Vyatta是linux下知名的開源路由器，在其官方的測(cè)試中性能甚至超過(guò)了cisco 7200系列路由器，可以支持RIP、OSPF、BGP等路由協(xié)議以及VPN、NAT、HA等特性。 　　1、首先從[url]http://www.vyatta.com[/url]下載vyatta的安裝ISO文件，在ESXi中新建一個(gè)虛擬機(jī)，分配2塊網(wǎng)卡，將下載的ISO文件掛載為光驅(qū)。 　　2、在ESXi的配置中，將第2塊網(wǎng)卡port group的vlan id改為4095 　　3、啟動(dòng)虛擬機(jī),用缺省的用戶名/密碼 root/vyatta登陸系統(tǒng) 　　4、安裝vyatta到硬盤上 　　install-system 　　5、進(jìn)入配置模式 　　configure 　　6、配置系統(tǒng)名稱 　　set system host-name vyatta-1 　　7、設(shè)置DNS 　　set system name-server x.x.x.x 　　8、設(shè)置缺省網(wǎng)關(guān) 　　set system gateway-address 10.0.0.1 　　9、定義外網(wǎng)接口IP地址 　　set interfaces ethernet eth0 address 10.0.0.2/24 　　10、定義內(nèi)網(wǎng)口IP地址 　　set interfaces ethernet eth1 vif 6 address 192.168.6.1/24 　　set interfaces ethernet eth1 vif 7 address 192.168.7.1/24 　　set interfaces ethernet eth1 vif 8 address 192.168.8.1/24 　　11、設(shè)置NAT策略 　　set service nat rule 1 source address 192.168.0.0/16 　　set service nat rule 1 outbound-interface eth0 　　set service nat rule 1 type masquerade 　　12、保存和啟用配置 　　commit 　　save vyatta最新的版本是VC5.12，如果要學(xué)習(xí)juniper的命令行，可用該軟件搭建實(shí)驗(yàn)環(huán)境。下文為本人2007年所寫，如果是通過(guò)CLI配置，可參考本文。 vyatta軟件路由器配置指南 早在2006年8月就看到vyatta的報(bào)道了，當(dāng)時(shí)馬上去down了ISO文件下來(lái)，并刻錄到光盤，但后來(lái)因?yàn)楣ぷ髅?，一直沒時(shí)間去研究，結(jié)果一晃就到了2007年。     最近因工作需要，開始研究軟路由的性能和功能，于是從柜子里拿出布滿灰塵的刻錄光盤，在家里那臺(tái)PIII 733/256M/40G兼容PC上做實(shí)驗(yàn)。 第一部分、準(zhǔn)備工作     網(wǎng)卡兩張，分別是8139和3com 905。     安裝很簡(jiǎn)單，將ISO文件通過(guò)nero刻錄到光盤；然后進(jìn)入CMOS設(shè)置為CDROM為第一啟動(dòng)設(shè)備（注意：如果用VMWARE則不必刻錄，可以直接以ISO文件做啟動(dòng)文件，vmware上安裝vyatta不在本次討論之中）     第二部分、安裝系統(tǒng)    系統(tǒng)引導(dǎo)完畢后，將出現(xiàn)：         vyatta login:    輸入root：         vyatta login: root         Password: vyatta    輸入vyatta，此時(shí)看到~ #出現(xiàn)：         ~ #    接著輸入xorpsh，將進(jìn)入shell模式：         root@vyatta>    進(jìn)入了shell模式了，是不是就大功告成了呢？當(dāng)然不是，網(wǎng)卡是否安裝成功還不知道吧？如何判斷兩張網(wǎng)卡是否安裝好了呢？輸入命令root@vyatta>show interface ethernet ?，注意要有個(gè)問(wèn)號(hào)，回車之后，系統(tǒng)將有如下顯示：    root@vyatta>show interfaces ethernet ?    Possible completions:      eth0    show ethernet interface information      eht1    show ethernet interface information    上面出現(xiàn)eth0和eth1字樣，可以作為兩張網(wǎng)卡安裝成功的依據(jù)（通過(guò)上述方法判斷是我自己總結(jié)的一個(gè)土方法，在notebook上只有一張8139的網(wǎng)卡，通過(guò)VMWARE環(huán)境試驗(yàn)時(shí)，驗(yàn)證過(guò)該方法同樣管用）。    輸入configure進(jìn)入配置模式：       root@vyatta>configure    root@vyatta# 第三部分、IP地址的配置     假設(shè)將eth0作為外網(wǎng)口，eth1作為內(nèi)網(wǎng)口。