Íå ïîëó÷àåòñÿ íàñòðîèòü Virtual DMZ

**Mam(O)n** · 21-11-2007, 22:39

Äà, òàáëèöû íîðìàëüíûå(-t mangle íå ïðàâèë âåäü?). Ìîæåò ïðîáëåìû ñ äðóãîé ñòîðîíû? Ìîæíî ïîñìîòðåòü, ïðèõîäÿò ëè ïàêåòû èç MAN êîìàíäîé tcpdump -ni ppp0 tcp port 80. Ïðè ïîïûòêå ïîäöåïèòñÿ íà 80 ïîðò èç MAN äîëæíî îòîáðàæàòüñÿ â êîíñîëè. ×òî òî òèïà ýòîãî:

Code:

[root@router tmp]$ tcpdump -ni vlan1 tcp port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
01:28:19.990966 IP 210.170.17.7.58629 > 210.170.17.141.80: S 889591788:889591788(0) win 65535 <mss 1440,nop,nop,sackOK,nop,wscale 1,[|tcp]>
01:28:22.989352 IP 210.170.17.7.58629 > 210.170.17.141.80: S 889591788:889591788(0) win 65535 <mss 1440,nop,nop,sackOK,nop,wscale 1,[|tcp]>
01:28:26.188446 IP 210.170.17.7.58629 > 210.170.17.141.80: S 889591788:889591788(0) win 65535 <mss 1440,nop,nop,sackOK,nop,wscale 1,[|tcp]>

**poVitter** · 21-11-2007, 23:23

Code:

[admin@(none) root]$ tcpdump -ni vlan1 tcp port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
02:08:39.630131 IP 10.154.41.19.1785 > 10.154.41.13.80: S 079881667:1079881667(0) win 65535 <mss 1460,nop,nop,sackOK>
02:08:54.922750 IP 10.154.41.19.1786 > 10.154.41.13.80: S 1644789729:1644789729(0) win 65535 <mss 1460,nop,nop,sackOK>
02:08:57.931048 IP 10.154.41.19.1786 > 10.154.41.13.80: S 1644789729:1644789729(0) win 65535 <mss 1460,nop,nop,sackOK>
02:09:03.964367 IP 10.154.41.19.1786 > 10.154.41.13.80: S 1644789729:1644789729(0) win 65535 <mss 1460,nop,nop,sackOK>

4 packets captured
95 packets received by filter
58 packets dropped by kernel
[admin@(none) root]$

âðîäå ïàêåòû åñòü. Íó íà ppp0 âîáùå âññå íîðëìàüíî. à Âîò íà vlan1 ïðè ïîïûòêå ñîåäèíèòñÿ îäèí âõîäÿùèé ïàêåò, à äàëüøå íè÷åãî íåò. Äà è âõîäÿùåãî ñîåäèíåíèÿ íà ñåðâåðå íå âèæó.

**Mam(O)n** · 21-11-2007, 23:51

Originally Posted by poVitter

Âîò íà vlan1 ïðè ïîïûòêå ñîåäèíèòñÿ îäèí âõîäÿùèé ïàêåò, à äàëüøå íè÷åãî íåò.

À ñ÷åò÷èê êðóòèòñÿ?

Code:

Chain PREROUTING (policy ACCEPT 31506 packets, 5273727 bytes)
    pkts      bytes target     prot opt in     out     source               destination
     244    29905 VSERVER    all  --  *      *       0.0.0.0/0            89.222.152.52
       0        0 VSERVER    all  --  *      *       0.0.0.0/0            10.154.41.13

È åùå òîãäà äëÿ ïîëíîòû êàðòèíû â ñòóäèþ:
iptables -L FORWARD -vn
iptables -L -vnt mangle
ifconfig
route -n

**poVitter** · 21-11-2007, 23:56

Originally Posted by Mam(O)n

Ïîçæå ïðî÷èòàë. Íó åñëè ïðîáëåìû êàêèå áóäóò, òî àï.

Ïîêà âðîäå ÿñíî â ÷åì äåëî. Ñïàñèáî çà ïîìîùü.

**anikss** · 29-11-2007, 21:17

Çäðàâñòâóéòå!
Ïîäñêàæèòå ïîæàëóéñòà, õî÷ó âêëþ÷èòü âîçìîæíîñòü Virtual DMZ, íî íè÷åãî íå ðàáîòàåò õîòü óáåé. Ïèíã èäåò, ïîïûòêà ñîåäèíèòüñÿ íà êàêèå-òî ïîðòû òåëíåòîì çàêàí÷èâàåòñÿ î÷åíü ñòðàííîé âåùüþ: ïîðòû 80 è 21 âûäàþò ÷åðíûé ýêðàí áåç èíôîðìàöèè, íà îñòàëüíûå ïîðòû âîîáùå íå êîííåêòèò.
Ìîæåò, ÷òî-òî íå òàê íàñòðîèë? Óñòðîéñòâî WL-500gP ïðîøèâêà 1.9.2.7-8. Ïî ñîâåòó â êàêîé-òî ñîñåäíåé òåìå ïðèâîæó òàáëèöû ðîóòåðà:

Code:

Chain INPUT (policy ACCEPT 30 packets, 960 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          state INVALID 
  678 63168 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED 
   30  1800 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0          state NEW 
  100  8208 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0          state NEW 

Chain FORWARD (policy ACCEPT 12 packets, 572 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0          
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          state INVALID 
  375  150K ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED 
    0     0 DROP       all  --  !br0   vlan1   0.0.0.0/0            0.0.0.0/0          
  271 16204 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          ctstate DNAT 

