Setting a Static IP address in LinuxSetting a static IP address in Linux.pngIntroduction: Usually, IP addresses are dynamically assigned by the router's DHCP server on most network devices. But using a static IP address on the server makes the provided services more stable. If the DHCP server is not working, it will affect the computers in the local area network to obtain IP addresses, thereby affecting access to services, while servers with static IP addresses are not affected, so static IP is also necessary (on devices providing services).Table of Contents: Configuring a static IP address in RHEL/CentOS/Fedora:Setting a static IP address in Debian / Ubuntu (versions prior to 17.10):Setting a static IP address in Ubuntu (newer versions):Setting up VLAN in Ubuntu:Setting up Bridge in Debian:Bridge without VLANBridge with VLANConfiguring a static IP address in RHEL/CentOS/Fedora: To set a static IP address in RHEL / CentOS / FedoraFirst check the local network interface name:2022-03-18_121212.pngThe above figure shows that the network interface name of the local machine is eth0, representing the edited network file ifcfg-eth0Use nano or vim to edit:vim /etc/sysconfig/network-scripts/ifcfg-eth0Make changes to the ifcfg-eth0 file based on your own network:DEVICE="eth0" BOOTPROTO="static" DNS1="8.8.8.8" DNS2="1.1.1.1" GATEWAY="192.168.0.1" HOSTNAME="linux.kingtam.win" HWADDR="00:19:99:A4:46:AB" IPADDR="192.68.0.100" NETMASK="255.255.255.0" NM_CONTROLLED="yes" ONBOOT="yes" TYPE="Ethernet" UUID="8105c095-799b-4f5a-a445-c6d7c3681f07"You need to edit the following settings:BOOTPROTO is dhcp (default) or static (static)DNS1 and DNS2 can use public DNS services such as 8.8.8.8, 1.1.1.1Gateway (GATEWAY) is the IP of the router or firewallHost name (HOSTNAME) customizableNetwork mask (NETMASK) is usually 255.255.255.0 (/24) modify according to your own network parametersIP address (IPADDR) the local IP addressONBOOT whether to start automatically is yes or noThen edit: resolve.confresolve.conf is used to set the definitions of each item when the DNS client requests name resolution.vim /etc/resolv.confnameserver 8.8.8.8 # Modify with your preferred DNS address nameserver 1.1.1.1 # Modify with your preferred DNS addressUse one of the following commands to restart the network and apply all settings:/etc/init.d/network restartsystemctl restart networkSetting a static IP address in Debian / Ubuntu (versions prior to 17.10): To set a static IP address in Debian/Ubuntu (versions prior to 17.10), open the following file:vim /etc/network/interfacesThe default is dhcp: no-auto-down eth0 # or possibly auto eth0 iface eth0 inet dhcpEdit using nano or vim, and make changes based on your own network:no-auto-down eth0 iface eth0 inet static address 192.168.0.100 netmask 255.255.255.0 gateway 192.168.0.1 dns-nameservers 1.1.1.1 dns-nameservers 8.8.8.8The following settings need to be edited:Change iface eth0 inet dhcp (default) to iface eth0 inet static (static)dns-nameservers can have multiple values, such as using public DNS services like 8.8.8.8, 1.1.1.1gateway is the IP address of the router or firewallnetmask is usually 255.255.255.0 (/24), adjust according to your own network parametersaddress is the IP address of the local machineAfter saving the interfaces settings, edit /etc/resolv.conf:vim /etc/resolv.conf nameserver 8.8.8.8 # Modify with your preferred DNS address nameserver 1.1.1.1 # Modify with your preferred DNS addressUse one of the following commands to restart the network and apply all settings:/etc/init.d/network restartsystemctl restart networkSetting a static IP address in Ubuntu (newer versions): Starting from Ubuntu 17.10, Netplan is the default network management tool.Network