由于本人用的小區(qū)寬帶且分配的是私有IP網(wǎng)段:192.168.10.x，故本文中將192.168.10.x作為公網(wǎng)ip地址。      外網(wǎng)eth0的IP為192.168.10.20，其網(wǎng)關(guān)是192.168.10.1      內(nèi)網(wǎng)eth1的IP為192.168.1.1 1、配置eth0    root@vyatta#set interfaces ethernet eth0 address 192.168.10.20 prefix-length 24   上面的命令設(shè)置eth0接口的ip地址為192.168.10.20 掩碼255.255.255.0寫為24，表示24位掩碼。    2、配置eth1    root@vyatta#set interfaces ethernet eth1 address 192.168.1.1 prefix-length 24    上面的命令設(shè)置eth1接口的ip地址為192.168.1.1 掩碼255.255.255.0寫為24，表示24位掩碼。 3、添加靜態(tài)路由    root@vyatta#set set protocols static route 0.0.0.0/0 next-hop 192.168.10.1   上面的命令設(shè)置靜態(tài)路由，0.0.0.0/0 next-hop 192.168.10.1表示到達(dá)外網(wǎng)任意地址，都通過(guò)網(wǎng)關(guān)192.168.10.1出去。 4、設(shè)置NAT root@vyatta# create service nat rule 1 [edit] root@vyatta# edit service nat rule 1 [edit service nat rule 1] root@vyatta# set type source [edit service nat rule 1] root@vyatta# set translation-type masquerade     指定NAT轉(zhuǎn)換的模式為隱藏內(nèi)網(wǎng)模式，通俗點(diǎn)講就是所有內(nèi)網(wǎng)地址都可通過(guò)這種方式訪問(wèn)外網(wǎng)。 [edit service nat rule 1] root@vyatta# set outbound-interface eth0     指定外網(wǎng)口為eth0 [edit service nat rule 1] root@vyatta# set protocols all [edit service nat rule 1] root@vyatta# set source network 192.168.1.0/24     表示源網(wǎng)絡(luò)為192.168.1.x網(wǎng)段的所有地址 [edit service nat rule 1] root@vyatta# set destination network 0.0.0.0/0     表示目的網(wǎng)絡(luò)為任意地址 [edit service nat rule 1] root@vyatta# top [edit] root@vyatta#commit 用另外一臺(tái)電腦的網(wǎng)卡和eth1口連接上，設(shè)置成192.168.1.2或其它IP，網(wǎng)關(guān)指向192.168.1.1，DSN設(shè)置成當(dāng)?shù)仉娦殴嫉腄NS。 先ping 192.168.1.2，看網(wǎng)卡是否正常。 再ping 192.168.1.1,看網(wǎng)關(guān)（即路由器的內(nèi)網(wǎng)口）是否正常。 接著ping 192.168.10.20，看路由器的外網(wǎng)口是否正常。 最后ping 192.168.10.1，看（電信）出口是否正常。 如果上述都ping通，如果你DNS設(shè)置正確，你的路由器正式運(yùn)行了。 --------------------------------------------------------------     后記：     安裝成功后，馬上用僵尸DDOS攻擊工具做TCP、UDP、ICMP攻擊，以驗(yàn)證系統(tǒng)的健壯性，VYATTA的抗攻擊能力比ROS要強(qiáng)，遺憾的是，結(jié)果和ROS一樣，還是不能抵擋高強(qiáng)度的DDOS攻擊，路由器很快崩潰，鍵盤沒反應(yīng)，需要重新啟動(dòng)電腦才行。     回頭專門寫個(gè)攻擊實(shí)驗(yàn)的帖子放上來(lái)。     附錄：常用命令 1、查看配置信息         vyatta@vyatta# show 2、提交配置         vyatta@vyatta# commit 3、退出不保存         vyatta@vyatta# exit discard 4、打開web管理功能         vyatta@vyatta#set service http port 80 5、打開telnet管理功能         vyatta@vyatta#set service telnet port 23 6、退出         vyatta@vyatta# exit或者root@vyatta# quit 7、up或者top退出命令         root@vyatta# up  /逐層退出，類似于exit或quit         root@vyatta# top /一步退出，類似于DOS命令下的cd \命令 8、退出show模式

