PRODUCT SUPPORT ANNOUNCEMENT
Some videos and Web Editions may be returning errors on launch. Learn more.
Save a fortune: Use Linux to deliver cost-effective, reliable routing services.
Linux routers are inexpensive, flexible, stable, adaptable, expandable, easy to manage, and based on proven technology. In Linux Routers, Second Edition, Tony Mancill shows you exactly how to configure, administer, and troubleshoot Linux routing for today's most common internetworking applications. Thoroughly updated for the latest technologies and version 2.4 of the Linux kernel, this edition includes practical coverage of dynamic routing, Quality of Service (QoS)even next-generation IPv6 routing. Mancill's step-by-step explanations walk you through:
Whether your goal is to reduce network costs, add applications, solve problems you can't solve with "traditional" routers, or simply learn about routing hands-on without investing expensive, proprietary network gear, Linux Routers, Second Edition is all you need to get the job done.
(NOTE: Each chapter concludes with a Summary.)
1. ROUTING BUILDING BLOCKS.
Router Hardware. The Environment around Your Router. Distributions —Router Software.
Routing 101. Ethernet 101 —Switches and Hubs. WA Basics 101.
Configuring a LAN Router. IP Aliasing for Multinetting. IP Monitoring Tools. The mii-diag Utility. LRP —The Linux Router Project.
Erbium 's Design. IP Masquerading Concepts. Linux 's netfilter —Concepts. Masquerading and AT with net filter.
Frame Relay Basics —DLCIs, PVCs, and CIRs. Linux WA Adapters. Linux and WANPIPE for Frame Relay. Troubleshooting Frame Relay with WANPIPE. MRTG —Monitoring Link Utilization. LRP with WANPIPE.
Linux and Token Ring. Cesium 's Environment. The iproute2 Toolset. FreeS/WAN —An IPsec Implementation for Linux. A Brief Introduction to IPv6 on Linux.
Connecting to the Internet. General Network Security Measures. IP Firewalling. Notification Systems.
CHDLC Router Topology. Conserving Bandwidth —Caches and Slaves. Replacing Servers —Multifunction Routers. Linux Traffic-Shaping Walkthrough. Remote System Support.
Allowing Access to the Outside —Proxying. Redirection of IP Traffic —Smoke and Mirrors. General Internet Services on Routers. Dynamic Routing Daemons. OSPF Walkthrough Using Zebra. Emergency Down Procedures.
IP Accounting. Conditional IP Forwarding for Linux. 345 10.3 IP Packet Filtering for Linux 2.2.x. IP Masquerading with the 2.2 Kernel. Configuring IP Masquerading for Linux 2.2.x. Using IP Masquerading Every Day. Kernel Port Forwarding —High Wizardry.
Router configuration has long been an arcane art possessed by the few(and the luckyat least in the eyes of the interested yet unchosen). One reason for this is that routers were expensive, and requiredspecialized training. They were also found only in small numbers inlarger companies. Unix, while not quite as inaccessible in terms ofcost, has also frequently been considered a black art for the few. Linux, of course, has turned all of this on its ear and delivered aGNU operating system to themasses. There used to be only a few big-city bookstores that had adecent selection of Unix books. Now every mall bookstore has aUnix/Linux section.
Routers, although not quite ubiquitous, are also much more prevalentin recent times too. The explosive growth of the Internet hasevery business, large and small, scrambling to get connected.Even completely nontechnical organizations POP their email fromtheir ISP over a dial-up link several times a day. And peopleuse more networked computers in general nowadays. People evenhave routers in their homes, perhaps to provide Internet connectivityvia a cable modem to multiple computers in the home.
Interestingly (but not surprisingly), Linux delivers a router platformaccessible by the many, almost as easily as it has resurrected the word"Unix." Although what folks think of as "traditional" routers arespecial-purpose hardware running embedded real-time operating systems,there has always been a group using Unix-based operating systems runningon general-purpose hardware. Linux has helped expand this groupimmensely by providing a full-featured and robust TCP/IP stack andhundreds of device drivers-all of which run on commonly availablecomputing hardware. Another important factor is the GNU/Linux community'sbasic tenet of sharing ideas and knowledge instead of hoarding them. The truly amazing part is that all of this is available without expensivelicensing costs or nondisclosure agreements. With these good tools andsome know-how, anyone can build an inexpensive, stable router platformcapable of performing a variety of functions within any organization.