configuration files are stored in *.yaml files in the directory /etc/netplan/.In my case, it is /etc/netplan/00-installer-config.yaml, and the default content is:network: ethernets: eth0: dhcp4: true version: 2Edit the 00-installer-config.yaml configuration file using nano or vim:network: version: 2 renderer: networkd ethernets: eth0: dhcp4: no addresses: [192.168.1.2/24] routes: - to: default via: 192.168.1.1 nameservers: addresses: [8.8.8.8,1.1.1.1]You need to edit the following settings:renderer: networkd specifies that this interface is managed by the systemd-networkd servicedhcp4: no changes to manual static IP address setupaddresses the local IP address and network segmentnameservers DNS serveraddresses [8.8.8.8,1.1.1.1] can be multiple IP addressesSave the 00-installer-config.yaml settings.Apply the network settings using the following command:netplan applySetting up VLAN in Ubuntu: In this example, N1 is flashed with Armbian, and the network port is connected to the trunk port of the switch.Dynamically obtain an IP addressThe network configuration files are stored in *.yaml files in the /etc/netplan/ directory.The default content of /etc/netplan/armbian-default.yaml is:network: version: 2 renderer: NetworkManagerEdit the /etc/netplan/armbian-default.yaml configuration file using nano or vim:network: version: 2 renderer: NetworkManager ethernets: eth0: dhcp4: true vlans: vlan.3: id: 3 link: eth0 dhcp4: trueThe configuration file is written in YAML format, and various settings are included:The "version: 2" in the first line specifies the YAML version used in this file.The "renderer" field specifies the network management tool to be used, which in this case is "NetworkManager", a popular tool for managing networks on Linux systems.In the "ethernets" section, the "eth0" physical interface is configured, and the interface is set to obtain an IPv4 address via DHCP.In the "vlans" section, the VLAN (Virtual Local Area Network) interface on the "eth0" network interface is configured. The VLAN ID is 3 and is connected to the physical interface "eth0" via the "link" field. The VLAN interface is also configured to obtain an IPv4 address via DHCP.This configuration file sets up a network connection where both the physical interface "eth0" and the VLAN interface obtain dynamic IP addresses via DHCP.Set static IP address version: 2 renderer: NetworkManager ethernets: eth0: dhcp4: false vlans: vlan.3: id: 3 link: eth0 dhcp4: no addresses: [10.3.3.3/24] routes: - to: default via: 10.3.3.1 nameservers: addresses: [8.8.8.8,1.1.1.1]The VLAN configuration sets up a new interface vlan.3 with ID 3 associated with eth0. Its dhcp4 is set to no, with the static IP address 10.3.3.3 and subnet mask 24. The default route is specified through IP address 10.3.3.1, and 8.8.8.8 and 1.1.1.1 are set as DNS servers.Setting up Bridge in Debian: Without VLANTo find out the default network interface name of the machine, use the following command:ip -c route | head -n 1 | cut -d ' ' -f 5eth0Edit the network interface via text editorsudo vim /etc/network/interfacesi. As DHCP:source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback # Wired adapter #1 allow-hotplug eth0 no-auto-down eth0 # Bridge as DHCP auto br0 iface br0 inet dhcp bridge_ports eth0Then restart the networking service:sudo systemctl restart networking.servicei. As Static:source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback # Wired adapter #1 allow-hotplug eth0 no-auto-down eth0 # Bridge setup to static IP auto br0 iface br0 inet static address 10.1.1.10 broadcast 10.1.1.255 netmask 255.255.255.0 gateway 10.1.1.1 bridge_ports eth0 bridge_stp off # disable Spanning Tree Protocol bridge_waitport 0 # no delay before a port becomes