Конфигурация сети au-team.irpo

hostnamectl set-hostname isp.au-team.irpo; exec bash

hostnamectl set-hostname hq-rtr.au-team.irpo; exec bash

hostnamectl set-hostname br-rtr.au-team.irpo; exec bash

hostnamectl set-hostname hq-srv.au-team.irpo; exec bash

hostnamectl set-hostname br-srv.au-team.irpo; exec bash

hostnamectl set-hostname hq-cli.au-team.irpo; exec bash

На всех устройствах настроить IP по таблице адресации.

На HQ-RTR, BR-RTR, HQ-SRV, BR-SRV, HQ-CLI дополнительно ввести DNS 77.88.8.8.

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p
cat > /etc/nftables/isp.nft << 'EOF'
table inet nat {
  chain POSTROUTING {
    type nat hook postrouting priority srcnat;
    oifname "ens33" masquerade
  }
}
EOF
echo 'include "/etc/nftables/isp.nft"' >> /etc/sysconfig/nftables.conf
systemctl enable --now nftables

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p
cat > /etc/nftables/hq-rtr.nft << 'EOF'
table inet nat {
  chain POSTROUTING {
    type nat hook postrouting priority srcnat;
    oifname "ens33" masquerade
  }
}
EOF
echo 'include "/etc/nftables/hq-rtr.nft"' >> /etc/sysconfig/nftables.conf
systemctl enable --now nftables

echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p
cat > /etc/nftables/br-rtr.nft << 'EOF'
table inet nat {
  chain POSTROUTING {
    type nat hook postrouting priority srcnat;
    oifname "ens33" masquerade
  }
}
EOF
echo 'include "/etc/nftables/br-rtr.nft"' >> /etc/sysconfig/nftables.conf
systemctl enable --now nftables

useradd sshuser -u 2026 -U
echo "sshuser:P@ssw0rd" | chpasswd
usermod -aG wheel sshuser
echo "sshuser ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

useradd net_admin -U
echo "net_admin:P@ssw0rd" | chpasswd
usermod -aG wheel net_admin
echo "net_admin ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

sed -i 's/SELINUX=enforcing/SELINUX=permissive/' /etc/selinux/config
setenforce 0
sed -i 's/#Port 22/Port 2026/' /etc/ssh/sshd_config
echo "AllowUsers sshuser" >> /etc/ssh/sshd_config
echo "MaxAuthTries 2" >> /etc/ssh/sshd_config
echo "Banner /etc/ssh-banner" >> /etc/ssh/sshd_config
cat > /etc/ssh-banner << 'EOF'
* * * * * * * * * * * * * * * * * * * *
*                                   *
*     Authorized access only        *
*                                   *
* * * * * * * * * * * * * * * * * * * *
EOF
systemctl restart sshd

После настройки на обоих:

nmcli connection modify tun1 ip-tunnel.ttl 64

dnf install -y frr
sed -i 's/ospfd=no/ospfd=yes/' /etc/frr/daemons
systemctl enable --now frr
vtysh << 'EOF'
configure terminal
router ospf
 passive-interface default
 network 192.168.1.0/27 area 0
 network 192.168.2.0/28 area 0
 network 192.168.3.0/29 area 0
 network 10.10.10.0/30 area 0
 area 0 authentication
 exit
 interface tun1
  no ip ospf network broadcast
  no ip ospf passive
  ip ospf authentication
  ip ospf authentication-key P@ssw0rd
 exit
 exit
 write
EOF
systemctl restart frr

dnf install -y frr
sed -i 's/ospfd=no/ospfd=yes/' /etc/frr/daemons
systemctl enable --now frr
vtysh << 'EOF'
configure terminal
router ospf
 passive-interface default
 network 192.168.4.0/28 area 0
 network 10.10.10.0/30 area 0
 area 0 authentication
 exit
 interface tun1
  no ip ospf network broadcast
  no ip ospf passive
  ip ospf authentication
  ip ospf authentication-key P@ssw0rd
 exit
 exit
 write
EOF
systemctl restart frr

dnf install dhcp-server -y
cat > /etc/dhcp/dhcpd.conf << 'EOF'
subnet 192.168.2.0 netmask 255.255.255.240 {
  range 192.168.2.2 192.168.2.14;
  option domain-name-servers 192.168.1.2;
  option domain-name "au-team.irpo";
  option routers 192.168.2.1;
  option broadcast-address 192.168.2.15;
  default-lease-time 600;
  max-lease-time 7200;
}
EOF
systemctl enable --now dhcpd

dnf install bind bind-utils -y
cat > /etc/named.conf << 'EOF'
options {
  listen-on port 53 { 127.0.0.1; 192.168.1.0/27; };
  allow-query { any; };
  forwarders { 77.88.8.8; };
  dnssec-validation no;
};
zone "au-team.irpo" {
  type master;
  file "master/au-team.db";
};
zone "1.168.192.in-addr.arpa" {
  type master;
  file "master/au-team_rev.db";
};
EOF
mkdir -p /var/named/master
cat > /var/named/master/au-team.db << 'EOF'
$TTL 1D
@  IN SOA hq-srv.au-team.irpo. root.au-team.irpo. ( 0 1D 1H 1W 3H )
   IN NS hq-srv.au-team.irpo.
hq-rtr  IN A 192.168.1.1
hq-srv  IN A 192.168.1.2
hq-cli  IN A 192.168.2.2
br-rtr  IN A 192.168.4.1
br-srv  IN A 192.168.4.2
EOF
cat > /var/named/master/au-team_rev.db << 'EOF'
$TTL 1D
@  IN SOA hq-srv.au-team.irpo. root.au-team.irpo. ( 0 1D 1H 1W 3H )
   IN NS hq-srv.au-team.irpo.
1  IN PTR hq-rtr.au-team.irpo.
2  IN PTR hq-srv.au-team.irpo.
EOF
chown -R root:named /var/named/master
chmod 0640 /var/named/master/*
named-checkconf -z
systemctl enable --now named

timedatectl set-timezone Europe/Moscow
timedatectl

dnf install openvswitch NetworkManager-ovs -y
systemctl enable --now openvswitch
ovs-vsctl add-br hq-sw
ovs-vsctl add-port hq-sw ens34 tag=100
ovs-vsctl add-port hq-sw ens35 tag=999
ovs-vsctl add-port hq-sw ens36 tag=200
ovs-vsctl add-port hq-sw vlan100 tag=100 -- set interface vlan100 type=internal
ovs-vsctl add-port hq-sw vlan200 tag=200 -- set interface vlan200 type=internal
ovs-vsctl add-port hq-sw vlan999 tag=999 -- set interface vlan999 type=internal
systemctl restart openvswitch NetworkManager
ip link set hq-sw up
ip a add 192.168.1.1/27 dev vlan100
ip a add 192.168.2.1/28 dev vlan200
ip a add 192.168.3.1/29 dev vlan999