Proxies
1. Intro
Proxies are all over the place. There is a lot of misunderstanding
what a proxy does. Therefore, I created this little lab. The goal is
to show how a proxy works and what kind of packets flow where.
As a client, I use a Windows 10 virtual machine, partly also because
I want to see some of the Windows 10 network behavior. The rest will
all be Linux boxes, because that is easier to generate with Vagrant.
2. The network
The basic idea is, that we have two different networks, one with a web server
and one with the client. Both networks get a DNS server, but the website will
not be in the DNS server of the client. The client can only access the
URL for the website via the proxy.
2.1. The client network
The client is a Windows 10 virtual machine that I have lying around. In
the client network, there is also a DNS server that serves DNS for the
client network only (so not for the server network that will be
created later on.
R1, which is the client router, will get the more-or-less standard .1 address
on those networks.
interface Ethernet0/0 ip address 10.128.1.1 255.255.255.0 no shut ! interface Ethernet0/1 ip address 10.128.2.1 255.255.255.0 no shut ! interface Ethernet0/3 ip address 10.128.3.2 255.255.255.0 half-duplex !
E0/3 is the connection towards the server router.
The server precise2 is a Linux server that will act as an Intranet server.
It will do name resolution for the Intranet, 10.128.1.0/24 and 10.128.2.0/24.
The server is created with Vagrant:
# -*- mode: ruby -*-
# vi: set ft=ruby :
# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
config.vm.define :precise2 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet2" ]
end
t.vm.provision "shell", path: "./setup.precise2.sh"
end
end
And the basic network configuration in
setup.precise2.sh
is:
ifconfig eth1 10.128.2.100 netmask 255.255.255.0 up route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.2.1
On the Windows client, the second network is connected to vboxnet1 and
it has the static IP address 10.128.1.100.
In a
cmd
console as administrator, the route to the GNS3 network needs to be set:
:\WINDOWS\system32>route ADD 10.128.0.0 MASK 255.255.0.0 10.128.1.1 OK! C:\WINDOWS\system32>ping 10.128.1.1 Pinging 10.128.1.1 with 32 bytes of data: Reply from 10.128.1.1: bytes=32 time=3ms TTL=255 Reply from 10.128.1.1: bytes=32 time=7ms TTL=255 Reply from 10.128.1.1: bytes=32 time<1ms TTL=255 Ping statistics for 10.128.1.1: Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 7ms, Average = 3ms Control-C ^C C:\WINDOWS\system32>ping 10.128.2.1 Pinging 10.128.2.1 with 32 bytes of data: Reply from 10.128.2.1: bytes=32 time<1ms TTL=255 Reply from 10.128.2.1: bytes=32 time=4ms TTL=255 Reply from 10.128.2.1: bytes=32 time=8ms TTL=255 Ping statistics for 10.128.2.1: Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 8ms, Average = 4ms Control-C ^C C:\WINDOWS\system32>ping 10.128.2.100 Pinging 10.128.2.100 with 32 bytes of data: Reply from 10.128.2.100: bytes=32 time=17ms TTL=63 Reply from 10.128.2.100: bytes=32 time=10ms TTL=63 Reply from 10.128.2.100: bytes=32 time=14ms TTL=63 Ping statistics for 10.128.2.100: Packets: Sent = 3, Received = 3, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 10ms, Maximum = 17ms, Average = 13ms Control-C ^C
2.2. The server network
The server network will have three servers:
-
a proxy on precise1
-
a web server on precise3
-
a name server on precise4
The Vagrantfile then becomes:
# -*- mode: ruby -*-
# vi: set ft=ruby :
# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
config.vm.define :precise1 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet0" ]
end
t.vm.provision "shell", path: "./setup.precise1.sh"
end
config.vm.define :precise2 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet2" ]
end
t.vm.provision "shell", path: "./setup.precise2.sh"
end
config.vm.define :precise3 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet3" ]
end
t.vm.provision "shell", path: "./setup.precise3.sh"
end
config.vm.define :precise4 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet4" ]
end
t.vm.provision "shell", path: "./setup.precise4.sh"
end
end
And the setup files:
setup.precise1.sh:
ifconfig eth1 10.128.4.100 netmask 255.255.255.0 up route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.4.1
setup.precise3.sh:
ifconfig eth1 10.128.5.100 netmask 255.255.255.0 up route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.5.1
setup.precise4.sh:
ifconfig eth1 10.128.6.100 netmask 255.255.255.0 up route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.6.1
The router R2 will get:
sh ip int br Interface IP-Address OK? Method Status Protocol Ethernet0/0 10.128.5.1 YES manual up up Ethernet0/1 10.128.4.1 YES manual up up Ethernet0/2 10.128.6.1 YES manual up up Ethernet0/3 10.128.3.1 YES manual up up
2.3. Last points
Finally, both routers get to talk RIP, because I'm a lazy sod and I don't care.
enable conf t router rip network 10.0.0.0
The network now looks like this.
