Linux IP Masquerade 指南
上一页第 3 章. 设置 IP Masquerade下一页

3.2. 检查您现有的内核是否具备 MASQ 功能

如今，几乎所有现代 Linux 发行版都已准备好 MASQ，但在尝试设置之前检查您的系统始终是好的。请按照以下几个步骤检查您的内核是否已准备好 MASQ。

要查看您的系统正在运行哪个内核，请运行以下命令

uname -a

您还需要编译大多数与 MASQ 相关的模块（大多数模块化内核已经完成了您需要的一切。那么您将不需要重新编译内核。如果您不确定您的 Linux 发行版是否已准备好 MASQ，请执行以下操作

最终，归结为是否看到诸如“iip_forward", "ip_masq_debug", "ip_masq_udp_dloose”（可选）和“ip_always_defrag”（可选）之类的 /proc 文件是否存在。

所以。您相应的内核是否显示了上述大多数 /proc 条目或内核模块？ 如果是，那就太好了！ 如果您找不到上述任何条目，或者不确定您的发行版是否默认支持 IP 伪装，请假设它不支持 MASQ。 您可以最后检查一下 第 7.1 节，看看您的 Linux 发行版是否在列表中。 仍然没有？ 听起来您需要编译内核，但别担心……这并不难。

无论您当前的内核是否支持 MASQ，仍然强烈建议阅读本节的其余部分，因为它包含其他有用的信息。

3.2.1. 编译 Linux 2.4.x 内核

接下来，如果您有兴趣应用 Patch-O-Matic 补丁集，请进入patch-o-matic-X目录 (/usr/src/archive/netfilter/patch-o-matic-X) 并运行命令

现在内核源代码已打好补丁，您需要配置它以了解您需要的功能类型（HD 支持、网络支持、MASQ 支持等）。 以下是启用 IP 伪装功能所需的最低内核配置选项。 请理解，本指南仅说明了一种配置和编译内核的方法（模块与静态）。 本示例与不同 MASQ 指南给出的示例的主要区别在于，有些人可能希望将内核组件编译为模块或单体到内核中。 基本上，将内容编译为模块为您提供了更大的灵活性，可以控制内核中安装或未安装的内容（减少您不使用/不会使用的内容的不必要内存使用，并且模块还允许即插即用的软件升级 [通常无需重新启动机器]）。 另一方面，内核模块增加了配置的复杂性，有时内核自动加载器可能会出错（不是说我曾经见过这种情况发生）。 将内容直接编译到内核中使事情变得更简单，但是您会失去很大的灵活性。 以下内核配置示例是内核模块选择和单体构建的混合（您可能始终需要 MASQ 功能随时可用）。

您将需要对以下程序回答 YES、NO 或 MODULE。 如果没有本指南稍后描述的正确内核补丁，并非所有选项都可用。 这不应该是一个问题，因为大多数第三方补丁仅适用于非常精选的用户群。

运行以下命令来配置您的内核

请注意，以下内核提示反映了 2.4.14 内核（以及一些可选的 Patch-O-Matic 添加项）。 请仔细阅读以下建议

[ Code maturity level options ]

  * Prompt for development and/or incomplete code/drivers (CONFIG_EXPERIMENTAL) [Y/n/?]
    - YES: though not required for IP MASQ, this option allows the kernel to create 
           the MASQ modules and enable the option for port forwarding

  * Enable loadable module support (CONFIG_MODULES) [Y/n/?]
    - YES: allows you to load kernel IP MASQ modules

  * Set version information on all module symbols (CONFIG_MODVERSIONS) [Y/n/?]
    - YES: allows newer kernels to load older modules if possible

  * Kernel module loader (CONFIG_KMOD) [Y/n/?] 
    - OPTIONAL: Recommended : allows the kernel to load various kernel modules as it needs them

  == Non-MASQ options skipped
  ==   (CPU type, memory, SMP, FPU, specific stuff)


[ General setup ]

  * Networking support (CONFIG_NET) [Y/n/?]
    - YES: Enables the network subsystem

  == Non-MASQ options skipped 
  ==   (specific hardware, PCI, kernel binaries, PCMCIA, etc.)


  * Sysctl support (CONFIG_SYSCTL) [Y/n/?] 
    - YES:  Enables the ability to enable disable options such as forwarding,
      dynamic IPs, etc. via the /proc interface


[ Block devices ]

  == Non-MASQ options skipped
  ==   (kernel binaries, power management, PnP, RAID, etc.)

    == Don't forget to compile in support for hardware that you might need:
    ==   IDE controllers, HDs, CDROMs, etc.

