|
[ Pobierz całość w formacie PDF ]
.You can view these associations at any time by looking at the/proc/net/ip_masquerade file.These associations will timeout after a period of inactivity, though.You can set the timeout values using the ipfwadm command.The general syntax for this is:ipfwadm -M -sand for the ipchains command it is:ipchains -M -SThe iptables implementation uses much longer default timers and does not allow you to set them.Each of these values represents a timer used by the IP masquerade software and are in units of seconds.Thefollowing table summarizes the timers and their meanings:Name DescriptiontcpTCP session timeout.How long a TCP connection may remain idle before the association for itis removed.tcpfinTCP timeout after FIN.How long an association will remain after a TCP connection has beendisconnected.udpUDP session timeout.How long a UDP connection may remain idle before the association for itis removed.Handling Name Server LookupsHandling domain name server lookups from the hosts on the LAN with IP masquerading has always presented aproblem.There are two ways of accomodating DNS in a masquerade environment.You can tell each of the hoststhat they use the same DNS that the Linux router machine does, and let IP masquerade do its magic on theirDNS requests.Alternatively, you can run a caching name server on the Linux machine and have each of thehosts on the LAN use the Linux machine as their DNS.Although a more aggressive action, this is probably thebetter option because it reduces the volume of DNS traffic travelling on the Internet link and will be marginallyfaster for most requests, since they'll be served from the cache.The downside to this configuration is that it ismore complex."Caching-only named Configuration" in Chapter 6 describes how to configure a caching nameserver.More About Network Address TranslationThe netfilter software is capable of many different types of Network Address Translation.IP Masquerade is onesimple application of it.It is possible, for example, to build NAT rules that translate only certain addresses or ranges of addresses andleave all others untouched, or to translate addresses into pools of addresses rather than just a single address, asmasquerade does.You can in fact use the iptables command to generate NAT rules that map just about any-thing, with combinations of matches using any of the standard attributes, such as source address, destinationaddress, protocol type, port number, etc.Translating the Source Address of a datagram is referred to as "Source NAT," or SNAT, in the netfilter documen-tation.Translating the Destination Address of a datagram is known as "Destination NAT," or DNAT.Translating 170the TCP or UDP port is known by the term REDIRECT.SNAT, DNAT, and REDIRECT are targets that you mayuse with the iptables command to build more complex and sophisticated rules.The topic of Network Address Translation and its uses warrants at least a whole chapter of its own.68 Unfortu-nately we don't have the space in this book to cover it in any greater depth.You should read the IPTABLES-HOWTO for more information, if you're interested in discovering more about how you might use Network Ad-dress Translation.68.and perhaps even a whole book! 171Chapter 12 - Important Network FeaturesAfter successfully setting up IP and the resolver, you then must look at the services you want to provide over thenetwork.This chapter covers the configuration of a few simple network applications, including the inetdserver and the programs from the rlogin family.We'll also deal briefly with the Remote Procedure Call inter-face, upon which services like the Network File System (NFS) and the Network Information System (NIS) arebased.The configuration of NFS and NIS, however, is more complex and are described in separate chapters, asare electronic mail and network news.Of course, we can't cover all network applications in this book.If you want to install one that's not discussedhere, like talk, gopher, or http, please refer to the manual pages of the server for details.The inetd Super ServerPrograms that provide application services via the network are called network daemons.A daemon is a programthat opens a port, most commonly a well-known service port, and waits for incoming connections on it [ Pobierz całość w formacie PDF ] |
Archiwum
|