available bridge_fd 0 # no forwarding delayThen restart the networking service:sudo systemctl restart networking.serviceWith VLAN (Advanced Example)Make sure the vlan package is installed on the system:sudo apt install vlan -yIf the host is a hypervisor consider adding below sysctl configurations:echo "net.ipv4.ip_forward=1" | sudo tee -a /etc/sysctl.conf echo "net.ipv4.conf.all.arp_filter=0" | sudo tee -a /etc/sysctl.conf echo "net.ipv4.conf.all.rp_filter=2" | sudo tee -a /etc/sysctl.confLoad configurations:$ sudo sysctl -pnet.ipv4.ip_forward = 1net.ipv4.conf.all.arp_filter = 0net.ipv4.conf.all.rp_filter = 2Then modify interfaces configurations:sudo vim /etc/network/interfacesThe interface content is as follow:source /etc/network/interfaces.d/* # The loopback network interface auto lo iface lo inet loopback # Wired adapter #1 allow-hotplug eth0 iface eth0 inet manual pre-up ifconfig $IFACE up pre-down ifconfig $IFACE down # VLAN 3 auto eth0.3 iface eth0.3 inet manual # Bridge br0 auto br0 iface br0 inet static bridge_ports eth0.3 bridge_stp off bridge_waitport 0 bridge_fd 0 address 10.3.3.3 netmask 255.255.255.0 gateway 10.3.3.1 dns-nameservers 1.1.1.1 8.8.4.4Then restart the networking service:sudo systemctl restart networking.serviceConclusion: Each Linux distribution may have different methods for setting a static IP address, but the process is generally similar.Reference: How to Set Static IP Address and Configure Network in Linux (tecmint.com)如何在Ubuntu Server 18.04 LTS中配置靜態IP地址 - soso101 - 博客園 (cnblogs.com)Create Linux Bridge on VLAN Interface in Debian 11/10
Linux的防火牆(iptables)初探前言: 我之前較為回避Linux的防火牆(iptables)，因為在接觸ubuntu系統時已經有內置的簡易的防火牆「UFW (Uncomplicated Firewall)」，大大簡化防火牆的使用，但在學習Wireguard、Zero-tier、NAT等應用又好像跨不開iptables，於是重新面對iptables。Red Hat 在Linux內核2.4後就引入了iptables，是以Netfilter的機制過濾MAC、IP、TCP、UDP、ICMP等packet 。可以簡單理解為iptables以是一款提供給人去使用的程式去給指令Netfilter執行操作。操作流程: iptables_small.png圖片來自於: Red Hat iptables所有packet進入PREROUTING路由判斷使用本機的資源-由INPUT進入到本機處理然後OUTPUT出去沒有使用本機資源-直接FORWARD內網的其他裝置最終經POSTROUTING出到本機外執行順序: 通常iptables rule是allow放前，deny放後。自上而下，從左至右的方式。packet進入到防火牆會一一對應每條table的rule，當第一條不匹配時會跳到第二條rule，直到找到匹配的rule去執行指定動作(後面所有的rule會被忽略)、如果沒有找到相對應的rule會根據iptables的預設Policy判斷是ACCEPT還是DROP。iptables的tables與chain: iptables有三個tabels(表) (*最少)，而每個table都有相對應的chain(鏈)去執行指定功能。如下圖示2022-03-15_150210.pngiptables的簡單應用: 指令的輸入規則iptables -t table -A/I/D/R chain -i/o Ethernet -p tcp/udp/icmp -s source_IP --sport source_port -d destination_IP --dport destination_port -j ACCEPT/DROP/REJECT/REDIRECTiptables基本參數參數作用-P--policy 設置默認策略:iptables -P INPUT 是ACCEPT-F--flush 清空所有table內的chain-L--list 查看table內的chain-A--append 在規則鏈的末尾加入新規則-I--insert 在規則鏈的頭部加入新規則-D--delete 刪除某一條規則(rule)-s--source 來源地址IP/MASK，加嘆號"!"表示除這個IP外。如192.168.1.5 或192.168.1.0/24-d--destination 目標地址，使用和-s相似-i--in-interface 從網卡流入的數據-o--out-interface 從網卡流出的數據-pprotocol協議,如tcp、udp、icmp-m使用state/mac，如: --state 可以有NEW、ESTABLISHED、RELATED、INVALID--dport目標端口號，如: --dport 80或 --dport 21:22--sport來源端口號-j--jump 匹配修件後跳至指定的動作，如ACCEPT、DROP、REJECT、REDIRECT實例:允許SSH連線iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPTSSH_2022-03-17_083441.png允許多組的端口通過，如HTTP和HTTPS服務iptables -t filter -A INPUT -i eth0 -p tcp -m multiport --dport 80,443 -j ACCEPT-i eth0 從網卡流入的數據允許連續的端口通過，如FTP服務iptables -t filter -A INPUT -i eth0 -p tcp --dport 20:22 -j ACCEPT 只允許ICMP內的PING進入iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT已經建立的連接允許通過iptables -t filter -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT已連線和本機相關的packet都被允許NAT的端口映射iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 8080 -j DNAT --to-destination 10.10.10.54:80本機的 8080 端口映射到內網其他裝置(IP-10.10.10.54)的80 端口iptables -t nat -A POSTROUTING -d 10.10.10.54 -p tcp --dport 80 -j SNAT --to-source 10.10.10.50指定packet