Есть еще вариант циско + дебиан + винда вроде норм там правда еще доп протоколы int gi1/gi2
ip nat outside/inside
access-list 1 permit 192/172 0.0.0.255
ip nat inside source list 1 interface Gi1 overload
interface Tunnel 1
ip address 172.16.1.1/2 255...
tunnel mode gre ip
tunnel source 4.4.4.100
tunnel destination 5.5.5.100
router eigrp 6500
network 192/172 0.0.0.255
network 172.16.1.0 0.0.0.255
crypto isakmp policy 1
encr aes
authentication pre-share
hash sha256
group 14
crypto isakmp key cisco address 5.100/4.100
crypto isakmp nat keepalive 5
crypto ipsec transform-set имя esp-aes 256 esp-sha256-hmac
mode tunnel
crypto ipsec profile VTI
set transform-set имя
interface Tunnel1
tunnel mode ipsec ipv4
tunnel protection ipsec profile VTI
—
ip access-list extended Lnew
permit tcp any any established
permit udp host 4.4.4.100 eq 53 any
permit udp host 5.5.5.1 eq 123 any
permit tcp any host 4.4.4.100 eq 80
permit tcp any host 4.4.4.100 eq 443
permit tcp any host 4.4.4.100 eq 2222
permit udp host 5.5.5.100 host 4.4.4.100 eq 500
permit esp any any
permit icmp any any
int gi 1
ip access-group Lnew in
--—
ip access-list extended Rnew
permit tcp any any established
permit tcp any host 5.5.5.100 eq 80
permit tcp any host 5.5.5.100 eq 443
permit tcp any host 5.5.5.100 eq 2244
permit udp host 4.4.4.100 host 5.5.5.100 eq 500
permit esp any any
permit icmp any any
int gi 1
ip access-group Rnew in
(L) ip nat inside source static tcp 192.168.100.100 22 4.4.4.100 2222
ip nat inside source static tcp/udp 192.168.100.200 53 4.4.4.100 53
(R) ip nat inside source static tcp 172.16.100.100 22 5.5.5.100 2244
/etc/chrony/chrony.conf
(ISP) local stratum 4
allow 4.4.4.0/24
allow 3.3.3.0/24
(webL-R) pool ntp.int.demo.wsr iburst
allow 192.168.100.0/24
ip domain name int.demo.wsr
ip name-server 192.168.100.200
ntp server ntp.int.demo.wsr (ip)
raid
/root/.smbclient
username/password
/etc/fstab
//srv.int.demo.wsr/диск /opt/share cifs user,rw,_netdev,credentials=/root/.smbclient 0 0
mkdir /opt/share
mount -a
apt install -y docker-ce
systemctl start docker
systemctl enable docker
mkdir /mnt/app
mount /dev/sr1 /mnt/app
docker load < /mnt/app/app.tar
docker images
docker run —name app -p 8080:80 -d app
docker ps
no ip http secure-server
reload
(L) ip nat inside source static tcp 192.168.100.100 80 4.4.4.100 80
ip nat inside source static tcp 192.168.100.100 443 4.4.4.100 443
(R) ip nat inside source static tcp 172.16.100.100 80 5.5.5.100 80
ip nat inside source static tcp 172.16.100.100 443 5.5.5.100 443
nginx
cd /opt/share
openssl pkcs12 -nodes -nocerts -in www.pfx -out www.key
openssl pkcs12 -nodes -nokeys -in www.pfx -out www.cer
-
cp /opt/share/www.key /etc/nginx/www.key
cp /opt/share/www.cer /etc/nginx/www.cer
nano /etc/nginx/snippets/snakeoil.conf
ssl_certificate /etc/nginx/www.cer;
ssl_certificate_key /etc/nginx/www.key;
/etc/nginx/sites-available/default
upstream backend {
server 192.168.100.100:8080 fail_timeout=25;
server 172.16.100.100:8080 fail_timeout=25;
}
server {
listen 443 ssl default_server;
include snippers/snakeoil.conf;
server_name www.demo.wsr;
location / {
proxy_pass http://backend ;
}
}
server {
listen 80 default_server;
server_name _;
return 301 https://www.demo.wsr;
}
(CLI) scp -P 2244 'root@5.5.5.100:/opt/share/ca.cer' C:\Users\user\Desktop\
Install-WindowsFeature -Name AD-Certificate, ADCS-Web-Enrollment -IncludeManagementTools
Install-AdcsCertificationAuthority -CAType StandaloneRootCa -CACommonName "Demo.wsr" -force
Install-AdcsWebEnrollment -Confirm -force
New-SelfSignedCertificate -subject "localhost"
Get-ChildItem cert:\LocalMachine\My
Move-item Cert:\LocalMachine\My\rключ -destination Cert:\LocalMachine\Webhosting\
New-IISSiteBinding -Name 'Default Web Site' -BindingInformation "*:443:" -Protocol https -CertificateThumbPrint ключ
Start-WebSite -Name "Default Web Site"
Get-CACrlDistributionPoint | Remove-CACrlDistributionPoint -force
Get-CAAuthorityInformationAccess |Remove-CAAuthorityInformationAccess -force
Get-CAAuthorityInformationAccess
|Remove-CAAuthorityInformationAccess -force
Restart-Service CertSrc
Вариант для распечатки
(??), 26-Окт-08, 11:30
