Vyatta是linux下知名的開源路由器，在其官方的測試中性能甚至超過了cisco 7200系列路由器，可以支持RIP、OSPF、BGP等路由協議以及VPN、NAT、HA等特性。 　　1、首先從[url]http://www.[/url]下載vyatta的安裝ISO文件，在ESXi中新建一個虛擬機，分配2塊網卡，將下載的ISO文件掛載為光驅。 　　2、在ESXi的配置中，將第2塊網卡port group的vlan id改為4095 　　3、啟動虛擬機,用缺省的用戶名/密碼 root/vyatta登陸系統(tǒng) 　　4、安裝vyatta到硬盤上 　　install-system 　　5、進入配置模式 　　configure 　　6、配置系統(tǒng)名稱 　　set system host-name vyatta-1 　　7、設置DNS 　　set system name-server x.x.x.x 　　8、設置缺省網關 　　set system gateway-address 10.0.0.1 　　9、定義外網接口IP地址 　　set interfaces ethernet eth0 address 10.0.0.2/24 　　10、定義內網口IP地址 　　set interfaces ethernet eth1 vif 6 address 192.168.6.1/24 　　set interfaces ethernet eth1 vif 7 address 192.168.7.1/24 　　set interfaces ethernet eth1 vif 8 address 192.168.8.1/24 　　11、設置NAT策略 　　set service nat rule 1 source address 192.168.0.0/16 　　set service nat rule 1 outbound-interface eth0 　　set service nat rule 1 type masquerade 　　12、保存和啟用配置 　　commit 　　save vyatta最新的版本是VC5.12，如果要學習juniper的命令行，可用該軟件搭建實驗環(huán)境。下文為本人2007年所寫，如果是通過CLI配置，可參考本文。 vyatta軟件路由器配置指南 早在2006年8月就看到vyatta的報道了，當時馬上去down了ISO文件下來，并刻錄到光盤，但后來因為工作忙，一直沒時間去研究，結果一晃就到了2007年。     最近因工作需要，開始研究軟路由的性能和功能，于是從柜子里拿出布滿灰塵的刻錄光盤，在家里那臺PIII 733/256M/40G兼容PC上做實驗。 第一部分、準備工作     網卡兩張，分別是8139和3com 905。     安裝很簡單，將ISO文件通過nero刻錄到光盤；然后進入CMOS設置為CDROM為第一啟動設備（注意：如果用VMWARE則不必刻錄，可以直接以ISO文件做啟動文件，vmware上安裝vyatta不在本次討論之中）     第二部分、安裝系統(tǒng)    系統(tǒng)引導完畢后，將出現：         vyatta login:    輸入root：         vyatta login: root         Password: vyatta    輸入vyatta，此時看到~ #出現：         ~ #    接著輸入xorpsh，將進入shell模式：         root@vyatta>    進入了shell模式了，是不是就大功告成了呢？當然不是，網卡是否安裝成功還不知道吧？如何判斷兩張網卡是否安裝好了呢？輸入命令root@vyatta>show interface ethernet ?，注意要有個問號，回車之后，系統(tǒng)將有如下顯示：    root@vyatta>show interfaces ethernet ?    Possible completions:      eth0    show ethernet interface information      eht1    show ethernet interface information    上面出現eth0和eth1字樣，可以作為兩張網卡安裝成功的依據（通過上述方法判斷是我自己總結的一個土方法，在notebook上只有一張8139的網卡，通過VMWARE環(huán)境試驗時，驗證過該方法同樣管用）。    輸入configure進入配置模式：       root@vyatta>configure    root@vyatta# 第三部分、IP地址的配置     假設將eth0作為外網口，eth1作為內網口。由于本人用的小區(qū)寬帶且分配的是私有IP網段:192.168.10.x，故本文中將192.168.10.x作為公網ip地址。      外網eth0的IP為192.168.10.20，其網關是192.168.10.1      內網eth1的IP為192.168.1.1 1、配置eth0    root@vyatta#set interfaces ethernet eth0 address 192.168.10.20 prefix-length 24   上面的命令設置eth0接口的ip地址為192.168.10.20 掩碼255.255.255.0寫為24，表示24位掩碼。    2、配置eth1    root@vyatta#set interfaces ethernet eth1 address 192.168.1.1 prefix-length 24    上面的命令設置eth1接口的ip地址為192.168.1.1 掩碼255.255.255.0寫為24，表示24位掩碼。 3、添加靜態(tài)路由    root@vyatta#set set protocols static route 0.0.0.0/0 next-hop 192.168.10.1   上面的命令設置靜態(tài)路由，0.0.0.0/0 next-hop 192.168.10.1表示到達外網任意地址，都通過網關192.168.10.1出去。 4、設置NAT root@vyatta# create service nat rule 1 [edit] root@vyatta# edit service nat rule 1 [edit service nat rule 1] root@vyatta# set type source [edit service nat rule 1] root@vyatta# set translation-type masquerade     指定NAT轉換的模式為隱藏內網模式，通俗點講就是所有內網地址都可通過這種方式訪問外網。 [edit service nat rule 1] root@vyatta# set outbound-interface eth0     指定外網口為eth0 [edit service nat rule 1] root@vyatta# set protocols all [edit service nat rule 1] root@vyatta# set source network 192.168.1.0/24     表示源網絡為192.168.1.x網段的所有地址 [edit service nat rule 1] root@vyatta# set destination network 0.0.0.0/0     表示目的網絡為任意地址 [edit service nat rule 1] root@vyatta# top [edit] root@vyatta#commit 用另外一臺電腦的網卡和eth1口連接上，設置成192.168.1.2或其它IP，網關指向192.168.1.1，DSN設置成當地電信公布的DNS。 先ping 192.168.1.2，看網卡是否正常。 再ping 192.168.1.1,看網關（即路由器的內網口）是否正常。 接著ping 192.168.10.20，看路由器的外網口是否正常。 最后ping 192.168.10.1，看（電信）出口是否正常。 如果上述都ping通，如果你DNS設置正確，你的路由器正式運行了。 --------------------------------------------------------------     后記：     安裝成功后，馬上用僵尸DDOS攻擊工具做TCP、UDP、ICMP攻擊，以驗證系統(tǒng)的健壯性，VYATTA的抗攻擊能力比ROS要強，遺憾的是，結果和ROS一樣，還是不能抵擋高強度的DDOS攻擊，路由器很快崩潰，鍵盤沒反應，需要重新啟動電腦才行。     回頭專門寫個攻擊實驗的帖子放上來。     附錄：常用命令 1、查看配置信息         vyatta@vyatta# show 2、提交配置         vyatta@vyatta# commit 3、退出不保存         vyatta@vyatta# exit discard 4、打開web管理功能         vyatta@vyatta#set service http port 80 5、打開telnet管理功能         vyatta@vyatta#set service telnet port 23 6、退出         vyatta@vyatta# exit或者root@vyatta# quit 7、up或者top退出命令         root@vyatta# up  /逐層退出，類似于exit或quit         root@vyatta# top /一步退出，類似于DOS命令下的cd \命令 8、退出show模式

