Kerosoft : Modus Operandi

はじめに

環境

• DNS権威サーバやメールサービスは、ISP-2側の固定IPアドレス192.0.2.123/32で行う
• Webサーバやファイルストレージサービス等、IPアドレスが変動してもDynamic DNSでrecoverできる程度のサービスは、ISP-1側の変動IPアドレスNAPT配下の10.10.1.2/24で行う

下準備

ISP-1のRouter

ISP-1側の静的IP設定

# vim /etc/sysconfig/network-scripts/ifcfg-eth1

DEVICE="eth1"
HWADDR="★MACアドレス★"
ONBOOT="yes"
NM_CONTROLLED="no"
TYPE=Ethernet
BOOTPROTO="none"
IPADDR="10.10.1.2"
NETMASK="255.255.255.0"
BROADCAST="10.10.1.255"
NETWORK="10.10.1.0"
GATEWAY="10.10.1.1"

IPV6INIT="yes"
IPV6_AUTOCONF="yes"
IPV6_PEERDNS="yes"

ISP-2側のPPPoE設定

# yum install rp-pppoe

# pppoe-setup

------------------------------------------------------------------
Welcome to the PPPoE client setup.  First, I will run some checks on
your system to make sure the PPPoE client is installed properly...


LOGIN NAME

Enter your Login Name (default root): ISP-2の接続ID


INTERFACE

Enter the Ethernet interface connected to the PPPoE modem
For Solaris, this is likely to be something like /dev/hme0.
For Linux, it will be ethX, where 'X' is a number.
(default eth0): eth0


Do you want the link to come up on demand, or stay up continuously?
If you want it to come up on demand, enter the idle time in seconds
after which the link should be dropped.  If you want the link to
stay up permanently, enter 'no' (two letters, lower-case.)
NOTE: Demand-activated links do not interact well with dynamic IP
addresses.  You may have some problems with demand-activated links.
Enter the demand value (default no): no


DNS

Please enter the IP address of your ISP's primary DNS server.
If your ISP claims that 'the server will provide dynamic DNS addresses',
enter 'server' (all lower-case) here.
If you just press enter, I will assume you know what you are
doing and not modify your DNS setup.
Enter the DNS information here: server


PASSWORD

Please enter your Password: ISP-2のパスワード

Please re-enter your Password: ISP-2のパスワード


USERCTRL

Please enter 'yes' (three letters, lower-case.) if you want to allow
normal user to start or stop DSL connection (default yes): no


FIREWALLING

Please choose the firewall rules to use.  Note that these rules are
very basic.  You are strongly encouraged to use a more sophisticated
firewall setup; however, these will provide basic security.  If you
are running any servers on your machine, you must choose 'NONE' and
set up firewalling yourself.  Otherwise, the firewall rules will deny
access to all standard servers like Web, e-mail, ftp, etc.  If you
are using SSH, the rules will block outgoing SSH connections which
allocate a privileged source port.

The firewall choices are:
0 - NONE: This script will not set any firewall rules.  You are responsible
          for ensuring the security of your machine.  You are STRONGLY
          recommended to use some kind of firewall rules.
1 - STANDALONE: Appropriate for a basic stand-alone web-surfing workstation
2 - MASQUERADE: Appropriate for a machine acting as an Internet gateway
                for a LAN
Choose a type of firewall (0-2): 0 （後で設定）


Start this connection at boot time

Do you want to start this connection at boot time?
Please enter no or yes (default no): yes

** Summary of what you entered **

Ethernet Interface: eth0
User name:          ISP-2の接続ID
Activate-on-demand: No
DNS addresses:      Supplied by ISP's server
Firewalling:        NONE
User Control:       no
Accept these settings and adjust configuration files (y/n)? y
Adjusting /etc/sysconfig/network-scripts/ifcfg-ppp0
Adjusting /etc/ppp/chap-secrets and /etc/ppp/pap-secrets
  (But first backing it up to /etc/ppp/chap-secrets.bak)
  (But first backing it up to /etc/ppp/pap-secrets.bak)



Congratulations, it should be all set up!

Type '/sbin/ifup ppp0' to bring up your xDSL link and '/sbin/ifdown ppp0'
to bring it down.
Type '/sbin/pppoe-status /etc/sysconfig/network-scripts/ifcfg-ppp0'
to see the link status.

USERCTL=no
BOOTPROTO=dialup
NAME=DSLppp0
DEVICE=ppp0
TYPE=xDSL
ONBOOT=yes
PIDFILE=/var/run/pppoe-adsl.pid
FIREWALL=NONE
PING=.
PPPOE_TIMEOUT=80
LCP_FAILURE=3
LCP_INTERVAL=20
CLAMPMSS=1412
CONNECT_POLL=6
CONNECT_TIMEOUT=60
DEFROUTE=yes
SYNCHRONOUS=no
ETH=eth0
PROVIDER=DSLppp0
USER=myusername@isp-1.example.com
PEERDNS=yes
DEMAND=no

USERCTL=no
BOOTPROTO=dialup
NAME=DSLppp0
DEVICE=ppp0
TYPE=xDSL
ONBOOT=yes
PIDFILE=/var/run/pppoe-adsl.pid
FIREWALL=NONE
PING=.
PPPOE_TIMEOUT=80
LCP_FAILURE=3
LCP_INTERVAL=20
CLAMPMSS=1412
CONNECT_POLL=6
CONNECT_TIMEOUT=60
DEFROUTE=no

SYNCHRONOUS=no
ETH=eth0
PROVIDER=DSLppp0
USER=myusername@isp-1.example.com
PEERDNS=yes
DEMAND=no
LINUX_PLUGIN=/usr/lib/pppd/2.4.5/rp-pppoe.so

ポリシールーティング

#  vim /etc/iproute2/rt_tables


#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep
202     isp-2

#  vim /etc/sysconfig/network-scripts/rule-ppp0

from 192.0.2.123 table isp-2

#  vim /etc/sysconfig/network-scripts/route-ppp0

default dev ppp0 table isp-2

確認

# ip route show table main

default via 10.10.1.1 dev eth1
169.254.0.0/16 dev eth0  scope link  metric 1002
169.254.0.0/16 dev eth1  scope link  metric 1003
10.10.1.0/24 dev eth1  proto kernel  scope link  src 10.10.1.2
★PPPサーバ★ dev ppp0  proto kernel  scope link  src 192.0.2.123

# ip route show table isp-2

default dev ppp0  scope link

# ip rule

0:      from all lookup local
32762:  from 192.0.2.123 lookup isp-2
32766:  from all lookup main
32767:  from all lookup default

おまけ

#  vim /etc/iproute2/rt_tables


#
# reserved values
#
255     local
254     main
253     default
0       unspec
#
# local
#
#1      inr.ruhep
201     isp-1

#  vim /etc/sysconfig/network-scripts/rule-eth1

from 10.10.1.2 table isp-1

#  vim /etc/sysconfig/network-scripts/route-eth1

10.10.1.0/24 dev eth1 src 10.10.1.2 table isp-1
10.10.1.0/24 dev eth1 src 10.10.1.2
default via 10.10.1.1 table isp-1

参考文献