0 - en to zh-CN translation catalogue (124 entries)

en: Network
zh-CN: 网络

en: Gateway
zh-CN: 网关

en: IPv6
zh-CN: IPV6

en: QoS
zh-CN: QoS（服务质量保证）

en: Network Infrastructure
zh-CN: 基本网络设置

en: Linux sports the whole Unix heritage for networking, and Debian provides a full set of tools to create and manage them. This chapter reviews these tools.
zh-CN: Linux从Unix系统上传承了网络的功能，Debian 同样提供了一整套完整的工具用于配置和管理网络。本章将向大家介绍这些工具。

en: <primary>gateway</primary>
zh-CN: <primary>网关</primary>

en: <primary>network</primary><secondary>gateway</secondary>
zh-CN: <primary>网络</primary><secondary>网关</secondary>

en: <primary>router</primary>
zh-CN: <primary>路由器</primary>

en: A gateway is a system linking several networks. This term often refers to a local network's “exit point” on the mandatory path to all external IP addresses. The gateway is connected to each of the networks it links together, and acts as a router to convey IP packets between its various interfaces.
zh-CN: “网关”用于连接多个网络。这个词常常用于表示本地网络通往外部 IP 地址的“出口”。网关充当路由器的身份，在它的多个网络接口间转发 IP 包，从而把它所连接的不同网络联系起来。

en: <emphasis>BACK TO BASICS</emphasis> IP packet
zh-CN: <emphasis>基本</emphasis> IP 封包

en: <primary>packet</primary><secondary>IP</secondary>
zh-CN: <primary>包</primary><secondary>IP</secondary>

en: Most networks nowadays use the IP protocol (<emphasis>Internet Protocol</emphasis>). This protocol segments the transmitted data into limited-size packets. Each packet contains, in addition to its payload data, a number of details required for its proper routing.
zh-CN: 今天，大部分的网络使用 IP 通信协议 (<emphasis>Internet Protocol</emphasis>)。这种协议把传输数据切割成小小的封包。除了实际传输的数据外，每个封包还包括必备的路由信息。

en: <emphasis>BACK TO BASICS</emphasis> TCP/UDP
zh-CN: <emphasis>基本</emphasis> TCP/UDP

en: <primary>port</primary><secondary>TCP</secondary>
zh-CN: <primary>端口</primary><secondary>TCP</secondary>

en: <primary>port</primary><secondary>UDP</secondary>
zh-CN: <primary>端口</primary><secondary>UDP</secondary>

en: Many programs do not handle the individual packets themselves, even though the data they transmit does travel over IP; they often use TCP (<emphasis>Transmission Control Protocol</emphasis>). TCP is a layer over IP allowing the establishment of connections dedicated to data streams between two points. The programs then only see an entry point into which data can be fed with the guarantee that the same data exits without loss (and in the same sequence) at the exit point at the other end of the connection. Although many kinds of errors can happen in the lower layers, they are compensated by TCP: lost packets are retransmitted, and packets arriving out of order (for example, if they used different paths) are re-ordered appropriately.
zh-CN: 即使在 IP 上传输数据，大部分程序都不处理个别的封包问题；他们通常使用 TCP (<emphasis>Transmission Control Protocol</emphasis>)。TCP 是 IP 的上层，为专属的数据流创建两点间的链接。程序只看到数据进来的条目，并保证同样的数据无误 (且以同样顺序) 流到另端链接的出口。在较低层可能发生多种错误，都可以被 TCP 补偿：重送失去的封包、重组到达的封包 (例如，经由不同路径送到) 的顺序。

en: Another protocol relying on IP is UDP (<emphasis>User Datagram Protocol</emphasis>). In contrast to TCP, it is packet-oriented. Its goals are different: the purpose of UDP is only to transmit one packet from an application to another. The protocol does not try to compensate for possible packet loss on the way, nor does it ensure that packets are received in the same order as were sent. The main advantage to this protocol is that the latency is greatly improved, since the loss of a single packet does not delay the receiving of all following packets until the lost one is retransmitted.
zh-CN: 另个在 IP 上的协议是 UDP (<emphasis>User Datagram Protocol</emphasis>)。与 TCP 不同，它是封包导向的。它的目标不同：UDP 的目的是在应用程序间传输封包。此协议不补偿封包的遗漏，也不在意封包依序到达。此协议的主要优点是，大幅改善延迟的问题，遗漏的封包不影响接收后续封包，并且持续重送该遗漏的封包。

en: TCP and UDP both involve ports, which are “extension numbers” for establishing communication with a given application on a machine. This concept allows keeping several different communications in parallel with the same correspondent, since these communications can be distinguished by the port number.
zh-CN: TCP 和 UDP 都涉及封包，也就是以 "分机号码" 模式在机器内的程序创建链接。此做法允许在同个通信中创建多个平行的管道，因为它们以不同的端口号区分之。