[ Networking options ]

  * Packet socket (CONFIG_PACKET) [Y/m/n/?]
    - YES: Though this is OPTIONAL, this recommended feature will allow you 
           to use TCPDUMP to debug any problems with IP MASQ

  * Packet socket: mmapped IO (CONFIG_PACKET_MMAP) [N/y/?] y
    - YES: Speed up the packet protocol

  * Kernel/User netlink socket (CONFIG_NETLINK) [Y/n/?] 
    - OPTIONAL:  Recommended : this feature will allow the logging of 
           advanced firewall issues such as routing messages, etc

  * Routing messages (CONFIG_RTNETLINK) [N/y/?] (NEW) y
    - OPTIONAL: Allows for support of advanced kernel routing messages
                if you enabled the CONFIG_NETLINK option

  * Netlink device emulation (CONFIG_NETLINK_DEV) [N/y/m/?] (NEW)  
    - NO:  This option does not have anything to do with packet firewall 
           logging

  * Network packet filtering (replaces ipchains) (CONFIG_NETFILTER) [N/y/?] y
    - YES: Enable this option to let IPTABLES configure the TCP/IP subsection
           of the kernel.  By enabling this, then you can turn on advanced 
           routing mechanisms like IP Masq, packet filtering, etc.

  * Network packet filtering debugging (CONFIG_NETFILTER_DEBUG) [N/y/?] (NEW) n
    - NO: Not required for Masquerading functionality though it may help 
          for troubleshooting.  There might be a performance penalty when
          enabling this.

  * Socket Filtering (CONFIG_FILTER) [Y/n/?]
    - OPTIONAL:  Recommended : Though this doesn't have anything do with IPMASQ, 
      if you plan on implimenting a DHCP server on the internal network, you WILL 
      need to enable this option.

  * Unix domain sockets (CONFIG_UNIX) [Y/m/n/?]
    - YES:  This enables the UNIX TCP/IP sockets mechanisms

  * TCP/IP networking (CONFIG_INET) [Y/n/?]
    - YES: Enables the TCP/IP protocol

  * IP: multicasting (CONFIG_IP_MULTICAST) [N/y/?] 
    - OPTIONAL:  You can enable this if you want to be able to receive
                 Multicast traffic.  Please note that your ISP must 
                 support Multicast as well for this all to work at all
                 
  * IP: advanced router (CONFIG_IP_ADVANCED_ROUTER) [Y/n/?]
    - OPTIONAL:  Though there is nothing in this section mandatory for 
                 Masquerade, some specific options might be useful

    == Non-MASQ options skipped 
    ==   ( autoconf, tunneling )

  * IP: multicast routing (CONFIG_IP_MROUTE) [N/y/?] n
    - OPTIONAL:  Though not needed for IPMASQ, enabling this feature will
                 let you route multicast traffic through your Linux box.
                 Please note that this requires that your ISP be multicast
                 enabled as well.

    == Non-MASQ options skipped 
    ==   (ARPd) 

  * IP: TCP Explicit Congestion Notification support (CONFIG_INET_ECN) [N/y/?] n
    - NO: Though enabling this option would be great, there are many Internet
          sites out there that will block this.  Hit the "?" when configuring
          the kernel to learn more about it but it is recommended to say NO for 
          now.

  * IP: TCP syncookie support (disabled per default) (CONFIG_SYN_COOKIES) [Y/n/?]
    - YES: Recommended : for basic TCP/IP network security


[ Networking options --> IP: Netfilter Configuration ]


  * Connection tracking (required for masq/NAT) (CONFIG_IP_NF_CONNTRACK) [N/y/m/?] (NEW) m
    - YES: (Module) This enables the kernel to track various network connections.
           This option is required for Masquerading support as well as to enable 
           Stateful tracking for various filewall mechanisms.  Please note that
           if you compile this directly into the kernel, you cannot enable
           the legacy IPCHAINS or IPFWADM compatibility modules.

  * FTP protocol support (CONFIG_IP_NF_FTP) [M/n/?] (NEW) m
    - YES: (Module) This enables the proper Masquerading of FTP connections if 
           CONFIG_IP_NF_CONNTRACK was enabled above

  * IRC protocol support (CONFIG_IP_NF_IRC) [M/n/?] (NEW) m
    - YES: (Module) This enables the proper Masquerading of IRC connections if 
           CONFIG_IP_NF_CONNTRACK was enabled above

  * Userspace queueing via NETLINK (EXPERIMENTAL) (CONFIG_IP_NF_QUEUE) [N/y/m/?] (NEW) m
    - OPTIONAL: Though this is OPTIONAL, this feature will allow IPTABLES to 
                copy specific packets to UserSpace tools for additional checks

  * IP tables support (required for filtering/masq/NAT) (CONFIG_IP_NF_IPTABLES) [N/y/m/?] (NEW) m
    - YES: (Module) Enables IPTABLES support

  * limit match support (CONFIG_IP_NF_MATCH_LIMIT) [N/y/m/?] (NEW) y
    - OPTIONAL:  (Module) Recommended : Though not required, this option can used to 
                 enable rate limiting of both traffic and loggin messages help slow down denial
                 of service (DoS) attacks.

