Author |
Message |
|
Post subject: Verejne ip - subnet
Posted: 03.04.2014 - 00:32 #106277
|
|
Basic
Joined: Feb 18, 2007
Posts: 418
|
|
Nazdar.
Rad by som urobil poriadok s mojim serverom, kedze moja siet ma xx userov a vsetci su za NAT cize maju jednu verejnu IP. Staci ze jeden ma poriadny botnet resp trojan a moj server je hned v blackliste.
Chcel by som im dat verejne IP ale tolko ich nemam aby som im vsetkym dal. Neda sa urobit tak aby napr. subnet 10.1.1.0/24 mal verejnu 1.2.3.4 a subnet 10.1.2.0/24 mal 1.2.3.5 a tak dalej? Cize nie NAT 1:1 ale NAt 1:subnet. Je to blbost?
Ako to vy riesite? Nehovorte ze kazdy ma 1000-2000 verejnych IP a pridelenych zakaznikom. Samozrejme okrem pomaranca a pantera. Resp ak by mal niekto na predaj verejne IP tak mozte ponuknut do SS. ![Embarassed](modules/PNphpBB2/images/smiles/icon_redface.gif) |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 03.04.2014 - 09:07 #106278
|
|
Guru
Joined: Júl 14, 2005
Posts: 1590
|
|
ja mam 8 cecok.. co je take minimum ale aj tak nedavam vsetkym verejku... ani by mi to uz nevychadzalo...
idealne je dat staticke IP adresy zakaznikom ktory si priplatia a zvysok siete rozhadzat na zvysne IPcky..
ako si pisal..
siet 10.10.10.0/24 je napr jedna verejka a atd.. mozes zamozrejme znatovat aj vacsie rozsahy napr 10.10.0.0./16 na 1 verejku |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 03.04.2014 - 09:19 #106279
|
|
Majster
![](./images/avatar/019.gif)
Joined: Okt 31, 2006
Posts: 2062
Location: TT
|
|
iptables
Code: › #NAT 10.1.1.0/24 -> 1.2.3.4
iptables -t nat -A POSTROUTING -o eth0 -s 10.1.1.0/24 -j SNAT --to-source 1.2.3.4
#NAT 10.1.1.0/24 -> 1.2.3.5
iptables -t nat -A POSTROUTING -o eth0 -s 10.1.2.0/24 -j SNAT --to-source 1.2.3.5
#maškaráda na všetko ostatné
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
to isté ale pre mikrotik:
Code: ›
add action=src-nat chain=srcnat disabled=no out-interface=ether1 src-address=10.1.1.0/24 to-addresses=1.2.3.4
add action=src-nat chain=srcnat disabled=no out-interface=ether1 src-address=10.1.2.0/24 to-addresses=1.2.3.5
add action=masquerade chain=srcnat disabled=no out-interface=ether1 |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: Verejne ip - subnet
Posted: 03.04.2014 - 09:49 #106280
|
|
Ucen
Joined: Júl 15, 2011
Posts: 769
|
|
sef wrote: ›Nazdar.
Rad by som urobil poriadok s mojim serverom, kedze moja siet ma xx userov a vsetci su za NAT cize maju jednu verejnu IP. Staci ze jeden ma poriadny botnet resp trojan a moj server je hned v blackliste.
Chcel by som im dat verejne IP ale tolko ich nemam aby som im vsetkym dal. Neda sa urobit tak aby napr. subnet 10.1.1.0/24 mal verejnu 1.2.3.4 a subnet 10.1.2.0/24 mal 1.2.3.5 a tak dalej? Cize nie NAT 1:1 ale NAt 1:subnet. Je to blbost?
Ako to vy riesite? Nehovorte ze kazdy ma 1000-2000 verejnych IP a pridelenych zakaznikom. Samozrejme okrem pomaranca a pantera. Resp ak by mal niekto na predaj verejne IP tak mozte ponuknut do SS. ![Embarassed](modules/PNphpBB2/images/smiles/icon_redface.gif)
tak tak pekne to rozdel podla oblasti alebo podla toho kde mas kolko ludi aby si mal zhruba rovnaky pocet ludi na kazdej verejnej ip a to uz ten pomer zalezi kolko mas tych IP.. |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 03.04.2014 - 11:57 #106282
|
|
Basic
Joined: Dec 20, 2012
Posts: 53
|
|
My uz dlhsiu dobu nenatujeme, ale kazdy user ma svoju verejnu ipku, v minulosti ked sme neboli learom sme ludi rozdelovali podla ich spravania, viem ze chalani nejak logovali trafficu a aj veci ako virusove a ine anomalie u klientov a potom napriklad tahacov sekli spolu do jedneho vreca a podobne... Bohuzial neviem sposob ako to robili ale fungovalo to dobre dnes mame ale ip aj connectu dost takze to uz dlhsie neriesime.. |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 03.04.2014 - 13:16 #106284
|
|
Majster
![](./images/avatar/005.gif)
Joined: Okt 21, 2003
Posts: 4247
|
|
tomas.juricek wrote: ›My uz dlhsiu dobu nenatujeme, ale kazdy user ma svoju verejnu ipku, v minulosti ked sme neboli learom sme ludi rozdelovali podla ich spravania,
btw kto je to "lear"? |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 03.04.2014 - 13:43 #106286
|
|
Majster
![](./images/avatar/004.gif)
Joined: Feb 14, 2011
Posts: 2544
|
|
Zrejme myslel "LIR" vsakze. |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 04.04.2014 - 09:26 #106289
|
|
Basic
Joined: Dec 20, 2012
Posts: 53
|
|
jj LIR prepáč môj hrozný omyl ![Smile](modules/PNphpBB2/images/smiles/icon_smile.gif) |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 07.04.2014 - 12:43 #106312
|
|
Basic
Joined: Feb 18, 2007
Posts: 418
|
|
Dik Thomas. Potrebujem pre iptables nie MK.
vo firewalle mam takto:
-A POSTROUTING -o eth0 -j MASQUERADE
-A POSTROUTING -o eth2 -j MASQUERADE
-A POSTROUTING -s "local lan" -o eth0 -j SNAT --to-source "verejna ip"
Ako prehodit aby masquerade bolo az po "-A POSTROUTING -s "local lan" -o eth0 -j SNAT --to-source "verejna ip" ???? |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 07.04.2014 - 15:12 #106313
|
|
Majster
![](./images/avatar/019.gif)
Joined: Okt 31, 2006
Posts: 2062
Location: TT
|
|
každá distribúcia to má trocha inak , ale určite v /etc nájdeš súbor kde sú iptables pravidlá uložené ten si zedituješ tak aby boli pravidlá v "správnom" poradí a pustíš si príslušný init script aby sa znova načítali |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Post subject: RE: Verejne ip - subnet
Posted: 09.04.2014 - 11:00 #106324
|
|
Ucen
Joined: Apr 18, 2008
Posts: 561
Location: Toropark
|
|
kráľ lear - shakespeare ![Razz](modules/PNphpBB2/images/smiles/icon_razz.gif) |
|
|
|
|
![](./modules/PNphpBB2/templates/PNTheme/images/spacer.gif) |
|
Powered by PNphpBB2 © 2003-2005 The PNphpBB Group Credits |