Настройка сети на ОС Альт Linux (роутеры и серверы) — 09.02.06 /etc/net

apt-get update && apt-get install iptables tzdata -y

hostnamectl set-hostname isp.au-team.irpo; exec bash

cat > /etc/net/ifaces/enp7s1/options << 'EOF'
BOOTPROTO=dhcp
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF

mkdir -p /etc/net/ifaces/enp7s2
cat > /etc/net/ifaces/enp7s2/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
echo '172.16.1.1/28' > /etc/net/ifaces/enp7s2/ipv4address

mkdir -p /etc/net/ifaces/enp7s3
cat > /etc/net/ifaces/enp7s3/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
echo '172.16.2.1/28' > /etc/net/ifaces/enp7s3/ipv4address

systemctl restart network

echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-forward.conf
sysctl -p /etc/sysctl.d/99-forward.conf

iptables -t nat -A POSTROUTING -s 172.16.1.0/28 -o enp7s1 -j MASQUERADE
iptables -t nat -A POSTROUTING -s 172.16.2.0/28 -o enp7s1 -j MASQUERADE

iptables-save > /etc/sysconfig/iptables
systemctl enable iptables

timedatectl set-timezone Europe/Moscow

apt-get update && apt-get install frr dhcp-server tzdata iptables sudo -y

hostnamectl set-hostname hq-rtr.au-team.irpo; exec bash

mkdir -p /etc/net/ifaces/enp7s1
cat > /etc/net/ifaces/enp7s1/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
echo '172.16.1.2/28' > /etc/net/ifaces/enp7s1/ipv4address
echo 'default via 172.16.1.1' > /etc/net/ifaces/enp7s1/ipv4route

mkdir -p /etc/net/ifaces/enp7s2
cat > /etc/net/ifaces/enp7s2/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF

mkdir -p /etc/net/ifaces/enp7s2.100
cat > /etc/net/ifaces/enp7s2.100/options << 'EOF'
BOOTPROTO=static
TYPE=vlan
HOST=enp7s2
VID=100
NM_CONTROLLED=no
DISABLED=no
EOF
echo '192.168.100.1/27' > /etc/net/ifaces/enp7s2.100/ipv4address

mkdir -p /etc/net/ifaces/enp7s2.200
cat > /etc/net/ifaces/enp7s2.200/options << 'EOF'
BOOTPROTO=static
TYPE=vlan
HOST=enp7s2
VID=200
NM_CONTROLLED=no
DISABLED=no
EOF
echo '192.168.200.1/27' > /etc/net/ifaces/enp7s2.200/ipv4address

mkdir -p /etc/net/ifaces/enp7s2.999
cat > /etc/net/ifaces/enp7s2.999/options << 'EOF'
BOOTPROTO=static
TYPE=vlan
HOST=enp7s2
VID=999
NM_CONTROLLED=no
DISABLED=no
EOF
echo '192.168.99.1/29' > /etc/net/ifaces/enp7s2.999/ipv4address

systemctl restart network
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-forward.conf
sysctl -p /etc/sysctl.d/99-forward.conf

iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
systemctl enable iptables

useradd -m net_admin
echo 'net_admin:P@ssw0rd' | chpasswd
echo 'net_admin ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/net_admin

mkdir -p /etc/net/ifaces/tun0
cat > /etc/net/ifaces/tun0/options << 'EOF'
TYPE=iptun
TUNTYPE=gre
TUNLOCAL=172.16.1.2
TUNREMOTE=172.16.2.2
TUNOPTIONS='ttl 64'
HOST=enp7s1
NM_CONTROLLED=no
DISABLED=no
EOF
echo '10.0.0.1/30' > /etc/net/ifaces/tun0/ipv4address
systemctl restart network

apt-get install -y frr
sed -i 's/ospfd=no/ospfd=yes/' /etc/frr/daemons
systemctl enable --now frr