  * MAC address match support (CONFIG_IP_NF_MATCH_MAC) [N/y/m/?] (NEW) m
    - OPTIONAL:  Though not required, the option can allow you to 
                 filter traffic based upon the SOURCE Ethernet MAC address.

  * netfilter MARK match support (CONFIG_IP_NF_MATCH_MARK) [N/y/m/?] (NEW) y
    - YES: (Module) Recommended : This enables IPTABLES to take action upon marked packets.  
           This mechanism can allow for PORTFW functionality, TOS marking, etc.

  * Multiple port match support (CONFIG_IP_NF_MATCH_MULTIPORT) [N/y/m/?] (NEW) y
    - YES: (Module) Recommended : This enables IPTABLES to accept mutliple SRC/DST port
           ranges (non-contiguous) instead of one port range per IPTABLES 
           statement.

  * TOS match support (CONFIG_IP_NF_MATCH_TOS) [Y/m/n/?] n
    - OPTIONAL:  This allows IPTABLES to match packets based upon their
                 DIFFSERV settings.

  * LENGTH match support (CONFIG_IP_NF_MATCH_LENGTH) [N/m/?] (NEW) n
    - OPTIONAL:  This allows IPTABLES to match packets based upon their
                 packet length.

  * TTL match support (CONFIG_IP_NF_MATCH_TTL) [N/m/?] (NEW) ? n
    - OPTIONAL:  This allows IPTABLES to match packets based upon their
                 TTL settings.

  * tcpmss match support (CONFIG_IP_NF_MATCH_TCPMSS) [N/y/m/?] m
    - OPTIONAL: (Module) Recommended :  This option allows users to examine the MSS value in
                 TCP SYN packets.  This is an advanced knob but can be very valuable in 
                 troubleshooting MTU problems.

  * Connection state match support (CONFIG_IP_NF_MATCH_STATE) [M/n/?]  m
    - YES: (Module) Recommended : This option allows for Stateful tracking of network
            connections.

  * Unclean match support (EXPERIMENTAL) (CONFIG_IP_NF_MATCH_UNCLEAN) [N/y/m/?] y
    - YES: (Module) Recommended :  This option allows for connection tracking on odd packets.
           It cal also help in the detection of possibly malicious packets.
            This can be a valuable tool in tracking hostile people on the network.

  * Owner match support (EXPERIMENTAL) (CONFIG_IP_NF_MATCH_OWNER) [N/y/m/?] n
    - OPTIONAL:  This option allows IPTABLES to match traffic based upon the 
                 user login, group, etc. who created the traffic.

  * Packet filtering (CONFIG_IP_NF_FILTER) [N/y/m/?] ? y
    - YES: (Module) This option allows for the kernel to be able filter traffic at
            the INPUT, FORWARDING, and OUTPUT traffic points.

    * REJECT target support (CONFIG_IP_NF_TARGET_REJECT) [N/y/m/?] (NEW) y
      - YES: (Module) With this option, a packet firewall can send an ICMP Reject packet
            back to the originator when a packet is blocked.

  * MIRROR target support (EXPERIMENTAL) (CONFIG_IP_NF_TARGET_MIRROR) [N/y/m/?] (NEW) n
    - OPTIONAL: This option allows the packet firewall to mirror the exact same 
                network packet back to the originator when it is supposed to be 
                blocked.  This is similar to the REJECT option above but it actually 
                sends the original packet back to the originator.  i.e. a
                hostile user could actually portscan themselves.


  * Full NAT (CONFIG_IP_NF_NAT) [M/n/?] m
    - YES: (Module) This option enables the future menus to enable Masquerading, 
           PORTFWing, Full (1:1) NAT, etc.


  * MASQUERADE target support (CONFIG_IP_NF_TARGET_MASQUERADE) [M/n/?] (NEW) m
    - YES: (Module) This option specifically enables Masquerade into the 
           kernel

  * REDIRECT target support (CONFIG_IP_NF_TARGET_REDIRECT) [N/y/m/?] n
    - OPTIONAL: Not needed for normal MASQ functionality though people who 
                want to do transparent proxy via Squid will want this.  

  * Basic SNMP-ALG support (EXPERIMENTAL) (CONFIG_IP_NF_NAT_SNMP_BASIC) [N/m/?] n
    - OPTIONAL: This enables IPTABLES to properly NAT internal SNMP packets so 
                that machines with duplicate addressing ranges can be properly
                managed.

                
  * Packet mangling (CONFIG_IP_NF_MANGLE) [N/y/m/?] y
    - YES: (Module) This option allows for advanced IPTABLES packet manipulation 
           options.


  * TOS target support (CONFIG_IP_NF_TARGET_TOS) [N/y/m/?] (NEW) n
    - OPTIONAL: Enables the kernel to modify the TOS field in a packet 
           before routing it on

  * MARK target support (CONFIG_IP_NF_TARGET_MARK) [N/y/m/?] (NEW) m
    - OPTIONAL: (Module) Recommended : This enables the kernel to manipulate 
                packets based upon the MARK field.  This can be used for PORTFW 
                as well as many other things.