3. The servers
3.1. Name servers
Precise4 and precise2 will be name servers. Precise1 will serve the
client side and precise1 the server side.
Installing a name server on a Linux machine is easy, but the configuration
requires some thinking. I solved that problem before and made a Perl script
that I just recycle here.
That makes the
setup.precise2.sh
simple:
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise2 start *'
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
# SHELL
function aptget {
DEBIAN_FRONTEND=noninteractive apt-get -y \
-o Dpkg::Options::="--force-confdef" \
-o Dpkg::Options::="--force-confold" \
$@
}
aptget -y update
aptget -y upgrade
ifconfig eth1 10.128.2.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.2.1
ifconfig
netstat -rn
echo '*********************************************************'
echo '* precise2: install bind *'
echo '*********************************************************'
aptget install bind9
aptget install dnsutils
cd /etc/bind
cp /vagrant/client /vagrant/make_config.perl .
perl make_config.perl client
/etc/init.d/bind9 restart
The file
client
contains the hosts that the name server must resolve:
gateway 10.128.1.1 win10 10.128.1.100 dnsgw 10.128.2.1 dns 10.128.2.100 proxy 10.128.4.100
The script is in the appendix.
The script for precise4 is the same, with the exception that the file is called
server
and not
client.
The file
server
contains:
proxy 10.128.4.100 web 10.128.5.100 dns 10.128.6.100
3.2. The web server
As a web server, we're not looking for anything special. Just serving
a page will do. So we'll use lighthttpd.
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise3 start *'
echo '*********************************************************'
echo '*************WEB SERVER**********************************'
echo '*********************************************************'
# SHELL
function aptget {
DEBIAN_FRONTEND=noninteractive apt-get -y \
-o Dpkg::Options::="--force-confdef" \
-o Dpkg::Options::="--force-confold" \
$@
}
aptget -y update
aptget -y upgrade
ifconfig eth1 10.128.5.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.5.1
ifconfig
netstat -rn
aptget install lighthttpd
And lo and behold, we can get the default page on the IP address
of the web server.
4. The Proxy
4.1. Installing the server
The proxy server is a simple out-of-the box Squid proxy on a virtual
Ubuntu server. The installation script is below:
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise1 start *'
echo '*********************************************************'
echo '**************PROXY**************************************'
echo '*********************************************************'
# SHELL
function aptget {
DEBIAN_FRONTEND=noninteractive apt-get -y \
-o Dpkg::Options::="--force-confdef" \
-o Dpkg::Options::="--force-confold" \
$@
}
aptget -y update
aptget -y upgrade
ifconfig eth1 10.128.4.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.4.1
ifconfig
netstat -rn
aptget install -y squid
aptget install -y squid-deb-proxy
aptget install -y language-pack-en
cp /vagrant/squid.conf /etc/squid3/squid.conf
service squid3 restart
cat > /etc/resolv.conf <
search server
nameserver 10.128.6.100
EOF
At the end of the script, we set the nameserver to 10.128.6.100. This is done
after
all the apt-gets, because our own DNS server does not resolve the hostnames
needed for the apt-get. It is also important to see that the DNS server is the
server server, for the .server hostnames, that is.
The
squid.conf
contains:
#Recommended minimum configuration:
acl manager proto cache_object
acl localhost src 127.0.0.1/32
acl to_localhost dst 127.0.0.0/8
acl localnet src 10.0.0.0/8 192.168.100.0/24 192.168.101.0/24
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
dns_nameservers 10.128.6.100
acl CONNECT method CONNECT
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny to_localhost
icp_access deny all
htcp_access deny all
http_port 3128
hierarchy_stoplist cgi-bin ?
access_log /var/log/squid3/access.log squid
#Suggested default:
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern -i (/cgi-bin/|\?) 0 0% 0
refresh_pattern . 0 20% 4320
# Leave coredumps in the first cache dir
coredump_dir /var/spool/squid3
# Allow all machines to all sites
http_access allow all
This is more or less a minimal setup for Squid.