vtysh << 'VEOF'
configure terminal
router ospf
 network 10.0.0.0/30 area 0
 network 192.168.100.0/27 area 0
 network 192.168.200.0/27 area 0
 network 192.168.99.0/29 area 0
 passive-interface enp7s1
 passive-interface enp7s2.100
 passive-interface enp7s2.200
 passive-interface enp7s2.999
exit
interface tun0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 P@ssw0rd
exit
router ospf
 area 0 authentication message-digest
exit
end
write memory
VEOF

apt-get install -y dhcp-server
cat > /etc/dhcp/dhcpd.conf << 'EOF'
subnet 192.168.200.0 netmask 255.255.255.224 {
  range 192.168.200.2 192.168.200.30;
  option routers 192.168.200.1;
  option domain-name-servers 192.168.100.2;
  option domain-name "au-team.irpo";
}
EOF

sed -i 's/DHCPDARGS=/DHCPDARGS=enp7s2.200/' /etc/sysconfig/dhcpd
systemctl enable --now dhcpd

timedatectl set-timezone Europe/Moscow

apt-get update && apt-get install frr tzdata iptables sudo -y

hostnamectl set-hostname br-rtr.au-team.irpo; exec bash

mkdir -p /etc/net/ifaces/enp7s1
cat > /etc/net/ifaces/enp7s1/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
echo '172.16.2.2/28' > /etc/net/ifaces/enp7s1/ipv4address
echo 'default via 172.16.2.1' > /etc/net/ifaces/enp7s1/ipv4route

mkdir -p /etc/net/ifaces/enp7s2
cat > /etc/net/ifaces/enp7s2/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
echo '192.168.201.1/28' > /etc/net/ifaces/enp7s2/ipv4address

systemctl restart network
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-forward.conf
sysctl -p /etc/sysctl.d/99-forward.conf
iptables -t nat -A POSTROUTING -o enp7s1 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
systemctl enable iptables

useradd -m net_admin
echo 'net_admin:P@ssw0rd' | chpasswd
echo 'net_admin ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/net_admin

mkdir -p /etc/net/ifaces/tun0
cat > /etc/net/ifaces/tun0/options << 'EOF'
TYPE=iptun
TUNTYPE=gre
TUNLOCAL=172.16.2.2
TUNREMOTE=172.16.1.2
TUNOPTIONS='ttl 64'
HOST=enp7s1
NM_CONTROLLED=no
DISABLED=no
EOF
echo '10.0.0.2/30' > /etc/net/ifaces/tun0/ipv4address
systemctl restart network

apt-get install -y frr
sed -i 's/ospfd=no/ospfd=yes/' /etc/frr/daemons
systemctl enable --now frr

vtysh << 'VEOF'
configure terminal
router ospf
 network 10.0.0.0/30 area 0
 network 192.168.201.0/28 area 0
 passive-interface enp7s1
 passive-interface enp7s2
exit
interface tun0
 ip ospf authentication message-digest
 ip ospf message-digest-key 1 md5 P@ssw0rd
exit
router ospf
 area 0 authentication message-digest
exit
end
write memory
VEOF

timedatectl set-timezone Europe/Moscow

apt-get update && apt-get install tzdata sudo -y

hostnamectl set-hostname hq-srv.au-team.irpo; exec bash

mkdir -p /etc/net/ifaces/enp7s1.100
cat > /etc/net/ifaces/enp7s1/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
cat > /etc/net/ifaces/enp7s1.100/options << 'EOF'
BOOTPROTO=static
TYPE=vlan
HOST=enp7s1
VID=100
NM_CONTROLLED=no
DISABLED=no
EOF
echo '192.168.100.2/27' > /etc/net/ifaces/enp7s1.100/ipv4address
echo 'default via 192.168.100.1' > /etc/net/ifaces/enp7s1.100/ipv4route

