0 - en to zh-TW translation catalogue (100 entries)

en: Network
zh-TW: 網路

en: Gateway
zh-TW: 閘道器

en: Network Infrastructure
zh-TW: 網路架構

en: Linux sports the whole Unix heritage for networking, and Debian provides a full set of tools to create and manage them. This chapter reviews these tools.
zh-TW: Linux 繼承整個 Unix 的網路功能，Debian 提供整套建立與管理網路的工具。本章介紹這些工具。

en: <primary>gateway</primary>
zh-TW: <primary>閘道器</primary>

en: <primary>network</primary><secondary>gateway</secondary>
zh-TW: <primary>網路</primary><secondary>閘道器</secondary>

en: <primary>router</primary>
zh-TW: <primary>路由器</primary>

en: A gateway is a system linking several networks. This term often refers to a local network's “exit point” on the mandatory path to all external IP addresses. The gateway is connected to each of the networks it links together, and acts as a router to convey IP packets between its various interfaces.
zh-TW: 閘道器是連結多個網路的系統。此名詞通常用於本地網路通往外部 IP 位址的 “出口”。閘道器把每個網路連結在一起，且做為路由器在不同介面間傳送 IP 封包。

en: <emphasis>BACK TO BASICS</emphasis> IP packet
zh-TW: <emphasis>基本</emphasis> IP 封包

en: <primary>packet</primary><secondary>IP</secondary>
zh-TW: <primary>封包</primary><secondary>IP</secondary>

en: Most networks nowadays use the IP protocol (<emphasis>Internet Protocol</emphasis>). This protocol segments the transmitted data into limited-size packets. Each packet contains, in addition to its payload data, a number of details required for its proper routing.
zh-TW: 今天，大部份的網路使用 IP 通信協定 (<emphasis>Internet Protocol</emphasis>)。這種協定把傳輸資料切割成小小的封包。除了實際傳輸的資料外，每個封包還包括必備的路由資訊。

en: <emphasis>BACK TO BASICS</emphasis> TCP/UDP
zh-TW: <emphasis>基本</emphasis> TCP/UDP

en: <primary>port</primary><secondary>TCP</secondary>
zh-TW: <primary>埠</primary><secondary>TCP</secondary>

en: <primary>port</primary><secondary>UDP</secondary>
zh-TW: <primary>埠</primary><secondary>UDP</secondary>

en: Many programs do not handle the individual packets themselves, even though the data they transmit does travel over IP; they often use TCP (<emphasis>Transmission Control Protocol</emphasis>). TCP is a layer over IP allowing the establishment of connections dedicated to data streams between two points. The programs then only see an entry point into which data can be fed with the guarantee that the same data exits without loss (and in the same sequence) at the exit point at the other end of the connection. Although many kinds of errors can happen in the lower layers, they are compensated by TCP: lost packets are retransmitted, and packets arriving out of order (for example, if they used different paths) are re-ordered appropriately.
zh-TW: 即使在 IP 上傳輸資料，大部份程式都不處理個別的封包問題；他們通常使用 TCP (<emphasis>Transmission Control Protocol</emphasis>)。TCP 是 IP 的上層，為專屬的資料流建立兩點間的連結。程式祗看到資料進來的款目，並保證同樣的資料無誤 (且以同樣順序) 流到另端連結的出口。在較低層可能發生多種錯誤，都可以被 TCP 補償：重送失去的封包、重組到達的封包 (例如，經由不同路徑送到) 的順序。

en: Another protocol relying on IP is UDP (<emphasis>User Datagram Protocol</emphasis>). In contrast to TCP, it is packet-oriented. Its goals are different: the purpose of UDP is only to transmit one packet from an application to another. The protocol does not try to compensate for possible packet loss on the way, nor does it ensure that packets are received in the same order as were sent. The main advantage to this protocol is that the latency is greatly improved, since the loss of a single packet does not delay the receiving of all following packets until the lost one is retransmitted.
zh-TW: 另個在 IP 上的協定是 UDP (<emphasis>User Datagram Protocol</emphasis>)。與 TCP 不同，它是封包導向的。它的目標不同：UDP 的目的是在應用程式間傳輸封包。此協定不補償封包的遺漏，也不在意封包依序到達。此協定的主要優點是，大幅改善延遲的問題，遺漏的封包不影響接收後續封包，並且持續重送該遺漏的封包。