If you're asking yourself, What's a router?, do not despair! Thisbook will cover most topics in enough depth and with enoughreferences that you will not be left stumped. If it fails to do this,please let me know. Traditionally, a router is defined as a layer 3switch. That is, it looks at the layer 3 packet headers and decideswhere to forward them. (Layer 3 refers to the OSI "network" layer.)For TCP/IP networks, the router examines the IP headers to determine thedestination IP address of the packet and the TTL (Time To Live), among otherthings. In this strict definition, the type of packetTCP, UDP, ICMP,etc.is immaterial. However, as routers accumulate functionality,they can now take into account the layer 4 (transport layer) headers (aswell as those above layer 4 and below layer 2) when deciding what to do with apacket. Some other things that routers do:
The focus of this book is admittedly not on academic definitions, but onhow to accomplish (or at least get started on) a certain task. You mayfind that knowing the correct technical definition for something is notthe same as successfully configuring and administering it in a productionenvironment. If you're just getting started as a network administrator,be confident that a lot of technical know-how can be learned only throughexperience (a.k.a. "the hard way"). Do not be intimidated by the lackof a formal body of knowledge; just admit it to yourself when you don'tknow the answer and strive to figure it out.
This isa thread that features a heated exchange between Linus Torvalds and AndyTanenbaum, a well-established researcher,professor, father of MINIX, and author ofseveral (good) OS-design books. (I read somewhere that Linus Torvaldsisn't particularly proud of the bravado he displayed in these messages. I find the characteristic of being passionate about something and then later beingable to admit having been caught up in the heat of themoment, and to rise above it, to be magnanimous indeed.)
This is a collection ofLinux-relevant postings made tocomp.os.minix about building an OS.
The way I understand the early history of Linux, it boils down to this:Linus Torvalds had an Intel 80386-based PC andsome free time. He set out to write an operating system that wouldcapitalize on the new features of this processor, ignoring backwardcompatibility with the 8088 and the 80286. (Other PC operating systemsof that era were struggling with some design trade-offs that were imposedby the limitations of the 386's predecessors. In all fairness, theydid this to maintain backward compatibility with software written to runon those systems.)
Another incentive for writing his own OS from scratch was to takeadvantage of the large body of excellent "free" software beingdeveloped by the Free Software Foundation. This is the (first) connection between Linux andRichard Stallman, who founded the GNUproject in 1984 and has lent both philosophy and code to the effort. The system software which Linus used for his new kernel is commonlyknown as the GNU toolset. These tools implement most of what iscommonly thought of as standard "Unix" systemtools. Remember, "GNU's Not Unix." This collectionof software had the tremendous advantage of being available insource-code form and being delivered with a license that allowed earlyLinux developers to modify that source and redistribute it.
In the early 1990s, the Internet made the transition from anacademic/scientific tool to the most powerful communicationsmedium ever available to the general public. The ability tocommunicate, collaborate, share, discuss, and debate has never beforebeen available to such a large percentage of the world's population. Whythe sentimentality about the Internet? If Linus Torvalds conceivedLinux, and it spent a while in the "womb" of academia, then theInternet is its homewhere it will play, grow, and mature. But Linuxhas become more than a user of the Internet; it has become part of it,and thus is now being used to propagate itself.
At this point, you may be thinking that this is all well and good andapropos in some sort of cosmic sensethe child has grown up to takecare of the parent, etc., and so on-but what makes a Linux router anybetter or different than other routers? As with most interestingquestions, the answer is: "It depends." Primarily, it depends upon whatyour definition of "better" is.
This book aims to promote Linux as a router by telling you how to set upand manage your own Linux router based on my experiences using them inproduction environments. Different "types" of routers are illustratedthrough a series of examples, each of which introduces the functionalityand configuration of that router. For instance,Chapter 3 describes a router used to route trafficbetween two LAN subnets, while Chapter 5 details theconfiguration of a Frame Relay (WAN) router. Because the fine detailsof "how" change continually, every attempt is made to maintain a levelof detail that will be useful for more than just the next point-releaseof the kernel. (However, the specific examples in this, the secondedition of the book, are for the 2.4.x kernel series. SeeChapter 10 for information on prior kernels.)
Alongside the configurations are general discussions about running Linuxin production, as well as coverage of some applications that help supportthe network infrastructure (like traffic analysis and systemmonitoring). For me, Linux is about enabling people to do things thatthey would not have been able to do or afford to do otherwise. Really. I mean that quite sincerely. Sometimes "afford" means more than havingsufficient moneyit means having sufficient time. Linux can help youcraft tailor-made solutions by building on the work of others. The bookalso contains some background information suited for "newbie"administrators who have never done network administration. While thisinformation will be familiar to experienced network administrators, Ifeel that it's important, because technical elegance is pointless withoutsound administration practices, or if you don't even know where to start.
To exhibit what I believe is the "true spirit" of Linuxsharinginformation, ideas, and accomplishments instead of hidingthemreferences to publicly available resources will be madewhenever I am aware of such sources. Several of these arecollected as a list of links in Appendix . Much ofwhat you read in this book is made possible by the existence of openlyavailable documentation. Another element of this spirit is theattitude that "whatever it is I need to accomplish, Linux is asufficient toolset to succeed." Having faith in your toolset and inyour ability to use it effectively to solve business problems iscrucial to your performing your work well and enjoying it, too. Thisbook aims to help you establish some faith in the toolset by offeringknowledge about how to use it. It will help you find ways in whichyou can:
The LinuxDocumentation Project, or LDP as it's commonly known, is an invaluable resource for Linuxdocumentation. The project aims to make high-quality documentationfreely available to all. This means not only covering a wide range oftopics at various depths and skill levels, but also making sure thatthe documentation is current and correct.
