2008年1月4日 (五) 14:46的版本

本条目正在从其他语言的文档内容翻译成中文。 欢迎您积极参与翻译与修订。

文章出处:

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch03_:_Linux_Networking

翻译人员:

Apshai

点击翻译:

English  • 中文

介绍

现在你已经牢牢掌握了许多最常用的网络概念，是时候应用它们来配置你的服务器了。其中一些设置在Linux安装过程中已经自动配置过了，但是你经常会发现你必须知道怎样修改这些初始设定。无论是你需要移动你的服务器到另一个网络中，还是添加一块新的网卡或者使用另一种方式连接到Internet。

在第二章中， "Introduction to NetworkingCh02 : Introduction to Networking/zh"，我们首先解释了什么是TCP/IP，所以我们也将从讨论怎样配置服务器的IP开始Linux的网络这一章。

怎样配置网卡的IP地址

你需要知道的一切必要步骤来配置网卡的IP地址。网站的购物车应用可能需要额外的固定IP地址。你也可能需要增加第二块网卡，用于处理服务器的数据备份。最後，但并不少见，你可能只想在服务器上玩玩以测试你的技巧。

本节将展示怎样处理最常见的服务器IP操作。

确定你的IP地址

大多数现代电脑都有一个以太网端口。在Linux安装中，这个设备被称为eth0。你可以通过ifconfig命令确定这个设备的IP地址。

[root@bigboy tmp]# ifconfig -a

eth0 Link encap:Ethernet HWaddr 00:08:C7:10:74:A8
BROADCAST MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
Interrupt:11 Base address:0x1820

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:787 errors:0 dropped:0 overruns:0 frame:0
TX packets:787 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:82644 (80.7 Kb) TX bytes:82644 (80.7 Kb)

wlan0 Link encap:Ethernet HWaddr 00:06:25:09:6A:B5
inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:47379 errors:0 dropped:0 overruns:0 frame:0
TX packets:107900 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:4676853 (4.4 Mb) TX bytes:43209032 (41.2 Mb)
Interrupt:11 Memory:c887a000-c887b000

wlan0:0 Link encap:Ethernet HWaddr 00:06:25:09:6A:B5
inet addr:192.168.1.99 Bcast:192.168.1.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
Interrupt:11 Memory:c887a000-c887b000

[root@bigboy tmp]#

在这个例子中，eth0是没有IP地址的，因为这台机器用无线网卡wlan0作为主网卡。接口wlan0有一个IP地址192.168.1.100和子网掩码255.255.255.0。

你可以看到，这个命令提供了每块网卡的中断或者PCI总线ID等有用信息。在某些罕见情况中，你可能发现你的网卡不工作是因为它与其他一些设备共享了中断和内存访问地址。你可以通过查看/proc/interrupts文件来获得系统使用的全部中断请求（IRQs）。在下面的例子中， 我们可以看到从IRQ 0 到 15没有中断冲突，每个中断只有一条记录。设备eth0和eth1分别使用了中断10和5：

[root@bigboy tmp]# cat /proc/interrupts
 CPU0
 0: 2707402473 XT-PIC timer
 1: 67 XT-PIC i8042
 2: 0 XT-PIC cascade
 5: 411342 XT-PIC eth1
 8: 1 XT-PIC rtc
 10: 1898752 XT-PIC eth0
 11: 0 XT-PIC uhci_hcd
 12: 58 XT-PIC i8042
 14: 5075806 XT-PIC ide0
 15: 506 XT-PIC ide1
NMI: 0
ERR: 43
[root@bigboy tmp]#

如果有冲突，您可能需要参考引发问题设备的手册，以确定是否可以用另一个中断或内存I/O地址。

改变你的IP地址

如果需要，你可以使用ifconfig命令为eth0指定一个IP地址。

[root@bigboy tmp]# ifconfig eth0 10.0.0.1 netmask 255.255.255.0 up

命令行结尾的"up"会激活这个设备。要让这个设定在你每次启动时都生效，你需要把这个命令加到/etc/rc.local文件中。它会在每次启动时执行。

Fedora Linux通过在/etc/sysconfig/network-scripts目录下的配置文件，使这个设定变得简单。设备eth0对应文件ifcfg-eth0，eth1对应ifcfg-eth1，等等。你可以把IP地址信息放到这些文件中，它们会在Linux启动时自动配置你的网卡。见Figure 3-1两个eth0设备的例子。一个假设该网卡有一个固定IP地址，另一个假设它需要通过DHCP获得IP地址。

图 3-1 - network-scripts的文件格式

[root@bigboy tmp]# cd /etc/sysconfig/network-scripts
[root@bigboy network-scripts]# cat ifcfg-eth0

# 
# File: ifcfg-eth0
# 
DEVICE=eth0
IPADDR=192.168.1.100
NETMASK=255.255.255.0
BOOTPROTO=static ONBOOT=yes
# 
# The following settings are optional
# 
BROADCAST=192.168.1.255
NETWORK=192.168.1.0

[root@bigboy network-scripts]#

[root@bigboy tmp]# cd /etc/sysconfig/network-scripts
[root@bigboy network-scripts]# cat ifcfg-eth0