en: TCP and UDP both involve ports, which are “extension numbers” for establishing communication with a given application on a machine. This concept allows keeping several different communications in parallel with the same correspondent, since these communications can be distinguished by the port number.
zh-TW: TCP 和 UDP 都涉及封包，也就是以 "分機號碼" 模式在機器內的程式建立連結。此做法允許在同個通訊中建立多個平行的管道，因為它們以不同的埠號區分之。

en: When a local network uses a private address range (not routable on the Internet), the gateway needs to implement <emphasis>address masquerading</emphasis> so that the machines on the network can communicate with the outside world. The masquerading operation is a kind of proxy operating on the network level: each outgoing connection from an internal machine is replaced with a connection from the gateway itself (since the gateway does have an external, routable address), the data going through the masqueraded connection is sent to the new one, and the data coming back in reply is sent through to the masqueraded connection to the internal machine. The gateway uses a range of dedicated TCP ports for this purpose, usually with very high numbers (over 60000). Each connection coming from an internal machine then appears to the outside world as a connection coming from one of these reserved ports.
zh-TW: 區域網路接在私人網址範圍內 (不在網路網路的路由上)，閘道器就需要 <emphasis>位址掩蔽</emphasis> 讓其經由網路與外界溝通。掩蔽作業是網路層次的代理工作：內部機器，都被閘道器取代 (因為閘道器有外部的路由位址)，藉由掩蔽連結，資料送出出去，進來的資料經由掩蔽連結至內部機器。閘道器以指定的 TCP 埠執行此工作，通常是較高的號碼 (超過 60000)。對外部而言，經由內部機器的連結，就是來自此等保留埠號。

en: <primary>masquerading</primary>
zh-TW: <primary>掩蔽</primary>

en: <emphasis>CULTURE</emphasis> Private address range
zh-TW: <emphasis>文化</emphasis> 私有位址範圍

en: <primary>private IP address</primary>
zh-TW: <primary>私有 IP 位址</primary>

en: RFC 1918 defines three ranges of IPv4 addresses not meant to be routed on the Internet but only used in local networks. The first one, <literal>10.0.0.0/8</literal> (see sidebar <xref linkend="sidebar.networking-basics" />), is a class-A range (with 2<superscript>24</superscript> IP addresses). The second one, <literal>172.16.0.0/12</literal>, gathers 16 class-B ranges (<literal>172.16.0.0/16</literal> to <literal>172.31.0.0/16</literal>), each containing 2<superscript>16</superscript> IP addresses. Finally, <literal>192.168.0.0/16</literal> is a class-B range (grouping 256 class-C ranges, <literal>192.168.0.0/24</literal> to <literal>192.168.255.0/24</literal>, with 256 IP addresses each). <ulink type="block" url="http://www.faqs.org/rfcs/rfc1918.html" />
zh-TW: RFC 1918 把三組 IPv4 位址設為區域網路專用，不能路由至網際網路。第一組是，<literal>10.0.0.0/8</literal> (見專欄 <xref linkend="sidebar.networking-basics" />)，是一個A級範圍 (是 2<superscript>24</superscript> IP 位址)。第二組是，<literal>172.16.0.0/12</literal>，16個B級範圍 (<literal>172.16.0.0/16</literal> 至 <literal>172.31.0.0/16</literal>)，每個有 2<superscript>16</superscript> IP 位址。最後，<literal>192.168.0.0/16</literal> 是一個B級範圍 (包括 256 個C級範圍，<literal>192.168.0.0/24</literal> 至 <literal>192.168.255.0/24</literal>，各有 256 個 IP 位址)。<ulink type="block" url="http://www.faqs.org/rfcs/rfc1918.html" />