en: When a local network uses a private address range (not routable on the Internet), the gateway needs to implement <emphasis>address masquerading</emphasis> so that the machines on the network can communicate with the outside world. The masquerading operation is a kind of proxy operating on the network level: each outgoing connection from an internal machine is replaced with a connection from the gateway itself (since the gateway does have an external, routable address), the data going through the masqueraded connection is sent to the new one, and the data coming back in reply is sent through to the masqueraded connection to the internal machine. The gateway uses a range of dedicated TCP ports for this purpose, usually with very high numbers (over 60000). Each connection coming from an internal machine then appears to the outside world as a connection coming from one of these reserved ports.
zh-CN: 局域网路接在私人网址范围内 (不在网络网络的路由上)，网关就需要 <emphasis>地址掩蔽</emphasis> 让其经由网络与外界沟通。掩蔽作业是网络层次的代理工作：内部机器，都被网关取代 (因为网关有外部的路由地址)，借由掩蔽链接，数据送出出去，进来的数据经由掩蔽链接至内部机器。网关以指定的 TCP 端口运行此工作，通常是较高的号码 (超过 60000)。对外部而言，经由内部机器的链接，就是来自此等保留端口号。

en: <primary>masquerading</primary>
zh-CN: <primary>掩蔽</primary>

en: <emphasis>CULTURE</emphasis> Private address range
zh-CN: <emphasis>文化</emphasis> 私有地址范围

en: <primary>private IP address</primary>
zh-CN: <primary>私有 IP 地址</primary>

en: RFC 1918 defines three ranges of IPv4 addresses not meant to be routed on the Internet but only used in local networks. The first one, <literal>10.0.0.0/8</literal> (see sidebar <xref linkend="sidebar.networking-basics" />), is a class-A range (with 2<superscript>24</superscript> IP addresses). The second one, <literal>172.16.0.0/12</literal>, gathers 16 class-B ranges (<literal>172.16.0.0/16</literal> to <literal>172.31.0.0/16</literal>), each containing 2<superscript>16</superscript> IP addresses. Finally, <literal>192.168.0.0/16</literal> is a class-B range (grouping 256 class-C ranges, <literal>192.168.0.0/24</literal> to <literal>192.168.255.0/24</literal>, with 256 IP addresses each). <ulink type="block" url="http://www.faqs.org/rfcs/rfc1918.html" />
zh-CN: RFC 1918 把三组 IPv4 地址设为局域网路专用，不能路由至互联网。第一组是，<literal>10.0.0.0/8</literal> (见专栏 <xref linkend="sidebar.networking-basics" />)，是一个A级范围 (是 2<superscript>24</superscript> IP 地址)。第二组是，<literal>172.16.0.0/12</literal>，16个B级范围 (<literal>172.16.0.0/16</literal> 至 <literal>172.31.0.0/16</literal>)，每个有 2<superscript>16</superscript> IP 地址。最后，<literal>192.168.0.0/16</literal> 是一个B级范围 (包括 256 个C级范围，<literal>192.168.0.0/24</literal> 至 <literal>192.168.255.0/24</literal>，各有 256 个 IP 地址)。<ulink type="block" url="http://www.faqs.org/rfcs/rfc1918.html" />

en: The gateway can also perform two kinds of <emphasis>network address translation</emphasis> (or NAT for short). The first kind, <emphasis>Destination NAT</emphasis> (DNAT) is a technique to alter the destination IP address (and/or the TCP or UDP port) for a (generally) incoming connection. The connection tracking mechanism also alters the following packets in the same connection to ensure continuity in the communication. The second kind of NAT is <emphasis>Source NAT</emphasis> (SNAT), of which <emphasis>masquerading</emphasis> is a particular case; SNAT alters the source IP address (and/or the TCP or UDP port) of a (generally) outgoing connection. As for DNAT, all the packets in the connection are appropriately handled by the connection tracking mechanism. Note that NAT is only relevant for IPv4 and its limited address space; in IPv6, the wide availability of addresses greatly reduces the usefulness of NAT by allowing all “internal” addresses to be directly routable on the Internet (this does not imply that internal machines are accessible, since intermediary firewalls can filter traffic).
zh-CN: 网关有两种 <emphasis>网络地址转换</emphasis> (英文缩写 NAT) 的功能。第一种是 <emphasis>目的 NAT</emphasis> (DNAT)，改变封包目的 IP 地址 (与 TCP 或 UDP 端口)。链接追踪机制同时改变后续封包的链接。第二种 NAT 是 <emphasis>来源 NAT</emphasis> (SNAT)，其中的 <emphasis>伪装</emphasis> 是特例之一；SNAT 改变出去链接的来源 IP 地址 (与 TCP 或 UDP 端口)。如同 DNAT，所有的封包由链接追踪机制处理。NAT 只用于 IPv4 及其限制的地址空间；在 IPv6 内，其宽广的地址技术允许直接在互联网路由 (并不表示可以近用内部机器，因为防火墙可以过滤流量) 减少 NAT 的用途。

en: <emphasis>BACK TO BASICS</emphasis> Port forwarding
zh-CN: <emphasis>基本</emphasis> 端口转发