  * LOG target support (CONFIG_IP_NF_TARGET_LOG) [N/y/m/?]  m
    - YES: (Module)  This allows for the logging of packets before they are accepted,
           denied, rejected, etc.

  * TCPMSS target support (CONFIG_IP_NF_TARGET_TCPMSS) [N/y/m/?] ? m
    - YES: (Module) This option help some people with MTU problems.  Typically,
           most users have to set their Internet connection's MTU to 
           1500 as well as ALL internal machines to 1500.  With this
           option, this whole MTU issue might be finally solved.

  * ipchains (2.2-style) support (CONFIG_IP_NF_COMPAT_IPCHAINS) [N/y/m/?] m
    - OPTIONAL: (Module) Recommended : If you have an existing IPCHAINS ruleset 
           (2.2.x kernels) and enable this option, you can continue to use the 
           IPCHAINS program and the majority of your old ruleset except for the 
           use of any 2.2.x kernel-specific modules.  Please note that if this
           IPCHAINS module is loaded, ALL IPTABLES modules will be non-
           operational.  This is an either/or deal only intended for legacy
           rulesets.

  * ipfwadm (2.0-style) support (CONFIG_IP_NF_COMPAT_IPFWADM) [N/y/m/?] n
    - OPTIONAL: If you have an existing IPFWADM ruleset (2.0.x kernels) and 
           enable this option, you can continue to use the IPFWADM program and 
           the majority of your old ruleset except for the use of any 2.0.x 
           kernel-specific modules.   Please note that if this IPFWADM module 
           is loaded, ALL IPTABLES modules will be non operational.  This is 
           an either/or deal only intended to support legacy rulesets.                 


    == Non-MASQ options skipped
    ==   (IPv6, khttpd, ATM, IPX, AppleTalk, etc.) --

  * Fast switching (read help!) (CONFIG_NET_FASTROUTE) [N/y/?] n
    - NO: This performance optimization is NOT compatible with IP MASQ and/or
          packet filtering


    == Non-MASQ options skipped
    == (QoS, Telephony, IDE, SCSI, 1394FW, I2O, etc)

      == Don't forget to compile in support for hardware that you might need:
      ==   IDE:    HDs, CDROMs, etc.
      ==   SCSI:   HDs, CDROMs, etc.


[ Network device support ]

  * Network device support (CONFIG_NETDEVICES) [Y/n/?]
    - YES: Enables the Linux Network device sublayer 

    == Non-MASQ options skipped
    ==   (Arcnet) 


  * Dummy net driver support (CONFIG_DUMMY) [M/n/y/?] 
    - YES:  Though OPTIONAL, this option can help when debugging problems

    == Non-MASQ options skipped
    == (EQL, etc..)

    == Don't forget to compile in support for hardware that you might need:
    ==   NICs:   eth, tr, etc.
    ==   MODEMs: ppp (ppp async) and/or slip
    ==   WANs:   T1, T3, ISDN, etc.
    ==   ISDN:   for internal ISDN modems


    == Non-MASQ options skipped
    ==   (Amateur Radio, IrDA, ISDN, USB, etc.)


[ Character devices ]

    == Don't forget to compile in serial port support if you are a modem user
    == Don't forget to compile in mouse support

    == Non-MASQ options skipped
    ==   (I2C, Watchdog cards, Ftape, Video for Linux, etc. )


[ File systems ]

    == Non-MASQ options skipped
    ==   (Quota, ISO9660, NTFS, etc )

  * /proc filesystem support (CONFIG_PROC_FS) [Y/n/?]
    - YES:  Required to dynamically configure the Linux forwarding 
            and NATing systems


    == Non-MASQ options skipped
    ==   (Console drivers, Sound, USB, Kernel Hacking)
继续并选择 “exit”，您应该会看到提示您保存配置。

注意：这些只是您需要用于 IP 伪装网络支持的内核组件。 您将需要选择特定设置所需的任何其他选项。 如果您想了解有关这些内核模块中每一个模块的作用的更多信息，请参阅本指南的 FAQ 部分以获取详细信息。

3.2.2. 编译 Linux 2.2.x 内核

有关任何必需的软件、补丁等，请参阅 第 2.7 节。

请注意以下内容的 YES 或 NO 答案。 如果没有本指南稍后描述的正确内核补丁，并非所有选项都可用。

运行以下命令来配置您的内核

以下内核提示反映了 2.2.20 内核

[ Code maturity level options ]

  * Prompt for development and/or incomplete code/drivers (CONFIG_EXPERIMENTAL) [Y/n/?]
    - YES: though not entirely required for IP MASQ, this option allows the kernel 
           to create possible additional MASQ modules such as PORTFW, etc.

  == Non-MASQ options skipped
  ==   (CPU, memory, MTRR, SMP, etc.)