4.2. Split DNS
Split DNS, also called split brains or split horizon, is a method that
separates the internal DNS from the external DNS. There are a number of reasons
for keeping a split DNS, most of which have some security aspects. The idea
behind it is very simple: there are two instances of DNS, that do not share data.
This is exactly how we set-up our network: the client does not know about
the server hostnames and vice-versa.
On the client (our Windows 10), the nameserver is precise2.
We can see this by issuing
ipconfig /all
on the command prompt. The result will contain:
DNS Servers . . . . . . . . . . . . . : 10.128.2.100
This means, that our Windows 10 system can resolve all the client addresses,
but not the server addresses:
C:\WINDOWS\system32>nslookup Default Server: dns.client Address: 10.128.2.100 > proxy.client Server: dns.client Address: 10.128.2.100 Name: proxy.client Address: 10.128.4.100 >web.server Server: dns.client Address: 10.128.2.100 *** dns.client can't find web.server: Query refused >
On the other hand, the proxy's DNS points to the server side. The same
nslookup
set here gives:
vagrant@precise64:~$ nslookup > proxy.client Server: 10.128.6.100 Address: 10.128.6.100#53 ** server can't find proxy.client: NXDOMAIN > web.server Server: 10.128.6.100 Address: 10.128.6.100#53 Name: web.server Address: 10.128.5.100 >
4.3. Using the proxy
There are many ways to set a proxy on Windows 10. You can do it system-wide
or just for a single application. I choose the latter. Under the 3-points menu in
the Edge browser, under Advanced, there is a setting Proxy Setup. Via the Open
Proxy Settings button, you can manually set a proxy. Use 10.128.4.100 on port 3128.
When we now browse to http://webserver/index.lighthttpd.html, we see our default
Placeholder Page. So, how does that work?
Our browser sends the complete http-get request to the proxy.
We see the packet coming from 10.128.1.100 (Windows 10) to 10.128.4.100, our proxy
server. We also see that the destination port of the packet is 3128, which is the proxy
port and not the http port. In the request, we see the complete http request to the
URL. The client has done nothing to resolve the host name, it just sends it in the
request to the proxy and lets the proxy handle it.
If you look at the rest of the traffic, you can see that Microsoft Edge is very noisy.
Most of the other requests fail, because our proxy does not work for the Internet.
We see calls to login.live.com, www.w3.or/Icons, nav.smartscreen.microsoft.com, which
all fail here, but normally just slow down your browser.
On our proxy, we see the following traffic. You may need to restart the proxy, because
otherwise it might serve from cache.
What we see is that the proxy first gets the http-request fro 10.128.1.100, our Windows
10 server. This results in a DNS query to 10.128.6.100, our server DNS (frame 116), from which it
gets its response. The response in 232 says that web.server is at 10.128.5.100, and the DNS
answer is to the proxy, not to the client.
Next, the proxy sets up a session to the web server to get the web page.
5. Conclusion
5.1. Result
We have shown how a proxy works. We did not use TLS, because we wanted to
show what is happening.
5.2. Windows 10: never again
You may ask why I did not put in a longer set of traffic. The answer is that
Our Windows 10 host just keeps blurting-out new requests. More and more hosts
are consulted by the Windows 10 Edge browser:
-
b-ring.msedge.net,
-
config.edge.skype.com,
-
ctldl.windowsupdate.com,
-
fp.msedge.net,
-
g.live.com,
-
iecvlist.microsoft.com,
-
livetileedge.dsx.mp.microsoft.com,
-
l-ring.msedge.net,
-
markets.books.microsoft.com,
-
nav.smartscreen.microsoft.com,
-
ocsp.digicert.com,
-
onecs-live.azureedge.net,
-
settings-win.data.microsoft.com,
-
sls.update.microsoft.com,
-
spo-ring.msedge.net,
-
v10.events.data.microsoft.com,
-
watson.telemetry.microsoft.com,
-
web.server,
-
www.bing.com,
-
www.w3.org.
In only 5 minutes time.
None of the sites was requested by me. And remember: I only set the proxy for the
Edge browser, not for the whole system!