en: <primary>port forwarding</primary>
zh-CN: <primary>端口转发</primary>

en: A concrete application of DNAT is <emphasis>port forwarding</emphasis>. Incoming connections to a given port of a machine are forwarded to a port on another machine. Other solutions may exist for achieving a similar effect, though, especially at the application level with <command>ssh</command> (see <xref linkend="sect.ssh-port-forwarding" />) or <command>redir</command>.
zh-CN: DNAT 的具体应用之一是 <emphasis>端口转发</emphasis>。进来链接至机器的指定端口号转发至另部机器的端口号。虽然还有其他的方案达成同样的效果，诸如应用层面的 <command>ssh</command> (见 <xref linkend="sect.ssh-port-forwarding" />) 或 <command>redir</command>。

en: Enough theory, let's get practical. Turning a Debian system into a gateway is a simple matter of enabling the appropriate option in the Linux kernel, by way of the <filename>/proc/</filename> virtual filesystem:
zh-CN: 理论讲多了，看看实务怎么做。system into a gateway is a simple matter of enabling the appropriate option in the Linux kernel, 经由 <filename>/proc/</filename> 虚拟文件系统，从 Linux 核心进入 Debian 系统的网关：

en: The <filename>/etc/sysctl.conf</filename> file
zh-CN: <filename>/etc/sysctl.conf</filename> 文件

en: The same effect can be obtained for IPv6 by simply replacing <literal>ipv4</literal> with <literal>ipv6</literal> in the manual command and using the <literal>net.ipv6.conf.all.forwarding</literal> line in <filename>/etc/sysctl.conf</filename>.
zh-CN: 在 IPv6 也能取得同样的效果，把手册中的 <literal>ipv4</literal> 换为 <literal>ipv6</literal>，并使用 <literal>net.ipv6.conf.all.forwarding</literal> 于 <filename>/etc/sysctl.conf</filename> 文件内。

en: Enabling IPv4 masquerading is a slightly more complex operation that involves configuring the <emphasis>netfilter</emphasis> firewall.
zh-CN: 启用 IPv4 伪装就有点复杂，涉及配置 <emphasis>netfilter</emphasis> 防火墙。

en: Similarly, using NAT (for IPv4) requires configuring <emphasis>netfilter</emphasis>. Since the primary purpose of this component is packet filtering, the details are listed in <xref linkend="security" xrefstyle="select: label quotedtitle nopage" /> (see <xref linkend="sect.firewall-packet-filtering" />).
zh-CN: 需配置 <emphasis>netfilter</emphasis>，才能使用 NAT (IPv4)。因为此种组件的主要目的是软件包筛选，详情列在 <xref linkend="security" xrefstyle="select: label quotedtitle nopage" /> (见 <xref linkend="sect.firewall-packet-filtering" />)。

en: X.509 certificates
zh-CN: X.509 认证

en: <primary>certificate</primary><secondary>X.509</secondary>
zh-CN: <primary>认证</primary><secondary>X.509</secondary>

en: <primary>X.509</primary><secondary>certificates</secondary>
zh-CN: <primary>X.509</primary><secondary>证书</secondary>

en: <primary>Certificate Authority</primary>
zh-CN: <primary>数字证书颁发机构</primary>

en: Certificates are an important building block of many network services built on cryptographic protocols, when they need some sort of central authentication.
zh-CN: 需要中央身份验证时，证书是基于密码协议构建的网络服务的重要组成部分。

en: Among those protocols, SSL (<emphasis>Secure Socket Layer</emphasis>) was invented by Netscape to secure connections to web servers. It was later standardized by IETF under the acronym TLS (<emphasis>Transport Layer Security</emphasis>). Since then TLS continued to evolve, and nowadays SSL is deprecated due to multiple design flaws that have been discovered.
zh-CN: 在那些协议中，SSL 协议 (<emphasis>Secure Socket Layer</emphasis>)是由Netscape发明的，用以保护与网页服务器的连接。它后来被 IETF 标准化为 TLS (<emphasis>Transport Layer Security</emphasis>)。此后，TLS不断演进。如今，由于SSL被发现了多个设计缺陷，它已被弃用。

en: The TLS protocol aims primarily to provide privacy and data integrity between two or more communicating computer applications. The most common case on the Internet is the communication between a client (e.g. a web browser) and a server.
zh-CN: TLS 协议主要关注于在两个或多个互相通信的计算机程序之间提供隐私和数据完整性。在互联网上，最常见的应用场景是在客户端（例如网页浏览器）和服务器之间的通信。

en: You can implement a CA (as described in <xref linkend="sect.easy-rsa" />), but if you intend to use the certificate for a website, you need to rely on a trusted CA. The prices vary significantly, but it is possible to implement great security spending little to no money.
zh-CN: 你可以建立自己的数字证书颁发机构（如在<xref linkend="sect.easy-rsa" /> 中所述），但如果你打算将证书用于网站，则需要依赖受信任的数字证书颁发机构。证书的价格差异很大，但，用很少的花费甚至零花费，来实现出色的安全性，是有可能的。

en: Creating gratis trusted certificates
zh-CN: 创建免费的受信任证书

en: Public Key Infrastructure: <emphasis>easy-rsa</emphasis>
zh-CN: 公钥基础设施：<emphasis>easy-rsa</emphasis>

en: <primary>Public Key Infrastructure</primary>
zh-CN: <primary>公钥基础设施</primary>