# 
# File: ifcfg-eth0
# 
DEVICE=eth0
BOOTPROTO=dhcp
ONBOOT=yes

[root@bigboy network-scripts]#

你可以看到eth0将在启动时被激活，因为参数ONBOOT的值是yes不是no。你可以在第2章中"Introduction to Networking"阅读更多关于netmask和DHCP内容。

缺省的RedHat/Fedora安装会在network-scripts文件包含广播和网络设定。这些都是可选的。

在改变网卡的配置文件后，你需要停止然后激活它以使修改生效。ifdown和ifup命令可用于实现这个目的：

[root@bigboy network-scripts]# ifdown eth0
[root@bigboy network-scripts]# ifup eth0

你的服务器必须有一个默认网关，使它能够与Internet通信。这将在本章的稍后涉及。

DHCP如何影响你使用的DNS服务器

DHCP服务器不仅为你的Linux机器提供IP地址，也包括所需的DNS服务器。当为一个网络设备设置DHCP时，确保在/etc/resolv.conf文件注释掉相关的服务器配置，以防止任何冲突。

为一个网卡设定多个IP地址

在上一节“确定你的IP地址中”大家可能注意到有两个无线网络设备：wlan0和wlan0:0。设备wlan0：0实际上是wlan0的子设备，一个虚拟的子设备也被称为IP别名。IP别名是为一个网卡创建多个IP地址的最常见方法。别名的命名方式是父设备名称:X，X是你选择的子设备号。

创建一个IP别名的过程与上一节“改变你的IP地址”中描述的非常相似：

• 首先，确保真实的父网络设备存在。
• 确认你计划使用的名字没有同名的其他IP别名存在。这里我们要创建一个网络设备wlan0:0。
• 用ifconfig命令创建虚拟网络设备

[root@bigboy tmp]# ifconfig wlan0:0 192.168.1.99 netmask 255.255.255.0 up

• 你也应该一个文件/etc/sysconfig/network-scripts/ifcfg-wlan0:0，这样这个别名就可以被ifup和ifdown命令自动管理。这个是一个配置样例:

DEVICE=wlan0:0
ONBOOT=yes
BOOTPROTO=static
IPADDR=192.168.1.99
NETMASK=255.255.255.0

下面命令用于激活和停止这个别名设备:

[root@bigboy tmp]# ifup wlan0:0
[root@bigboy tmp]# ifdown wlan0:0

注意: 关闭主网络设备也同时关闭其所有别名。而别名可以独立于其他网络设备关闭。

完成这4个简单的步骤後，你应该能从网络的其他服务器上ping通这个新的IP别名。

为DSL连接设定IP地址

如果你使用是有固定或静态IP地址的DSL连接，那么配置步骤和之前描述的是一样的。你把以太网接口连接到DSL modem上，配置ISP提供的

IP地址，子网掩码，广播地址，和网关信息。重启网络设备後你就应该连上网了。记住，你可能还需要正确地配置DNS服务器。

如果你使用的是有DHCP或或动态IP地址的DSL连接，那么过程就不一样了。你的ISP会为您提供一个PPPoE（PPP authentication over

Ethernet）的用户名和密码，这将使您的电脑在每次启动时透明地登录到互联网上。Fedora的Linux需要安装rp-PPPoE的RPM软件包来支持这

个功能。

注意：除非你特别申请静态IP地址，你的ISP会向你提供一个基于DHCP的连接。而DHCP分配给你的机器或者互联网路由的IP地址可能很多天

都不会改变，你可能会误为是静态的。

下载和安装RPM包并不难。如果你需要复习，第6章"Installing Linux Software"

中涵盖了关于RPM操作的详细内容。 当寻找该文件时，记得PPPoE的RPM文件名通常是以rp-pppoe开头，后面是版本号，例如：rp-pppoe-

3.5-8.i386.rpm。

在安装RPM后，你需要经过若干步骤来完成连接。PPPoE配置将创建立一个名为ppp0的虚拟接口，它将通过物理网络接口eth0的来连接。下面

是你需要做的：

• 备份你的ifcfg-eth0文件。

[root@bigboy tmp]#
[root@bigboy tmp]# cd /etc/sysconfig/network-scripts/
[root@bigboy network-scripts]# ls ifcfg-eth0 ifcfg-eth0
[root@bigboy network-scripts]# cp ifcfg-eth0 DISABLED.ifcfg-eth0

• 编辑你的ifcfg-eth0文件，删除IP信息，并且设定在启动时激活。

DEVICE=eth0
ONBOOT=no

• 关闭你的eth0设备。

[root@bigboy network-scripts]# ifdown eth0
[root@bigboy network-scripts]#

• 运行adsl-setup配置脚本

[root@bigboy network-scripts]# adsl-setup

它会提示你输入你的ISP用户名，要使用的网络设备（eth0）和是否你需要连接长期保持。如果可能我们都使用缺省设置。

Welcome to the ADSL client setup.� First, I will run some checks on

your system to make sure the PPPoE client is installed properly...