en: The gateway can also perform two kinds of <emphasis>network address translation</emphasis> (or NAT for short). The first kind, <emphasis>Destination NAT</emphasis> (DNAT) is a technique to alter the destination IP address (and/or the TCP or UDP port) for a (generally) incoming connection. The connection tracking mechanism also alters the following packets in the same connection to ensure continuity in the communication. The second kind of NAT is <emphasis>Source NAT</emphasis> (SNAT), of which <emphasis>masquerading</emphasis> is a particular case; SNAT alters the source IP address (and/or the TCP or UDP port) of a (generally) outgoing connection. As for DNAT, all the packets in the connection are appropriately handled by the connection tracking mechanism. Note that NAT is only relevant for IPv4 and its limited address space; in IPv6, the wide availability of addresses greatly reduces the usefulness of NAT by allowing all “internal” addresses to be directly routable on the Internet (this does not imply that internal machines are accessible, since intermediary firewalls can filter traffic).
zh-TW: 閘道器有兩種 <emphasis>網路位址轉換</emphasis> (英文縮寫 NAT) 的功能。第一種是 <emphasis>目的 NAT</emphasis> (DNAT)，改變封包目的 IP 位址 (與 TCP 或 UDP 埠)。連結追蹤機制同時改變後續封包的連結。第二種 NAT 是 <emphasis>來源 NAT</emphasis> (SNAT)，其中的 <emphasis>偽裝</emphasis> 是特例之一；SNAT 改變出去連結的來源 IP 位址 (與 TCP 或 UDP 埠)。如同 DNAT，所有的封包由連結追蹤機制處理。NAT 祗用於 IPv4 及其限制的位址空間；在 IPv6 內，其寬廣的位址技術允許直接在網際網路路由 (並不表示可以近用內部機器，因為防火牆可以過濾流量) 減少 NAT 的用途。

en: <emphasis>BACK TO BASICS</emphasis> Port forwarding
zh-TW: <emphasis>基本</emphasis> 埠轉發

en: <primary>port forwarding</primary>
zh-TW: <primary>埠映射</primary>

en: A concrete application of DNAT is <emphasis>port forwarding</emphasis>. Incoming connections to a given port of a machine are forwarded to a port on another machine. Other solutions may exist for achieving a similar effect, though, especially at the application level with <command>ssh</command> (see <xref linkend="sect.ssh-port-forwarding" />) or <command>redir</command>.
zh-TW: DNAT 的具體應用之一是 <emphasis>埠轉發</emphasis>。進來連結至機器的指定埠號轉發至另部機器的埠號。雖然還有其他的方案達成同樣的效果，諸如應用層面的 <command>ssh</command> (見 <xref linkend="sect.ssh-port-forwarding" />) 或 <command>redir</command>。

en: Enough theory, let's get practical. Turning a Debian system into a gateway is a simple matter of enabling the appropriate option in the Linux kernel, by way of the <filename>/proc/</filename> virtual filesystem:
zh-TW: 理論講多了，看看實務怎麼做。system into a gateway is a simple matter of enabling the appropriate option in the Linux kernel, 經由 <filename>/proc/</filename> 虛擬檔案系統，從 Linux 核心進入 Debian 系統的閘道器：

en: The <filename>/etc/sysctl.conf</filename> file
zh-TW: <filename>/etc/sysctl.conf</filename> 檔案

en: The same effect can be obtained for IPv6 by simply replacing <literal>ipv4</literal> with <literal>ipv6</literal> in the manual command and using the <literal>net.ipv6.conf.all.forwarding</literal> line in <filename>/etc/sysctl.conf</filename>.
zh-TW: 在 IPv6 也能取得同樣的效果，把手冊中的 <literal>ipv4</literal> 換為 <literal>ipv6</literal>，並使用 <literal>net.ipv6.conf.all.forwarding</literal> 於 <filename>/etc/sysctl.conf</filename> 檔案內。

en: Enabling IPv4 masquerading is a slightly more complex operation that involves configuring the <emphasis>netfilter</emphasis> firewall.
zh-TW: 啟用 IPv4 偽裝就有點複雜，涉及組態 <emphasis>netfilter</emphasis> 防火牆。

en: Similarly, using NAT (for IPv4) requires configuring <emphasis>netfilter</emphasis>. Since the primary purpose of this component is packet filtering, the details are listed in <xref linkend="security" xrefstyle="select: label quotedtitle nopage" /> (see <xref linkend="sect.firewall-packet-filtering" />).
zh-TW: 需組態 <emphasis>netfilter</emphasis>，才能使用 NAT (IPv4)。因為此種組件的主要目的是套件篩選，詳情列在 <xref linkend="security" xrefstyle="select: label quotedtitle nopage" /> (見 <xref linkend="sect.firewall-packet-filtering" />)。

en: <primary>certificate</primary><secondary>X.509</secondary>
zh-TW: <primary>認證</primary><secondary>X.509</secondary>

en: Public Key Infrastructure: <emphasis>easy-rsa</emphasis>
zh-TW: 公鑰基礎設施：<emphasis>easy-rsa</emphasis>

en: <primary>Public Key Infrastructure</primary>
zh-TW: <primary>公鑰基礎設施</primary>