en: <primary>RSA (algorithm)</primary>
zh-CN: <primary>RSA (算法)</primary>

en: <primary>key pair</primary>
zh-CN: <primary>密钥对</primary>

en: The Falcot Corp administrators use this tool to create the required certificates, both for the server and the clients. This allows the configuration of all clients to be similar since they will only have to be set up so as to trust certificates coming from Falcot's local CA. This CA is the first certificate to create; to this end, the administrators set up a directory with the files required for the CA in an appropriate location, preferably on a machine not connected to the network in order to mitigate the risk of the CA's private key being stolen.
zh-CN: Falcot 公司的管理者以此工具添加必要的服务器与客户端认证。可以把所有的客户端配置成类似的状态，因为他们只需信件 Falcot 本地 CA 的认证。此 CA 是率先认证的；为此工作，管理者在适当的地方创建新的文件夹，供 CA 的文件使用，最好放在脱机的地方，杜绝私钥被窃的危险。

en: They then store the required parameters into the <filename>vars</filename> file, which can be uncommented and edited:
zh-CN: 然后它们将所需的参数存储到<filename>vars</filename>文件中，可以不加注释和编辑：

en: The next step is the creation of the CA's key pair itself (the two parts of the key pair will be stored under <filename>pki/ca.crt</filename> and <filename>pki/private/ca.key</filename> during this step). We can add the option <literal>nopass</literal> to avoid entering a password each time the private key is used:
zh-CN: 下一步是创建CA本身的密钥对（在这一步中，密钥对的两个部分将存储在<filename>pki/ca.crt</filename>和<filename>pki/private/ca.key</filename>下）。我们可以添加选项 <literal>nopass</literal> 来避免每次使用私钥时输入密码：

en: The following step creates certificates for the VPN clients; one certificate is required for each computer or person allowed to use the VPN:
zh-CN: 以上的步骤添加 VPN 客户；每个使用 VPN 的电脑或用户都需有个认证：

en: Virtual Private Network
zh-CN: 虚拟专用网络

en: <primary>network</primary><secondary>virtual private</secondary>
zh-CN: <primary>网络</primary><secondary>虚拟专用</secondary>

en: A <emphasis>Virtual Private Network</emphasis> (VPN for short) is a way to link two different local networks through the Internet by way of a tunnel; the tunnel is usually encrypted for confidentiality. VPNs are often used to integrate a remote machine within a company's local network.
zh-CN: <emphasis>虚拟专用网络</emphasis> (VPN) 是以信道方式，经由互联网链接两个局域网路的方式；通常以加密方式在信道内发送信息。VPN 通常用于集成公司内部远程机器。

en: OpenVPN is a piece of software dedicated to creating virtual private networks. Its setup involves creating virtual network interfaces on the VPN server and on the client(s); both <literal>tun</literal> (for IP-level tunnels) and <literal>tap</literal> (for Ethernet-level tunnels) interfaces are supported. In practice, <literal>tun</literal> interfaces will most often be used except when the VPN clients are meant to be integrated into the server's local network by way of an Ethernet bridge.
zh-CN: OpenVPN 用于创建虚拟专用网络的一个软件。在 VPN 服务器及客户端创建虚拟专用网络；支持 <literal>tun</literal> (IP 层面的信道) 和 <literal>tap</literal> (Ethernet 层面的信道) 接口。实务上，常用的是 <literal>tun</literal> 接口，除非 VPN 客户端难以经由 Ethernet 桥接器集成入服务器的局域网路。

en: OpenVPN relies on OpenSSL for all the SSL/TLS cryptography and associated features (confidentiality, authentication, integrity, non-repudiation). It can be configured either with a shared private key or using X.509 certificates based on a public key infrastructure. The latter configuration is strongly preferred since it allows greater flexibility when faced with a growing number of roaming users accessing the VPN.
zh-CN: OpenVPN 所有的 SSL/TLS 加密与其他功能 (机密性、认证、完整性、不可否认性)，均有赖于 OpenSSL。可以用公钥基础设施的共享私钥或使用 X.509 认证的方式配置它。建议使用后者的方式配置，以漫游方式近用 VPN 的用户可享有更多的弹性。

en: Configuring the OpenVPN Server
zh-CN: 配置 OpenVPN 服务器

en: Barring further action, VPN clients can only access the VPN server itself by way of the <literal>10.8.0.1</literal> address. Granting the clients access to the local network (192.168.0.0/24), requires adding a <literal>push route 192.168.0.0 255.255.255.0</literal> directive to the OpenVPN configuration so that VPN clients automatically get a network route telling them that this network is reachable by way of the VPN. Furthermore, machines on the local network also need to be informed that the route to the VPN goes through the VPN server (this automatically works when the VPN server is installed on the gateway). Alternatively, the VPN server can be configured to perform IP masquerading so that connections coming from VPN clients appear as if they are coming from the VPN server instead (see <xref linkend="sect.gateway" />).
zh-CN: 禁止进一步的行动，VPN 客户端只能经由 <literal>10.8.0.1</literal> 地址近用 VPN 服务器。为了授权客户近用本地网络 (192.168.0.0/24)，需在 OpenVPN 配置中加入 <literal>推送路径 192.168.0.0 255.255.255.0</literal>，让 VPN 客户端自动取得网络路由，使其明了经由 VPN 可以进入该网络。此外，本地网络的机器也需被告知，经由 VPN 服务器 (在闸道安装 VPN 服务器即自动启用) 进入VPN。另外，VPN 服务器可以配置后运行伪装 IP 的工作，让来自 VPN 客户端的消息显示成来自 VPN 服务器 (见 <xref linkend="sect.gateway" />)。