[ Loadable module support ]

  * Enable loadable module support (CONFIG_MODULES) [Y/n/?] y
    - YES: allows you to load kernel IP MASQ modules

  * Set version information on all symbols for modules (CONFIG_MODVERSIONS) [N/y/?] y
    - YES: allows newer kernels to load older modules if possible

  * Kernel module loader (CONFIG_KMOD) [Y/n/?] y
    - OPTIONAL: Recommended : allows the kernel to load various kernel modules as 
         it needs them


[ General setup ]

  * Networking support (CONFIG_NET) [Y/n/?]
    - YES: This enables the network subsystem

  == Non-MASQ options skipped
  ==   (PCI, kernel binaries, specific hardware options, etc.)


  * Sysctl support (CONFIG_SYSCTL) [Y/n/?] 
    - YES:  Enables the ability to enable disable options such as forwarding,
      dynamic IPs, etc. via the /proc interface


[ Block devices ]

  == Non-MASQ options skipped
  ==   (kernel binaries, power management, PnP, IDE, SCSI, etc.)

    == Don't forget to compile in support for hardware that you might need:
    ==   IDE controllers, HDs, CDROMs, etc.


[ Networking options ]


  * Packet socket (CONFIG_PACKET) [Y/m/n/?] y
    - YES: Though this is OPTIONAL, this recommended feature will allow you 
           to use TCPDUMP to debug any problems with IP MASQ

  * Kernel/User netlink socket (CONFIG_NETLINK) [Y/n/?] y
    - OPTIONAL: Recommended :  This feature will allow the logging of 
           advanced firewall issues such as routing messages, etc

  * Routing messages (CONFIG_RTNETLINK) [Y/n/?] y
    - OPTIONAL: If you enabled the CONFIG_NETLINK option above, this option 
           will send routing messages and other information to SYSLOG.

  * Netlink device emulation (CONFIG_NETLINK_DEV) [N/y/m/?] (NEW) n
    - NO:  This option does not have anything to do with packet firewall 
           logging

  * Network firewalls (CONFIG_FIREWALL) [Y/n/?] y
    - YES: Enables the kernel to be comfigured by the IPCHAINS firewall tool

  * Socket Filtering (CONFIG_FILTER) [Y/n/?] y
    - OPTIONAL:  Though this doesn't have anything do with IPMASQ, if you 
         plan on implimenting a DHCP server on the internal network, you 
         WILL need this option.

  * Unix domain sockets (CONFIG_UNIX) [Y/m/n/?] y
    - YES:  This enables the UNIX TCP/IP sockets mechanisms

  * TCP/IP networking (CONFIG_INET) [Y/n/?] y
    - YES: Enables the TCP/IP protocol

  * IP: multicasting (CONFIG_IP_MULTICAST) [N/y/?] y
    - OPTIONAL:  You can enable this if you want to be able to receive
                 Multicast traffic.  Please note that your ISP must 
                 support Multicast as well for this all to work
                 
  * IP: advanced router (CONFIG_IP_ADVANCED_ROUTER) [Y/n/?] n
    - OPTIONAL:  Though there is nothing in this section mandatory for 
                 Masquerade, some specific options might be useful

  * IP: kernel level autoconfiguration (CONFIG_IP_PNP) [N/y/?] ?
    - NO:  Not needed for normal MASQ functionality

  * IP: firewalling (CONFIG_IP_FIREWALL) [Y/n/?] y
    - YES: This enables the kernel to support packet filtering, NAT, etc.

  * IP: firewall packet netlink device (CONFIG_IP_FIREWALL_NETLINK) [Y/n/?] n
    - OPTIONAL: Though this is OPTIONAL, this feature will allow IPCHAINS to 
                copy some packets to UserSpace tools for additional checks

  * IP: transparent proxy support (CONFIG_IP_TRANSPARENT_PROXY) [N/y/?] n
    - OPTIONAL:  Not needed for normal MASQ functionality though people who 
           want to do transparent proxy via Squid will want this.  Please note
           that there is a PERFORMANCE PENALTY enabling this feature.

  * IP: masquerading (CONFIG_IP_MASQUERADE) [Y/n/?] y
    - YES: Enable IP Masquerade to re-address specific internal to external 
           TCP/IP packets

  * IP: ICMP masquerading (CONFIG_IP_MASQUERADE_ICMP) [Y/n/?] y
    - YES: Enable support for masquerading ICMP ping packets (ICMP error 
           codes will be MASQed regardless).  This is an important feature 
           for troubleshooting connections.

  * IP: masquerading special modules support (CONFIG_IP_MASQUERADE_MOD) [Y/n/?] y
    - YES: Though OPTIONAL, this enables the option to later enable other
           modules like the PORTFW to give external computers a directly 
           connection to specified internal MASQed machines.

  * IP: ipautofw masq support (EXPERIMENTAL) (CONFIG_IP_MASQUERADE_IPAUTOFW) [N/y/m/?] n
    - NO:  NOT recommended : IPautofw is a legacy method of port forwarding.  It 
           is mainly old code and has been found to have some issues.  

