前几天显得无聊弄个个asus的wl520gu 回来 52刀 价格还是不错的 主要是可以刷tomato 这样正好可以练习下linux的网关技术 ^_^
下面简单说下吧。
wl520gu 用的是博通的芯片4mflash 16m ddr 带个几台下bt的机器足够用了。我刷的是dualwan 改版的tomato。

好了下面说下实验的环境。学校的网关是172.17.1.1 采用dhcp，我利用自己的权限偷偷给了自己n个静态ip（静态dhcp列表）172.17.167.17/18/19
路由器绑定是172.17.167.19
打算把172.17.167.18绑到laptop上，172.17.167.17绑到bt server上面方便从学校内网的其他机器访问。
拓扑图

因为不论tomato、dd-wrt还是dualwan的web设置都是很简单的 所以直接ssh到 路由
telnet 192.168.1.1
用户名为root 不要输成admin。

进入后就是busybox busybox是个linux的命令行 他简化了linux 可以自己添加命令 主要用于工程机。 具体信心google吧。
先用ifconfig 查看下网卡状态
# ifconfig
br0        Link encap:Ethernet  HWaddr 00:26:18:13:54:65
           inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:4738408 errors:0 dropped:0 overruns:0 frame:0
           TX packets:4377015 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0
           RX bytes:796135268 (759.2 MiB)  TX bytes:4205217353 (3.9 GiB)

eth0       Link encap:Ethernet  HWaddr 00:26:18:13:54:65
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:40477302 errors:12636 dropped:0 overruns:3651 frame:3651
           TX packets:3943571 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:100
           RX bytes:3945465567 (3.6 GiB)  TX bytes:692054944 (659.9 MiB)
           Interrupt:4 Base address:0x1000

eth1       Link encap:Ethernet  HWaddr 00:26:18:13:54:67
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:4741308 errors:0 dropped:0 overruns:0 frame:57195958
           TX packets:4633764 errors:2023 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:100
           RX bytes:862835253 (822.8 MiB)  TX bytes:4266446464 (3.9 GiB)
           Interrupt:13 Base address:0x5000

imq0       Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00
0-00
           UP RUNNING NOARP  MTU:1500  Metric:1
           RX packets:4181208 errors:0 dropped:0 overruns:0 frame:0
           TX packets:4181001 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:30
           RX bytes:4083558188 (3.8 GiB)  TX bytes:4083286490 (3.8 GiB)

imq1       Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00
0-00
           UP RUNNING NOARP  MTU:1500  Metric:1
           RX packets:3052447 errors:0 dropped:0 overruns:0 frame:0
           TX packets:3052447 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:30
           RX bytes:476100316 (454.0 MiB)  TX bytes:476100316 (454.0 MiB)

lo         Link encap:Local Loopback
           inet addr:127.0.0.1  Mask:255.0.0.0
           UP LOOPBACK RUNNING MULTICAST  MTU:16436  Metric:1
           RX packets:467 errors:0 dropped:0 overruns:0 frame:0
           TX packets:467 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0
           RX bytes:36671 (35.8 KiB)  TX bytes:36671 (35.8 KiB)

vlan0      Link encap:Ethernet  HWaddr 00:26:18:13:54:65
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:368198 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0
           RX bytes:0 (0.0 B)  TX bytes:67479636 (64.3 MiB)

vlan1      Link encap:Ethernet  HWaddr 00:26:18:13:54:68
           inet addr:172.17.167.19  Bcast:172.17.255.255  Mask:255.255.0.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
           RX packets:40477302 errors:0 dropped:0 overruns:0 frame:0
           TX packets:3575373 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:0
           RX bytes:3216874131 (2.9 GiB)  TX bytes:624575308 (595.6 MiB)

vlan1就是wan1口
vlan0是wan2口 我把它禁用了
然后给vlan1增加ip
ifconfig vlan1:1 172.17.167.18 broadcast 172.17.255.255 netmask 255.255.0.0
ifconfig vlan1:2 172.17.167.17 broadcast 172.17.255.255 netmask 255.255.0.0
再用ifconfig查看
vlan1:1    Link encap:Ethernet  HWaddr 00:26:18:13:54:68
           inet addr:172.17.167.18  Bcast:172.17.255.255  Mask:255.255.0.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
vlan1:2    Link encap:Ethernet  HWaddr 00:26:18:13:54:68
           inet addr:172.17.167.17  Bcast:172.17.255.255  Mask:255.255.0.0
           UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
多出2个vlan1 这样ip就绑定对了 你再试试用几个ip能访问到80端口不。
为了安全在iptables先做下安全
iptables -A INPUT -i vlan1 -p tcp --dport 23 -s ! 192.168.1.1/255.255.255.0 -j REJECT --reject-with tcp-reset
iptables -A INPUT -i vlan1 -p tcp --dport 80 -s ! 192.168.1.1/255.255.255.0 -j REJECT --reject-with tcp-reset
幽默点对于非192.168.1.1/24这段ip 访问路由器 全部返回 tcp-reset 就是连接重置。
开始进行nat
先把192.168.1.254 nat 到172.17.167.17上
iptables -t nat -I POSTROUTING -s 192.168.1.1/255.255.255.0 -d 192.168.1.254 -j SNAT --to-source 172.17.167.17
iptables -t nat -I PREROUTING -d 172.17.167.17 -j DNAT --to-destination 192.168.1.254
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.254 -j SNAT --to 172.17.167.17
iptables -I FORWARD -i vlan1 -d 192.168.1.254 -j ACCEPT
在吧192.168.1.118 nat 到172.17.167.18上
iptables -t nat -I POSTROUTING -s 192.168.1.1/255.255.255.0 -d 192.168.1.118 -j SNAT --to-source 172.17.167.18
iptables -t nat -I PREROUTING -d 172.17.167.18 -j DNAT --to-destination 192.168.1.118
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.118 -j SNAT --to 172.17.167.18
iptables -I FORWARD -i vlan1 -d 192.168.1.118 -j ACCEPT
ok  这样nat 就ok了

为了开机自动执行脚本
把
ifconfig vlan1:1 172.17.167.18 broadcast 172.17.255.255 netmask 255.255.0.0
ifconfig vlan1:2 172.17.167.17 broadcast 172.17.255.255 netmask 255.255.0.0
加到wan联网时
把
iptables -t nat -I POSTROUTING -s 192.168.1.1/255.255.255.0 -d 192.168.1.254 -j SNAT --to-source 172.17.167.17
iptables -t nat -I PREROUTING -d 172.17.167.17 -j DNAT --to-destination 192.168.1.254
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.254 -j SNAT --to 172.17.167.17
iptables -I FORWARD -i vlan1 -d 192.168.1.254 -j ACCEPT
iptables -t nat -I POSTROUTING -s 192.168.1.1/255.255.255.0 -d 192.168.1.118 -j SNAT --to-source 172.17.167.18
iptables -t nat -I PREROUTING -d 172.17.167.18 -j DNAT --to-destination 192.168.1.118
iptables -t nat -I POSTROUTING -o vlan1 -s 192.168.1.118 -j SNAT --to 172.17.167.18
iptables -I FORWARD -i vlan1 -d 192.168.1.118 -j ACCEPTiptables -A INPUT -i vlan1 -p tcp --dport 23 -s ! 192.168.1.1/255.255.255.0 -j REJECT --reject-with tcp-reset
iptables -A INPUT -i vlan1 -p tcp --dport 80 -s ! 192.168.1.1/255.255.255.0 -j REJECT --reject-with tcp-reset
加入到防火墙中
结束
目前严重策略路由中 过几天写一下