en: Configuring the OpenVPN Client
zh-CN: 配置 OpenVPN 客户端

en: Setting up an OpenVPN client also requires creating a configuration file in <filename>/etc/openvpn/</filename>. A standard configuration can be obtained by using <filename>/usr/share/doc/openvpn/examples/sample-config-files/client.conf</filename> as a starting point. The <literal>remote vpn.falcot.com 1194</literal> directive describes the address and port of the OpenVPN server; the <literal>ca</literal>, <literal>cert</literal> and <literal>key</literal> also need to be adapted to describe the locations of the key files.
zh-CN: 需配置 <filename>/etc/openvpn/</filename> 内的文件才能设置 OpenVPN 客户端。标准的配置方法可从使用 <filename>/usr/share/doc/openvpn/examples/sample-config-files/client.conf</filename> 这个文件开始。<literal>remote vpn.falcot.com 1194</literal> 介绍 OpenVPN 服务器的地址及端口号；描述密钥文档地址时，需参考 <literal>ca</literal>、<literal>cert</literal> 和 <literal>key</literal>。

en: Virtual Private Network with SSH
zh-CN: SSH 下的虚拟专属网络

en: The second method is more recent, and was introduced with OpenSSH 4.3; it is now possible for OpenSSH to create virtual network interfaces (<literal>tun*</literal>) on both sides of an SSH connection, and these virtual interfaces can be configured exactly as if they were physical interfaces. The tunneling system must first be enabled by setting <literal>PermitTunnel</literal> to “yes” in the SSH server configuration file (<filename>/etc/ssh/sshd_config</filename>). When establishing the SSH connection, the creation of a tunnel must be explicitly requested with the <literal>-w any:any</literal> option (<literal>any</literal> can be replaced with the desired <literal>tun</literal> device number). This requires the user to have administrator privilege on both sides, so as to be able to create the network device (in other words, the connection must be established as root).
zh-CN: 第二个方法较新，适用于 OpenSSH 4.3；可以在 OpenSSH 之下创建虚拟网络接口 (<literal>tun*</literal>) 于 SSH 链接的两端，且可以精准地配置这些虚拟接口，就像在实体接口环境下。必须先设置 <literal>PermitTunnel</literal> 为 “yes” 于 SSH 服务器配置档 (<filename>/etc/ssh/sshd_config</filename>)，才能启用此隧道系统。启用 SSH 链接后，添加的隧道必须以 <literal>-w any:any</literal> 选项 (<literal>any</literal> 可以用期望的 <literal>tun</literal> 设备名称取代) 请求链接。两端的用户需有管理者权限，才能添加网络设备 (换句话说，必须以超级用户的身份才能创建链接)。

en: Both methods for creating a virtual private network over SSH are quite straightforward. However, the VPN they provide is not the most efficient available; in particular, it does not handle high levels of traffic very well.
zh-CN: 以 SSH 创建虚拟专属网络的两种方法都很直接。然而，它们提供的 VPN 不是最有效的；特别是，无法有效处理高端的流量。

en: IPsec
zh-CN: 互联网安全协议

en: <primary>IPsec</primary>
zh-CN: <primary>互联网安全协议</primary>

en: In spite of its status as the reference, the complexity of setting up IPsec restricts its usage in practice. OpenVPN-based solutions will generally be preferred when the required tunnels are neither too many nor too dynamic.
zh-CN: 仅管其状态为参照，IPsec 的设置限制其用途。必备的信道不多也不是动态时，OpenVPN-based 解决方案较受用。

en: <emphasis>CAUTION</emphasis> IPsec and NAT
zh-CN: <emphasis>注意</emphasis> IPsec 与 NAT

en: NATing firewalls and IPsec do not work well together: since IPsec signs the packets, any change on these packets that the firewall might perform will void the signature, and the packets will be rejected at their destination. Various IPsec implementations now include the <emphasis>NAT-T</emphasis> technique (for <emphasis>NAT Traversal</emphasis>), which basically encapsulates the IPsec packet within a standard UDP packet.
zh-CN: NAT 的防火墙与 IPsec 无法并用：因为 IPsec 是软件包，任何改变将引发防火墙的作用，软件包就会被拒绝。不同的 IPsec 应用包括：<emphasis>NAT-T</emphasis> 技术 (给 <emphasis>NAT Traversal</emphasis>)，把 IPsec 软件包包装在标准的 UDP 封包内。

en: <emphasis>SECURITY</emphasis> IPsec and firewalls
zh-CN: <emphasis>安全</emphasis> IPsec 与防火墙

