, and Prod the least. ServerTokens Prod UseCanonicalName Off AccessFileName .htaccess ServerSignature Off HostnameLookups Off ExtendedStatus On RequestReadTimeout header=20-40,MinRate=500 body=20,MinRate=500 RemoteIPHeader X-Forwarded-For RemoteIPInternalProxy 127.0.0.1 touch /etc/init.d/httpd chmod +x /etc/init.d/httpd #!/bin/bash # # httpd Startup script for the Apache HTTP Server # # chkconfig: - 85 15 # description: The Apache HTTP Server is an efficient and extensible \ # server implementing the current HTTP standards. # processname: httpd # config: /server/httpd/conf/httpd.conf # pidfile: /var/run/httpd/httpd.pid # ### BEGIN INIT INFO # Provides: httpd # Required-Start: $local_fs $remote_fs $network $named # Required-Stop: $local_fs $remote_fs $network # Should-Start: distcache # Short-Description: start and stop Apache HTTP Server # Description: The Apache HTTP Server is an extensible server # implementing the current HTTP standards. ### END INIT INFO # Source function library. . /etc/rc.d/init.d/functions # Start httpd in the C locale by default. HTTPD_LANG="C" # This will prevent initlog from swallowing up a pass-phrase prompt if # mod_ssl needs a pass-phrase from the user. INITLOG_ARGS="" # Set HTTPD=/usr/sbin/httpd.worker in /etc/sysconfig/httpd to use a server # with the thread-based "worker" MPM; BE WARNED that some modules may not # work correctly with a thread-based MPM; notably PHP will refuse to start. # Path to the apachectl script, server binary, and short-form for messages. apachectl=/server/httpd/bin/apachectl httpd=/server/httpd/bin/httpd prog=httpd pidfile=/var/run/httpd/httpd.pid lockfile=/var/lock/subsys/httpd RETVAL=0 STOP_TIMEOUT=10 # The semantics of these two functions differ from the way apachectl does # things -- attempting to start while running is a failure, and shutdown # when not running is also a failure. So we just do it the way init scripts # are expected to behave here. start() < echo -n $"Starting $prog: " LANG=$HTTPD_LANG daemon --pidfile=$$httpd $OPTIONS RETVAL=$? echo [ $RETVAL = 0 ] && touch $ return $RETVAL > # When stopping httpd, a delay (of default 10 second) is required # before SIGKILLing the httpd parent; this gives enough time for the # httpd parent to SIGKILL any errant children. stop() < echo -n $"Stopping $prog: " killproc -p $-d $ $httpd RETVAL=$? echo [ $RETVAL = 0 ] && rm -f $ $ > reload() < echo -n $"Reloading $prog: " if ! LANG=$HTTPD_LANG $httpd $OPTIONS -t >&/dev/null; then RETVAL=6 echo $"not reloading due to configuration syntax error" failure $"not reloading $httpd due to configuration syntax error" else # Force LSB behaviour from killproc LSB=1 killproc -p $ $httpd -HUP RETVAL=$? if [ $RETVAL -eq 7 ]; then failure $"httpd shutdown" fi fi echo > # See how we were called. case "$1" in start) start ;; stop) stop ;; status) status -p $ $httpd RETVAL=$? ;; restart) stop start ;; condrestart|try-restart) if status -p $ $httpd >&/dev/null; then stop start fi ;; force-reload|reload) reload ;; graceful|help|configtest|fullstatus) $apachectl $@ RETVAL=$? ;; *) echo $"Usage: $prog " RETVAL=2 esac exit $RETVAL Четвертый шаг, настройка раздачи интернета
На сервере установлено два сетевых интерфейса:
eth0 — Интернет от провайдера
eth1 — Наша локальная сеть
Создаем файл /iptables с содержимым:
#!/bin/sh PATH=/usr/sbin:/sbin:/bin:/usr/bin # - Очищаем таблицы iptables -F iptables -t nat -F iptables -t mangle -F iptables -X iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -m state --state NEW ! -i eth0 -j ACCEPT iptables -A FORWARD -i eth0 -o eth1 -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j DNAT --to 192.168.5.1:3128 echo 1 > /proc/sys/net/ipv4/ip_forward mcedit /etc/sysconfig/network-scripts/ifcfg-eth1 DEVICE=eth1 HWADDR=00:0E:0C:73:E4:F9 TYPE=Ethernet ONBOOT=yes NM_CONTROLLED=yes BOOTPROTO=static IPADDR=192.168.5.1 NETMASK=255.255.255.0 GATEWAY=192.168.1.106 NETWORK=192.168.5.0 GATEWAY — айпи eth0 интерфейса