This documentation covers a wide variety of topics, from generalhardware compatibility to specialized software configurations. Thedocumentation takes several forms, from the informal FAQs andmini-HOWTOs to the regular HOWTOs and the longer guides. If you'renot already familiar with this site, bookmark itI will referthroughout this book to documentation found there.
This book does not aspire to incite the masses to riot and replace all"traditional" routers with Linux systems. (Throughout this book theterm "traditional" should be taken to mean router product offeringsbased on a closed, proprietary system interfaces or "operatingsystems." This would include the fine family of Cisco products, Nortel,Ascend Communications, et al.) These products have their place, and theyhave paved the way for the existence of Linux andthe Linux router. In many instances, depending upon either the specificapplication or your corporate culture, traditional routers are the rightchoice for your production environment. On the other hand, a soundbusiness principle is to pick the least expensive tool capable ofsatisfying all of the operational requirementsthe tool that willresult in the lowest total cost of ownership. Realistically, cost isthe overriding factor for most business ventures, and Linux-basedsolutions will often have the advantage.
This book does not attempt to thoroughly teach TCP/IP or fully explainrouting protocols used in TCP/IP networks. Nor does the book thoroughlyaddress firewall configuration or security. These topics are simply beyond thescope of this book, and other people have done fantastic jobs of coveringthem (much better than I could). I do heartily recommend athorough understanding of TCP/IP and networking in general for anyoneconsidering administering a TCP/IP network, regardless of the equipmentused. For an authoritative treatment of networking and routing, seeInterconnections by Radia Perlman. Finally, the book you nowhold covers only routing with TCP/IP (although Linux is capable ofhandling other protocols). If you need to support something other thanIP, know that you are not alone, and that much of the software andhardware specifically supports protocols besides IP.
Chapters and discuss topics which aregeneric and applicable to all Linux routers, whileChapters - each cover a type of Linuxrouter as I have used it in production and highlight what I learned inthe process. (There should probably be a chapter called"Franken-router" for the router configurations that did not work-aHOWNOTTO of sorts. Adventurous readers will be able to writethis chapter themselves.... :) ) Of the latter sevenchapters, the first three are basic LAN, extranet, and WAN routers,while the remaining four address more advanced topics suchas connecting to the Internet and making routers do morethan just route.
Within each router chapter, first the router is introduced by itsfunction, and then technical details of configuration are discussed.Throughout the book, several threads of related topics are presented anddeveloped alongside the routers themselves. These topics include choiceof hardware, choice of software, strategies for high availability, TCP/IPniceties of Linux available in the kernel, and monitoring configurationsand software. Different chapters have different components andrequirements, but generally have the following layout:
The appendices address topics either too general or too specific for themain text, from how to compile the Linux kernel(Appendix ) to using VMware to augment yourtesting strategies (Appendix ) to ethical considerationsof a network admin. Finally, there may not be a single "flavor" ofrouter presented in this book that fits your application. If that is thecase, do not shy away from combining configurations presented here intosomething new.
Initially, the first edition of this text encompassed the 2.0.x and the2.2.x versions of the kernel. As that book went through various stagesof editing (and time passed), it became clear that the main text shouldappeal to the broadest userbase without forcing the reader to switch backand forth between the details of two different kernel versions. This isparticularly true for the sections on masquerading and firewalling(Chapters 4, 7, and 9).
In the second edition the focus is on the 2.4 kernel, since all of themajor Linux distributions at the time of writing run on 2.4 kernels. However, notes for 2.0 and 2.2 kernel users remain and are scatteredthroughout the text, including many of the first edition materials forthe 2.2.x kernels collected in Chapter 10. If you supportan environment running on an older kernel and need assistance, check
You might have already noticed a common thread in the names of thechapters in this book. Maybe they make you want to check the cover tomake sure that this isn't a science textbook. Selecting a naming motiffor Unix systems is a tradition that seems to have been around for quitea while. Perhaps one of the hacker subculture deities knows its origin.(See The New Hackers Dictionary by Eric Raymond if this sort oftrivia interests you.) If you haven't already guessed, I've named myrouters after elements in the periodic table.
The periodic table has characteristics that render it useful asa system naming scheme. First of all, there is a large pool of names,many of which sound cool. Next, every name has a short yet unique"symbol name" associated with it, e.g., gold is Au, carbon is C. These can be used as a sort of shorthand, alongwith aliases (CNAMEs) in DNS to save keystrokes.