I’m a sell out, it’s official. I’ve had such an overwhelming response, according to my stats, on the Vyatta router story that I had to do another. So let’s grab some documentation and get started. By the way here’s the quick start guide, and the command reference for your convenience. I do this because to get the command reference they want you to register and give your e-mail address, unless you know the direct link. Ok, so back at the barn….. I set my test board back up but hooked to my KVM on my main machine and plugged into my network. My main box is running DHCP with Dynamic DNS updates to my in house DNS server on the same box and getting routed out the house through the same box via a NAT firewall through my 8Mb/512Kb cable modem. The main machine is a AMD FX2 3800 with 2GB and dual onboard Gigabit NICs. The test board is from a thin client (got it off an auction) and just a little oversized from a standard mini-itx, which has internal 100Mb NIC and basic IO including audio, video, serial, usb, etc. It is running an unknown VIA 1Ghz processor with 512MB ram and a 1GB CF card for storage, as well as being loaded with a second D-link 100Mb NIC in the single PCI slot. Now that we have specs out of the way, let’s fire this thing off.

So I started booting the test board and then pulled up the docs on a different screen to learn how to setup a few basics. Skimming the docs I learned that they seem to have taken a lesson from the routing industry and have created a Command Line Interface similar to popular commercial routers. You can have different users with different privileges and then there are different modes for working in the router. The first mode is called “Operational Mode” which allows you to run basic utilities for diagnostics and show settings for troubleshooting. To set anything you need to enter the “Configuration Mode” with the command configure, which allows you to change and commit settings. We’ll hit that in a minute. First let’s login. Default credentials are root with a password of vyatta for your privileged user, and username vyatta with password of vyatta for your non-privileged user. Now let’s check our connectivity and see if we can talk to the network we are plugged into. Vyatta has the familiar tab completion for commands found in both UNIX systems and commercial routers, which helps you muttle your way through with minimal referencing of the docs. Logged in as the root user I did the following…..