en: <primary>ESP, protocol</primary>
zh-CN: <primary>ESP，协议</primary>

en: <primary>AH, protocol</primary>
zh-CN: <primary>AH，协议</primary>

en: <primary>protocol</primary><secondary>AH</secondary>
zh-CN: <primary>协议</primary><secondary>AH</secondary>

en: <primary>protocol</primary><secondary>ESP</secondary>
zh-CN: <primary>协议</primary><secondary>ESP</secondary>

en: The standard mode of operation of IPsec involves data exchanges on UDP port 500 for key exchanges (also on UDP port 4500 in the case that NAT-T is in use). Moreover, IPsec packets use two dedicated IP protocols that the firewall must let through; reception of these packets is based on their protocol numbers, 50 (ESP) and 51 (AH).
zh-CN: IPsec 的标准操作模式在 UDP 端口号 500 做键值交换 (使用 NAT-T 时，也可在 UDP 端口号 4500)。而且，IPsec 封包使用两个固定的 IP 协议允许防火墙通过；收到这些封包的基础是其协议编号，50 (ESP) 与 51 (AH)。

en: <primary>GRE, protocol</primary>
zh-CN: <primary>GRE，协议</primary>

en: <primary>protocol</primary><secondary>GRE</secondary>
zh-CN: <primary>协议</primary><secondary>GRE</secondary>

en: PPTP (for <emphasis>Point-to-Point Tunneling Protocol</emphasis>) uses two communication channels, one for control data and one for payload data; the latter uses the GRE protocol (<emphasis>Generic Routing Encapsulation</emphasis>). A standard PPP link is then set up over the data exchange channel.
zh-CN: PPTP (𪅈原文是 <emphasis>Point-to-Point Tunneling Protocol</emphasis>) 用到两种通信闸道，一个控制数据另个酬载数据；后者使用 GRE 协议 (<emphasis>Generic Routing Encapsulation</emphasis>)。标准的 PPP 链接创建在数据交换闸道。

en: Configuring the Client
zh-CN: 配置客户端

en: The <emphasis role="pkg">pptp-linux</emphasis> package contains an easily-configured PPTP client for Linux. The following instructions take their inspiration from the official documentation: <ulink type="block" url="http://pptpclient.sourceforge.net/howto-debian.phtml" />
zh-CN: 此 <emphasis role="pkg">pptp-linux</emphasis> 封包含有易于配置的 Linux 客户端 PPTP。以下说明取自官方文档：<ulink type="block" url="http://pptpclient.sourceforge.net/howto-debian.phtml" />

en: The Falcot administrators created several files: <filename>/etc/ppp/options.pptp</filename>, <filename>/etc/ppp/peers/falcot</filename>, <filename>/etc/ppp/ip-up.d/falcot</filename>, and <filename>/etc/ppp/ip-down.d/falcot</filename>.
zh-CN: Falcot 管理者添加若干文件：<filename>/etc/ppp/options.pptp</filename>、<filename>/etc/ppp/peers/falcot</filename>、<filename>/etc/ppp/ip-up.d/falcot</filename>、与 <filename>/etc/ppp/ip-down.d/falcot</filename>。

en: The <filename>/etc/ppp/options.pptp</filename> file
zh-CN: <filename>/etc/ppp/options.pptp</filename> 文件

en: The <filename>/etc/ppp/peers/falcot</filename> file
zh-CN: <filename>/etc/ppp/peers/falcot</filename> 文件

en: The <filename>/etc/ppp/ip-up.d/falcot</filename> file
zh-CN: <filename>/etc/ppp/ip-up.d/falcot</filename> 文件

en: The <filename>/etc/ppp/ip-down.d/falcot</filename> file
zh-CN: <filename>/etc/ppp/ip-down.d/falcot</filename> 文件

en: <emphasis>SECURITY</emphasis> MPPE
zh-CN: <emphasis>安全</emphasis> MPPE

en: Securing PPTP involves using the MPPE feature (<emphasis>Microsoft Point-to-Point Encryption</emphasis>), which is available in official Debian kernels as a module.
zh-CN: 加密的 PPTP 涉及使用 MPPE 功能 (<emphasis>Microsoft Point-to-Point Encryption</emphasis>)，可从 Debian 官方的核心取得模块。

en: Configuring the Server
zh-CN: 配置服务器

en: <emphasis>CAUTION</emphasis> PPTP and firewalls
zh-CN: <emphasis>注意</emphasis> PPTP 与防火墙

en: Intermediate firewalls need to be configured to let through IP packets using protocol 47 (GRE). Moreover, the PPTP server's port 1723 needs to be open so that the communication channel can happen.
zh-CN: 需配置中间防火墙让 IP 封包使用端口号 47 (GRE)。此外，需打开 PPTP 服务器的端口号 1723以使用通信闸道。

