說(shuō)明
測(cè)試環(huán)境中的機(jī)器需要控制只能請(qǐng)求某些地址，其他的都屏蔽掉，如果在每臺(tái)機(jī)器的iptables中配置，重復(fù)工作太多。 只需將局域網(wǎng)中的默認(rèn)網(wǎng)關(guān)指向一臺(tái)機(jī)器，然后再這臺(tái)機(jī)器上控制iptables即可。
iptables一般只能做對(duì)IP的訪問(wèn)控制，如果做域名的控制，iptables會(huì)自動(dòng)解析成IP寫(xiě)入iptables規(guī)則中。所以需要使用dnsmasq+ipset+iptables
- dnsmasq：dns服務(wù)器，這里有兩個(gè)作用，一個(gè)是做dns轉(zhuǎn)發(fā)，本身不提供dns解析功能。二是將域名解析到的ip自動(dòng)添加到ipset的表中（高版本的dnsmasq才支持ipset）
- ipset：作為iptables和dnsmasq的中轉(zhuǎn)，一個(gè)用來(lái)記錄dnsmasq解析出來(lái)的IP，二是iptables使用ipset的表來(lái)控制訪問(wèn)權(quán)限
配置
| 主機(jī)名 | IP |
|---|---|
| route-a | 192.168.111.100 |
| work-b | 192.168.111.101 |
網(wǎng)關(guān)服務(wù)器配置
-
安裝dnsmasq
[root@route-a ~]# wget http://www.thekelleys.org.uk/dnsmasq/dnsmasq-2.70.tar.gz [root@route-a ~]# tar zxvf dnsmasq-2.70.tar.gz [root@route-a ~]# cd dnsmasq-2.70 [root@route-a ~]# make install -
查看dnsmasq是否支持ipset
[root@route-a ~]# dnsmasq -v Dnsmasq version 2.70 Copyright (c) 2000-2014 Simon Kelley Compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP no- conntrack ipset auth no-DNSSEC This software comes with ABSOLUTELY NO WARRANTY. Dnsmasq is free software, and you are welcome to redistribute it under the terms of the GNU General Public License, version 2 or 3. -
配置dnsmasq
[root@route-a ~]# vim /etc/dnsmasq.conf ... server=/.com/114.114.114.114 conf-dir=/etc/dnsmasq.d [root@route-a ~]# vim /etc/dnsmasq.d/domain.conf ipset=/.baidu.com/bdlist將.com結(jié)尾的域名轉(zhuǎn)發(fā)到114.114.114.114 DNS服務(wù)器解析，將baidu.com的解析的ip記錄到dblist的ipset表中
-
ipset配置
創(chuàng)建dblist表
[root@route-a ~]# ipset create dblist hash:ip [root@route-a ~]# ipset list Name: bdlist Type: hash:ip Revision: 1 Header: family inet hashsize 1024 maxelem 65536 Size in memory: 16560 References: 1 Members: 115.239.211.112 115.239.210.27members 對(duì)應(yīng)的IP就是域名解析的IP，如果members為空是因?yàn)檫€沒(méi)有通過(guò)dnsmasq請(qǐng)求過(guò)baidu.com
-
啟動(dòng)服務(wù)
[root@route-a ~]# dnsmasq -C /etc/dnsmasq.conf -
配置轉(zhuǎn)發(fā)
[root@route-a ~]# sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/' /etc/sysctl.conf [root@route-a ~]# sysctl -p -
iptables刪除默認(rèn)規(guī)則
[root@route-a ~]# iptables -F -
iptables配置默認(rèn)拒絕所有轉(zhuǎn)發(fā)
[root@route-a ~]# iptables -P FORWARD DROP -
iptables開(kāi)放白名單
[root@route-a ~]# iptables -A FORWARD -s 192.168.111.101 -m set --match-set bdlist dst -j ACCEPT允許111.101服務(wù)器訪問(wèn)dblist中的地址，而dblist中存放的是baidu.com的地址，所以允許該服務(wù)器訪問(wèn)baidu
節(jié)點(diǎn)服務(wù)器配置
-
配置默認(rèn)網(wǎng)關(guān)到網(wǎng)關(guān)服務(wù)器
[root@work-b ~]# sed -i 's/^GATEWAY.*/GATEWAY=192.168.111.100/' /etc/sysconfig/network-scripts/ifcfg-eth0 [root@work-b ~]# service network restart -
配置dns
[root@work-b ~]# vim /etc/resolv.conf nameserver 192.168.111.110