LOGIN NAME

Enter your Login Name (default root): bigboy-login@isp

INTERFACE

Enter the Ethernet interface connected to the ADSL modem
For Solaris, this is likely to be something like /dev/hme0.
For Linux, it will be ethX, where 'X' is a number.
(default eth0):

Do you want the link to come up on demand, or stay up continuously?
If you want it to come up on demand, enter the idle time in seconds
after which the link should be dropped.� If you want the link to
stay up permanently, enter 'no' (two letters, lower-case.)
NOTE: Demand-activated links do not interact well with dynamic IP
addresses. You might have some problems with demand-activated links.

Enter the demand value (default no):

接着会提示你输入你的DNS服务器信息。这步会编辑你的/etc/resolv.conf文件。如果你在服务器上以缓存DNS模式运行BIND，就不用输入

直接回车。如果你希望你的ISP的DNS服务器自动提供IP地址，就输入单词server。

Please refer to Chapter 18, "Configuring DNS", for more information on BIND and

DNS.

DNS

Please enter the IP address of your ISP's primary DNS server.
If your ISP claims that 'the server will provide dynamic DNS addresses', enter 'server' (all lower-case) here.
If you just press enter, I will assume you know what you are doing and not modify your DNS setup.    
Enter the DNS information here:

脚本会提示你输入你的ISP密码

PASSWORD

Please enter your Password:
Please re-enter your Password:

然后它会询问是否后允许常规用户（不是超级用户root）激活/停止这个新的ppp0设备。这可能是需要的，如果你家里有非root的成员需要

访问Internet的话：

USERCTRL

Please enter 'yes' (two letters, lower-case.) if you want to allow normal user to start or stop DSL connection (default 

yes):

rp-pppoe包在/etc/ppp目录下有两个样例ip表防火墙脚本，文件名是firewall-standalone和firewall-masq。它们都非常基本并不涵盖将

你的Linux机器设置成web服务器，DNS服务器或者mail服务器的规则。我都推荐选择NONE，然后使用第14章"[[Quick HOWTO : Ch14 : Linux

Firewalls Using iptables|Linux Firewalls Using iptables]]"中的一个基本脚本样例，或者附录II中的更复杂脚本

FIREWALLING

Please choose the firewall rules to use. Note that these rules are very basic. You are strongly encouraged to use a more 

sophisticated firewall setup; however, these will provide basic security. If you are running any servers on your machine,

you must choose 'NONE' and set up firewalling yourself. Otherwise, the firewall rules will deny access to all standard

servers like Web, e-mail, ftp, etc. If you are using SSH, the rules will block outgoing SSH connections which allocate a

privileged source port.

The firewall choices are:

0 - NONE: This script will not set any firewall rules. You are responsible
	for ensuring the security of your machine. You are STRONGLY
	recommended to use some kind of firewall rules.
1 - STANDALONE: Appropriate for a basic stand-alone web-surfing workstation
2 - MASQUERADE: Appropriate for a machine acting as an Internet gateway
		for a LAN

Choose a type of firewall (0-2): 0

接着你会被询问是否在启动时激活连接。大部分人都会选择yes.

Start this connection at boot time

Do you want to start this connection at boot time?
Please enter no or yes (default no):yes

在退出前，你会获得一个摘要，包括你输入参数，那些配置文件将根据你的选择更新：

** Summary of what you entered **


Ethernet Interface: eth0

User name: 		bigboy-login@isp
Activate-on-demand: 	No
DNS: 			Do not adjust
Firewalling: 		NONE 
User Control: 		yes
Accept these settings and adjust configuration files (y/n)? y

Adjusting /etc/sysconfig/network-scripts/ifcfg-ppp0
Adjusting /etc/ppp/chap-secrets and /etc/ppp/pap-secrets
(But first backing it up to /etc/ppp/chap-secrets.bak)
(But first backing it up to /etc/ppp/pap-secrets.bak)

在最后，它会告诉你激活/关闭这个新的ppp0设备，以及获得设备状态的命令。

Congratulations, it should be all set up!

Type '/sbin/ifup ppp0' to bring up your xDSL link and '/sbin/ifdown ppp0'to bring it down.
Type '/sbin/adsl-status /etc/sysconfig/network-scripts/ifcfg-ppp0' to see the link status.

注意: 这个例子中推荐使用adsl-status命令后面跟上PPPoE接口配置文件名字。不过这个命令会缺省显示ppp0设备的信息，因此在

大部分系统中没有必要加上ifcfg-ppp0文件名。

在你完成安装配置rp-pppoe后，你应该可以通过DSL的DHCP连接到Internet上。

adsl-setup创建的一些重要文件

有三个adsl-setup脚本创建的文件你可能会感兴趣。第一个是ifcfg-pppo文件，包含了设备链路层的连接参数。

[root@bigboy network-scripts]# more ifcfg-ppp0
USERCTL=yes
BOOTPROTO=dialup
NAME=DSLppp0
DEVICE=ppp0
TYPE=xDSL
ONBOOT=yes
PIDFILE=/var/run/pppoe-adsl.pid
FIREWALL=NONE
PING=.
PPPOE_TIMEOUT=20
LCP_FAILURE=3
LCP_INTERVAL=80
CLAMPMSS=1412
CONNECT_POLL=6
CONNECT_TIMEOUT=60
DEFROUTE=yes
SYNCHRONOUS=no
ETH=eth0
PROVIDER=DSLppp0
USER= bigboy-login@isp
PEERDNS=no
[root@bigboy network-scripts]#