  * IP: ipportfw masq support (EXPERIMENTAL) (CONFIG_IP_MASQUERADE_IPPORTFW) [Y/m/n/?] y
    - OPTIONAL: Recommended : This enables PORTFW which allows external computers 
           on the Internet to directly communicate to specified internal MASQed 
           machines.  This feature is typically used to allow access to internal 
           SMTP, TELNET, and WWW servers.  Please note that FTP port forwarding 
           needs an additional patch, as described in the FAQ section of the MASQ 
           HOWTO.  Please see the this FAQ section in the HOWTO for additional 
           information.

  * IP: ip fwmark masq-forwarding support (EXPERIMENTAL) (CONFIG_IP_MASQUERADE_MFW) [Y/m/n/?] y
    - OPTIONAL:  This is a NEW method of performing PORTFW-like functionality which is
           similar to how the new 2.4.x kernels do things.  With this option, IPCHAINS 
           can mark packets that should have additional work done upon it.  Using a 
           UserSpace tool, much like IPMASQADM or IPPORFW, IPCHAINS would then 
           do things like re-address the packets, change their TOS value, etc. 
           Currently, this code is less tested than PORTFW but it looks promising.  
           For now, this HOWTO recommends to use IPMASQADM and IPPORTFW.  If you 
           have specific thoughts or comments on MFW, please email dranch.

  * IP: optimize as a router not host (CONFIG_IP_ROUTER) [Y/n/?] y
    - YES:  This optimizes the kernel for the network subsystem, though it 
            isn't well known if this makes a siginificant performance difference 
            or not.

  == Non-MASQ options skipped 
  ==   ( autoconf, tunneling, GRE )


  * IP: multicast routing (CONFIG_IP_MROUTE) [N/y/?] n
    - OPTIONAL:  Though not needed for IPMASQ, enabling this feature will
                 let you route multicast traffic through your Linux box.
                 Please note that this requires that your ISP be multicast
                 enabled as well.


    == Non-MASQ options skipped 
    ==  (Aliasing, ARPd) 

  * IP: TCP syncookie support (disabled per default) (CONFIG_SYN_COOKIES) [Y/n/?]
    - YES: Recommended : for basic TCP/IP network security

  * IP: GRE tunnels over IP (CONFIG_NET_IPGRE) [N/y/m/?]
    - NO:   This OPTIONAL selection is to enable PPTP and GRE tunnels through 
            the IP MASQ box

    == Non-MASQ options skipped
    ==   (aliasing, ARPd) 


  * IP: TCP syncookie support (not enabled per default) (CONFIG_SYN_COOKIES) [Y/n/?]
    - YES: HIGHLY recommended for basic TCP/IP network security

    == Non-MASQ options skipped
    ==  (RARP)


  * IP: Allow large windows (not recommended if <16Mb of memory) * (CONFIG_SKB_LARGE) [Y/n/?]
    - YES:  This is recommended to optimize Linux's TCP window 

    == Non-MASQ options skipped
    ==   (IPv6, IPX, WAN router, etc.)

  * Fast switching (read help!) (CONFIG_NET_FASTROUTE) [N/y/?] n
    - NO: This performance optimization is NOT compatible with IP MASQ and/or
          packet filtering


  == Non-MASQ options skipped
  == (Slow CPU, Telephony, SCSI, I2O, etc. )

    == Don't forget to compile in support for hardware that you might need:
    ==   SCSI:   HDs, CDROMs, etc.


[ Network device support ]

  * Network device support (CONFIG_NETDEVICES) [Y/n/?]
    - YES: Enables the Linux Network device sublayer 


  == Non-MASQ options skipped
  ==   (Arcnet) 


  * Dummy net driver support (CONFIG_DUMMY) [M/n/y/?] 
    - YES:  Though OPTIONAL, this option can help when debugging problems


  == Non-MASQ options skipped
  == (EQL, NICs, Wireless, IrDA, ISDN, etc..)

    == Don't forget to compile in support for hardware that you might need:
    ==   NICs:   eth, tr, etc.
    ==   MODEMs: ppp and/or slip
    ==   WANs:   T1, T3, ISDN, etc.
    ==   ISDN:   for internal ISDN modems


 [ Character devices ]

  == Don't forget to compile in serial port support for modem users
  == Don't forget to compile in mouse support


  == Non-MASQ options skipped
  ==   (I2C, Watchdog cards, Ftape, Video for Linux, USB, etc. )


[ File systems ]

  == Non-MASQ options skipped
  ==   (Quota, ISO9660, NTFS, etc )


  * /proc filesystem support (CONFIG_PROC_FS) [Y/n/?]
    - YES:  Required to dynamically configure the Linux forwarding 
            and NATing systems


  == Non-MASQ options skipped
  ==   (network fs, NLS, video section, sound, kernel hacking)
继续并 “exit”，您应该会看到提示您保存配置。