Пятый шаг, настройка dhcpd
ddns-update-style none; ignore client-updates; DHCPARGS="eth1"; INTERFACES="eth1"; subnet 192.168.5.0 netmask 255.255.255.0 < range 192.168.5.100 192.168.5.200; option routers 192.168.5.1; option subnet-mask 255.255.255.0; option domain-name ".loc"; option domain-name-servers 192.168.5.1; option time-offset -18000; default-lease-time 21600; max-lease-time 43200; >host astraPC1 < hardware ethernet 00:21:91:91:11:42; fixed-address 192.168.5.6; >host astraPC2 < hardware ethernet D0:27:88:43:7E:AE; fixed-address 192.168.5.7; >host astraPC3 < hardware ethernet D0:27:88:43:7F:0E; fixed-address 192.168.5.8; >host astraPC4 < hardware ethernet 90:2B:34:BB:15:F2; fixed-address 192.168.5.9; >host astraPC5
Здесь мы указали dns сервер, айпи нашего шлюза. В качестве DNS логично использовать что то простое, я выбрал dnsmasq
Шаг шестой, настройка dns сервера
DHCP у нас уже установлен, остальной функционал нам не нужен, конфиг файл довольно простой по принципу включать только то, что нужно
interface=eth1 no-dhcp-interface=eth1 port=53 # - Опция для подхвата настроек /etc/hosts localise-queries all-servers # - очистка кеша при перезагрузке clear-on-reload # - DNS шлюза интернета server=192.168.1.1 В /etc/hosts для нашей локальной сети необходимы были некоторые хосты:
192.168.5.1 sarg.loc 192.168.5.1 mysql.loc SARG — генератор логов для SQUID
Шаг седьмой, установка squid
acl manager proto cache_object acl localhost src 127.0.0.1/32 ::1 acl to_localhost dst 127.0.0.0/8 0.0.0.0/32 ::1 acl lan src 192.168.5.1/32 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access allow localhost http_access allow lan http_access deny all # - Прозрачный прокси http_port 3128 transparent hierarchy_stoplist cgi-bin ? coredump_dir /var/spool/squid refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 # - Превращаем squid в анонимный прокси forwarded_for off request_header_access From deny all request_header_access Server deny all request_header_access Link deny all request_header_access X-Forwarded-For deny all request_header_access Via deny all request_header_access Cache-Control deny all visible_hostname myhost.com Шаг восьмой, установка sarg
Т.к в нашей локальной сети не важны настройки, стандартные вполне подходят, единственное нужно было указать папку, куда сохранять логи, правим конфигурационный файл до такого состояния:
mcedit /usr/local/etc/sarg.conf output_dir /var/www/sarg/public_html/sarg.loc SARG желательно добавить в крон, что бы он каждый день сохранял статистику. Генерация логов производится запуском команды:
Шаг девятый, настройка HTB
wget -O /etc/init.d/htb wget http://downloads.sourceforge.net/project/htbinit/HTB.init/0.8.5/htb.init-v0.8.5?use_mirror=citylan Настройки шейпера зависят от ваших нужд. В нашем случае исходные данные были:
Ширина канала: 6Mbit/sec
Пользователей: 5
Примечание: Пользователи редко скачивают, часто «серфят» в интернете.
cd /etc/sysconfig/htb touch eth1 touch eth1-2.root touch eth1-2:06.astraPC1 touch eth1-2:07.astraPC2 touch eth1-2:08.astraPC3 touch eth1-2:09.astraPC4 touch eth1-2:10.astraPC5 eth1 — Корневой файл нашего интерфейса
# — Точность шейпера
eth1-2.root — Задаем правила для всей цепочки
eth1-2:06.astraPC1 — Файл для машины, для удобства расширение файла — хост компьютера, а префикс — последний октет айпи
BURST=100kb RATE=1024Kbit CEIL=3064Kbit LEAF=sfq PRIO=1 RULE=192.168.5.6 Остальные файлы сделаны по аналогии.