2.配置vlan的ip地址
[H3C]system-view//进入视图模式
[H3C]interface vlan 1//进入vlan 1接口模式
[H3C-Vlan-interface1]ip address 192.168.10.10 255.255.0.0//设置ip地址和子网掩码
[H3C-Vlan-interface1]quit
[H3C]ip route-static 0.0.0.0 0.0.0.0 192.168.20.254
3.配置web用户
[H3C] local-user admin //添加用户admin
[H3C-luser-admin] service-type telnet //服务类型为telnet
[H3C-luser-admin] password simple admin //设置密码为admin
[H3C-luser-admin] authorization-attribute level 3 //设置认证级别为3,0到3数字越小级别越低
4.telnet配置
<H3C> system-view//进入视图模式
[H3C-ui-vty0-4] user-interface vty 0 4 //进入虚拟终端 0 4
[H3C-ui-vty0-4] authentication-mode password //设置认证方式为密码验证方式为password
[H3C-ui-vty0-4] set authentication password simple 123456 设置登陆验证的password为明文密码”123456”也可以用cipher加密模式
[H3C-ui-vty0-4] user privilege level 3 配置登陆用户的级别为最高级别3(缺省为级别1)
[H3C] save //最后别忘记save
The current configuration will be written to the device. Are you sure? [Y/N]:y
Please input the file name(*.cfg)[flash:/startup.cfg]
(To leave the existing filename unchanged, press the enter key):
Validating file. Please wait...........
Configuration is saved to device successfully.
CentOS5.6服务器配置
1.[root@localhost zhh]# rpm -q vconfig //查看vconfig软件包是否存在不存在用yum -y install vconfig来安装即可。
vconfig-1.9-3
2.[root@localhost zhh]# yum -y install dhcp//安装dhcp服务
[root@localhost zhh]# chkconfig dhcpd off //关闭启动服务首先要先启动脚本vlan.sh，如果反过来dhpcd启动就会失败。
3.[root@localhost zhh]# cat vlan.sh //查看vlan.sh的脚本也就是添加vlan 10,20.30.40.50.60.70段vid一定要和你交换机创建的vlan名字一样