另外两个内容相同的文件时/etc/ppp/pap-secrets和/etc/ppp/chap-secrets，包含了登录ISP的用户名和密码：

[root@bigboy network-scripts]# more /etc/ppp/pap-secrets
# Secrets for authentication using PAP
# client server secret IP addresses
"bigboy-login@isp" * "password" [root@bigboy network-scripts]#

简单的故障诊断

你可以运行adsl-status命令来检查你的连接状态。在这个例子中，可以看到包已经装好但是设备没有被激活。

[root@bigboy tmp]# adsl-status
Note: You have enabled demand-connection; adsl-status may be inaccurate.
adsl-status: Link is attached to ppp0, but ppp0 is down
[root@bigboy tmp]#

激活后，设备即正常工作。

[root@bigboy tmp]# ifup ppp0
[root@bigboy tmp]# adsl-status
adsl-status: Link is up and running on interface ppp0
ppp0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1462 inet
...
...
[root@bigboy tmp]#

关于更多的故障诊断信息，你可以访问rp-pppoe的网站Roaring Penguin (www.roaringpenguin.com)。那里有一些如果避免VPN客户端问题

的很好的提示。

为Cable Modem设置IP地址

Cable modems使用DHCP来获得IP地址，你可以据此配置你服务器的以太网卡。

怎样激活/关闭你的网卡

命令ifup和ifdown分别用于激活和停止一块网络设备。你必须有一个相关的ifcfg文件在/etc/sysconfig/network-scripts目录下来确保这些命令工作。下面是一个eth0设备的例子：

[root@bigboy tmp]# ifdown eth0
[root@bigboy tmp]# ifup eth0

怎样查看你当前的路由表

netstat -nr命令会显示路由表的内容。网关为0.0.0.0的网络通常是直连到网络设备上的。因为到自己的直连设备上是不需要网关的，所以0.0.0.0的网关地址是正常的。目的地址是0.0.0.0的路由是你的缺省网关。

• 在这个例子里,有两个网关，缺省的并且是到255.255.255.255通常是DHCP服务器添加的。在这个例子里bigbogy服务器也是一个DHCP服务器。

[root@bigboy tmp]# netstat -nr

Kernel IP routing table
Destination	 Gateway	Genmask		Flags MSS Window irtt Iface
255.255.255.255 0.0.0.0	255.255.255.255 UH    40  0      0    wlan0
192.168.1.0	 0.0.0.0	255.255.255.0 	U     40  0 	 0    wlan0
127.0.0.0 	 0.0.0.0 	255.0.0.0 	U     40  0 	 0    lo
0.0.0.0 	 192.168.1.1 	0.0.0.0 	UG    40  0 	 0    wlan0
[root@bigboy tmp]#

• 在这个例子里，有多个网关负责把数据从不同网络设备上传输到不同的目的地。

[root@bigboy tmp]# netstat -nr

Kernel IP routing table 
Destination	Gateway		Genmask		Flags MSS Window irtt Iface
172.16.68.64 	172.16.69.193 	255.255.255.224 UG    40  0 	 0    eth1
172.16.11.96 	172.16.69.193 	255.255.255.224 UG    40  0	 0    eth1
172.16.68.32 	172.16.69.193 	255.255.255.224 UG    40  0	 0    eth1
172.16.67.0 	172.16.67.135 	255.255.255.224 UG    40  0	 0    eth0
172.16.69.192 	0.0.0.0 	255.255.255.192 U     40  0	 0    eth1
172.16.67.128 	0.0.0.0 	255.255.255.128 U     40  0	 0    eth0
172.160.0 	172.16.67.135 	255.255.0.0 	UG    40  0	 0    eth0
172.16.0.0 	172.16.67.131 	255.240.0.0 	UG    40  0	 0    eth0
127.0.0.0 	0.0.0.0 	255.0.0.0 	U     40  0	 0    lo
0.0.0.0	172.16.69.193 	0.0.0.0 	UG    40  0	 0    eth1
[root@bigboy tmp]#

How to Change Your Default Gateway

Your server needs to have a single default gateway. DHCP servers will automatically assign a default gateway to DHCP configured NICs, but NICs with configured static IP addresses will need to have a manually configured default gateway. This can be done with a simple command. This example uses a newly installed wireless interface called wlan0, most PCs would be using the standard Ethernet interface eth0.

[root@bigboy tmp]# route add default gw 192.168.1.1 wlan0

In this case, make sure that the router/firewall with IP address 192.168.1.1 is connected to the same network as interface wlan0!

Once done, you'll need to update your /etc/sysconfig/network file to reflect the change. This file is used to configure your default gateway each time Linux boots.

NETWORKING=yes

HOSTNAME=bigboy GATEWAY=192.168.1.1

Note: In Debian based systems the default gateway is permanently defined in the /etc/network/interfaces file. See the section "Debian / Ubuntu Network Configuration" later in this chapter for more details.

Some people don't bother modifying network specific files and just place the route add command in the script file /etc/rc.d/rc.local which is run at the end of each reboot.

