ネットワークの二重化

以下のテキストは、執筆時当時の情報を元に書いたものであり、 現在の情勢にそぐわないことを含む場合があるので注意されたい。 また、テキストは最終提出原稿で校正を経る前のものなので、実際にUNIXUSER 本誌に記載されたものとは異なる。誤字脱字等そのままである。

致命的な誤り以外は加筆修正等は行なわないので情報の鮮度に気をつけつつ 利用して欲しい。

目次


  


HDD




LAN


===========================================
Part 1
===========================================



Part1 









1










ADSL






Mbps

100MbpsADSL


 


---[ ]------------------------------------------------------------
(20056)


			1	()
--------------------------------------------------------
NTT-		14227		5460

--------------------------------------------------------
NTT-		29295		5218.5
100
--------------------------------------------------------
TEPCO		290002	60002
100Mbps
--------------------------------------------------------
		26250		3990

--------------------------------------------------------
YAHOO			21003	7234
Yahoo! BB
--------------------------------------------------------

1 
    

2 
    

3 
----------------------------------------------------------------------



2
IP
WebDNS
IP





ADSL





ADSL
ADSLADSL










	()
	  



 LAN


   SSH


SSH









 

---[ ]------------------------------------------------------------

   / ISP1/      /ADSL ISP2/
        |a1.a2.a3.a4      |b1.b2.b3.b4
    +---+---+         +---+---+
    |   |         |   |
    | PPPoE |         | PPPoE |
    |A|	      |B|
    +---+---+	      +---+---+
        |10.1.1.254       | 10.2.2.254
         \               /
          \             /
           \           /
            \         /
    default  \       /
    10.1.1.10 |     | 10.2.2.10
          +---+-----+----+
	  |        |
	  |    venus     |
	  +------+-------+
		 |192.168.1.254
		 |
                 |          LAN 192.168.1.0/24
     o-----------+--------------------------------o

----------------------------------------------------------------------

ISPPPPoE
PC

	* ASSH() venus 
	* BSSH() venus 
	* venus  A 
	* venus  AB 







	




 B
venus
venus

---[ ]------------------------------------------------------------
  x1.x2.x3.x4                    b1.b2.b3.b4
 +----------+                             +-------+
 ||--> -->|B|
 +----------+			    ISP2  +---+---+
 					      |10.2.2.254
					      |
 					      |10.2.2.10
		ISP1	+-------+	  +-------+
		 X <--<-|A|<--<--<--| venus |
			+-------+	  +-------+

----------------------------------------------------------------------

B
venusA
B
B

B

		x1.x2.x3.x4
		b1.b2.b3.b4
		22

BSSHvenusvenus


		x1.x2.x3.x4
		10.2.2.10
		22

venus
x1.x2.x3.x4 
A x1.x2.x3.x4 
Bx1.x2.x3.x4

venus



()
(Policy
Based Routing) 
10.2.2.10B
venus
B(10.2.2.254)

FreeBSD(IPFW2)Linux(iproute2)


IPFW2

FreeBSD
IP

()


---[ ]------------------------------------------------------------
FreeBSD

              
   10.1.1.254        10.2.2.254
        |                 |
         \               /
          \             /
           \           /
            \         /
    default  \       /
    10.1.1.10 |     | 10.2.2.10
       fxp0   |     |   fxp1
          +---+-----+----+
	  |    FreeBSD   |
	  +------+-------+
		 |192.168.1.254
		 | vr0
                 |          LAN 192.168.1.0/24
     o-----------+--------------------------------o

----------------------------------------------------------------------



FreeBSD 5.4-RELEASE


	options IPFIREWALL_FORWARD
	options IPFIREWALL_FORWARD_EXTENDED



	()
	# cd /sys/i386/conf/
	# cp GENERIC UU		()
	# vi UU
	 2
	# config UU
	# cd ../compile/UU
	# make depend && make && make install





IPFW2 fwd /



	ipfw add [] fwd <> <>

 

	10.2.2.1010.2.2.254



	ipfw add fwd 10.2.2.254 ip from 10.2.2.10 to any

 10.2.2.254 
(fxp0)


	ipfw add fwd 10.2.2.254 ip from 10.2.2.10 to any via fxp0

venusLAN 10.2.2.254 
LAN ipfw(8) 



iproute2

iproute2





 "IP: policy
routing"  



---[ ]------------------------------------------------------------
Linux(menuconfig)

 %image linuxmenu-1.png
	Networking options 

 %image linuxmenu-2.png
	IP: advanced router (*)
	 IP: policy routing (*)
----------------------------------------------------------------------



