

   The Linux Cipe+Masquerading mini-HOWTO
   Anthony Ciaravalo, acj@home.com
   v0.4, 28 October 1998

   1. 
   
   Linux Cipe+Masquerading mini-HOWTO. Ľʹcipe
   linux masquerading firewallһ·(LAN)
   ·֮˽·(Virtual Private Network)
   
   1.1. Ȩ
   
   (C)opyright 1998 Anthony Ciaravalo, acj@home.com
   
   رLinux HOWTOļİȨǹԭСֻҪ֤Ȩܵ
   Linux HOWTOļܹκεӻʵý򲿷ֵĸơɢ
   ҵǱģԹǰǱ֪ԭߡ
   
   ԴLinux HOWTOļ롢ıࡢȵȣݰ
   ȨҲ˵κ˽ԲļɢϼơĳЩ
   £ŵLinux HOWTO coordinatorǢѯ緽
   ʽ
   
   κʣӭǢѯLinux HOWTO coordinator Greg Hankins 
   ѯ(finger)ʺȡ绰ʼַ
   
   1.2 γе
   
   ʹô˷ļġѶгеաھInternetӵ·
   ʱܻలȫԵ⡣ʹѶϢѾܣȷ
   firewall趨Ȼᵼ°ȫϵѷ졣cipe connectionҪرС
   ĽȻȻ޷100İȫ߲֤ļṩ
   ѶͬʱҲṩһȫ·
   
   1.3. ʹûر
   
   κ⡢顢ۣӭдŵ acj@home.net.
   
   1.4. ļ֮°汾
   
   °ļᷢ cipe mailing list email  Linux HOWTO
   coordinator ҽ Linux HOWTO
   
   1.5 ȡõ
   
   ļ cipe version 1.0.0 дɵġԴ
   [1]http://sites.inka.de/~bigred/sw/cipe-1.0.0.tar.gz ȡļ
   
   2. 趨
   
   2.1 Firewall 趨
   
   ļ kernel Ѿ趨֧Ԯ IP masquerade Ѿִ
   firewall 趨вȥ趨 masquerading firewallֻ
   趨ġ˵ʹ masquerading firewall ʱcipe
   ڲοļҵ趨 linux IP masquerade
   firewall.
   
   2.2. The Star/Hub 趨
   
   趨ʹ star/hub ܹ machine A ֹͣmachine B
    C ޷ߡԿ machine B  C ֮һ cipe
   connection ⡣·һʱ򣬾ͻῪʼ
   Σڡļֻ star/hub 趨ġ
   

                         Machine A
                         eth0: 10.10.1.1
                         eth1: real ip 1
                      /                   \
                     /                     \
               Machine B                 Machine C
               eth0: 10.10.2.1           eth0:10.10.3.1
               eth1: real ip 2           eth1: real ip 3

   2.3. ʲο
   
   eth0  local network (fake address)
   eth1  internet address (real address)
   
   Port A κѡЧͨѶ
   Port B κѡЧͨѶ
   
   Key A κѡЧ key (Ķ cipe ļ)
   Key B κѡЧ key
   
   2.4. Machine A 趨
   
   2.4a. /etc/cipe/ip-up
   

   #a trimmed down version of the sample ip-up that comes with the
   distribution
   #!/bin/sh
   umask 022
   PATH=/sbin:/bin:/usr/sbin:/usr/bin
   echo "UP $*" >> /tmp/cipe
   echo $3 > /var/run/$1.pid
   #趨 routing ʱֳɲͬĵ裬¡

   2.4b. /etc/cipe/options.machineB
   

   #豸
   device          cip3b0
   # the peers internal (fake) ip address
   ptpaddr         10.10.2.1
   # my cipe (fake) ip address
   ipaddr          10.10.1.1
   # my real ip address and cipe port
   me              (real ip 1):(port A)
   # the peers ip address and cipe port
   peer            (real ip 2):(port A)
   #128 λԪļ keyӦԱ
   key             (Key A)

   2.4c. /etc/cipe/options.machineC
   

   #豸
   device          cip3b1
   # the peers internal (fake) ip address
   ptpaddr         10.10.3.1
   # my cipe (fake) ip address
   ipaddr          10.10.1.1
   # my real ip address and cipe port
   me              (real ip 1):(port B)
   # the peers ip address and cipe port
   peer            (real ip 3):(port B)
   #128 λԪļ keyӦԱ
   key             (Key B)

   2.4d. /etc/cipe/setroute
   

   #!/bin/sh
   #趨 routing table ĵ
   #趨 Machine B  routing table
   /sbin/route add -host 10.10.2.1 dev cip3b0
   /sbin/route add -net 10.10.2.0 netmask 255.255.255.0 gw 10.10.2.1
   #趨 Machine C  routing table
   /sbin/route add -host 10.10.3.1 dev cip3b1
   /sbin/route add -net 10.10.3.0 netmask 255.255.255.0 gw 10.10.3.1

