Router2

Server

Virtuelle Maschine auf KVM

512MB RAM 10GB HD 1 vCPU

Betriebssystem

Debian 5.0 (Lenny)

Netzwerkkonfiguration

/etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

# The loopback network interface
auto lo eth1 tunnel0
iface lo inet loopback

# The primary network interface
allow-hotplug eth0
iface eth0 inet static
        address 188.40.111.111
        netmask 255.255.255.192
        network 188.40.111.64
        broadcast 188.40.111.127
        gateway 188.40.111.87
        # dns-* options are implemented by the resolvconf package, if installed
        dns-nameservers 213.133.100.100
        dns-search aquapool.de
        post-up /sbin/ip addr add 188.40.111.106 dev eth0 
        post-up /sbin/ip addr add 188.40.111.105 dev eth0 
iface eth1 inet static
        address 172.16.42.1
        netmask 255.255.255.0
        broadcast 172.16.42.255

iface tunnel0 inet static
  pre-up iptunnel add tunnel0 mode gre local 188.40.111.111 remote 78.46.105.143
  address 172.16.43.1
  netmask 255.255.255.255
  pointopoint 172.16.43.2
  up ip route add 78.47.185.40/29 via 172.16.43.2

 

Software

pptpd für den VPN Zugriff von außen dnsmasq für die Interne DNS Auflösung

 

DNSMASQ

/etc/dnsmasq.conf

expand-hosts
domain=aquapool.de
dhcp-range=172.16.42.240,172.16.42.250,12h
 
dhcp-authoritative

PPTPD Konfiguration

/etc/pptpd.conf

option /etc/ppp/pptpd-options
logwtmp
localip 172.16.42.200
remoteip 172.16.42.201-204

/etc/ppp/pptpd-options

name pptpd
auth
ms-dns 172.16.42.1
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
require-mppe-128
proxyarp
nodefaultroute
noipx
lock
nobsdcomp 

iptables

Regeln werden in der /etc/rc.local per iptables-restore < /etc/iptables geladen. Nach dem Ändern sollte man die Config mit iptables-save > /etc/iptables sichern.

/etc/iptables

# Generated by iptables-save v1.4.2 on Fri Oct 16 19:20:26 2009
*nat
:PREROUTING ACCEPT [21106:1397562]
:POSTROUTING ACCEPT [15861:956541]
:OUTPUT ACCEPT [5148:352497]
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.42.12:80 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.42.12:443 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 9443 -j DNAT --to-destination 172.16.42.12:9443 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 20 -j DNAT --to-destination 172.16.42.12:20 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 21 -j DNAT --to-destination 172.16.42.12:21 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 12000:13000 -j DNAT --to-destination 172.16.42.12 
-A PREROUTING -d 188.40.111.106/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.42.10:80 
-A PREROUTING -d 188.40.111.106/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.42.10:443 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 172.16.42.20:80 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 443 -j DNAT --to-destination 172.16.42.20:443 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 7676 -j DNAT --to-destination 172.16.42.14:7676 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 3820 -j DNAT --to-destination 172.16.42.14:3820 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 3700 -j DNAT --to-destination 172.16.42.14:3700 
-A PREROUTING -d 188.40.111.105/32 -p tcp -m tcp --dport 3920 -j DNAT --to-destination 172.16.42.14:3920 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 3820 -j DNAT --to-destination 172.16.42.14:3820 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 3700 -j DNAT --to-destination 172.16.42.14:3700 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 3920 -j DNAT --to-destination 172.16.42.14:3920 
-A PREROUTING -d 188.40.111.111/32 -p tcp -m tcp --dport 55820 -j DNAT --to-destination 172.16.42.14:55820 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 80 -j SNAT --to-source 188.40.111.105:80 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 443 -j SNAT --to-source 188.40.111.105:443 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 9443 -j SNAT --to-source 188.40.111.105:9443 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 20 -j SNAT --to-source 188.40.111.105:20 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 21 -j SNAT --to-source 188.40.111.105:21 
-A POSTROUTING -s 172.16.42.12/32 -p tcp -m tcp --sport 12000:13000 -j SNAT --to-source 188.40.111.105 
-A POSTROUTING -s 172.16.42.10/32 -p tcp -m tcp --sport 80 -j SNAT --to-source 188.40.111.106:80 
-A POSTROUTING -s 172.16.42.10/32 -p tcp -m tcp --sport 443 -j SNAT --to-source 188.40.111.106:443 
-A POSTROUTING -s 172.16.42.20/32 -p tcp -m tcp --sport 80 -j SNAT --to-source 188.40.111.111:80 
-A POSTROUTING -s 172.16.42.20/32 -p tcp -m tcp --sport 443 -j SNAT --to-source 188.40.111.111:443 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 3920 -j SNAT --to-source 188.40.111.105:3920 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 3700 -j SNAT --to-source 188.40.111.105:3700 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 3820 -j SNAT --to-source 188.40.111.105:3820 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 7676 -j SNAT --to-source 188.40.111.111:7676 
-A POSTROUTING -s 172.16.42.14/32 -p tcp -m tcp --sport 55820 -j SNAT --to-source 188.40.111.111:55820 
-A POSTROUTING -s 172.16.42.0/24 -j MASQUERADE 
COMMIT
# Completed on Fri Oct 16 19:20:26 2009
# Generated by iptables-save v1.4.2 on Fri Oct 16 19:20:26 2009
*filter
:INPUT ACCEPT [299013:88950782]
:FORWARD ACCEPT [1124189:768413642]
:OUTPUT ACCEPT [368819:339895642]
COMMIT
# Completed on Fri Oct 16 19:20:26 2009

Sonstiges

Hat einen GRE Tunnel zu DS3000 mail damit die internen Rechner vom Bacula erreicht werden können.