IP: pilicy routing 


	# ip rule
	  ~~~~~~~
	0:      from all lookup local 
	32766:  from all lookup main 
	32767:  from all lookup 253 


(all)
 local, main, 253 
local, main


	# ip route show table local
	# ip route show table main

localmain
 route 



/etc/iproute2/rt_tables 


	# vi /etc/iproute2/rt_tables

---------------------------- rt_tables 
#
# reserved values
#
#255    local
#254    main
#253    default
#0      unspec

#
# local
#
#1      inr.ruhep

10	FOO          <<<<----
------------------------------

 FOO FOO


	# ip route show table FOO





---[ ]------------------------------------------------------------
Linux

              
   10.1.1.254        10.2.2.254
        |                 |
         \               /
          \             /
           \           /
            \         /
    default  \       /
    10.1.1.10 |     | 10.2.2.10
       eth0   |     |   eth1
          +---+-----+----+
	  |    Linux     |
	  +------+-------+
		 |192.168.1.254
		 | eth2
                 |          LAN 192.168.1.0/24
     o-----------+--------------------------------o

----------------------------------------------------------------------

 

	(1) FOO
	    10.2.2.254
	(2) 10.2.2.10FOO
	    

FOO10.2.2.254


	# ip route add default via 10.2.2.254 table FOO

10.2.2.10FOO


	# ip rule add from 10.2.2.10 table FOO




	# ip route flush cache






	% telnet B 22

SSH greeting message 



	Trying b1.b2.b3.b4...

venus

 fxp0(FreeBSD)
eth0(Linux)tcpdump

	venus# tcpdump -i fxp0 host  (FreeBSD)
	venus# tcpdump -i eth0 host  (Linux)

telnet

 venus  telnet
ACK  

---[ ]------------------------------------------------------------
17:29:42.108095 IP balius.gentei.org.ssh > external.example.org.55672:
S 533449298:533449298(0) ack 1310590309 win 5840 
----------------------------------------------------------------------
---[ ]------------------------------------------------------------

----------------------------------------------------------------------

NIC1

 ,  NIC
2NIC
 NIC



---[ ]------------------------------------------------------------
LANFreeBSD

          
   [[A]]    [[B]]
   10.1.1.254     10.1.1.253
         |         /
          \       /
           \     /
	    |   |
         +---------+
         |   HUB   |
         +----+----+
              |
              |
              |
    10.1.1.10 | 10.1.1.11(alias)
        +-----+--------+
	|    venus     |
	| defaut route |
	| ->10.1.1.254 |
	+------+-------+
	       |192.168.1.254
	       |
	       |          LAN 192.168.1.0/24
   o-----------+--------------------------------o

----------------------------------------------------------------------


IP
 IP 10.1.1.10/24 10.1.1.11/32
 IP-alias Bvenus
alias 10.1.1.11 B
venusB
 10.1.1.11 


	FreeBSD
	# ifconfig fxp0 alias 10.1.1.11 netmask 0xffffffff
	# ipfw add fwd 10.1.1.253 ip from 10.1.1.1 to any via fxp0

	Linux
	# ifconfig eth0:1 10.1.1.11 netmask 0xffffffff
	# ip rule add from 10.1.1.11 table FOO
	# ip route add default via 10.1.1.253 table FOO
	# ip route flush cache


--------------------[[  IP Filter  PF  ]]--------------------
%  : PF
% PF
% PF

 IP Filter 
PF 



	 fxp0 (10.1.1.10)
		 10.1.1.254
	 fxp1 (10.2.2.10)
	 10.2.2.254

 10.2.2.254 


IP Filter

IP Filterpassto(fastroute)



pass out quick on fxp0 to fxp1:10.2.2.254 from 10.2.2.10 to any



PF

PF "route-to" 

pass out quick on fxp0 route-to (fxp1 10.2.2.254) from 10.2.2.10 to any

PFIP
IP


main_if	= fxp0
main_ip	= "10.1.1.10"
sub_if	= fxp1
sub_ip	= "10.2.2.10"
sub_gw	= "10.2.2.254"

pass out quick on $main_if route-to ($sub_if $sub_gw) from $sub_ip to any
---------------------------------------------------------------------------

%
%
%
%LAN
%
%
% Linux 
% iptables -A PREROUTING -t mangle -p tcp --dport 22 -j MARK --set-mark 1
% 
% ip rule add fwmark 1 table FOO
%
% (HOWTO
% )
%
% ipfw