注意：这些只是您需要用于 IP Masquerade 的组件。 您将需要选择特定设置所需的任何其他选项。

3.2.3. 编译 Linux 2.0.x 内核

有关任何必需的软件、补丁等，请参阅 第 2.8 节。

请注意以下选项的 YES 或 NO 答案。 如果没有本指南稍后描述的正确内核补丁，并非所有选项都可用

运行以下命令来配置您的内核

以下内核提示反映了 2.0.39 内核

[ Code maturity level options ]

  * Prompt for development and/or incomplete code/drivers (CONFIG_EXPERIMENTAL) [Y/n/?] 
    - YES: this will allow you to later select the IP Masquerade feature code 


[ Loadable module support ]

  * Enable loadable module support (CONFIG_MODULES) [Y/n/?] y
    - YES: allows you to load kernel IP MASQ modules

  * Set version information on all module symbols (CONFIG_MODVERSIONS) [N/y/?] y
    - YES: allows newer kernels to load older modules if possible

  * Kernel daemon support (e.g. autoload of modules) (CONFIG_KERNELD) [N/y/?] y
    - OPTIONAL: Recommended : allows the kernel to load various kernel modules as 
         it needs them


[ General setup ]

  == Non-MASQ options skipped
  ==   (FPU, memory) 

  * Networking support (CONFIG_NET) [Y/n/?] y
    - YES: Enables the network subsystem

  == Non-MASQ options skipped
  ==   (memory, PCI, binary format, APM, etc.) 

    == Don't forget to compile in support for hardware that you might need:
    ==   IDE controllers, HDs, CDROMs, etc.


[ Networking options ]

  * Network firewalls (CONFIG_FIREWALL) [Y/n/?] y
    - YES: Enables the IPFWADM firewall tool

  == Non-MASQ options skipped
  ==   (Aliasing)


  * TCP/IP networking (CONFIG_INET) [Y/n/?] y
    - YES: Enables the TCP/IP protocol

  * IP: forwarding/gatewaying (CONFIG_IP_FORWARD) [N/y/?] y
    - YES: Enables Linux network packet forwarding and routing 
           - Controlled by IPFWADM

  * IP: multicasting (CONFIG_IP_MULTICAST) [N/y/?] y
    - OPTIONAL:  You can enable this if you want to be able to receive
                 Multicast traffic.  Please note that your ISP must 
                 support Multicast as well for this all to work
                 
  * IP: syn cookies (CONFIG_SYN_COOKIES) [Y/n/?] y
    - YES: HIGHLY recommended for basic network security

  * IP: firewalling (CONFIG_IP_FIREWALL) [Y/n/?] y
    - YES: Enable the packet firewall features

  * IP: firewall packet logging (CONFIG_IP_FIREWALL_VERBOSE) [Y/n/?] y
    - YES: Allows the kernel to report back on various packets traversing
           the firewall.

  * IP: masquerading (CONFIG_IP_MASQUERADE [Y/n/?] y
    - YES: Enable the kernel to perform IP MASQ NAT functionality

  * IP: ipautofw masquerade support (EXPERIMENTAL) (CONFIG_IP_MASQUERADE_IPAUTOFW) [Y/n/?] n
    - NO:  NOT Recommended : IPautofw is a legacy method of TCP/IP port forwarding.  
           Though IPautofw works, IPPORTFW is a better choice.


  * IP: ipportfw masq support (EXPERIMENTAL) (CONFIG_IP_MASQUERADE_IPPORTFW) [Y/n/?] y
    - YES: This option is ONLY AVAILABLE VIA A PATCH for the 2.0.x kernels.  
           With this option, external computers on the Internet can directly 
           communicate to specified internal MASQed machines.  This feature is 
           typically used to access internal SMTP, TELNET, and WWW servers.  
           FTP port forwarding sometimes might require an additional patch as 
           described in the FAQ section.  Additional information on port 
           forwarding is available in the Forwards section of this HOWTO.


  * IP: MS PPTP masq support (EXPERIMENTAL) (CONFIG_IP_MASQUERADE_PPTP) [N/y/?] (NEW) n
    - OPTIONAL: Enabling this feature will allow internal MASQ clients to
          properly connect to PPTP servers on the Internet.

  * IP: MS PPTP Call ID masq support (CONFIG_IP_MASQUERADE_PPTP_MULTICLIENT) [N/y/?] (NEW) n
    - OPTIONAL:  If you enabled the CONFIG_IP_MASQUERADE_PPTP above, this
          option will allow for multiple internal PPTP clients behind the MASQ 
          server to communicate to the same PPTP server.

  * IP: MS PPTP masq debugging (DEBUG_IP_MASQUERADE_PPTP) [N/y/?] n
    - OPTIONAL:  NOT recommended : This is not required for IP MASQ or MASQing PPTP 
           connections unless you need additional troubleshooting help.  If enabled, 
           this can fill up your logs quickly.