# DNS — сам на себя (будет bind):
echo 'nameserver 127.0.0.1' > /etc/resolv.conf
systemctl restart network

useradd -m remote_user
useradd -m -u 2026 sshuser
echo 'sshuser:P@ssw0rd' | chpasswd
echo 'sshuser ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/sshuser

sed -i 's/#Port 22/Port 2026/' /etc/ssh/sshd_config
sed -i 's/#MaxAuthTries 6/MaxAuthTries 2/' /etc/ssh/sshd_config
sed -i 's|#Banner none|Banner /etc/ssh/banner|' /etc/ssh/sshd_config
echo 'AllowUsers sshuser' >> /etc/ssh/sshd_config
echo 'Authorized access only' > /etc/ssh/banner
systemctl restart sshd

apt-get install -y bind

mkdir -p /var/lib/bind/zone
cat > /var/lib/bind/zone/au-team.irpo << 'EOF'
$TTL 3600
@ IN SOA hq-srv.au-team.irpo. admin.au-team.irpo. (
        2024010101 3600 900 604800 86400 )
  IN NS  hq-srv.au-team.irpo.
hq-rtr  IN A 192.168.100.1
hq-srv  IN A 192.168.100.2
hq-cli  IN A 192.168.200.2
br-rtr  IN A 172.16.2.2
br-srv  IN A 192.168.201.2
docker  IN A 172.16.1.1
web     IN A 172.16.2.1
EOF

# Обратная зона 100.168.192:
cat > /var/lib/bind/zone/100.168.192.in-addr.arpa << 'EOF'
$TTL 3600
@ IN SOA hq-srv.au-team.irpo. admin.au-team.irpo. (
        2024010101 3600 900 604800 86400 )
  IN NS  hq-srv.au-team.irpo.
1  IN PTR hq-rtr.au-team.irpo.
2  IN PTR hq-srv.au-team.irpo.
EOF

# Обратная зона 200.168.192:
cat > /var/lib/bind/zone/200.168.192.in-addr.arpa << 'EOF'
$TTL 3600
@ IN SOA hq-srv.au-team.irpo. admin.au-team.irpo. (
        2024010101 3600 900 604800 86400 )
  IN NS  hq-srv.au-team.irpo.
2  IN PTR hq-cli.au-team.irpo.
EOF

cat > /etc/bind/named.conf << 'EOF'
options {
  directory "/var/lib/bind/zone";
  listen-on { any; };
  allow-query { any; };
  forwarders { 77.88.8.7; 77.88.8.3; };
  recursion yes;
};
zone "au-team.irpo" {
  type master;
  file "au-team.irpo";
};
zone "100.168.192.in-addr.arpa" {
  type master;
  file "100.168.192.in-addr.arpa";
};
zone "200.168.192.in-addr.arpa" {
  type master;
  file "200.168.192.in-addr.arpa";
};
EOF

chown -R named:named /var/lib/bind/zone
systemctl enable --now named
systemctl restart named

timedatectl set-timezone Europe/Moscow

apt-get update && apt-get install tzdata sudo -y

hostnamectl set-hostname br-srv.au-team.irpo; exec bash

mkdir -p /etc/net/ifaces/enp7s1
cat > /etc/net/ifaces/enp7s1/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
echo '192.168.201.2/28' > /etc/net/ifaces/enp7s1/ipv4address
echo 'default via 192.168.201.1' > /etc/net/ifaces/enp7s1/ipv4route
echo 'nameserver 192.168.100.2' > /etc/resolv.conf
systemctl restart network

useradd -m remote_user
useradd -m -u 2026 sshuser
echo 'sshuser:P@ssw0rd' | chpasswd
echo 'sshuser ALL=(ALL) NOPASSWD: ALL' > /etc/sudoers.d/sshuser

sed -i 's/#Port 22/Port 2026/' /etc/ssh/sshd_config
sed -i 's/#MaxAuthTries 6/MaxAuthTries 2/' /etc/ssh/sshd_config
sed -i 's|#Banner none|Banner /etc/ssh/banner|' /etc/ssh/sshd_config
echo 'AllowUsers sshuser' >> /etc/ssh/sshd_config
echo 'Authorized access only' > /etc/ssh/banner
systemctl restart sshd