en: <primary>RSA (algorithm)</primary>
zh-TW: <primary>RSA (演算法)</primary>

en: <primary>key pair</primary>
zh-TW: <primary>密鑰配對</primary>

en: The Falcot Corp administrators use this tool to create the required certificates, both for the server and the clients. This allows the configuration of all clients to be similar since they will only have to be set up so as to trust certificates coming from Falcot's local CA. This CA is the first certificate to create; to this end, the administrators set up a directory with the files required for the CA in an appropriate location, preferably on a machine not connected to the network in order to mitigate the risk of the CA's private key being stolen.
zh-TW: Falcot 公司的管理者以此工具新增必要的伺服器與客戶端認證。可以把所有的客戶端組態成類似的狀態，因為他們祗需信件 Falcot 在地 CA 的認證。此 CA 是率先認證的；為此工作，管理者在適當的地方建立新的資料夾，供 CA 的檔案使用，最好放在離線的地方，杜絕私鑰被竊的危險。

en: The following step creates certificates for the VPN clients; one certificate is required for each computer or person allowed to use the VPN:
zh-TW: 以上的步驟新增 VPN 客戶；每個使用 VPN 的電腦或使用者都需有個認證：

en: Virtual Private Network
zh-TW: 虛擬專用網路

en: <primary>network</primary><secondary>virtual private</secondary>
zh-TW: <primary>網路</primary><secondary>虛擬專用</secondary>

en: A <emphasis>Virtual Private Network</emphasis> (VPN for short) is a way to link two different local networks through the Internet by way of a tunnel; the tunnel is usually encrypted for confidentiality. VPNs are often used to integrate a remote machine within a company's local network.
zh-TW: <emphasis>虛擬專用網路</emphasis> (VPN) 是以通道方式，經由網際網路連結兩個區域網路的方式；通常以加密方式在通道內傳送資訊。VPN 通常用於整合公司內部遠端機器。

en: OpenVPN is a piece of software dedicated to creating virtual private networks. Its setup involves creating virtual network interfaces on the VPN server and on the client(s); both <literal>tun</literal> (for IP-level tunnels) and <literal>tap</literal> (for Ethernet-level tunnels) interfaces are supported. In practice, <literal>tun</literal> interfaces will most often be used except when the VPN clients are meant to be integrated into the server's local network by way of an Ethernet bridge.
zh-TW: OpenVPN 用於建立虛擬專用網路的一個軟體。在 VPN 伺服器及客戶端建立虛擬專用網路；支援 <literal>tun</literal> (IP 層面的通道) 和 <literal>tap</literal> (Ethernet 層面的通道) 介面。實務上，常用的是 <literal>tun</literal> 介面，除非 VPN 客戶端難以經由 Ethernet 橋接器整合入伺服器的區域網路。

en: OpenVPN relies on OpenSSL for all the SSL/TLS cryptography and associated features (confidentiality, authentication, integrity, non-repudiation). It can be configured either with a shared private key or using X.509 certificates based on a public key infrastructure. The latter configuration is strongly preferred since it allows greater flexibility when faced with a growing number of roaming users accessing the VPN.
zh-TW: OpenVPN 所有的 SSL/TLS 加密與其他功能 (機密性、認證、完整性、不可否認性)，均有賴於 OpenSSL。可以用公鑰基礎設施的共享私鑰或使用 X.509 認證的方式組態它。建議使用後者的方式組態，以漫遊方式近用 VPN 的使用者可享有更多的彈性。

en: Configuring the OpenVPN Server
zh-TW: 組態 OpenVPN 伺服器

en: Barring further action, VPN clients can only access the VPN server itself by way of the <literal>10.8.0.1</literal> address. Granting the clients access to the local network (192.168.0.0/24), requires adding a <literal>push route 192.168.0.0 255.255.255.0</literal> directive to the OpenVPN configuration so that VPN clients automatically get a network route telling them that this network is reachable by way of the VPN. Furthermore, machines on the local network also need to be informed that the route to the VPN goes through the VPN server (this automatically works when the VPN server is installed on the gateway). Alternatively, the VPN server can be configured to perform IP masquerading so that connections coming from VPN clients appear as if they are coming from the VPN server instead (see <xref linkend="sect.gateway" />).
zh-TW: 禁止進一步的行動，VPN 客戶端祗能經由 <literal>10.8.0.1</literal> 位址近用 VPN 伺服器。為了授權客戶近用在地網路 (192.168.0.0/24)，需在 OpenVPN 組態中加入 <literal>推送路徑 192.168.0.0 255.255.255.0</literal>，讓 VPN 客戶端自動取得網路路由，使其明瞭經由 VPN 可以進入該網路。此外，在地網路的機器也需被告知，經由 VPN 伺服器 (在閘道安裝 VPN 伺服器即自動啟用) 進入VPN。另外，VPN 伺服器可以組態後執行偽裝 IP 的工作，讓來自 VPN 客戶端的訊息顯示成來自 VPN 伺服器 (見 <xref linkend="sect.gateway" />)。