  * IP: MS PPTP masq verbose debugging (DEBUG_IP_MASQUERADE_PPTP_VERBOSE) [N/y/?] (NEW) n
    - OPTIONAL: NOT Recommended : If you enabled the DEBUG_IP_MASQUERADE_PPTP
           option above, this will make the logging even more verbose.

  * IP: IPSEC ESP & ISAKMP masq support (EXPERIMENTAL) * (CONFIG_IP_MASQUERADE_IPSEC) [N/y/?] m
    - OPTIONAL: This option allows for some forms of IPSEC tunnels to be
           masquraded

  * IP: IPSEC masq table lifetime (minutes) (CONFIG_IP_MASQUERADE_IPSEC_EXPIRE) * [30] (NEW) 
    - OPTIONAL: This feature allows to change the MASQ table timeouts so that
      idle IPSEC tunnels won't be prematurely disconnected.

  * IP: Disable inbound ESP destination guessing * (CONFIG_IP_MASQUERADE_IPSEC_NOGUESS) [N/y/?] n
    - OPTIONAL: This feature allows the kernel to guess where the fully encrypted IPSEC VPN 
           might be going and add it to the MASQ table.

  * IP: IPSEC masq debugging (DEBUG_IP_MASQUERADE_IPSEC) [N/y/?] ? n
    - OPTIONAL:  NOT recommended : This is not required for IP MASQ or MASQing IPSEC 
           connections unless you need additional troubleshooting help.  If enabled, 
           this can fill up your logs quickly.

  * IP: IPSEC masq verbose debugging (DEBUG_IP_MASQUERADE_IPSEC_VERBOSE) [N/y/?] (NEW) n
    - OPTIONAL: NOT Recommended : If you enabled the DEBUG_IP_MASQUERADE_IPSEC
           option above, this will make the logging even more verbose.


  * IP: ICMP masquerading (CONFIG_IP_MASQUERADE_ICMP) [Y/n/?]
    - YES: Enable support for masquerading ICMP packets. Though thought of as 
           optional, many programs will NOT function properly with out ICMP 
           support.

  * IP: transparent proxy support (EXPERIMENTAL) (CONFIG_IP_TRANSPARENT_PROXY) [N/y/?] n
    - OPTIONAL:  Not needed for normal MASQ functionality though people who 
           want to do transparent proxy via Squid will want this.  Please note
           that there is a PERFORMANCE PENALTY enabling this feature.

  * IP: loose UDP port managing (EXPERIMENTAL) (CONFIG_IP_MASQ_LOOSE_UDP) [Y/n/?] 
    - YES: This option is ONLY AVAILABLE VIA A PATCH for the 2.0.x kernels.
           With this option, internally masqueraded computers can play 
           NAT-friendly games over the Internet.  Explicit details are given 
           in the FAQ section of this HOWTO.

  * IP: always defragment (CONFIG_IP_ALWAYS_DEFRAG) [Y/n/?]
    - YES:  This feature optimizes IP MASQ connections

  == Non-MASQ options skipped
  ==   (Accounting)


  * IP: optimize as router not host (CONFIG_IP_ROUTER) [Y/n/?] 
    - YES:  This optimizes the kernel for the network subsystem 

  == Non-MASQ options skipped
  ==   (Tunneling, Mcast routing, RARP, PMTU, etc.)


  * IP: Drop source routed frames (CONFIG_IP_NOSR) [Y/n/?]
    - YES: HIGHLY recommended for basic network security

  == Non-MASQ options skipped
  ==   (IPX, Bridging, SCSI, etc.)

    == Don't forget to compile in support for hardware that you might need:
    ==   SCSI controllers, HDs, CDROMs, etc.


[ Network device support ]

  * Network device support (CONFIG_NETDEVICES) [Y/n/?]
    - YES: Enables the Linux Network device sublayer 


  == Non-MASQ options skipped
  ==   (Dummy, EQL, PPP, SLIP, NICs, Wireless, etc.) 

    == Don't forget to compile in support for hardware that you might need:
    ==   NICs:   eth, tr, etc.
    ==   MODEMs: ppp and/or slip
    ==   WANs:   T1, T3, ISDN, etc.
    ==   ISDN:   for internal ISDN modems


[ File systems ]

  == Non-MASQ options skipped
  ==   (Quota, ISO9660, Codepages, NTFS, etc )


  * /proc filesystem support (CONFIG_PROC_FS) [Y/n/?]
    - YES:  Required to dynamically configure the Linux forwarding 
            and NATing systems
  

 [ Character devices ]

  == Non-MASQ options skipped
  ==   (multi-port serial, parallel, mice, Ftape, Sound, etc. )

    == Don't forget to compile in serial port support for modem users
    == Don't forget to compile in mouse support

继续并 “exit”，您应该会看到提示您保存配置。

注意：这些只是用于 IP Masquerade 功能的组件。 您可能还需要选择其他选项以匹配您的特定网络和硬件设置。

上一页首页下一页
如果需要，编译新内核向上为内部 LAN 分配专用网络 IP 地址