It is possible to define default gateways in the NIC configuration file in the /etc/sysconfig/network-scripts directory, but you run the risk of inadvertently assigning more than one default gateway when you have more than one NIC. This could cause connectivity problems. If one of the default gateways has no route to the intended destination, every other packet will become lost. Firewalls that are designed to block packets with irregular sequence numbers and unexpected origins could also obstruct your data flow.

How to Configure Two Gateways

Some networks may have multiple router/firewalls providing connectivity. Here's a typical scenario:

• You have one router providing access to the Internet that you'd like to have as your default gateway (see the default gateway example earlier)

• You also have another router providing access to your corporate network using addresses in the range 10.0.0.0 to 10.255.255.255. Let's assume that this router has an IP address of 192.168.1.254

The Linux box used in this example uses interface wlan0 for its Internet connectivity. You might be most likely using interface eth0, please adjust your steps accordingly.

There are a number of ways to add this new route.

Adding Temporary Static Routes

The route add command can be used to add new routes to your server that will last till the next reboot. It has the advantage of being univeral to all versions of Linux and is well documented in the man pages. In our example the reference to the 10.0.0.0 network has to be preceded with a -net switch and the subnet mask and gateway values also have to be preceded by the netmask and gw switches respectively.

[root@bigboy tmp]# route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.1.254 wlan0

If you wanted to add a route to an individual server, then the "-host" switch would be used with no netmask value. (The route command automatically knows the mask should be 255.255.255.255). Here is an example for a route to host 10.0.0.1.

[root@bigboy tmp]# route add -host 10.0.0.1 gw 192.168.1.254 wlan0

A universal way of making this change persistent after a reboot would be to place this route add command in the file /etc/rc.d/rc.local, which is always run at the end of the booting process.

Adding Permanent Static Routes

In Fedora Linux, permanent static routes are added on a per interface basis in files located in the /etc/sysconfig/network-scripts directory. The filename format is route-interface-name so the filename for interface wlan0 would be route-wlan0.

The format of the file is quite intuitive with the target network coming in the first column followed by the word via and then the gateway's IP address. In our routing example, to set up a route to network 10.0.0.0 with a subnet mask of 255.0.0.0 (a mask with the first 8 bits set to 1) via the 192.168.1.254 gateway, we would have to configure file /etc/sysconfig/network-scripts/route-wlan0 to look like this:

#

1. File /etc/sysconfig/network-scripts/route-wlan0

10.0.0.0/8 via 192.168.1.254

Note: The /etc/sysconfig/network-scripts/route-* filename is very important. Adding the wrong interface extension at the end will result in the routes not being added after the next reboot. There will also be no reported errors on the screen or any of the log files in the /var/log/ directory.

You can test the new file by running the /etc/sysconfig/network-scripts/ifup-routes command with the interface name as the sole argument. In the next example we check the routing table to see no routes to the 10.0.0.0 network and execute the ifup-routes command, which then adds the route:

[root@bigboy tmp]# netstat -nr

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wlan0 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0 [root@bigboy tmp]# ./ifup-routes wlan0 [root@bigboy tmp]# netstat -nr Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 wlan0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wlan0 10.0.0.0 192.168.1.254 255.0.0.0 UG 0 0 0 wlan0 0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 wlan0 [root@bigboy tmp]#

Note: In Debian based systems, permanent static routes are configured using the /etc/network/interfaces file. See the section "Debian / Ubuntu Network Configuration" later in this chapter for more details.

How to Delete a Route

Here's how to delete the routes added in the previous section.

[root@bigboy tmp]# route del -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.1.254 wlan0

The file /etc/sysconfig/network-scripts/route-wlan0 will also have to be updated so that when you reboot the server will not reinsert the route. Delete the line that reads:

10.0.0.0/8 via 192.168.1.254

Changing NIC Speed and Duplex

There is no better Linux investment than the purchase of a fully Linux compatible NIC card. Most Linux vendors will have a list of compatible hardware on their Web sites: read this carefully before you start hooking up you machine to the network. If you can't find any of the desired models in your local computer store, then a model in the same family or series should be sufficient. Most cards will work, but only the fully compatible ones will provide you with error-free, consistent throughput.

Linux defaults to automatically negotiating the speed and duplex of it's NIC automatically with that of the switch to which it is attached. Configuring a switch port to auto-negotiate the speed and duplex often isn't sufficient because there are frequently differences in the implementation of the protocol standard.

Typically, NICs with failed negotiation will work, but this is usually accompanied by many collision type errors being seen on the NIC when using the ifconfig -a command and only marginal performance. Don't limit your troubleshooting of these types of errors to just failed negotiation; the problem could also be due to a bad NIC card, switch port, or cabling.

Using mii-tool

One of the original Linux tools for setting the speed and duplex of your NIC card was the mii-tool command. It is destined to be deprecated and replaced by the newer ethtool command, but many older NICs support only mii-tool so you'll need to be aware of it. Issuing the command without any arguments gives a brief status report, as seen in the next example, with unsupported NICs providing an Operation not supported message. NICs that are not compatible with mii-tool often will still work, but you have to refer to the manufacturer's guides to set the speed and duplex to anything but auto-negotiate.