timedatectl set-timezone Europe/Moscow

hostnamectl set-hostname hq-cli.au-team.irpo; exec bash

mkdir -p /etc/net/ifaces/enp7s1.200
cat > /etc/net/ifaces/enp7s1/options << 'EOF'
BOOTPROTO=static
TYPE=eth
NM_CONTROLLED=no
DISABLED=no
EOF
cat > /etc/net/ifaces/enp7s1.200/options << 'EOF'
BOOTPROTO=dhcp
TYPE=vlan
HOST=enp7s1
VID=200
NM_CONTROLLED=no
DISABLED=no
EOF
systemctl restart network
timedatectl set-timezone Europe/Moscow

apt-get install -y task-samba-dc
rm -f /etc/samba/smb.conf

samba-tool domain provision \
  --use-rfc2307 \
  --realm=AU-TEAM.IRPO \
  --domain=AU-TEAM \
  --server-role=dc \
  --dns-backend=SAMBA_INTERNAL \
  --adminpass='P@ssw0rd'

cp /var/lib/samba/private/krb5.conf /etc/krb5.conf
systemctl disable --now smb nmb winbind 2>/dev/null
systemctl enable --now samba

for i in 1 2 3 4 5; do samba-tool user create hquser$i P@ssw0rd; done
samba-tool group add hq
samba-tool group addmembers hq hquser1,hquser2,hquser3,hquser4,hquser5

apt-get install -y task-auth-ad-sssd

# DNS клиента указываем на BR-SRV (контроллер домена):
echo 'nameserver 192.168.201.2' > /etc/resolv.conf

system-auth write ad au-team.irpo AU-TEAM br-srv.au-team.irpo Administrator 'P@ssw0rd'
# Альтернатива:
realm join au-team.irpo -U Administrator

echo '%hq ALL=(ALL) NOPASSWD: /usr/bin/cat, /usr/bin/grep, /usr/bin/id' > /etc/sudoers.d/hq

apt-get install -y mdadm
lsblk
# Определи два диска по 1 ГБ, обычно /dev/sdb и /dev/sdc
mdadm --create /dev/md0 --level=0 --raid-devices=2 /dev/sdb /dev/sdc
mdadm --detail --scan >> /etc/mdadm.conf
mkfs.ext4 /dev/md0
mkdir -p /raid
echo '/dev/md0 /raid ext4 defaults 0 0' >> /etc/fstab
mount -a

apt-get install -y nfs-server
mkdir -p /raid/nfs
echo '/raid/nfs 192.168.200.0/27(rw,sync,no_root_squash)' > /etc/exports
exportfs -ra
systemctl enable --now nfs-server

apt-get install -y nfs-clients
mkdir -p /mnt/nfs
echo '192.168.100.2:/raid/nfs /mnt/nfs nfs defaults,_netdev 0 0' >> /etc/fstab
mount -a

apt-get install -y chrony
cat > /etc/chrony.conf << 'EOF'
server pool.ntp.org iburst
local stratum 5
allow 0.0.0.0/0
driftfile /var/lib/chrony/drift
EOF
systemctl enable --now chronyd && systemctl restart chronyd

apt-get install -y chrony
cat > /etc/chrony.conf << 'EOF'
server 172.16.1.1 iburst
driftfile /var/lib/chrony/drift
EOF
systemctl enable --now chronyd && systemctl restart chronyd

apt-get install -y ansible
mkdir -p /etc/ansible

cat > /etc/ansible/ansible.cfg << 'EOF'
[defaults]
inventory = /etc/ansible/hosts
host_key_checking = False
EOF

cat > /etc/ansible/hosts << 'EOF'
[servers]
hq-srv ansible_host=192.168.100.2 ansible_port=2026 ansible_user=sshuser
hq-cli ansible_host=192.168.200.2 ansible_user=sshuser