en: Configuring the OpenVPN Client
zh-TW: 組態 OpenVPN 客戶端

en: Setting up an OpenVPN client also requires creating a configuration file in <filename>/etc/openvpn/</filename>. A standard configuration can be obtained by using <filename>/usr/share/doc/openvpn/examples/sample-config-files/client.conf</filename> as a starting point. The <literal>remote vpn.falcot.com 1194</literal> directive describes the address and port of the OpenVPN server; the <literal>ca</literal>, <literal>cert</literal> and <literal>key</literal> also need to be adapted to describe the locations of the key files.
zh-TW: 需組態 <filename>/etc/openvpn/</filename> 內的檔案才能設定 OpenVPN 客戶端。標準的組態方法可從使用 <filename>/usr/share/doc/openvpn/examples/sample-config-files/client.conf</filename> 這個檔案開始。<literal>remote vpn.falcot.com 1194</literal> 介紹 OpenVPN 伺服器的位址及埠號；描述密鑰文件位址時，需參考 <literal>ca</literal>、<literal>cert</literal> 和 <literal>key</literal>。

en: Virtual Private Network with SSH
zh-TW: SSH 下的虛擬專屬網路

en: The second method is more recent, and was introduced with OpenSSH 4.3; it is now possible for OpenSSH to create virtual network interfaces (<literal>tun*</literal>) on both sides of an SSH connection, and these virtual interfaces can be configured exactly as if they were physical interfaces. The tunneling system must first be enabled by setting <literal>PermitTunnel</literal> to “yes” in the SSH server configuration file (<filename>/etc/ssh/sshd_config</filename>). When establishing the SSH connection, the creation of a tunnel must be explicitly requested with the <literal>-w any:any</literal> option (<literal>any</literal> can be replaced with the desired <literal>tun</literal> device number). This requires the user to have administrator privilege on both sides, so as to be able to create the network device (in other words, the connection must be established as root).
zh-TW: 第二個方法較新，適用於 OpenSSH 4.3；可以在 OpenSSH 之下建立虛擬網路介面 (<literal>tun*</literal>) 於 SSH 連結的兩端，且可以精準地組態這些虛擬介面，就像在實體介面環境下。必須先設定 <literal>PermitTunnel</literal> 為 “yes” 於 SSH 伺服器組態檔 (<filename>/etc/ssh/sshd_config</filename>)，才能啟用此隧道系統。啟用 SSH 連結後，新增的隧道必須以 <literal>-w any:any</literal> 選項 (<literal>any</literal> 可以用期望的 <literal>tun</literal> 設備名稱取代) 請求連結。兩端的使用者需有管理者權限，才能新增網路設備 (換句話說，必須以超級使用者的身份才能建立連結)。

en: Both methods for creating a virtual private network over SSH are quite straightforward. However, the VPN they provide is not the most efficient available; in particular, it does not handle high levels of traffic very well.
zh-TW: 以 SSH 建立虛擬專屬網路的兩種方法都很直接。然而，它們提供的 VPN 不是最有效的；特別是，無法有效處理高階的流量。

en: IPsec
zh-TW: 網際網路安全協定

en: <primary>IPsec</primary>
zh-TW: <primary>網際網路安全協定</primary>

en: In spite of its status as the reference, the complexity of setting up IPsec restricts its usage in practice. OpenVPN-based solutions will generally be preferred when the required tunnels are neither too many nor too dynamic.
zh-TW: 僅管其狀態為參照，IPsec 的設定限制其用途。必備的通道不多也不是動態時，OpenVPN-based 解決方案較受用。

en: <emphasis>CAUTION</emphasis> IPsec and NAT
zh-TW: <emphasis>注意</emphasis> IPsec 與 NAT

en: NATing firewalls and IPsec do not work well together: since IPsec signs the packets, any change on these packets that the firewall might perform will void the signature, and the packets will be rejected at their destination. Various IPsec implementations now include the <emphasis>NAT-T</emphasis> technique (for <emphasis>NAT Traversal</emphasis>), which basically encapsulates the IPsec packet within a standard UDP packet.
zh-TW: NAT 的防火牆與 IPsec 無法併用：因為 IPsec 是套件，任何改變將引發防火牆的作用，套件就會被拒絕。不同的 IPsec 應用包括：<emphasis>NAT-T</emphasis> 技術 (給 <emphasis>NAT Traversal</emphasis>)，把 IPsec 套件包裝在標準的 UDP 封包內。