In the past, I used a Linux box with a Firefox or even Dillo browser. I could get nice
clean pcap files, without all sorts of sites that the browser seemed to need or seems to think
that I needed for my "experience". So, for demonstration purposes, Windows 10 will not be
used anymore.
A Config files
A1. Vagrantfile
# -*- mode: ruby -*-
# vi: set ft=ruby :
# All Vagrant configuration is done below. The "2" in Vagrant.configure
# configures the configuration version (we support older styles for
# backwards compatibility). Please don't change it unless you know what
# you're doing.
Vagrant.configure("2") do |config|
config.vm.define :precise1 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet0" ]
end
t.vm.provision "shell", path: "./setup.precise1.sh"
end
config.vm.define :precise2 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet2" ]
end
t.vm.provision "shell", path: "./setup.precise2.sh"
end
config.vm.define :precise3 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet3" ]
end
t.vm.provision "shell", path: "./setup.precise3.sh"
end
config.vm.define :precise4 do |t|
t.vm.box = "hashicorp/precise64"
t.vm.provider "virtualbox" do |prov|
prov.customize ["modifyvm", :id, "--nic2", "hostonly", "--hostonlyadapter2", "vboxnet4" ]
end
t.vm.provision "shell", path: "./setup.precise4.sh"
end
end
A2. make_config.perl
#!/usr/bin/perl
$i_am=`hostname`; chomp $i_am;
$i_am_long=`hostname -f`;chomp $i_am_long;
$i_am_domain=`hostname -d`;chomp $i_am_domain;
$i_am_ip=`hostname -i`;chomp $i_am_ip;
($a,$b,$c,$d)=split('\.',$i_am_ip);
$subnet=sprintf("%03d.%03d.%03d",$a,$b,$c);
# Read the hosts-file for this named
$infile=@ARGV[0];
if ($i_am_domain eq ''){
$i_am_domain=$infile;
}
open (INFILE,"<$infile") || die "cannot open $infile ; did you supply a source file as argument? ";
@hosts=
close INFILE;
$qty=0;
$zns=0;
for (@hosts){
s/\#.*//;s/[ ]*$//;
if (/^$/){
print ' ';
}
else {
($h,$ip,$dhcp)=split;
print "\n$h,$ip =";
($a,$b,$c,$d)=split('\.',$ip);
@ip1[$qty]=$ip;
$zn=sprintf("%03d%03d%03d",$a,$b,$c);
print "$zn -";
$fl=0;
for ($i=0;$i<$zns;$i++){ if (@zones[$i] eq $zn) {$fl=1;}}
if ($fl==0){
@zones[$zns]=$zn;
@nw[$zns]="$c.$b.$a";
print "@nw[$zns]";
$zns++;
}
$h=~s/\..*//;
@hst[$qty]=$h;
@hw[$qty]=$dhcp;
$qty++;
}
}
open (NDCONF, ">named.conf.local") || die "cannot write named.conf.local";
print NDCONF "zone \"$i_am_domain.\" in { type master ; file \"/etc/bind/db.$i_am_domain\"; };\n";
for($i=0;$i<$zns;$i++){
print NDCONF "zone \"@nw[$i].in-addr.arpa\" in { type master; file \"/etc/bind/db.@zones[$i]\"; };\n";
}
close NDCONF;
open (DB,">db.$i_am_domain")|| die "cannot open db.$i_am_domain";
print DB "@ IN SOA $i_am_long. $i_am_long. (\n";
print DB " 1 ; serial\n";
print DB " 360000 ; refresh\n";
print DB " 3600 ; retry\n";
print DB " 960000 ; expire\n";
print DB " 36000 ; ttl\n";
print DB " )\n";
print DB " IN NS $i_am_long.\n";
for($i=0;$i<$qty;$i++){
print DB "@hst[$i] IN A @ip1[$i]\n";
}
close DB;
for ($i=0;$i<$zns;$i++){
open (DB,">db.@zones[$i]")|| die "cannot open db.@zones[$i]";
print DB '$TTL 604800';
print DB "\n@ IN SOA $i_am_ip $i_am_long. (\n";
print DB " 2 ; serial\n";
print DB " 360000 ; refresh\n";
print DB " 3600 ; retry\n";
print DB " 960000 ; expire\n";
print DB " 36000 ; ttl\n";
print DB " )\n";
print DB " IN NS $i_am_long.\n";
for($j=0;$j<$qty;$j++){
($a,$b,$c,$d)=split('\.',@ip1[$j]);
$zn=sprintf("%03d%03d%03d",$a,$b,$c);
if (@zones[$i] eq $zn) {
printf DB ("%-4d IN PTR @hst[$j].$i_am_domain.\n",$d);;
}
}
close DB;
}
print "\n";
system "pkill -HUP named";
A3. R1
ip cef
!
interface Ethernet0/0
ip address 10.128.1.1 255.255.255.0
!
interface Ethernet0/1
ip address 10.128.2.1 255.255.255.0
!
interface Ethernet0/3
ip address 10.128.3.2 255.255.255.0
!
router rip
network 10.0.0.0
!