[root@bigboy tmp]# mii-tool

SIOCGMIIPHY on 'eth0' failed: Operation not supported eth1: 100 Mbit, half duplex, link ok [root@bigboy tmp]#

By using the verbose mode -v switch you can get much more information. In this case, negotiation was OK, with the NIC selecting 100Mbps, full duplex mode (FD):

[root@bigboy tmp]# mii-tool -v

eth1: negotiated 100baseTx-FD, link ok

product info: vendor 00:10:18, model 33 rev 2
basic mode: autonegotiation enabled
basic status: autonegotiation complete, link ok
capabilities: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD
advertising: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD
link partner: 100baseTx-FD 100baseTx-HD 10baseT-FD 10baseT-HD flow-control

[root@bigboy tmp]#

Setting Your NIC's Speed Parameters with mii-tool

You can set your NIC to force itself to a particular speed and duplex by using the -F switch with any of the following options: 100baseTx-FD, 100baseTx-HD, 10baseT-FD, or 10baseT-HD. Remember that you could lose all network connectivity to your server if you force your NIC to a particular speed/duplex that doesn't match that of your switch:

[root@bigboy tmp]# mii-tool -F 100baseTx-FD eth0

Unfortunately there is no way to set this on reboot permanently except by placing it the command in the /etc/rc.local file to let it be run at the very end of the booting process or by creating your own startup script if you need it set earlier. Creating your own startup scripts is covered in Chapter 7, "The Linux Boot Process".

Using ethtool

The ethtool command is slated to be the replacement for mii-tool in the near future and tends to be supported by newer NIC cards.

The command provides the status of the interface you provide as its argument. Here we see interface eth0 not doing autonegotiation and set to a speed of 100 Mbps, full duplex. A list of supported modes is also provided at the top of the output.

[root@bigboy tmp]# ethtool eth0

Settings for eth0:

Supported ports: [ TP MII ]
Supported link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
Supports auto-negotiation: Yes
Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
Advertised auto-negotiation: No
Speed: 100Mb/s
Duplex: Full
Port: MII
PHYAD: 1
Transceiver: internal
Auto-negotiation: off
Supports Wake-on: g
Wake-on: g
Current message level: 0x00000007 (7)
Link detected: yes

[root@bigboy tmp]#

Setting Your NIC's Speed Parameters with ethtool

Unlike mii-tool, ethtool settings can be permanently set as part of the interface's configuration script with the ETHTOOL_OPTS variable. In our next example, the settings will be set to 100 Mbps, full duplex with no chance for auto-negotiation on the next reboot:

#

1. File: /etc/sysconfig/network-scripts/ifcfg-eth0

DEVICE=eth0 IPADDR=192.168.1.100 NETMASK=255.255.255.0 BOOTPROTO=static ONBOOT=yes ETHTOOL_OPTS="speed 100 duplex full autoneg off"

You can test the application of these parameters by shutting down the interface and activating it again with the ifup and ifdown commands. These settings can also be changed from the command line using the -s switch followed by the interface name and its desired configuration parameters.

[root@bigboy tmp]# ethtool -s eth1 speed 100 duplex full autoneg off

[root@bigboy tmp]#

The Linux man pages give more details on other ethtool options, but you can get a quick guide by just entering the ethtool command alone, which provides a quicker summary.

[root@bigboy tmp]# ethtool

... ...

ethtool -s DEVNAME \
[ speed 10|100|1000 ] \
[ duplex half|full ] \
[ port tp|aui|bnc|mii|fibre ] \

... ... [root@bigboy tmp]#

A Note About Duplex Settings

By default, Linux NICs negotiate their speed and duplex settings with the switch. This is done by exchanging electronic signals called Fast Link Pulses (FLP). When the speed and duplex are forced to a particular setting the FLPs are not sent. When a NIC is in auto-negotiation mode and detects a healthy, viable link but receives no FLPs, it errs on the side of caution and sets its duplex to half-duplex and sometimes it will also set its speed to the lowest configurable value. It is therefore possible to force a switch port to 100 Mbps full duplex, but have the auto-negotiating server NIC set itself to 100Mbps half-duplex which will result in errors. The same is true for the switch if the switch port is set to auto-negotiate and server NIC is set to 100 Mbps full duplex. It is best to either force both the switch port and server NIC to either auto-negotiate or the same forced speed and duplex values.

How to Convert Your Linux Server into a Simple Router

Router/firewall appliances that provide basic Internet connectivity for a small office or home network are becoming more affordable every day, but when budgets are tight you might seriously want to consider modifying an existing Linux server to do the job.

Details on how to configure Linux firewall security are covered in Chapter 14, "Linux Firewalls Using iptables", but you need to understand how to activate routing through the firewall before it can become a functioning networking device.

Configuring IP Forwarding

For your Linux server to become a router, you have to enable packet forwarding. In simple terms packet forwarding enables packets to flow through the Linux box from one network to another. The Linux kernel configuration parameter to activate this is named net.ipv4.ip_forward and can be found in the file /etc/sysctl.conf. Remove the "#" from the line related to packet forwarding.