   2.4e. /etc/rc.d/rc.local
   

   echo Configuring VPN network
   /usr/local/sbin/ciped -o /etc/cipe/options.machineB
   /usr/local/sbin/ciped -o /etc/cipe/options.machineC
   /etc/cipe/setroute

   2.4f. Firewall 
   

   #ȥ incoming firewall Ĺ򣬲ԤֵΪ deny
   /sbin/ipfwadm -I -f
   /sbin/ipfwadm -I -p deny
   #½ķ (packets)  cipe links ·
   /sbin/ipfwadm -I -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   /sbin/ipfwadm -I -a accept -W cip3b1 -S 10.10.0.0/16 -D 10.10.0.0/16
   #һЩķ

   #ȥ outgoing firewall Ĺ򣬲ԤֵΪ deny
   /sbin/ipfwadm -O -f
   /sbin/ipfwadm -O -p deny
   #ͳķ (packets)  cipe links ·
   /sbin/ipfwadm -O -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   /sbin/ipfwadm -O -a accept -W cip3b1 -S 10.10.0.0/16 -D 10.10.0.0/16
   #һЩķͳ

   #ȥ forwarding firewall Ĺ򣬲ԤֵΪ deny
   /sbin/ipfwadm -F -f
   /sbin/ipfwadm -F -p deny
   #ת͵ķ (packets)  cipe links ·
   /sbin/ipfwadm -F -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   /sbin/ipfwadm -F -a accept -W cip3b1 -S 10.10.0.0/16 -D 10.10.0.0/16
   #̨ʵ ip forward ʵ ip
   /sbin/ipfwadm -F -a accept -W eth1 -S (real ip 1) -D (real ip 2)
   /sbin/ipfwadm -F -a accept -W eth1 -S (real ip 1) -D (real ip 3)
   # local interface (fake ip address) ת͵·
   /sbin/ipfwadm -F -a accept -W eth0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #һЩķת͹

   2.4g. ͨѶբ (Gateway)
   
    10.10.1.0 ·ϵĻ 10.10.1.1 ͨѶբ
   趨Ὣ޷
   
   2.5. Machine B 趨
   
   2.5a. /etc/cipe/ip-up
   

   #a trimmed down version of the sample ip-up that comes with the
   distribution
   #!/bin/sh
   umask 022
   PATH=/sbin:/bin:/usr/sbin:/usr/bin
   echo "UP $*" >> /tmp/cipe
   echo $3 > /var/run/$1.pid
   #趨 routing ʱֳɲͬĵ裬¡

   2.5b. /etc/cipe/options.machineA
   
   #豸
   device          cip3b0
   # the peers internal (fake) ip address
   ptpaddr         10.10.1.1
   # my cipe (fake) ip address
   ipaddr          10.10.2.1
   # my real ip address and cipe port
   me              (real ip 1):(port A)
   # the peers ip address and cipe port
   peer            (real ip 2):(port A)
   #128 λԪļ keyӦԱ
   key             (Key A)

   2.5c. /etc/cipe/setroute
   

   #!/bin/sh
   #趨 routing table ĵ
   #趨 Machine A  routing table
   /sbin/route add -host 10.10.1.1 dev cip3b0
   /sbin/route add -net 10.10.1.0 netmask 255.255.255.0 gw 10.10.1.1

   2.5d. /etc/rc.d/rc.local
   

   echo Configuring VPN network
   /usr/local/sbin/ciped -o /etc/cipe/options.machineA
   /etc/cipe/setroute

   2.5e. Firewall 
   
   ( 2.4f ע˵)
   
   #flush all incoming firewall rules and set default policy to deny
   /sbin/ipfwadm -I -f
   /sbin/ipfwadm -I -p deny
   #allow incoming packets to your network via the cipe link
   /sbin/ipfwadm -I -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #add rest of your incoming rules here

   #flush all outgoing firewall rules and set default policy to deny
   /sbin/ipfwadm -O -f
   /sbin/ipfwadm -O -p deny
   #allow outgoing packets to your network via the cipe link
   /sbin/ipfwadm -O -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #add rest of your outgoing rules here

   #flush all forwarding firewall rules and set default policy to deny
   /sbin/ipfwadm -F -f
   /sbin/ipfwadm -F -p deny
   #allow packets to be forwarded to the other networks via the cipe
   links
   /sbin/ipfwadm -F -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #allow forwarding from real ip of this machine to the real ip address
   of the other machines
   /sbin/ipfwadm -F -a accept -W eth1 -S (real ip 2) -D (real ip 1)
   #allow packets to be forwarded to the other networks via the local
   interface (fake ip address)
   /sbin/ipfwadm -F -a accept -W eth0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #add rest of your forwarding rules here

