Services Configuration File Examples

DHCP server

Variables

Globals

Name	Value
domain_name	Domain name
dns_1	Primary DNS
dns_2	Secondary DNS
net_address	Network address where the DHCP service will run
net_mask	Network mask
net_start	Start address for the dynamic address range
net_end	End address for the dynamic address range
net_gateway	Network gateway

For each host

Name	Value
host1_name	Host name
host1_mac	Host MAC Address (for example 00:00:12:34:56:78)
host1_ip	Host IP Address

Configuration file

ddns-update-style none;

option domain-name %(domain_name);
option domain-name-servers %(dns_1), %(dns_2);

authoritative;

log-facility local7;

subnet %(net_address) netmask %(net_mask) {
  range %(net_start) %(net_end);
  option routers %(net_gateway);
}

# for each host
host %(host1_name) {
  fixed-address %(host1_ip);
  hardware ethernet %(host1_mac);
}
# end for each host

DNS (Bind)

Variables

Name	Value
isp_dns1	ISP’s DNS server (can have multiple values)
bind_addr1	IP Address where the server will listen (can have multiple values)
zone1	Zone (or domain) that the server will manage (can have multiple values)

Configuration file

options {
        directory "/var/bind";

        forward first;
        forwarders {
                %(isp_dns1);
                %(isp_dns2);
        };

        listen-on-v6 { none; };
        listen-on {
                %(bind_addr1);
                %(bind_addr2);
        };

        pid-file "/var/run/named/named.pid";
};

zone "." IN {
        type hint;
        file "named.ca";
};

zone "localhost" IN {
        type master;
        file "pri/localhost.zone";
        allow-update { none; };
        notify no;
};

zone "127.in-addr.arpa" IN {
        type master;
        file "pri/127.zone";
        allow-update { none; };
        notify no;
};

# for each host
zone "%(zone1)" IN {
        type master;
        file "pri/%(zone1).zone";
        allow-update { none; };
        notify no;
};

zone "%(zone1)" IN {
        type master;
        file "pri/%(zone1).zone.ptr";
        allow-update { none; };
        notify no;
};
# end for each host

iptables

Table management

List rules from a table

# iptables -t ${table} -L -v

Remove a rule from a table

# iptables -t ${table} -D ${chain} ${num}

Remove all rules from a table

# iptables -t ${table} -F

Remove all rules of a specific chain from a table

# iptables -t ${table} -F ${chain}

Filter rules

List

# iptables -t filter -L -v

Add

# iptables -t filter -I ${chain} ${pos} -j ${target} \
      [-s ${src_ip}/${src_ip_prefix_length}] \
      [-d ${dest_ip}/${dst_ip_prefix_length}] \
      [-p ${protocol}]

If protocol (-p option) is udp or tcp, source and target ports can be added:

# iptables -t filter -I ${chain} ${num} -j ${target} \
      [-s ${src_ip}/${src_ip_prefix_length}] \
      [-d ${dest_ip}/${dst_ip_prefix_length}] \
      [-p ${protocol}] -m ${protocolo} \
      [--sport ${src_port}] [--dport ${dst_port}]

Where:

• ${chain} is INPUT, OUTPUT or FORWARD

• ${pos} is the index of the rule inside de table

• ${protocol} is udp, tcp, icmp or all

• ${target} is DROP, ACCEPT or REJECT

NAT rules

List

# iptables -t nat -L -v

Port forwarding

# iptables -t nat -I PREROUTING ${pos} -i ${dev} \
      -j DNAT --to ${nat_dst_ip}[:${nat_dst_port}] \
      -p <tcp|udp> --dport ${port} \
      [-s ${src_ip}/${src_ip_prefix_length}] \
      [-d ${dest_ip}/${dst_ip_prefix_length}]

Masquerading (masq)

# iptables -t nat -I POSTROUTING ${pos} -o ${dev} \
      -j MASQUERADE -s ${src_ip}/${src_ip_prefix_length}

SNAT (snat)

# iptables -t nat -I POSTROUTING ${pos} -o ${dev} \
      -j SNAT --to ${nat_src_ip} \
      -s ${src_ip}/${src_ip_prefix_length}