Before:

1. Disables packet forwarding

net.ipv4.ip_forward=0

After:

1. Enables packet forwarding

net.ipv4.ip_forward=1

This enables packet forwarding only when you reboot at which time Linux will create a file in one of the subdirectories of the special RAM memory-based /proc filesystem. To activate the feature immediately you have to force Linux to read the /etc/sysctl.conf file with the sysctl command using the -p switch. Here is how it's done:

[root@bigboy tmp] sysctl -p

sysctl -p net.ipv4.ip_forward = 1 net.ipv4.conf.default.rp_filter = 1 kernel.sysrq = 0 kernel.core_uses_pid = 1 [root@bigboy tmp]#

Please refer to Appendix I for more information on adjusting kernel parameters.

Configuring Proxy ARP

If a server needs to send a packet to another device on the same network, it sends out an ARP request to the network asking for the MAC address of the other device.

If the same server needs to send a packet to another device on a remote network the process is different. The server first takes a look at its routing table to find out the IP address of the best router on its network that will be able to relay the packet to the destination. The server then sends an ARP request for the MAC address that matches the router's IP address. It then sends the packet to the router using the router's MAC address and a destination IP address of the remote server.

If there is no suitable router on its network, the server will then send out an ARP request for the MAC address of the remote server. Some routers can be configured to answer these types of ARP requests for remote networks. This feature is called proxy ARP. There are some disadvantages with this. One of the most common problems occurs if two routers are on the network configured for proxy ARP. In this scenario there is the possibility that either one will answer the local server's ARP request for the MAC address of the remote server. If one of the routers has an incorrect routing table entry for the remote network, then there is the risk that traffic to the remote server will occasionally get lost. In other words you can lose routing control.

Note: It is for this and other reasons that it is generally not a good idea to configure proxy ARP on a router. It is also good to always configure a default gateway on your server and use separate routing entries via other routers for all networks your default gateway may not know about.

Some types of bridging mode firewalls need to have proxy ARP enabled to operate properly. These devices are typically inserted as part of a daisy chain connecting multiple network switches together on the same LAN while protecting one section of a LAN from traffic originating on another section. The firewall typically isn't configured with an IP address on the LAN and appears to be an intelligent cable capable of selectively blocking packets.

If you need to enable proxy ARP on a Linux server the /proc filesystem comes into play again. Proxy ARP is handled by files in the /proc/sys/net/ipv4/conf/ directory. This directory then has subdirectories corresponding to each functioning NIC card on your server. Each subdirectory then has a file called proxy_arp. If the value within this file is 0, then proxy ARP on the interface is disabled; if the value is 1 then it is enabled.

You can use the /etc/sysctl.conf file mentioned in Appendix II to activate or disable proxy ARP. The next example activates proxy ARP, first for all interfaces and then for interfaces eth0 and wlan0.

#

1. File: /etc/sysctl.conf

1. Enables Proxy ARP on all interfaces

net/ipv4/conf/all/proxy_arp = 1

1. Enables Proxy ARP on interfaces eth1 and wlan0

net/ipv4/conf/eth1/proxy_arp = 1 net/ipv4/conf/wlan0/proxy_arp = 1

You can then activate these settings with the sysctl command.

[root@bigboy tmp] sysctl -p

Configuring Your /etc/hosts File

The /etc/hosts file is just a list of IP addresses and their corresponding server names. Your server will typically check this file before referencing DNS. If the name is found with a corresponding IP address then DNS won't be queried at all. Unfortunately, if the IP address for that host changes, you also have to also update the file. This may not be much of a concern for a single server, but can become laborious if it has to be done companywide. For ease of management, it is often easiest to limit entries in this file to just the loopback interface and also the server's own hostname, and use a centralized DNS server to handle most of the rest. Sometimes you might not be the one managing the DNS server, and in such cases it may be easier to add a quick /etc/hosts file entry till the centralized change can be made.

192.168.1.101 smallfry

In the example above server smallfry has an IP address of 192.168.1.101. You can access 192.168.1.101 using the ping, telnet or any other network aware program by referring to it as smallfry. Here is an example using the ping command to see whether smallfry is alive and well on the network:

[root@bigboy tmp]# ping smallfry

PING zero (192.168.1.101) 56(84) bytes of data. 64 bytes from smallfry (192.168.1.101): icmp_seq=0 ttl=64 time=0.197 ms 64 bytes from smallfry (192.168.1.101): icmp_seq=1 ttl=64 time=0.047 ms

--- smallfry ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 2017ms rtt min/avg/max/mdev = 0.034/0.092/0.197/0.074 ms, pipe 2 [root@bigboy tmp]#

You can also add aliases to the end of the line which enable you to refer to the server using other names. Here we have set it up so that smallfry can also be accessed using the names tiny and littleguy.

192.168.1.101 smallfry tiny littleguy

You should never have an IP address more than once in this file because Linux will use only the values in the first entry it finds.

192.168.1.101 smallfry # (Wrong)

192.168.1.101 tiny # (Wrong) 192.168.1.101 littleguy # (Wrong)

The loopback Interface's localhost Entry

Usually the first entry in /etc/hosts defines the IP address of the server's virtual loopback interface. This is usually mapped to the name localhost.localdomain (the universal name used when a server refers to itself) and localhost (the shortened alias name). By default, Fedora inserts the hostname of the server between the 127.0.0.1 and the localhost entries like this:

127.0.0.1 bigboy localhost.localdomain localhost

When the server is connected to the Internet this first entry after the 127.0.0.1 needs to be the fully qualified domain name (FQDN) of the server. For example, bigboy.mysite.com, like this:

127.0.0.1 bigboy.my-site.com localhost.localdomain localhost

Some programs such as Sendmail are very sensitive to this and if they detect what they feel is an incorrect FQDN they will default to using the name localhost.localdomain when communicating with another server on the network. This can cause confusion, as the other server also feels it is localhost.localdomain.