header的來源IP為本機(即10.10.10.50)最後啟用IP轉發功能echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf即時生效sysctl -pnet.ipv4.ip_forward = 1如果多組端口要做映射，而又不想每一次指定來源IP iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADEMASQUERADE是將所有的IP 偽裝成 -o eht0 上的 IP 出去NAT_2022-03-17_092820.png訪問的是10.10.10.50:8080，實際是指向10.10.10.54:80設置默認的規則iptables -P INPUT DROP # 更改默認不允許進入，只有已設定的rules才會被允許 iptables -P FORWARD ACCEPT # 默認的允許轉發 iptables -P OUTPUT ACCEPT # 默認的可以出去查看iptables的filter設定iptables -t filter -L -n-t：指定的table 如: filter、nat、mangle-L ：列出目前的 table 的chain-n ：只顯示IP及Port號碼--line-numbers：顯示table內chain的rules次序List_2022-03-17_094645.png或者iptables-save# Generated by iptables-save v1.8.4 on Thu Mar 17 09:47:39 2022*nat:PREROUTING ACCEPT [7:1112]:INPUT ACCEPT [1:251]:OUTPUT ACCEPT [0:0]:POSTROUTING ACCEPT [0:0]-A PREROUTING -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.10.10.54:80-A POSTROUTING -o eth0 -j MASQUERADECOMMIT# Completed on Thu Mar 17 09:47:39 2022# Generated by iptables-save v1.8.4 on Thu Mar 17 09:47:39 2022*filter:INPUT DROP [1:251]:FORWARD ACCEPT [20:2390]:OUTPUT ACCEPT [97:11556]-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT-A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT-A INPUT -i eth0 -p tcp -m tcp --dport 21:22 -j ACCEPT-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j ACCEPT-A INPUT -i eth0 -p tcp -m multiport --dports 80,443 -j ACCEPTCOMMIT# Completed on Thu Mar 17 09:47:39 2022刪除指定的規則iptables -t filter -D INPUT 1刪除filter 表內的INPUT chain第一條ruleDEL_2022-03-17_111129.pngiptables -t filter -D INPUT -p tcp --dport 22 -j ACCEPT也可以是輸入規則的形式刪除清空規則iptables -t filter -F清空filter(table)內所有chain的rules設定參數功能-t指定的table 如: filter、nat、mangle-F清空所有table內的chain-X清除自定rule-Zchain 的統計流量清零儲存設定所有的iptables設定是即時生效，但下次開機時會被清空，所以需要將iptables的所有設定儲存，并在下次開機時自動加載iptables設定。CentOS和 RHEL 儲存設定/etc/init.d/iptables saveUbuntu 和 Debian儲存設定需要安裝一款iptables-persistent的軟件進行儲存安裝apt install iptables-persistent -y儲存netfilter-persistent saveUsage: /usr/sbin/netfilter-persistent (start|stop|restart|reload|flush|save)結語: 這貼文初步對iptables的學習記錄，對netfilter實現豐富功能需要更多地去探索，而且netfilter是有內核(kernel)所提供，所以在效能上非常有優勢。netfilter機制正是和好多軟/硬件防火牆的運作原理相近，對往後接觸不同的防火牆系統設定可以更好地了解。參考資料: 鳥哥的防火牆與 NAT 伺服器Linux上常用的防火牆軟件Red Hat IPTables
TFTP 在Linux的安裝與使用Configuring TFTP Server and Client On Linux.png前言:TFTP 是 FTP 的簡化版本。TFTP 沒有身份驗證功能，它在 UDP 端口 69 上運行。由於它非常輕量級，到現在厰商都會預設選用TFTP 協議，如: BOOTP、PXE 網絡引導協議，網絡裝置存儲配置文件和固件的備份與還原等等。目錄內容:TFTP 伺服器的安裝與設定TFTP 客戶端的安裝與使用 TFTP 伺服器的安裝與設定在範例中會在Linux Deepin 20.3 上安裝tftpd-hpa TFTP 服務器包。可以在官方軟件倉庫(APT Repository)輕鬆安裝。sudo apt update sudo apt install tftpd-hpa -yTFTP_Server_install.pngTFTP 伺服器文件配置sudo vim /etc/default/tftpd-hapTFTP_Server_config.png只修TFTP目錄和參數TFTP_DIRECTORY="~/ftfp" #為家目錄的tftp文件夾TFTP_OPTIONS="--ipv4 --secure --create" #允許IPV4地址及可寫入目錄創建家目錄的tftp文件夾及屬性mkdir -p ~/tftp && chown tftp:tftp ~/tftp重新啟動tftpd-hpa服務，使設定生效 sudo systemctl restart tftpd-hpaTFTP_Server_restart.png檢查tftpd-hpa服務是否正在運行： sudo systemctl status tftpd-hpaTFTP_Server_status.png可見active (running) 代表配置正確及可正常啟動。 TFTP 客戶端的安裝與使用在範例中會在Ubuntu 20.04.3上安裝tftp-hpa TFTP 客戶端。sudo apt update sudo apt install tftp-hpaTFTP_Client_install.pngTFTP 服務器的IP地址是: 192.168.192.56在TFTP 客戶端使用以下指命連入伺服器:put .bashrc get dde-introduction.mp4TFTP_Client_using.png範例:透過建立的TFTP伺服器保存交換機配置文件。備份H3C Switch 的備份設定tftp 10.10.10.23 put startup.cfgScreenshot_putty_20220105072740.pngScreenshot_deepin-terminal_20220105072745.png在TFTP伺服器可查看到已經上載的startup.cfg配置文件備份Cisco Switch 的備份設定enable copy running-config tftpScreenshot_deepin-terminal_20220105082211.png輸入TFTP伺服器IP地址: 10.10.10.23 -> EnterScreenshot_deepin-terminal_20220105082216.png在TFTP伺服器可查看到已經上載的core-switch-config配置文件結語:這是最基本的設定與使用，希望往後還有時間學習及折騰一下PXE的網絡啟動。參考資料:Installing and Configuring TFTP Server on Ubuntu