en: <emphasis>SECURITY</emphasis> IPsec and firewalls
zh-TW: <emphasis>安全</emphasis> IPsec 與防火牆

en: <primary>ESP, protocol</primary>
zh-TW: <primary>ESP，協定</primary>

en: <primary>AH, protocol</primary>
zh-TW: <primary>AH，協定</primary>

en: <primary>protocol</primary><secondary>AH</secondary>
zh-TW: <primary>協定</primary><secondary>AH</secondary>

en: <primary>protocol</primary><secondary>ESP</secondary>
zh-TW: <primary>協定</primary><secondary>ESP</secondary>

en: The standard mode of operation of IPsec involves data exchanges on UDP port 500 for key exchanges (also on UDP port 4500 in the case that NAT-T is in use). Moreover, IPsec packets use two dedicated IP protocols that the firewall must let through; reception of these packets is based on their protocol numbers, 50 (ESP) and 51 (AH).
zh-TW: IPsec 的標準操作模式在 UDP 埠號 500 做鍵值交換 (使用 NAT-T 時，也可在 UDP 埠號 4500)。而且，IPsec 封包使用兩個固定的 IP 協定允許防火牆通過；收到這些封包的基礎是其協定編號，50 (ESP) 與 51 (AH)。

en: <primary>GRE, protocol</primary>
zh-TW: <primary>GRE，協定</primary>

en: <primary>protocol</primary><secondary>GRE</secondary>
zh-TW: <primary>協定</primary><secondary>GRE</secondary>

en: PPTP (for <emphasis>Point-to-Point Tunneling Protocol</emphasis>) uses two communication channels, one for control data and one for payload data; the latter uses the GRE protocol (<emphasis>Generic Routing Encapsulation</emphasis>). A standard PPP link is then set up over the data exchange channel.
zh-TW: PPTP (𪅈原文是 <emphasis>Point-to-Point Tunneling Protocol</emphasis>) 用到兩種通訊閘道，一個控制資料另個酬載資料；後者使用 GRE 協定 (<emphasis>Generic Routing Encapsulation</emphasis>)。標準的 PPP 連結建立在資料交換閘道。

en: Configuring the Client
zh-TW: 設定客戶端

en: The <emphasis role="pkg">pptp-linux</emphasis> package contains an easily-configured PPTP client for Linux. The following instructions take their inspiration from the official documentation: <ulink type="block" url="http://pptpclient.sourceforge.net/howto-debian.phtml" />
zh-TW: 此 <emphasis role="pkg">pptp-linux</emphasis> 封包含有易於組態的 Linux 客戶端 PPTP。以下說明取自官方文件：<ulink type="block" url="http://pptpclient.sourceforge.net/howto-debian.phtml" />

en: The Falcot administrators created several files: <filename>/etc/ppp/options.pptp</filename>, <filename>/etc/ppp/peers/falcot</filename>, <filename>/etc/ppp/ip-up.d/falcot</filename>, and <filename>/etc/ppp/ip-down.d/falcot</filename>.
zh-TW: Falcot 管理者新增若干檔案：<filename>/etc/ppp/options.pptp</filename>、<filename>/etc/ppp/peers/falcot</filename>、<filename>/etc/ppp/ip-up.d/falcot</filename>、與 <filename>/etc/ppp/ip-down.d/falcot</filename>。

en: The <filename>/etc/ppp/options.pptp</filename> file
zh-TW: <filename>/etc/ppp/options.pptp</filename> 檔案

en: The <filename>/etc/ppp/peers/falcot</filename> file
zh-TW: <filename>/etc/ppp/peers/falcot</filename> 檔案

en: The <filename>/etc/ppp/ip-up.d/falcot</filename> file
zh-TW: <filename>/etc/ppp/ip-up.d/falcot</filename> 檔案

en: The <filename>/etc/ppp/ip-down.d/falcot</filename> file
zh-TW: <filename>/etc/ppp/ip-down.d/falcot</filename> 檔案