en: <command>pptpd</command> is the PPTP server for Linux. Its main configuration file, <filename>/etc/pptpd.conf</filename>, requires very few changes: <emphasis>localip</emphasis> (local IP address) and <emphasis>remoteip</emphasis> (remote IP address). In the example below, the PPTP server always uses the <literal>192.168.0.199</literal> address, and PPTP clients receive IP addresses from <literal>192.168.0.200</literal> to <literal>192.168.0.250</literal>.
zh-CN: <command>pptpd</command> 是 Linux 的 PPTP 服务器。它的主要配置档是，<filename>/etc/pptpd.conf</filename>，应做若干改变：<emphasis>localip</emphasis> (内网 IP 地址) 与 <emphasis>remoteip</emphasis> (外网 IP 地址)。在下例中，PPTP 服务器总是使用 <literal>192.168.0.199</literal> 地址，以及从 <literal>192.168.0.200</literal> 至 <literal>192.168.0.250</literal> 之间接收 PPTP 客户端的 IP 地址。

en: The <filename>/etc/pptpd.conf</filename> file
zh-CN: <filename>/etc/pptpd.conf</filename> 文件

en: The PPP configuration used by the PPTP server also requires a few changes in <filename>/etc/ppp/pptpd-options</filename>. The important parameters are the server name (<literal>pptp</literal>), the domain name (<literal>falcot.com</literal>), and the IP addresses for DNS and WINS servers.
zh-CN: PPP 采用 PPTP 服务器配置时也需在 <filename>/etc/ppp/pptpd-options</filename> 做若干改变。 重要的参数有服务器名称 (<literal>pptp</literal>)、网域名称 (<literal>falcot.com</literal>)、以及 DNS 与 WINS 服务器的 IP 地址。

en: The <filename>/etc/ppp/pptpd-options</filename> file
zh-CN: <filename>/etc/ppp/pptpd-options</filename> 文件

en: The last step involves registering the <literal>vpn</literal> user (and the associated password) in the <filename>/etc/ppp/chap-secrets</filename> file. Contrary to other instances where an asterisk (<literal>*</literal>) would work, the server name must be filled explicitly here. Furthermore, Windows PPTP clients identify themselves under the <literal><replaceable>DOMAIN</replaceable>\\<replaceable>USER</replaceable></literal> form, instead of only providing a user name. This explains why the file also mentions the <literal>FALCOT\\vpn</literal> user. It is also possible to specify individual IP addresses for users; an asterisk in this field specifies that dynamic addressing should be used.
zh-CN: 登录 <literal>vpn</literal> 用户 (及其密码) 于 <filename>/etc/ppp/chap-secrets</filename> 文件的最后一个步骤。其他的作为里，星号 (<literal>*</literal>) 是有作用的，在此的服务器名称必须明示出来。而且，Windows PPTP 客户端以 <literal><replaceable>DOMAIN</replaceable>\\<replaceable>USER</replaceable></literal> 形式辨识，不是以用户名区别。这就说明了在 <literal>FALCOT\\vpn</literal> 用户必须提及的文件。也可以指定用户使用特定的 IP 地址；此字段内的星号用于指定动态的地址。

en: The <filename>/etc/ppp/chap-secrets</filename> file
zh-CN: 该 <filename>/etc/ppp/chap-secrets</filename> 文件

en: <emphasis>SECURITY</emphasis> PPTP vulnerabilities
zh-CN: <emphasis>安全</emphasis> PPTP 漏洞

en: Microsoft's first PPTP implementation drew severe criticism because it had many security vulnerabilities; most have since then been fixed in more recent versions. The configuration documented in this section uses the latest version of the protocol. Be aware though that removing some options (such as <literal>require-mppe-128</literal> and <literal>require-mschap-v2</literal>) would make the service vulnerable again.
zh-CN: 𧢒微软的第一个 PPTP 应用发生重大的瑕疪，因为出现很多安全漏洞；多半在新版已修正了。本节的配置文档使用最新版的协议。移除部分选项 (如 <literal>require-mppe-128</literal> 与 <literal>require-mschap-v2</literal>) 仍可能再出现服务漏洞。

en: Quality of Service
zh-CN: 品质服务

en: Principle and Mechanism
zh-CN: 原则与机制

en: <emphasis>Quality of Service</emphasis> (or <emphasis>QoS</emphasis> for short) refers to a set of techniques that guarantee or improve the quality of the service provided to applications. The most popular such technique involves classifying the network traffic into categories, and differentiating the handling of traffic according to which category it belongs to. The main application of this differentiated services concept is <emphasis>traffic shaping</emphasis>, which limits the data transmission rates for connections related to some services and/or hosts so as not to saturate the available bandwidth and starve important other services. Traffic shaping is a particularly good fit for TCP traffic, since this protocol automatically adapts to available bandwidth.
zh-CN: <emphasis>服务品质</emphasis> (Quality of Service 或缩写为 <emphasis>QoS</emphasis>) 系指提供应用时足以保证或改进服务品质的技术。最常见的技术包括分类网络流量、及依照其类别区分流量的作用。这种区分服务的概念是 <emphasis>流量成形</emphasis>，限制部分服务或主机的数据传输率，使其不致塞饱可用的带宽以及压缩其他的服务。流量成形是 TCP 流量的特定形式，此协议自动调整可用的频。

en: It is also possible to alter the priorities on traffic, which allows prioritizing packets related to interactive services (such as <command>ssh</command> and <command>telnet</command>) or to services that only deal with small blocks of data.
zh-CN: 也可能改变流量的优先级，允许与交互服务有关的 (如 <command>ssh</command> 与 <command>telnet</command>) 或只服务小量数据的封包优先处理。