% ipfw add fwd 10.1.1.253 tcp from 10.1.1.11 to any via fxp0
% 
%
% 







SMTPpreference
IP


DNSA
www.example.org 
WebBIND
www.example.org 


	www	IN	A	a1.a2.a3.a4
	; (a1.a2.a3.a4IP)

www

	www	IN	A	b1.b2.b3.b4
	; (b1.b2.b3.b4IP)


---[ ]------------------------------------------------------------

  

    a1.a2.a3.a4   +---------+     +------------------+
   ---------------| A +---\ | [DNS]	     |
   		  +---------+    \|  www.example.org |
                                  |  == a1.a2.a3.a4  |
    b1.b2.b3.b4   +---------+    /|                  |
   ---------------| B +---/ |		     |
   		  +---------+     +------------------+

  

    a1.a2.a3.a4   +---------+     +------------------+
   ---------| A +---\ | [DNS]	     |
   		  +---------+    \|  www.example.org |
                                  |  == b1.b2.b3.b4  |
    b1.b2.b3.b4   +---------+    /|                  |
   ---------------| B +---/ |		     |
   		  +---------+     +------------------+

----------------------------------------------------------------------

make 
m4 

---[ ]------------------------------------------------------------
Unix

----------------------------------------------------------------------

m4 (
)IP a1.a2.a3.a4 
(MAIN_NET)

	www	IN	A	MAIN_NET

m4 MAIN_NET  a1.a2.a3.a4
 MAIN_NET  b1.b2.b3.b4 


example.org DNS example.zone 
 example.src 
  Makefile (
TAB)

---[ ]--------------------------------------------------------
#
# Makefile for example.zone
#
M4OPT		=
SRC		= example.src
all:		example.zone

example.zone:	${SRC}
	echo ';;; DO NOT EDIT THIS FILE! Edit example.src' > $@
	cat ${SRC} | m4 ${M4OPT} >> $@

backup:
	touch ${SRC}
	${MAKE} M4OPT=-DBACKUP
----------------------------------------------------------------------


make

	# make

 example.zone  example.src 
 diff 1

	# diff -ua example.{src,zone}
	--- example.src       Sat Jun  4 15:06:00 JST 2005
	+++ example.zone      Sat Jun  4 15:06:20 JST 2005
	@@ -1,3 +1,4 @@
	+;;; DO NOT EDIT THIS FILE! Edit example.src
	 ;
	 ; Zone file of example.org
	 ;

example.src m4
IP MAIN_LINE 
example.src  
---[ ]--------------------------------------------------------
ifdef(`BACKUP',
`define(`MAIN_LINE', `b1.b2.b3.b4')',
`define(`MAIN_LINE', `a1.a2.a3.a4')')
----------------------------------------------------------------------

(`)(')
 m4BACKUP 
 MAIN_LINE  "b1.b2.b3.b4"  MAIN_LINE 
"a1.a2.a3.a4" m4
 -D 

 example.src wwwA

----------------------------------------------------------------------
www		IN	A	MAIN_LINE
----------------------------------------------------------------------

 make  example.zone 

	# make
	  ~~~~
	# grep '^www' example.zone
	  ~~~~~~~~~~~~~~~~~~~~~~~~
	www	IN	A	a1.a2.a3.a4

m4 BACKUP  make 
backup

	# make backup
	  ~~~~~~~~~~~
	# grep '^www' example.zone
	  ~~~~~~~~~~~~~~~~~~~~~~~~
	www	IN	A	b1.b2.b3.b4


wwwAmake
(a1.a2.a3.a4)


make backup
cronWeb
  
	

---[ ]------------------------------------------------------------
DNSTTL
TTL

----------------------------------------------------------------------

---[ ]--------------------------------------------------------
pingDNS swdns.sh
(   Makefile )

#!/bin/sh

# PPPoE
ISP=i1.i2.i3.i4

# DNS
ZONEDIR=/var/dns/namedb

case `uname` in
  *BSD)  PING='ping -t 5' ;;
  Linux) PING='ping -w 5' ;;
esac

ckalive () {
  $PING -c 1 $ISP || \
  $PING -c 1 $ISP || \
  $PING -c 1 $ISP
}
ckalive > /dev/null 2>&1  ||   TARGET="BACKUP"

(cd $ZONEDIR; make $TARGET)
----------------------------------------------------------------------


















ipfw
http://www.jp.freebsd.org/cgi/mroff.cgi?subdir=man&lc=1&cmd=&man=ipfw&dir=jpman-5.2.0%2Fman§=8#toc

iproute2
http://www.linux.or.jp/JF/JFdocs/Adv-Routing-HOWTO/index.html

PF
http://www.openbsd.org/faq/pf/ja/


yuuji@gentei.org
Fingerprint16 = FF F9 FF CC E0 FE 5C F7 19 97 28 24 EC 5D 39 BA
HIROSE Yuuji - ASTROLOGY / BIKE / EPO / GUEST BOOK / YaTeX [Tweet]