en: <emphasis>SECURITY</emphasis> MPPE
zh-TW: <emphasis>安全</emphasis> MPPE

en: Securing PPTP involves using the MPPE feature (<emphasis>Microsoft Point-to-Point Encryption</emphasis>), which is available in official Debian kernels as a module.
zh-TW: 加密的 PPTP 涉及使用 MPPE 功能 (<emphasis>Microsoft Point-to-Point Encryption</emphasis>)，可從 Debian 官方的核心取得模組。

en: Configuring the Server
zh-TW: 組態伺服器

en: <emphasis>CAUTION</emphasis> PPTP and firewalls
zh-TW: <emphasis>注意</emphasis> PPTP 與防火牆

en: Intermediate firewalls need to be configured to let through IP packets using protocol 47 (GRE). Moreover, the PPTP server's port 1723 needs to be open so that the communication channel can happen.
zh-TW: 需組態中間防火牆讓 IP 封包使用埠號 47 (GRE)。此外，需打開 PPTP 伺服器的埠號 1723以使用通訊閘道。

en: <command>pptpd</command> is the PPTP server for Linux. Its main configuration file, <filename>/etc/pptpd.conf</filename>, requires very few changes: <emphasis>localip</emphasis> (local IP address) and <emphasis>remoteip</emphasis> (remote IP address). In the example below, the PPTP server always uses the <literal>192.168.0.199</literal> address, and PPTP clients receive IP addresses from <literal>192.168.0.200</literal> to <literal>192.168.0.250</literal>.
zh-TW: <command>pptpd</command> 是 Linux 的 PPTP 伺服器。它的主要組態檔是，<filename>/etc/pptpd.conf</filename>，應做若干改變：<emphasis>localip</emphasis> (內網 IP 位址) 與 <emphasis>remoteip</emphasis> (外網 IP 位址)。在下例中，PPTP 伺服器總是使用 <literal>192.168.0.199</literal> 位址，以及從 <literal>192.168.0.200</literal> 至 <literal>192.168.0.250</literal> 之間接收 PPTP 客戶端的 IP 位址。

en: The <filename>/etc/pptpd.conf</filename> file
zh-TW: <filename>/etc/pptpd.conf</filename> 檔案

en: The PPP configuration used by the PPTP server also requires a few changes in <filename>/etc/ppp/pptpd-options</filename>. The important parameters are the server name (<literal>pptp</literal>), the domain name (<literal>falcot.com</literal>), and the IP addresses for DNS and WINS servers.
zh-TW: PPP 採用 PPTP 伺服器組態時也需在 <filename>/etc/ppp/pptpd-options</filename> 做若干改變。 重要的參數有伺服器名稱 (<literal>pptp</literal>)、網域名稱 (<literal>falcot.com</literal>)、以及 DNS 與 WINS 伺服器的 IP 位址。

en: The <filename>/etc/ppp/pptpd-options</filename> file
zh-TW: <filename>/etc/ppp/pptpd-options</filename> 檔案

en: The last step involves registering the <literal>vpn</literal> user (and the associated password) in the <filename>/etc/ppp/chap-secrets</filename> file. Contrary to other instances where an asterisk (<literal>*</literal>) would work, the server name must be filled explicitly here. Furthermore, Windows PPTP clients identify themselves under the <literal><replaceable>DOMAIN</replaceable>\\<replaceable>USER</replaceable></literal> form, instead of only providing a user name. This explains why the file also mentions the <literal>FALCOT\\vpn</literal> user. It is also possible to specify individual IP addresses for users; an asterisk in this field specifies that dynamic addressing should be used.
zh-TW: 登錄 <literal>vpn</literal> 使用者 (及其密碼) 於 <filename>/etc/ppp/chap-secrets</filename> 檔案的最後一個步驟。其他的作為裡，星號 (<literal>*</literal>) 是有作用的，在此的伺服器名稱必須明示出來。而且，Windows PPTP 客戶端以 <literal><replaceable>DOMAIN</replaceable>\\<replaceable>USER</replaceable></literal> 形式辨識，不是以使用者名稱區別。這就說明了在 <literal>FALCOT\\vpn</literal> 使用者必須提及的檔案。也可以指定使用者使用特定的 IP 位址；此欄位內的星號用於指定動態的位址。

en: The <filename>/etc/ppp/chap-secrets</filename> file
zh-TW: 該 <filename>/etc/ppp/chap-secrets</filename> 檔案

en: <emphasis>SECURITY</emphasis> PPTP vulnerabilities
zh-TW: <emphasis>安全</emphasis> PPTP 漏洞