   2.5f. ͨѶբ
   
    10.10.2.0 ·ϵĻ 10.10.2.1 ͨѶբ
   趨Ὣ޷
   
   2.6. Machine C 趨
   
   2.6a. /etc/cipe/ip-up
   

   #a trimmed down version of the sample ip-up that comes with the
   distribution
   #!/bin/sh
   umask 022
   PATH=/sbin:/bin:/usr/sbin:/usr/bin
   echo "UP $*" >> /tmp/cipe
   echo $3 > /var/run/$1.pid
   #趨 routing ʱֳɲͬĵ裬¡

   2.6b. /etc/cipe/options.machineA
   

   #豸
   device          cip3b0
   # the peers internal (fake) ip address
   ptpaddr         10.10.1.1
   # my cipe (fake) ip address
   ipaddr          10.10.3.1
   # my real ip address and cipe port
   me              (real ip 3):(port B)
   # the peers ip address and cipe port
   peer            (real ip 1):(port B)
   #128 λԪļ keyӦԱ
   key             (Key B)

   2.6c. /etc/cipe/setroute
   

   #!/bin/sh
   #趨 routing table ĵ
   #趨 Machine A  routing table
   /sbin/route add -host 10.10.1.1 dev cip3b0
   /sbin/route add -net 10.10.1.0 netmask 255.255.255.0 gw 10.10.1.1

   2.6d. /etc/rc.d/rc.local
   

   echo Configuring VPN network
   /usr/local/sbin/ciped -o /etc/cipe/options.machineA
   /etc/cipe/setroute

   2.6e. Firewall Rules
   
   ( 2.4f ע˵)
   

   #flush all incoming firewall rules and set default policy to deny
   /sbin/ipfwadm -I -f
   /sbin/ipfwadm -I -p deny
   #allow incoming packets to your network via the cipe link
   /sbin/ipfwadm -I -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #add rest of your incoming rules here

   #flush all outgoing firewall rules and set default policy to deny
   /sbin/ipfwadm -O -f
   /sbin/ipfwadm -O -p deny
   #allow outgoing packets to your network via the cipe link
   /sbin/ipfwadm -O -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #add rest of your outgoing rules here

   #flush all forwarding firewall rules and set default policy to deny
   /sbin/ipfwadm -F -f
   /sbin/ipfwadm -F -p deny
   #allow packets to be forwarded to the other networks via the cipe
   links
   #this machine to the real ip address of the other machines
   /sbin/ipfwadm -F -a accept -W cip3b0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #allow forwarding from real ip of this machine to the real ip address
   of the other machine
   /sbin/ipfwadm -F -a accept -W eth1 -S (real ip 3) -D (real ip 1)
   #allow packets to be forwarded to the other networks via the local
   interface (fake ip address)
   /sbin/ipfwadm -F -a accept -W eth0 -S 10.10.0.0/16 -D 10.10.0.0/16
   #add rest of your forwarding rules here

   2.6f. ͨѶբ
   
    10.10.3.0 ·ϵĻ 10.10.3.1 ͨѶբ
   趨Ὣ޷
   
   3. 
   
   ÿִֶ̨бӵ rc.local ָ
   
   4. ӵ WAN.
   
   趨Ϊֹ WANӦܹ˳ӡȥ ping·ϵĻ
   һ裬·ܹ SAMBA ˴˻ȡһЩС
   ʾ lmhosts  wins serverǱģر NT ¡Ѿʵ趨
   ɹڱƪн֡
   
   5. οļ
   
   5.1. Web ַ
   

   Cipe HomePage     [2]http://sites.inka.de/~bigred/devel/cipe.html
   Masq Home Page    [3]http://ipmasq.home.ml.org
   Samba Home Page   [4]http://samba.anu.edu.au
   Linux HQ          [5]http://www.linuxhq.com --- һLinuxѶĲվ

   5.2. ļ
   
   cipe.info: йcipe׼Ѷĵ Firewall HOWTO,Mark
   Grennan  IP Masquerade mini-HOWTO, Ambrose Au 
   
   ο
   1. http://sites.inka.de/~bigred/sw/cipe-1.0.0.tar.gz
   2. http://sites.inka.de/~bigred/devel/cipe.html
   3. http://ipmasq.home.ml.org/
   4. http://samba.anu.edu.au/
   5. http://www.linuxhq.com/

References

   1. http://sites.inka.de/~bigred/sw/cipe-1.0.0.tar.gz
   2. http://sites.inka.de/~bigred/devel/cipe.html
   3. http://ipmasq.home.ml.org/
   4. http://samba.anu.edu.au/
   5. http://www.linuxhq.com/