I’m a sell out, it’s official. I’ve had such an overwhelming response, according to my stats, on the Vyatta router story that I had to do another. So let’s grab some documentation and get started. By the way here’s the quick start guide, and the command reference for your convenience. I do this because to get the command reference they want you to register and give your e-mail address, unless you know the direct link. Ok, so back at the barn….. I set my test board back up but hooked to my KVM on my main machine and plugged into my network. My main box is running DHCP with Dynamic DNS updates to my in house DNS server on the same box and getting routed out the house through the same box via a NAT firewall through my 8Mb/512Kb cable modem. The main machine is a AMD FX2 3800 with 2GB and dual onboard Gigabit NICs. The test board is from a thin client (got it off an auction) and just a little oversized from a standard mini-itx, which has internal 100Mb NIC and basic IO including audio, video, serial, usb, etc. It is running an unknown VIA 1Ghz processor with 512MB ram and a 1GB CF card for storage, as well as being loaded with a second D-link 100Mb NIC in the single PCI slot. Now that we have specs out of the way, let’s fire this thing off.

So I started booting the test board and then pulled up the docs on a different screen to learn how to setup a few basics. Skimming the docs I learned that they seem to have taken a lesson from the routing industry and have created a Command Line Interface similar to popular commercial routers. You can have different users with different privileges and then there are different modes for working in the router. The first mode is called “Operational Mode” which allows you to run basic utilities for diagnostics and show settings for troubleshooting. To set anything you need to enter the “Configuration Mode” with the command configure, which allows you to change and commit settings. We’ll hit that in a minute. First let’s login. Default credentials are root with a password of vyatta for your privileged user, and username vyatta with password of vyatta for your non-privileged user. Now let’s check our connectivity and see if we can talk to the network we are plugged into. Vyatta has the familiar tab completion for commands found in both UNIX systems and commercial routers, which helps you muttle your way through with minimal referencing of the docs. Logged in as the root user I did the following…..

Last login: Fri Aug 8 01:28:13 2008 from 192.168.60.1
Linux vyatta 2.6.23-1-486-vyatta #1 SMP Sat Apr 19 12:37:43 PDT 2008 i686
Welcome to Vyatta.
This system is open-source software. The exact distribution terms for
each module comprising the full system are described in the individual
files in /usr/share/doc/*/copyright.
vyatta:~# show interfaces ethernet
Interface IP Address State Link Description
eth0 192.168.60.252/24 up up
eth1 - up down
vyatta:~#

Now you can see in this terminal output that I already have an address, but it didn’t to start with, so I need to configure that……

vyatta:~# configure
[edit]
root@vyatta# set interfaces ethernet eth0 address dhcp
[edit]
root@vyatta#

Ok so far so good. Now let’s setup ssh so we don’t need a monitor and keyboard attached to it.

root@vyatta# set service ssh port 22
[edit]
root@vyatta# set service ssh allow-root
[edit]
root@vyatta# commit
There should be some text here about generating the ssh keys and restarting the service.
root@vyatta# exit
exit
vyatta:~#

Ok so now we should be able to login to this thing. Let’s go find the IP address and check the interface.

vyatta:~# show interfaces ethernet detail
eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:16:ec:54:fd:e8 brd ff:ff:ff:ff:ff:ff
inet 192.168.60.252/24 brd 192.168.60.255 scope global eth0
inet6 fe80::216:ecff:fe54:fde8/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast
76484 719 0 0 0 0
TX: bytes packets errors dropped carrier collisions
54652 443 0 0 0 0

eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:40:05:08:9e:26 brd ff:ff:ff:ff:ff:ff

RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collisions
0 0 0 0 0 0

vyatta:~#

Looks good to me. Now go ssh over to it and play. I will post more to come

1、準(zhǔn)備工作
到vyatta網(wǎng)站下載軟件http://www.vyatta.com/download/，有兩個(gè)版本可以下載，一個(gè)是iso版本，另一個(gè)是虛擬機(jī)版本。
2、安裝系統(tǒng)
iso版本安裝，將ISO文件通過(guò)nero刻錄到光盤；然后進(jìn)入CMOS設(shè)置為CDROM為第一啟動(dòng)設(shè)備，這需要你的機(jī)器真的擁有兩塊以上的網(wǎng)卡。
虛擬機(jī)版，直接在vmware中打開就可以可了，系統(tǒng)引導(dǎo)完畢后，將出現(xiàn)：
vyatta login: root  
Password:vyatta
    ~ # 進(jìn)入linux 的shell模式下
接著輸入xorpsh，進(jìn)入路由器配置模式。
root@vyatta>
如果，
vyatta login: vyatta  
Password:vyatta
會(huì)直接進(jìn)入路由配置模式。
3、配置路由器
我們需要實(shí)現(xiàn)的任務(wù)很簡(jiǎn)單，就是在路由器上做個(gè)nat，讓藏在后面的多臺(tái)pc可以共享上網(wǎng)。

將eth0作為外網(wǎng)口，eth1作為內(nèi)網(wǎng)口，本人用的光電的小區(qū)寬帶且分配的是私有IP網(wǎng)段:10.113.18.244。
外網(wǎng)eth0的IP為10.113.18.244，其網(wǎng)關(guān)是10.113.18.254。內(nèi)網(wǎng)eth1的IP為10.113.19.244。
root@vyatta#set interfaces ethernet eth0 address 10.113.18.244 prefix-length 24 //外網(wǎng)端口ip地址配置
root@vyatta#set interfaces ethernet eth1 address 10.113.19.244 prefix-length 24 //內(nèi)網(wǎng)端口ip地址配置
root@vyatta#set set protocols static route 0.0.0.0/0 next-hop 10.113.18.254       //靜態(tài)路由
root@vyatta# set service nat rule 1      //建立nat
root@vyatta# edit service nat rule 1
[edit service nat rule 1]
root@vyatta# set type source
[edit service nat rule 1]
root@vyatta# set translation-type masquerade              //轉(zhuǎn)換類型，還有dynamic、static可選
[edit service nat rule 1]
root@vyatta# set outbound-interface eth0                  //定義出口
[edit service nat rule 1]
root@vyatta# set protocols all                            //允許通過(guò)協(xié)議
[edit service nat rule 1]
root@vyatta# set source network 10.113.19.0/24            //需要轉(zhuǎn)換的地址段
[edit service nat rule 1]
root@vyatta# set destination network 0.0.0.0/0     //需要到達(dá)的網(wǎng)絡(luò)
[edit service nat rule 1]
root@vyatta#top        //返回頂端目錄下
root@vyatta#commit        //最后需要通過(guò)這個(gè)命令使剛才的配置生效，比思科人性化的地方
配置好后，可以ping 10.113.18.254，然后把eth1接到另一個(gè)虛擬機(jī)windows2003上，Win2003只需要配置ip：10.113.19.246
gateway:10.113.19.244即可，ping 10.113.18.254，路由器上可以通過(guò)show nat statistic看一下有無(wú)轉(zhuǎn)換。
這個(gè)路由器還可以實(shí)現(xiàn)如dhcp DMZ firewall等功能，大家可以自己配置一下。

常用的命令
*、show查看配置信息
*、commit提交配置
*、exit discard退出不保存
*、set service http port 80打開web管理功能
*、set service telnet port 23打開telnet管理功能
*、exit或者 quit退出
*、up或top返回上一級(jí)或頂級(jí)

配置縮略圖：