Last login: Fri Aug 8 01:28:13 2008 from 192.168.60.1
Linux vyatta 2.6.23-1-486-vyatta #1 SMP Sat Apr 19 12:37:43 PDT 2008 i686
Welcome to Vyatta.
This system is open-source software. The exact distribution terms for
each module comprising the full system are described in the individual
files in /usr/share/doc/*/copyright.
vyatta:~# show interfaces ethernet
Interface IP Address State Link Description
eth0 192.168.60.252/24 up up
eth1 - up down
vyatta:~#

Now you can see in this terminal output that I already have an address, but it didn’t to start with, so I need to configure that……

vyatta:~# configure
[edit]
root@vyatta# set interfaces ethernet eth0 address dhcp
[edit]
root@vyatta#

Ok so far so good. Now let’s setup ssh so we don’t need a monitor and keyboard attached to it.

root@vyatta# set service ssh port 22
[edit]
root@vyatta# set service ssh allow-root
[edit]
root@vyatta# commit
There should be some text here about generating the ssh keys and restarting the service.
root@vyatta# exit
exit
vyatta:~#

Ok so now we should be able to login to this thing. Let’s go find the IP address and check the interface.

vyatta:~# show interfaces ethernet detail
eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:16:ec:54:fd:e8 brd ff:ff:ff:ff:ff:ff
inet 192.168.60.252/24 brd 192.168.60.255 scope global eth0
inet6 fe80::216:ecff:fe54:fde8/64 scope link
valid_lft forever preferred_lft forever

RX: bytes packets errors dropped overrun mcast
76484 719 0 0 0 0
TX: bytes packets errors dropped carrier collisions
54652 443 0 0 0 0

eth1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast qlen 1000
link/ether 00:40:05:08:9e:26 brd ff:ff:ff:ff:ff:ff

RX: bytes packets errors dropped overrun mcast
0 0 0 0 0 0
TX: bytes packets errors dropped carrier collisions
0 0 0 0 0 0

vyatta:~#

Looks good to me. Now go ssh over to it and play. I will post more to come

1、準備工作
到vyatta網站下載軟件http://www./download/，有兩個版本可以下載，一個是iso版本，另一個是虛擬機版本。
2、安裝系統(tǒng)
iso版本安裝，將ISO文件通過nero刻錄到光盤；然后進入CMOS設置為CDROM為第一啟動設備，這需要你的機器真的擁有兩塊以上的網卡。
虛擬機版，直接在vmware中打開就可以可了，系統(tǒng)引導完畢后，將出現：
vyatta login: root  
Password:vyatta
    ~ # 進入linux 的shell模式下
接著輸入xorpsh，進入路由器配置模式。
root@vyatta>
如果，
vyatta login: vyatta  
Password:vyatta
會直接進入路由配置模式。
3、配置路由器
我們需要實現的任務很簡單，就是在路由器上做個nat，讓藏在后面的多臺pc可以共享上網。

將eth0作為外網口，eth1作為內網口，本人用的光電的小區(qū)寬帶且分配的是私有IP網段:10.113.18.244。
外網eth0的IP為10.113.18.244，其網關是10.113.18.254。內網eth1的IP為10.113.19.244。
root@vyatta#set interfaces ethernet eth0 address 10.113.18.244 prefix-length 24 //外網端口ip地址配置
root@vyatta#set interfaces ethernet eth1 address 10.113.19.244 prefix-length 24 //內網端口ip地址配置
root@vyatta#set set protocols static route 0.0.0.0/0 next-hop 10.113.18.254       //靜態(tài)路由
root@vyatta# set service nat rule 1      //建立nat
root@vyatta# edit service nat rule 1
[edit service nat rule 1]
root@vyatta# set type source
[edit service nat rule 1]
root@vyatta# set translation-type masquerade              //轉換類型，還有dynamic、static可選
[edit service nat rule 1]
root@vyatta# set outbound-interface eth0                  //定義出口
[edit service nat rule 1]
root@vyatta# set protocols all                            //允許通過協議
[edit service nat rule 1]
root@vyatta# set source network 10.113.19.0/24            //需要轉換的地址段
[edit service nat rule 1]
root@vyatta# set destination network 0.0.0.0/0     //需要到達的網絡
[edit service nat rule 1]
root@vyatta#top        //返回頂端目錄下
root@vyatta#commit        //最后需要通過這個命令使剛才的配置生效，比思科人性化的地方
配置好后，可以ping 10.113.18.254，然后把eth1接到另一個虛擬機windows2003上，Win2003只需要配置ip：10.113.19.246
gateway:10.113.19.244即可，ping 10.113.18.254，路由器上可以通過show nat statistic看一下有無轉換。
這個路由器還可以實現如dhcp DMZ firewall等功能，大家可以自己配置一下。

常用的命令
*、show查看配置信息
*、commit提交配置
*、exit discard退出不保存
*、set service http port 80打開web管理功能
*、set service telnet port 23打開telnet管理功能
*、exit或者 quit退出
*、up或top返回上一級或頂級

配置縮略圖：