[routers]
hq-rtr ansible_host=192.168.100.1 ansible_user=net_admin
br-rtr ansible_host=192.168.201.1 ansible_user=net_admin
EOF

ssh-keygen -t rsa -N '' -f ~/.ssh/id_rsa
ssh-copy-id -p 2026 sshuser@192.168.100.2
ssh-copy-id sshuser@192.168.200.2
ssh-copy-id net_admin@192.168.100.1
ssh-copy-id net_admin@192.168.201.1

ansible all -m ping

apt-get install -y docker-engine docker-compose
systemctl enable --now docker

# Подключить Additional.iso:
mount /dev/cdrom /mnt
docker load -i /mnt/docker/site_latest
docker load -i /mnt/docker/mariadb_latest

mkdir -p /opt/testapp && cd /opt/testapp
cat > docker-compose.yml << 'EOF'
version: '3'
services:
  db:
    container_name: db
    image: mariadb_latest
    environment:
      MYSQL_ROOT_PASSWORD: P@ssw0rd
      MYSQL_DATABASE: testdb
      MYSQL_USER: test
      MYSQL_PASSWORD: P@ssw0rd
    restart: always
  testapp:
    container_name: testapp
    image: site_latest
    ports:
      - '8080:8080'
    environment:
      DB_HOST: db
      DB_NAME: testdb
      DB_USER: test
      DB_PASSWORD: P@ssw0rd
    depends_on:
      - db
    restart: always
EOF
docker-compose up -d

apt-get install -y httpd2 php8.2 php8.2-mysqlnd-mysqli mariadb-server
systemctl enable --now mariadb httpd2

mount /dev/cdrom /mnt
mysql -e "CREATE DATABASE webdb;"
mysql -e "CREATE USER 'web'@'localhost' IDENTIFIED BY 'P@ssw0rd';"
mysql -e "GRANT ALL ON webdb.* TO 'web'@'localhost'; FLUSH PRIVILEGES;"
mysql webdb < /mnt/web/dump.sql

cp /mnt/web/index.php /var/www/html/
cp -r /mnt/web/images /var/www/html/

# Отредактируй index.php — подключение к БД:
# host=localhost, dbname=webdb, user=web, password=P@ssw0rd
nano /var/www/html/index.php
systemctl restart httpd2

iptables -t nat -A PREROUTING -p tcp -d 172.16.2.2 --dport 8080 -j DNAT --to 192.168.201.2:8080
iptables -t nat -A PREROUTING -p tcp -d 172.16.2.2 --dport 2026 -j DNAT --to 192.168.201.2:2026
iptables-save > /etc/sysconfig/iptables

iptables -t nat -A PREROUTING -p tcp -d 172.16.1.2 --dport 8080 -j DNAT --to 192.168.100.2:80
iptables -t nat -A PREROUTING -p tcp -d 172.16.1.2 --dport 2026 -j DNAT --to 192.168.100.2:2026
iptables-save > /etc/sysconfig/iptables

apt-get install -y nginx

cat > /etc/nginx/sites-available.d/proxy.conf << 'EOF'
server {
  listen 80;
  server_name web.au-team.irpo;
  location / {
    proxy_pass http://172.16.1.2:8080;
  }
}
server {
  listen 80;
  server_name docker.au-team.irpo;
  location / {
    proxy_pass http://172.16.2.2:8080;
  }
}
EOF

ln -sf /etc/nginx/sites-available.d/proxy.conf /etc/nginx/sites-enabled.d/
nginx -t && systemctl enable --now nginx && systemctl restart nginx

apt-get install -y apache2-htpasswd || apt-get install -y httpd-tools
htpasswd -bc /etc/nginx/.htpasswd WEB P@ssw0rd

# В блок server web.au-team.irpo добавить:
#   auth_basic "Restricted";
#   auth_basic_user_file /etc/nginx/.htpasswd;
systemctl restart nginx

apt-get install -y yandex-browser-stable