Модуль 1: настройка сетевой инфраструктуры

ip -br a
su -
whoami

apt-get update
apt-get install -y tzdata sudo iptables

hostnamectl set-hostname ISP
timedatectl set-timezone Europe/Samara

iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
systemctl enable --now iptables
iptables -t nat -S
systemctl is-enabled iptables

apt-get update
apt-get install -y tzdata sudo iptables openvswitch frr dhcp-server

hostnamectl set-hostname hq-rtr.au-team.irpo
timedatectl set-timezone Europe/Samara
useradd net_admin -G wheel
passwd net_admin
# Введите пароль P@ssw0rd два раза
vim /etc/sudoers

net_admin ALL=(ALL) NOPASSWD: ALL

iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
systemctl enable --now iptables
iptables -t nat -S
test -s /etc/sysconfig/iptables
systemctl is-enabled iptables

apt-get update
apt-get install -y tzdata sudo dnsmasq openssh

hostnamectl set-hostname hq-srv.au-team.irpo
timedatectl set-timezone Europe/Samara
useradd sshuser -u 2027 -G wheel
passwd sshuser
# Введите пароль P@ssw0rd два раза
vim /etc/sudoers

sshuser ALL=(ALL) NOPASSWD: ALL

apt-get update
apt-get install -y tzdata sudo
hostnamectl set-hostname hq-cli.au-team.irpo
timedatectl set-timezone Europe/Samara

apt-get update
apt-get install -y tzdata sudo iptables frr

hostnamectl set-hostname br-rtr.au-team.irpo
timedatectl set-timezone Europe/Samara
useradd net_admin -G wheel
passwd net_admin
# Введите пароль P@ssw0rd два раза
vim /etc/sudoers

net_admin ALL=(ALL) NOPASSWD: ALL

iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
iptables-save > /etc/sysconfig/iptables
systemctl enable --now iptables
iptables -t nat -S
test -s /etc/sysconfig/iptables
systemctl is-enabled iptables

apt-get update
apt-get install -y tzdata sudo frr

hostnamectl set-hostname br-fw.au-team.irpo
timedatectl set-timezone Europe/Samara

apt-get update
apt-get install -y tzdata sudo openssh

hostnamectl set-hostname br-srv.au-team.irpo
timedatectl set-timezone Europe/Samara
useradd sshuser -u 2027 -G wheel
passwd sshuser
# Введите пароль P@ssw0rd два раза
vim /etc/sudoers

sshuser ALL=(ALL) NOPASSWD: ALL

vim /etc/frr/daemons
systemctl enable --now frr
vtysh
conf t
router ospf
passive-interface default
network 10.10.10.0/30 area 0
network 192.168.1.0/28 area 0
network 192.168.2.0/28 area 0
network 192.168.3.0/29 area 0
exit
interface gre1
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 P@ssw0rd
no ip ospf passive
end
do write
show ip ospf neighbors

ospfd=yes

vim /etc/frr/daemons
systemctl enable --now frr
vtysh
conf t
router ospf
passive-interface default
network 10.10.10.0/30 area 0
network 172.16.4.0/30 area 0
exit
interface gre1
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 P@ssw0rd
no ip ospf passive
interface ens19
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 P@ssw0rd
no ip ospf passive
end
do write
show ip ospf neighbors

ospfd=yes

vim /etc/frr/daemons
systemctl enable --now frr
vtysh
conf t
router ospf
passive-interface default
network 172.16.4.0/30 area 0
network 172.16.5.0/28 area 0
exit
interface ens18
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 P@ssw0rd
no ip ospf passive
end
do write
show ip ospf neighbors

ospfd=yes

vim /etc/dhcp/dhcpd.conf
cat /etc/dhcp/dhcpd.conf

ddns-update-style none;
subnet 192.168.2.0 netmask 255.255.255.240 {
option routers 192.168.2.1;
option subnet-mask 255.255.255.240;
option domain-name "au-team.irpo";
option domain-name-servers 192.168.1.2;
range dynamic-bootp 192.168.2.2 192.168.2.10;
default-lease-time 21600;
max-lease-time 43200;
}

vim /etc/sysconfig/dhcpd
systemctl enable --now dhcpd
systemctl status dhcpd
cat /etc/sysconfig/dhcpd

DHCPDARGS=vlan200

systemctl restart network
ip -br a
ip route
cat /etc/resolv.conf

vim /etc/dnsmasq.conf
systemctl enable --now dnsmasq
systemctl restart dnsmasq
systemctl status dnsmasq
nslookup hq-rtr.au-team.irpo 192.168.1.2
nslookup 192.168.1.2 192.168.1.2

no-resolv
domain=au-team.irpo
server=77.88.8.7
interface=ens18
address=/hq-rtr.au-team.irpo/192.168.1.1
address=/br-rtr.au-team.irpo/172.16.2.2
address=/br-fw.au-team.irpo/172.16.4.2
address=/hq-srv.au-team.irpo/192.168.1.2
address=/hq-cli.au-team.irpo/192.168.2.10
address=/br-srv.au-team.irpo/172.16.5.2
address=/docker.au-team.irpo/172.16.1.1
address=/web.au-team.irpo/172.16.2.1
ptr-record=/2.1.168.192.in-addr.arpa,hq-srv.au-team.irpo
ptr-record=/2.5.16.172.in-addr.arpa,br-srv.au-team.irpo

systemctl enable --now sshd
vim /etc/openssh/sshd_config
vim /etc/openssh/bannermotd
systemctl restart sshd
systemctl status sshd
ss -lntp | grep 2027
ssh sshuser@192.168.1.2 -p 2027

Port 2027
AllowUsers sshuser
MaxAuthTries 2
Banner /etc/openssh/bannermotd
Authorized access only

systemctl enable --now sshd
vim /etc/openssh/sshd_config
vim /etc/openssh/bannermotd
systemctl restart sshd
systemctl status sshd
ss -lntp | grep 2027
ssh sshuser@172.16.5.2 -p 2027

Port 2027
AllowUsers sshuser
MaxAuthTries 2
Banner /etc/openssh/bannermotd
Authorized access only