en: The Debian kernels include the features required for QoS along with their associated modules. These modules are many, and each of them provides a different service, most notably by way of special schedulers for the queues of IP packets; the wide range of available scheduler behaviors spans the whole range of possible requirements.
zh-CN: Debian 核心包括 QoS 必备的功能与相关的模块。这些模块提供多样服务，多半系供 IP 封包数组使用；这些数组行为包括多种可能的需求。

en: <emphasis>CULTURE</emphasis> LARTC — <emphasis>Linux Advanced Routing &amp; Traffic Control</emphasis>
zh-CN: <emphasis>文化</emphasis> LARTC — <emphasis>Linux 高端路由与流量控制</emphasis>

en: <primary>routing</primary><secondary>advanced</secondary>
zh-CN: <primary>路由</primary><secondary>高端</secondary>

en: <primary>traffic</primary><secondary>control</secondary>
zh-CN: <primary>流量</primary><secondary>控制</secondary>

en: <primary>control of traffic</primary>
zh-CN: <primary>流量控制</primary>

en: Configuring and Implementing
zh-CN: 配置与应用

en: QoS parameters are set through the <command>tc</command> command (provided by the <emphasis role="pkg">iproute</emphasis> package). Since its interface is quite complex, using higher-level tools is recommended.
zh-CN: 经由 <command>tc</command> 命令 (由 <emphasis role="pkg">iproute</emphasis> 软件包提供) 设置 QoS 参数。因为其接口较为复杂，推荐使用高端的工具。

en: Reducing Latencies: <command>wondershaper</command>
zh-CN: 减少延迟：<command>wondershaper</command>

en: <primary>limitation of traffic</primary>
zh-CN: <primary>流量的限制</primary>

en: <primary>traffic</primary><secondary>limitation</secondary>
zh-CN: <primary>流量</primary><secondary>限制</secondary>

en: The main purpose of <command>wondershaper</command> (in the similarly-named package) is to minimize latencies independent of network load. This is achieved by limiting total traffic to a value that falls just short of the link saturation value.
zh-CN: <command>wondershaper</command> (在同名的软件包中) 的主要目的是最小化独立网络负载的延迟。经由限制整体流量的值缩短链接的饱和值。

en: Changes in the <filename>/etc/network/interfaces</filename> file
zh-CN: 对文件<filename>/etc/network/interfaces</filename>的变更

en: <emphasis>GOING FURTHER</emphasis> Optimal configuration
zh-CN: <emphasis>进阶</emphasis>优化配置

en: The <filename>/usr/share/doc/wondershaper/README.Debian.gz</filename> file describes, in some detail, the configuration method recommended by the package maintainer. In particular, it advises measuring the download and upload speeds so as to best evaluate real limits.
zh-CN: 文件<filename>/usr/share/doc/wondershaper/README.Debian.gz</filename>描述了由包维护者推荐的，一些细节的配置方式。尤其是，它建议测量下载和上传速度来最好评估实际限制。

en: Standard Configuration
zh-CN: 标准配置

en: Configuring
zh-CN: 配置

en: Network Diagnosis Tools
zh-CN: 网络诊断工具

en: Local Diagnosis: <command>netstat</command>
zh-CN: 本地诊断：<command>netstat</command>

en: Let's first mention the <command>netstat</command> command (in the <emphasis role="pkg">net-tools</emphasis> package); it displays an instant summary of a machine's network activity. When invoked with no argument, this command lists all open connections; this list can be very verbose since it includes many Unix-domain sockets (widely used by daemons) which do not involve the network at all (for example, <literal>dbus</literal> communication, <literal>X11</literal> traffic, and communications between virtual filesystems and the desktop).
zh-CN: 首先是在 <emphasis role="pkg">net-tools</emphasis> 包中的 <command>netstat</command> 命令；这个命令能够显示机器的实时网络活动。当直接运行时，该程序会输出所有的连接；由于该命令会输出很多不涉及网络的 Unix 域套接字（如 <literal>dbus</literal> 连接、<literal>X11</literal> 连接，以及虚拟文件系统和桌面间的通信），所以输出内容会非常长。

en: Common invocations therefore use options that alter <command>netstat</command>'s behavior. The most frequently used options include:
zh-CN: 因此，运行 <command>netstat</command> 命令时通常会使用其他命令行参数。最常用的参数都有：

en: <literal>-t</literal>, which filters the results to only include TCP connections;
zh-CN: <literal>-t</literal>, 会只输出 TCP 连接；

en: <literal>-p</literal>, to list the processes involved; this option is only useful when <command>netstat</command> is run as root, since normal users will only see their own processes;
zh-CN: <literal>-p</literal>, 列出所涉及的进程；由于普通用户只能看到自己的进程，这个选项仅在 <command>netstat</command> 以 root 身份运行时才有效；

en: <literal>-c</literal>, to continuously refresh the list of connections.
zh-CN: <literal>-c</literal>, 不断刷新连接列表。

en: The <command>wireshark</command> network traffic analyzer
zh-CN: <command>wireshark</command> 网络流量分析器
