论坛徽章:: 0

电梯直达

1楼 [收藏(0)] [报告]

发表于 2006-04-24 09:58 |只看该作者 |倒序浏览

网络拓扑图
                  [ ppp (tun0) ]
[ Internal network ]----- lnc1 [ Firewall ] lnc0 ----------------[ Internet ]

方式一：
注意以下三个文件的内容，/etc/ppp/ppp.conf /etc/rc.conf /etc/pf.conf

firewall# more /etc/ppp/ppp.conf (全部)
default:
  set log Phase tun command # you can add more detailed logging if you wish
  set ifaddr 10.0.0.1/0 10.0.0.2/0 # do not change this line.

chinatelecom: # defined by yourself, it is "ppp_profile"
  set device PPPoE:lnc0 # replace lnc0 with your Ethernet device
  set authname xxxxxxx # username provided by ISP
  set authkey xxxxxxx # password provided by ISP, you can reset it.
  set dial # do not change this line.
  set login # do not change this line.
  add default HISADDR # do not change this line.

firewall# more /etc/rc.conf (PPP&PF部分)
ppp_nat="YES"
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="chinatelecom"
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""

firewall# more /etc/pf.conf
int_if=lnc1 # define internal network interface
ppp_if=tun0 # define ppp interface
nat on $ppp_if from $int_if:network to any -> ($ppp_if)

Note:
进出rules自己按照目的添加，如果不懂就按我下面的加几行在这个文件里。
block all
pass in on $int_if inet from $int_if:network to any keep state
pass out on $ppp_if inet from $ppp_if to any keep state

方式二：
目的是系统启动以后再拨号
/etc/ppp/ppp.conf 和 /etc/pf.conf 内容继续保持方式一中的。

firewall# more /etc/rc.conf (PF部分)
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""

系统启动以后，打以下两条命令，记住是两条，
1.拨号
firewall# ppp -ddial chinatelecom
2.加载pf防火墙，虽然你也许在启动的时候加载过了，但是那时ppp拨号还没有建立，所以防火墙的设置

虽然正确但是没办法正确加载。
firewall # pfctl -f /etc/pf.conf

Troubleshooting：

ifconfig 确定拨号是否建立
netstat -r 确定路由是否正确
pfctl -sn 确定防火墙中的NAT是否启动
pfctl -sr 确定PF防火墙rules启动正确