Configure vyatta

Username: vyatta

Password: vyatta

配置网卡：

编辑：

configure

内部网络IP地址配置：192.168.0.1

set interfaces ethernet eth0 address 192.168.0.1/24

set interfaces ethernet eth0 description Inside

从DHCP 服务器上自动外网IP地址：

set interfaces ethernet eth1 address dhcp

set interfaces ethernet eth1 description Outside

commit

查看：

show interfaces

ip addr

ping www.google.com

ethernet eth0 {

address 192.168.0.1/24

description Inside

duplex auto

smp_affinity auto

speed auto

}

ethernet eth1 {

address dhcp

description Outside

duplex auto

firewall {

in {

name WAN_IN

}

}

smp_affinity auto

speed auto

}

loopback lo {

}

配置SSH：

set service ssh port '22'

set service ssh listen-address 192.168.0.1      （router内网ip地址）

commit

vyatta@vyatta# show service ssh

listen-address 192.168.0.1

port 22

protocol-version v2

内网通外网：

配置网络地址转换（NAT）：             //内部网络的所有机器共享同一个外部网络地址（连接外网）

Configure Source NAT for our "Inside" network.

set service nat rule 10 outbound-interface eth1  （外网网卡）   NAT出口设置

set service nat rule 10 source address 192.168.0.0/24                        NAT需要转换的地址

set service nat rule 10 type masquerade            启用NAT

commit

vyatta@vyatta# show service

nat {

rule 10 {

outbound-interface eth1

source {

address 192.168.0.0/24

}

type masquerade

}

设置DNS Forwarding(DNS 服务器转发):

set service dns forwarding listen-on eth0      （内网网卡）

set service dns forwarding cache-size '0'

set service dns forwarding name-server 10.108.36.85    （搭建有dns服务器的任意一台VM的IP地址）

commit

vyatta@vyatta# show service dns

dns {

forwarding {

cache-size 0

listen-on eth0   (内网)

name-server 10.108.36.85

}

}

外网通内网：

配置防火墙规则：

set firewall name WAN_IN rule 10 action accept

set firewall name WAN_IN rule 10 destination address 192.168.0.12

set firewall name WAN_IN rule 10 destination port 443

set firewall name WAN_IN rule 10  protocol tcp

set firewall name WAN_IN rule 10 description ALLOW-ACCESS-TO-ACCESS-GATEWAY

set firewall name WAN_IN rule 10 log enable

set firewall name WAN_IN rule 20 action accept

set firewall name WAN_IN rule 20 destination address 192.168.0.0/24

set firewall name WAN_IN rule 20 description NAT-FOR-LAN

Commit

NAT rule:

set service nat rule 20 destination address 10.108.16.30     (router 外网IP地址)

set service nat rule 20 destination port 443          （内网443端口打开）

set service nat rule 20 inbound-interface eth1   （外网网卡）

set service nat rule 20 inside-address address 192.168.0.12   （gateway ip  address, vip 客户端访问的ip地址）绑定内网web server 的ip 地址和端口号

set service nat rule 20 inside-address port 443

set service nat rule 20 type destination

set service nat rule 20 protocol tcp

commit

vyatta@vyatta# show service

rule 20 {

destination {

port 443

}

inbound-interface eth1

inside-address {

address 192.168.0.12

port 443

}

protocol tcp

type destination

}

}

防火墙策略分配给NIC  eth1

set interfaces ethernet eth1 firewall in name WAN_IN               在 eth1（外网网卡）上配置WAN_IN策略

Commit

Configure a DHCP Server:

set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 default-router '192.168.0.1'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24
dns-server '192.168.0.1'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24
domain-name 'internal-network'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 lease
'86400'

set service dhcp-server disabled 'false'
set service dhcp-server shared-network-name LAN subnet 192.168.0.0/24 start
192.168.0.30 stop '192.168.0.254'

commit

save

vyatta@vyatta# show service dhcp-server

disabled false

shared-network-name DHCP_Pool_ETH1 {

authoritative disable

subnet 192.168.0.0/24 {

default-router 192.168.0.1

dns-server 192.168.0.1

domain-name internal-network

lease 86400

start 192.168.0.30 {

stop 192.168.0.254

}

}

}

Commit

Save

检查内外网通信：

内网VM 打开外网共享服务器

外网打开https:router_externel_ip

更多内容可参考：From <https://wiki.vyos.net/wiki/User_Guide>