Criação de um router interno que permita gerir o acesso à Internet através de um GUI web em PHP.
0. Pré-requisitos
1x máquina com duas placas de rede eth0 = WAN e eth1 = LAN1. Instalação e Configuração como Router
Adicionar ao ficheiro /etc/init.d/nat:#! /bin/bash
# Author: Mario Pinto
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="NAT router"
NAME=nat
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/$NAME
WAN=eth0
# Function that starts the daemon/service
do_start()
{
echo -n "Starting $DESC... "
[ ! -e $PIDFILE ] || return 1
touch $PIDFILE
modprobe iptable_nat
modprobe ip_conntrack_tftp # Allow TFTP UDP traffic
modprobe ip_nat_tftp # Allow TFTP UDP traffic
iptables -t nat -F
iptables -t nat -A POSTROUTING -o $WAN -j MASQUERADE
echo 1 > /proc/sys/net/ipv4/ip_forward
return 0
}
# Function that stops the daemon/service
do_stop()
{
echo -n "Stopping $DESC... "
[ -e $PIDFILE ] || return 1
iptables -t nat -F
echo 0 > /proc/sys/net/ipv4/ip_forward
rm $PIDFILE
return 0
}
# MAIN OPTIONS
case "$1" in
start)
do_start
case "$?" in
0) echo "done" ;;
1) echo "already running" ;;
2) echo "error" ;;
esac
;;
stop)
do_stop
case "$?" in
0) echo "done" ;;
1) echo "not running" ;;
2) echo "error" ;;
esac
;;
restart)
do_stop
case "$?" in
0) echo "done" ;;
1) echo "not running" ;;
2) echo "error" ;;
esac
do_start
case "$?" in
0) echo "done" ;;
1) echo "already running" ;;
2) echo "error" ;;
esac
;;
status)
echo "Status: IPTABLES" >&2
iptables -t nat -L
echo "";echo "IP forward: ";cat /proc/sys/net/ipv4/ip_forward
;;
*)
echo "Usage: $SCRIPTNAME {start|stop|restart}" >&2
exit 3
;;
esac
:
Tornar o script executável:
chmod 755 /etc/init.d/nat
Testar o serviço com:
service nat start
Starting NAT router... done
O serviço pode ser instalado para arrancar automaticamente com:
update-rc.d nat defaults
[Ainda faltam as partes de gestão e controlo]
2. Configuração do iptables
3. Scripts para configuração iptables
4. Aplicação web para gestão
Tutorial iptables:
https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
TFTP UDP Traffic passthrough:
http://keystoneit.wordpress.com/2007/11/25/tftp-through-ipcop-or-other-iptables-firewalls/
Accounting:
http://www.catonmat.net/blog/traffic-accounting-with-iptables/
Bandwith:
http://jim-zimmerman.com/?p=798