en: Microsoft's first PPTP implementation drew severe criticism because it had many security vulnerabilities; most have since then been fixed in more recent versions. The configuration documented in this section uses the latest version of the protocol. Be aware though that removing some options (such as <literal>require-mppe-128</literal> and <literal>require-mschap-v2</literal>) would make the service vulnerable again.
zh-TW: 𧢒微軟的第一個 PPTP 應用發生重大的瑕疪，因為出現很多安全漏洞；多半在新版已修正了。本節的組態文件使用最新版的協定。移除部份選項 (如 <literal>require-mppe-128</literal> 與 <literal>require-mschap-v2</literal>) 仍可能再出現服務漏洞。

en: Quality of Service
zh-TW: 品質服務

en: Principle and Mechanism
zh-TW: 原則與機制

en: <emphasis>Quality of Service</emphasis> (or <emphasis>QoS</emphasis> for short) refers to a set of techniques that guarantee or improve the quality of the service provided to applications. The most popular such technique involves classifying the network traffic into categories, and differentiating the handling of traffic according to which category it belongs to. The main application of this differentiated services concept is <emphasis>traffic shaping</emphasis>, which limits the data transmission rates for connections related to some services and/or hosts so as not to saturate the available bandwidth and starve important other services. Traffic shaping is a particularly good fit for TCP traffic, since this protocol automatically adapts to available bandwidth.
zh-TW: <emphasis>服務品質</emphasis> (Quality of Service 或縮寫為 <emphasis>QoS</emphasis>) 係指提供應用時足以保證或改進服務品質的技術。最常見的技術包括分類網路流量、及依照其類別區分流量的作用。這種區分服務的概念是 <emphasis>流量成形</emphasis>，限制部份服務或主機的資料傳輸率，使其不致塞飽可用的頻寬以及壓縮其他的服務。流量成形是 TCP 流量的特定形式，此協定自動調整可用的頻。

en: It is also possible to alter the priorities on traffic, which allows prioritizing packets related to interactive services (such as <command>ssh</command> and <command>telnet</command>) or to services that only deal with small blocks of data.
zh-TW: 也可能改變流量的優先順序，允許與互動服務有關的 (如 <command>ssh</command> 與 <command>telnet</command>) 或祗服務小量資料的封包優先處理。

en: The Debian kernels include the features required for QoS along with their associated modules. These modules are many, and each of them provides a different service, most notably by way of special schedulers for the queues of IP packets; the wide range of available scheduler behaviors spans the whole range of possible requirements.
zh-TW: Debian 核心包括 QoS 必備的功能與相關的模組。這些模組提供多樣服務，多半係供 IP 封包陣列使用；這些陣列行為包括多種可能的需求。

en: <emphasis>CULTURE</emphasis> LARTC — <emphasis>Linux Advanced Routing &amp; Traffic Control</emphasis>
zh-TW: <emphasis>文化</emphasis> LARTC — <emphasis>Linux 進階路由與流量控制</emphasis>

en: <primary>routing</primary><secondary>advanced</secondary>
zh-TW: <primary>路由</primary><secondary>進階</secondary>

en: <primary>traffic</primary><secondary>control</secondary>
zh-TW: <primary>流量</primary><secondary>控制</secondary>

en: <primary>control of traffic</primary>
zh-TW: <primary>流量控制</primary>

en: Configuring and Implementing
zh-TW: 組態與應用

en: QoS parameters are set through the <command>tc</command> command (provided by the <emphasis role="pkg">iproute</emphasis> package). Since its interface is quite complex, using higher-level tools is recommended.
zh-TW: 經由 <command>tc</command> 命令 (由 <emphasis role="pkg">iproute</emphasis> 套件提供) 設定 QoS 參數。因為其介面較為複雜，建議使用高階的工具。

en: Reducing Latencies: <command>wondershaper</command>
zh-TW: 減少延遲：<command>wondershaper</command>

en: <primary>limitation of traffic</primary>
zh-TW: <primary>流量的限制</primary>

en: <primary>traffic</primary><secondary>limitation</secondary>
zh-TW: <primary>流量</primary><secondary>限制</secondary>

en: The main purpose of <command>wondershaper</command> (in the similarly-named package) is to minimize latencies independent of network load. This is achieved by limiting total traffic to a value that falls just short of the link saturation value.
zh-TW: <command>wondershaper</command> (在同名的套件中) 的主要目的是最小化獨立網路負載的延遲。經由限制整體流量的值縮短連結的飽和值。

en: Configuring
zh-TW: 配置