A4. R2
ip cef
interface Ethernet0/0
ip address 10.128.5.1 255.255.255.0
interface Ethernet0/1
ip address 10.128.4.1 255.255.255.0
interface Ethernet0/2
ip address 10.128.6.1 255.255.255.0
interface Ethernet0/3
ip address 10.128.3.1 255.255.255.0
router rip
network 10.0.0.0
A5. setup.precise1.sh
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise1 start *'
echo '*********************************************************'
echo '**************PROXY**************************************'
echo '*********************************************************'
# SHELL
function aptget {
DEBIAN_FRONTEND=noninteractive apt-get -y \
-o Dpkg::Options::="--force-confdef" \
-o Dpkg::Options::="--force-confold" \
$@
}
aptget -y update
aptget -y upgrade
ifconfig eth1 10.128.4.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.4.1
ifconfig
netstat -rn
aptget install -y squid
aptget install -y squid-deb-proxy
aptget install -y language-pack-en
cp /vagrant/squid.conf /etc/squid3/squid.conf
service squid3 restart
cat > /etc/resolv.conf <
search server
nameserver 10.128.6.100
EOF
A6. setup.precise2.sh
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise2 start *'
echo '*********************************************************'
echo '***************DNS CLIENT********************************'
echo '*********************************************************'
# SHELL
function aptget {
DEBIAN_FRONTEND=noninteractive apt-get -y \
-o Dpkg::Options::="--force-confdef" \
-o Dpkg::Options::="--force-confold" \
$@
}
aptget -y update
aptget -y upgrade
ifconfig eth1 10.128.2.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.2.1
ifconfig
netstat -rn
echo '*********************************************************'
echo '* precise2: install bind *'
echo '*********************************************************'
aptget install bind9
aptget install dnsutils
cd /etc/bind
cp /vagrant/client /vagrant/make_config.perl .
perl make_config.perl client
/etc/init.d/bind9 restart
A7. setup.precise3.sh
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise3 start *'
echo '*********************************************************'
echo '*************WEB SERVER**********************************'
echo '*********************************************************'
# SHELL
function aptget {
DEBIAN_FRONTEND=noninteractive apt-get -y \
-o Dpkg::Options::="--force-confdef" \
-o Dpkg::Options::="--force-confold" \
$@
}
aptget -y update
aptget -y upgrade
ifconfig eth1 10.128.5.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.5.1
ifconfig
netstat -rn
aptget install lighttpd
cat > /etc/resolv.conf <
search server
nameserver 10.128.6.100
EOF
A8. setup.precise4.sh
echo '*********************************************************'
echo '*********************************************************'
echo '*********************************************************'
echo '* Setup precise4 start *'
echo '*********************************************************'
echo '**************DNS SERVER*********************************'
echo '*********************************************************'
# SHELL
function aptget {
DEBIAN_FRONTEND=noninteractive apt-get -y \
-o Dpkg::Options::="--force-confdef" \
-o Dpkg::Options::="--force-confold" \
$@
}
aptget -y update
aptget -y upgrade
ifconfig eth1 10.128.6.100 netmask 255.255.255.0 up
route add -net 10.128.0.0 netmask 255.255.0.0 gw 10.128.6.1
ifconfig
netstat -rn
echo '*********************************************************'
echo '* precise4: install bind *'
echo '*********************************************************'
aptget install bind9
aptget install dnsutils
cd /etc/bind
cp /vagrant/server /vagrant/make_config.perl .
perl make_config.perl server
/etc/init.d/bind9 restart
cat > /etc/resolv.conf <
search server
nameserver 10.128.6.100
EOF
A9. client
gateway 10.128.1.1 win10 10.128.1.100 dnsgw 10.128.2.1 dns 10.128.2.100 proxy 10.128.4.100