Как я настраивал alt linux на даче, приехав туда на Citroen C3 2012 года

1. hostnamectl set-hostname xxx.au-team.irpo; exec bash (на всех)

2. dhcpcd (на всех)

3. echo nameserver 10.0.5.1 > /etc/resolv.conf (на всех)

4. apt-get update (на всех)

5. apt-get install nano (на всех)

6. apt-get install NetworkManager-tui (на всех)

7. apt-get install openssh-server (hq-srv)

8. apt-get install frr (hq-rtr br-rtr)

9. apt-get install dhcp-server (hq-rtr)

10. timedatectl set-timezone Europe/Moscow (на всех)

11. NetworkManager (на всех)

12. добавляем сетевые адаптеры, настраиваем в nmtui (на всех)

13. //настраиваем vlanы “parent-ensXX” //также vlan делаем на cli и srv (hq-rtr)

14. //настраиваем gre-тунель “parent-ensXX”

//“localip-172.16.4.2” “remoteip-172.16.5.2” “addr-10.10.0.1/30” “gat-0.2” (hq-rtr)

15. //настраиваем gre-тунель “parent-ensXX”

//“localip-172.16.5.2” “remoteip-172.16.4.2” “addr-10.10.0.2/30” “gat-…0.1 (hq-rtr)

16. nano /etc/sysctl.conf net.ipv4.ip_forward = 1 (isp hq-rtr br-rtr)

17. nano /etc/net/sysctl.conf net.ipv4.ip_forward = 1 (isp hq-rtr br-rtr)

18. sysctl –p (isp hq-rtr br-rtr)

19. iptables -t nat -A POSTROUTING -o ens19 -j MASQUERADE “где ens19 это кабель,

которыйидётвинтернет(намашинахHQ-RTRи BR-RTR это кабель к ISP)”(isp hq-rtr br-rtr)

20. //iptables-save > /etc/sysconfig/iptables //systemctl enable –now iptables (isp hq br)

20. //useradd sshuser -u 1010 –U //passwd sshuser //P@ssw0rd //P@ssw0rd

//usermod -aG wheel sshuser

//EDITOR=nano visudo //sshuser ALL=(ALL) NOPASSWD: ALL (hq-srv br-srv)

21. //useradd net_admin –U //passwd net_admin //P@$$w0rd //P@$$w0rd

//usermod -aG wheel net_admin

//EDITOR=nano visudo //net_admin ALL=(ALL) NOPASSWD: ALL (hq-rtr br-rtr)

22. //nano /etc/openssh/sshd_config //AllowUsers sshuser //MaxAuthTries 2

//Banner /etc/ssh-banner “делаем баннер” //systemctl restart sshd “-t”(hq-s br-s)

23. //nmcli connection edit tun1 //set ip-tunnel.ttl 64 //save //quit (hq-rtr br-rtr)

23. //nmcli connection edit tun1 //set ip-tunnel.ttl 64 //save //quit (hq-rtr br-rtr)

24. //nano /etc/frr/daemons //ospfd=yes //systemctl enable –now frr (hq-rtr br-rtr)

25. //vtysh conf t //router ospf //passive-interface default //network 10.10.0.0/30 area 0

//network 172.16.4.0/28 area 0 //network 172.16.100.0/26 area 0

//network 172.16.100.65/28 area 0 //exit //interface tun1

//no ip ospf network broadcast //no ip ospf passive //exit //do write memory //exit (hq-rtr)

26. //vtysh conf t //router ospf //passive-interface default //network 10.10.0.0/30 area 0

ewrite//network 172.16.5.0/28 area 0 //network 172.16.200.0/27 area 0

//exit //interface tun1 //no ip ospf network broadcast //no ip ospf passive

//exit //do write memory //exit (br-rtr)

НА ISP ip route add 172.16.100(200).0/26(27) via 172.16.4(5).1

27. перезапуск и sh ip ospf neighbor ( isp hq-rtr br-rtr)

27. перезапуск и ship ospf neighbor ( isp hq-rtr br-rtr)

28. cd /etc/dhcp/

(hq-rtr)

29. cpdhcpd.conf.example dhcpd.conf (hq-rtr)

30. заходим в

последний файл, там стираем всё после строчки max-lease-time 7200; (hq-rtr)

31.subnet 192.168.100.64 netmask 255.255.255.240 {

//range192.168.100.66 192.168.100.78; //option

domain-name-servers 192.168.100.2;

//option domain-name"au-team.irpo"; //option

routers 192.168.100.1;

//default-lease-time600; max-lease-time 7200; }

//systemctl enable –now dhcpd //и включить

dhcp наcli!!! (hq-rtr)

1.

ПРОКИДЫВАНИЕ ПОРТОВ:

//iptables -t nat -A PREROUTING -i ens19 -p tcp

--dport 2024 -j

DNAT --to-destination 192.168.100.2:2024 (hq-rtr)

2. //iptables -t nat -A PREROUTING -i ens19 -p tcp--dport 2024 -j

DNAT --to-destination 192.168.200.2:2024

//iptables -t nat -A PREROUTING -i ens19 -p tcp

--dport 80 -j

DNAT --to-destination 192.168.200.2:8080 (br-rtr)

3. УСТАНОВИТЬ YANDEXBROWSER

наCLIENT

4. ANSIBLE: //apt-get install ansible –y //ssh-keygen -t

rsa

//ls -l ~/.ssh (br-srv)

5. systemctlenable –now sshd (hq-rtr br-rtr hq-cli)

6. //ssh-copy-id -p 2024 sshuser@172.16.100.2

//ssh-copy-id user@172.16.100.66 “’это ip cli по dhcp”

//ssh-copy-id net_admin@172.16.4.2 (yes, P@$$)

//ssh-copy-id net_admin@172.16.5.2 (br-srv)

7. //nano

/etc/ansible/demo //[all:vars]//ansible_python_interpreter=/usr/bin/python3

//[hq]

//172.16.100.2 ansible_port=2024 ansible_user=sshuser

//172.16.100.66

ansible_user=user //172.16.4.2 ansible_user=net_admin

8. //[br]

//172.16.5.2 ansible_user=net_admin

9. ansible all -i

/etc/ansible/demo -m ping (br-srv)

10.CHRONY:

//apt-getinstall chrony //nano /etc/chrony.conf

//server 127.0.0.1 iburst prefer

//allow172.16.100.0/26 //allow

172.16.100.64/28 //allow 172.16.200.0/27//pool коммент

//systemctlrestart chronyd //systemctl enable –now

chronyd //chronyc clients (hq-rtr)

11. //apt-getinstall chrony //nano /etc/chrony.conf

//server 172.16.100.1 iburst

//systemctlrestart chronyd //systemctl enable –now chronyd (hq-srv hq-cli br-rtr br-srv)