Note: You must always have a localhost and localhost.localdomain entry mapping to 127.0.0.1 for Linux to work properly and securely.

Debian / Ubuntu Network Configuration

Many of the core Fedora / Redhat commands and configuration files covered in this chapter can be used in Debian based operating systems, but there are some key differences.

The /etc/network/interfaces File

The main network configuration file is the /etc/network/interfaces file in which all the network interface parameters are defined. The file is divided into stanzas:

The auto Stanza

The auto stanza defines the interfaces that should be automatically initialized when the system boots up.

The mapping Stanza

This stanza maps configuration parameters for an interface depending on the output of a script. For example, on booting the script could prompt you as to whether your laptop Linux system is at home or work with the mapping statement using the answer to configure the appropriate IP address.

By default the much simpler hotplug system is used which assumes that the interfaces will have only one purpose. Typical hotplug configurations simply assign each physical interface with a matching logical interface name (nick name).

mapping hotplug
script grep
map eth0 eth0
map eth1

In this case interface eth0 is specifically given the logical name eth0, while the logical name for eth1 is implied to be the same.

The iface Stanza

The iface stanza defines the characteristics of a logical interface. Typically the first line of these stanzas starts with the word iface, followed by the logical name of the interface, the protocol used, and finally the type of addressing scheme to be used, such as DHCP or static. Protocol keywords include inet for regular TCP/IP, inet6 for IPv6, ipx for the older IPX protocol used by Novell, and loopback for loopback addresses.

Subsequent lines in the stanza define protocol characteristics such as addresses, subnet masks, and default gateways. In this example, interface eth1 is given the IP address 216.10.119.240/27 while interface eth0 gets its IP address using DHCP.

# The primary network interface

auto eth1 iface eth1 inet static

address 216.10.119.240
netmask 255.255.255.224
network 216.10.119.224
broadcast 216.10.119.255
gateway 216.10.119.241
dns-nameservers 216.10.119.241

1. The secondary network interface

auto eth0 iface eth0 inet dhcp

Note: When static IP addresses are used, a default gateway usually needs to be defined. Remember to place the gateway statement in the correct stanza with the appropriate router IP address.

Creating Interface Aliases

IP aliases can be easily created in the /etc/network/interfaces file once the main interface has already been defined. A modified duplicate of the main interfaces' iface stanza is required. A colon followed by the sub interface number needs to be added to the first line, and only the subnet mask and the new IP address needs to follow as can be seen in this example for interface eth1:1 with the IP address 216.10.119.239.

auto eth1:1

iface eth1:1 inet static

address 216.10.119.239
netmask 255.255.255.224

Adding Permanent Static Routes

The up option in the appropriate iface stanza of the /etc/network/interfaces file allows you to selectively run commands once the specified interface becomes activated with the ifup command. This makes it useful when adding permanent static routes.

In this example, a route to the 10.0.0.0/8 network via router address 216.10.119.225 has been added. Remember, the up option and the command must reside on the same line of the stanza.

# The primary network interface

auto eth1 iface eth1 inet static

...
...
...
up route add -net 10.0.0.0 netmask 255.0.0.0 gw 216.10.119.225 eth1

A complete /etc/network/interfaces file

We can now construct a complete file based on the previous examples we discussed. Just like in Fedora, interfaces can be activated with the ifup and ifdown commands.

# 

1. Debian / Ubuntu

2. File: /etc/network/interfaces

1. The loopback network interface

auto lo iface lo inet loopback

1. This is a list of hotpluggable network interfaces.
2. They will be activated automatically by the hotplug subsystem.

mapping hotplug

script grep
map eth0 eth0
map eth1 eth1

1. The primary network interface

auto eth1 iface eth1 inet static

address 216.10.119.240
netmask 255.255.255.224
network 216.10.119.224
broadcast 216.10.119.255
gateway 216.10.119.241
# dns-* options are implemented by the resolvconf package, if installed
dns-nameservers 216.10.119.241
wireless-key 98d126d5ac
wireless-essid schaaffe

up route add -net 10.0.0.0 netmask 255.0.0.0 gw 216.10.119.225 eth1

auto eth1:1 iface eth1:1 inet static

address 216.10.119.239
netmask 255.255.255.224

1. The secondary network interface

auto eth0 iface eth0 inet dhcp

For more information on the /etc/network/interfaces file just issue the command man interfaces from the command line.

结论

你可以想象，配置Linux的网络只是提供互联网接入到您的服务器第一步。实际操作中，总是存在一些事情可能出错，可完全脱离你的控制。好的系统管理员了解能够找出这些问题可能原因的所需工具，使他们能够找到相应类型的帮助以解决它。未来两章向您展示如何在事情出错时自信地调试您的网络和Linux服务器应用。对你的公司和事业来说，你查明和纠正这些问题的能力将会被证明是非常宝贵的。