实验要求:
1)网关服务器:ens36:12.0.0.254/24,ens33:192.168.100.254/24;Server1:192.168.100.101/24;PC1和server2:自动获取IP;交换机无需配置。要求能够使用Xshell等远程工具登录Server1和网关服务器。
2)网关服务器提供DHCP服务给PC1和server2分配对应网段的IP地址。
3)server1服务器上创建密钥对并上传给网关服务器,并使server1的root用户可以使用root用户免交互登录网关服务器。
4)server1服务器安装和启动httpd服务搭建Web网站,首页内容自定,但需要把server2的/share目录中的首页文件index.html,通过NFS挂载到server1的/var/www/html目录下使用。
5)网关服务器:搭建DNS分离,局域网解析www.benet.com 为server1的IP地址,外网解析为12.0.0.254,并且实现SNAT和DNAT 转换成ens36接口地址,PC1可以使用域名www.benet.com解析12.0.0.254直接访问Web网站。
一、搭建网络环境
根据实验要求在VMware中添加VMnet1(192.168.100.0)和VMnet2(12.0.0.0)
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030333484-2144038051.png)
网关服务器的VMnet设置
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030759238-1327640321.png)
配置ens33网卡如下:
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030530628-1239529085.png)
ens36网卡配置如下:
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030551870-2136350094.png)
使用Xshell连接网关服务器
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030612083-925324985.png)
server1的VMnet配置
ens33网卡配置如下:
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030723418-1606878139.png)
重启ens33网卡后查看IP地址
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030838977-939073053.png)
使用Xshell进行连接
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030910419-528347477.png)
server2的VMnet配置
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802030924476-566589497.png)
PC1的VMnet配置
二、DHCP分配网段
注意:所有虚拟机先配置好yum本地源,以及提前关闭防火墙和selinux,防止后面忘记!
网关服务器安装dhcp服务(确认好是否已安装)
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031020453-2106458227.png)
1.yum install -y dhcp
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031123974-586870436.png)
2 .复制dhcp配置文件并覆盖原文件
cp /usr/share/doc/dhcp-4.2.5/dhcpd.conf.example /etc/dhcp/dhcpd.conf
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031141265-1351540533.png)
3. 修改配置文件添加ens33和ens37网卡对应的两个网段!
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031201928-1047738175.png)
4. 开启dhcp服务
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031217046-811711280.png)
server2的ens33网卡配置如图:
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031240261-1713192405.png)
重启网卡然后查看IP地址是否为dhcp自动分配的网段范围内
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031303405-1995092959.png)
根据dhcp服务器分配的IP连接xshell
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031320560-1390902869.png)
设置pc1的ipv4为【自动获取ip地址】
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031336854-1755756569.png)
查看IP地址是否为dhcp自动分配的网段范围内
三、免交互登录网关服务器
1.(server1端)在server1端 生成密钥对(公钥和私钥)
ssh-keygen -t ecdsa
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031421026-337422704.png)
2. (server1)将server1的公钥文件上传至网关服务器的opt目录下
scp /root/.ssh/id_ecdsa.pub root@192.168.100.254:/opt
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031435904-1953484248.png)
3. (网关服务器端)导入server1的公钥至网关服务器的公钥库
mkdir /root/.ssh/
cat /opt/id_ecdsa.pub >> /root/.ssh/authorized_keys
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031451007-1710768924.png)
4. (server1端)实现登录网关服务器免交互(结束后exit退出,不然影响后面实验)
ssh-agent bash
ssh-add
ssh root@192.168.80.254
四、搭建Web网站
1.(server2端)查看是否安装rpcbind nfs-utils服务
rpm -q rpcbind nfs-utils
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031553114-1772374170.png)
2.(server2端) 创建共享目录赋予权限然后修改配置文件
[root@cj0307 ~]# mkdir -p /opt/share/
[root@cj0307 ~]# chmod 777 /opt/share/
[root@cj0307 ~]# vim /etc/exports
/opt/share 192.168.100.0/24(rw,sync,no_root_squash) #配置文件新增的内容
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031611563-1253371057.png)
2. (server2端)在共享目录中创建index.html文件,内容如下:
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031625677-1911806310.png)
3. (server2端)发布共享的目录
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031640675-1604768766.png)
4. (server1端)安装httpd服务并开启,扫描server2的共享目录并挂载到自己的/var/www/html目录下
yum install -y httpd
showmount -e 192.168.100.200
mount 192.168.100.200:/opt/share /var/www/html/
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031655455-1758865028.png)
5. (server1端)开启httpd服务,在火狐浏览器中输入本机的IP地址信息查看
systemctl start httpd
五、分离解析和DNAT
1.(网关服务器端)安装bind程序
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031723365-1110291874.png)
2.(网关服务器端)修改主配置文件,修改网段为any,然后注释zone区域
vim /etc/named.conf
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031753907-1572399886.png)
3. (网关服务器端)修改区域配置文件
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031840121-1487346200.png)
4. (网关务器端)修改区域数据文件(lan和wan)
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031908060-2066714386.png)
5. (网关服务器端)开启named服务,并进行内网和外网解析测试
[root@cheng0307 named]# systemctl restart named
[root@cheng0307 named]# echo "nameserver 12.0.0.254" > /etc/resolv.conf
[root@cheng0307 named]# nslookup www.benet.com
[root@cheng0307 named]# echo "nameserver 192.168.100.254" > /etc/resolv.conf
[root@cheng0307 named]# nslookup www.benet.com
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802031949518-2103886724.png)
(server1端)进行域名解析测试如下:
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032010787-1380864411.png)
(server2端)进行域名解析测试如下:
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032025768-1579656565.png)
(win10—PC端)pc1端设置dns为网关服务器的外网网卡IP地址,然后进行域名解析测试
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032113247-1422184543.png)
9. (网关服务器端)开启路由转发功能
net.ipv4.ip_forward = 1
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032130141-569868514.png)
10. (网关服务器端)清空iptables的规则
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032144269-184700630.png)
11. (网关服务器端) 添加新的iptables规则(安装iptables服务)
iptables -t nat -A PREROUTING -i ens36 -d 12.0.0.254 -p tcp --dport 80 -j DNAT --to 192.168.100.101
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032210762-2086581815.png)
(win10—PC端)在PC1 通过域名进行访问server1的web服务
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032229098-289206015.png)
附加选项:通过设置SANT相关规则,使PC1访问server1时,源地址由12.0.0.200转换为192.168.100.254
步骤一:(网关服务器端) 添加新的iptables规则
iptables -t nat -I POSTROUTING -s 12.0.0.0/24 -o ens33 -j SNAT --to-source 192.168.100.254
步骤二:(win10—PC端)再次在PC1 通过域名进行访问server1的web服务
![](https://www.icode9.com/i/l/?n=20&i=blog/2387990/202108/2387990-20210802032259335-164959923.png)
步骤三:(server1端)查看/var/log/httpd/access_log日志文件的最底部。
标签:网关,http,dnat,server1,192.168,nfs,server2,服务器,root
来源: https://www.cnblogs.com/qwert19990410/p/15088348.html