#!/bin/sh
vconfig add eth1 10
vconfig add eth1 20
vconfig add eth1 30
vconfig add eth1 40
vconfig add eth1 50
vconfig add eth1 60
vconfig add eth1 70
ifconfig eth1.10 192.168.10.254 netmask 255.255.255.0
ifconfig eth1.20 192.168.20.254 netmask 255.255.255.0
ifconfig eth1.30 192.168.30.254 netmask 255.255.255.0
ifconfig eth1.40 192.168.40.254 netmask 255.255.255.0
ifconfig eth1.50 192.168.50.254 netmask 255.255.255.0
ifconfig eth1.60 192.168.60.254 netmask 255.255.255.0
ifconfig eth1.70 192.168.70.254 netmask 255.255.255.0
/etc/rc.d/init.d/dhcpd stop
/etc/rc.d/init.d/dhcpd start
sh /root/zhh/iptables
4.[root@localhost zhh]# cat /etc/dhcpd.conf //dhcpd.conf配置文件如下：
# DHCP Server Configuration file.
# see /usr/share/doc/dhcp*/dhcpd.conf.sample
#
ddns-update-style interim;
ignore client-updates;
#//192.168.10.* //设置10段网络的ip地址池
subnet 192.168.10.0 netmask 255.255.255.0 { //subnet一个子网中的客户端，动态地指定ip地址，则在此subnet声明中，必须包含一组ip地址范围。
option routers 192.168.10.254; //网关地址
option subnet-mask 255.255.255.0; //子网掩码
option broadcast-address 192.168.10.255; //广播地址
option domain-name-servers 202.101.172.35;//dns ip地址
range dynamic-bootp 192.168.10.100 192.168.10.200; //地址池pool范围地址
default-lease-time 21600; //默认的ip租用时间期限单位为秒
max-lease-time 43200; //ip租用最长的期限单位为秒
}
#//
#//192.168.20.*
subnet 192.168.20.0 netmask 255.255.255.0 {
option routers 192.168.20.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.20.255;
option domain-name-servers 202.101.172.35;
range dynamic-bootp 192.168.20.100 192.168.20.210;
default-lease-time 21600;
max-lease-time 43200;
}
#//
#//192.168.30.*
subnet 192.168.30.0 netmask 255.255.255.0 {
option routers 192.168.30.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.30.255;
option domain-name-servers 202.101.172.35;
range dynamic-bootp 192.168.30.100 192.168.30.250;
default-lease-time 21600;
max-lease-time 43200;
}
#//
#//192.168.40.*
subnet 192.168.40.0 netmask 255.255.255.0 {
option routers 192.168.40.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.40.255;
option domain-name-servers 202.101.172.35;
range dynamic-bootp 192.168.40.100 192.168.40.180;
default-lease-time 21600;
max-lease-time 43200;
}
#//
#//192.168.50.*
subnet 192.168.50.0 netmask 255.255.255.0 {
option routers 192.168.50.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.50.255;
option domain-name-servers 202.101.172.35;
range dynamic-bootp 192.168.50.100 192.168.50.180;
default-lease-time 21600;
max-lease-time 43200;
}
#//
#//192.168.60.*
subnet 192.168.60.0 netmask 255.255.255.0 {
option routers 192.168.60.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.60.255;
option domain-name-servers 202.101.172.35;
range dynamic-bootp 192.168.60.100 192.168.60.140;
default-lease-time 21600;
max-lease-time 43200;
}
#//
#//192.168.70.*
subnet 192.168.70.0 netmask 255.255.255.0 {
option routers 192.168.70.254;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.70.255;
option domain-name-servers 202.101.172.35;
range dynamic-bootp 192.168.70.100 192.168.70.150;
default-lease-time 21600;
max-lease-time 43200;
}
#//
5.配置iptables NAT脚本如下：
[root@localhost zhh]# cat iptables
#!/bin/sh
MODPROBE=/sbin/modprobe //加载模块
IPTABLES=/sbin/iptables
#modprobe
$MODPROBE ip_tables > /dev/null 2>&1
$MODPROBE iptable_nat > /dev/null 2>&1
$MODPROBE ip_nat_ftp > /dev/null 2>&1
$MODPROBE ip_nat_irc > /dev/null 2>&1
$MODPROBE ip_conntrack > /dev/null 2>&1
$MODPROBE ip_conntrack_ftp > /dev/null 2>&1
$MODPROBE ip_conntrack_irc > /dev/null 2>&1
#clear old rules//清理原规则
$IPTABLES -F
$IPTABLES -X
$IPTABLES -Z
$IPTABLES -F -t nat
$IPTABLES -X -t nat
$IPTABLES -Z -t nat
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -t nat -P PREROUTING ACCEPT
$IPTABLES -t nat -P POSTROUTING ACCEPT
$IPTABLES -t nat -P OUTPUT ACCEPT
iptables -I INPUT -p gre -j ACCEPT
# Open ip_forwad//打开转发功能
echo "1" > /proc/sys/net/ipv4/ip_forward
$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
#$IPTABLES -A FORWARD -p udp -j ACCEPT
# Lan//局域网
for LAN in 192.168.0.0/16
do
$IPTABLES -A INPUT -p udp -s $LAN -m multiport --destination-ports 22 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s $LAN -m multiport --destination-ports 5000,1701,1723,8001,7001,53,1755,8005,801,873 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s $LAN -m multiport --destination-ports 5060,5063,10000,10001,12000,12001,20000,20001,22000,22001 -j ACCEPT
$IPTABLES -A FORWARD -p udp -s $LAN -m multiport --destination-ports 30000,30001,32000,32001,3388,7708 -j ACCEPT
$IPTABLES -A FORWARD -p icmp -s $LAN -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s $LAN -m multiport --destination-ports 110,80,123,1701,2095,8001,3389,8181,2121,8005,801,1723 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s $LAN -m multiport --destination-ports 21,22,25,81,82,8080,443,1433,3214,1503,3128,3388,5632,5631 -j ACCEPT
$IPTABLES -A FORWARD -p tcp -s $LAN -m multiport --destination-ports 5050,7708 -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -s $LAN -o eth0 -j SNAT --to 192.168.200.9 //启动NAT功能，192.168.200.9为进线地址如果电信给的静态ip就写电信给的静态ip即可.
done