Chain OUTPUT (policy ACCEPT 967 packets, 524K bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain MACS (0 references)
 pkts bytes target     prot opt in     out     source               destination         

Chain SECURITY (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp flags:0x16/0x02 limit: avg 1/sec burst 5 
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp flags:0x17/0x04 limit: avg 1/sec burst 5 
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0          limit: avg 5/sec burst 5 
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0          limit: avg 5/sec burst 5 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          

Chain logaccept (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0          state NEW LOG flags 7 level 4 prefix `ACCEPT ' 
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0          state NEW LOG flags 7 level 4 prefix `DROP ' 
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          
Chain PREROUTING (policy ACCEPT 132 packets, 6267 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    5   284 VSERVER    all  --  *      *       0.0.0.0/0            77.41.77.118       

Chain POSTROUTING (policy ACCEPT 38 packets, 2253 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   11   524 MASQUERADE  all  --  *      vlan1  !77.41.77.118         0.0.0.0/0          
    6   970 MASQUERADE  all  --  *      br0     192.168.0.0/24       192.168.0.0/24     

Chain OUTPUT (policy ACCEPT 39 packets, 2939 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain VSERVER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
    5   284 DNAT       all  --  *      *       0.0.0.0/0            0.0.0.0/0          to:192.168.0.1

Ïîìîãèòå ïîæàëóéñòà, åñëè âàñ íå çàòðóäíèò! Ñïàñèáî áîëüøîå!

**anikss** · 30-11-2007, 22:20

Òàê, âûÿñíÿþòñÿ íîâûå ïîäðîáíîñòè.
Îêàçûâàåòñÿ, íè DMZ, íè Virtual Server íå ñîáèðàþòñÿ ôîðâàðäèòü íè÷åãî íà ìàøèíû â ìîåé ëîêàëêå! À âîò åñëè óêàçàòü àäðåñ ñåðâåðà, êîòîðûé ïîäêëþ÷åí ïî Wi-Fi, è òî è òî ïðåêðàñíî ðàáîòàåò.

Òî÷íåå, òàê. Åñëè óñòàíîâèòü ôîðâàðäèíã íà ìàøèíó èç ëîêàëêè, è çàéòè íà âíåøíèé (WAN) àäðåñ ðîóòåðà èç ýòîé æå ëîêàëêè, òî âñå ðàáîòàåò. À åñëè çàõîäèòü èçâíå, òî.... ñì. ïåðâûé àáçàö ïîñòà.

Êàê áûòü? Ñïàñèáî çà âíèìàíèå.

**anikss** · 30-11-2007, 23:12

Ëîãè TCP Dump, ïðè îáðàùåíèè íà 80 ïîðò è Virtual DMZ íà ìàøèíó èç ñåòè (WAN->LAN):

Code:

[admin@WIFIROUTER root]$ tcpdump tcp port 80
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 68 bytes
02:02:28.056082 IP 89.19.166.84.4463 > 192.168.0.1.www: S 2787142012:2787142012(0) win 16384 <mss 1360,nop,nop,sackOK>
02:02:30.969963 IP 89.19.166.84.4463 > 192.168.0.1.www: S 2787142012:2787142012(0) win 16384 <mss 1360,nop,nop,sackOK>
02:02:36.966998 IP 89.19.166.84.4463 > 192.168.0.1.www: S 2787142012:2787142012(0) win 16384 <mss 1360,nop,nop,sackOK>

Ïîñëå ýòîãî êîííåêò îáðûâàåòñÿ. Íó è WAN->WLAN ðàáîòàåò êàê íàäî, òàì ïàêåòîâ íà ïîðÿäîê áîëüøå.

Ñïàñèáî çà âíèìàíèå.

**anikss** · 01-12-2007, 12:51

Åñëè êòî-òî âñå æå îáðàòèò âíèìàíèå íà ïðîáëåìó, ãîòîâ ïðåäîñòàâèòü ëþáóþ âñïîìîãàòåëüíóþ èíôîðìàöèþ

Âîò, íàïðèìåð:

Code:

[admin@WIFIROUTER root]$ iptables -L -vxn -t nat
Chain PREROUTING (policy ACCEPT 22 packets, 1186 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       4      433 VSERVER    all  --  *      *       0.0.0.0/0            77.41.77.118

Chain POSTROUTING (policy ACCEPT 15 packets, 1123 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 MASQUERADE  all  --  *      vlan1  !77.41.77.118         0.0.0.0/0
       0        0 MASQUERADE  all  --  *      br0     192.168.0.0/24       192.168.0.0/24

Chain OUTPUT (policy ACCEPT 11 packets, 690 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain VSERVER (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       4      433 DNAT       all  --  *      *       0.0.0.0/0            0.0.0.0/0          to:192.168.0.1

Code:

[admin@WIFIROUTER root]$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
77.41.64.1      0.0.0.0         255.255.255.255 UH    0      0        0 vlan1
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 br0
77.41.64.0      0.0.0.0         255.255.240.0   U     0      0        0 vlan1
127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo
0.0.0.0         77.41.64.1      0.0.0.0         UG    0      0        0 vlan1

**al37919** · 02-12-2007, 20:01

DMZ âêëþ÷èë â web-IF?
ïðîâàéäåð íå çàêðûâàåò ïîðòû?
WAN IP ðåàëüíûé? (ïîõîæå äà)
óäàåòñÿ ëè ïîäêëþ÷èòüñÿ èçâíå ê ðîóòåðó?
íà êîìïå ôàéðâîë âûêëþ÷åí?
íåò ëè ãäå êîíôëèêòà àäðåñîâ 192.168.0.Õ (íàïðèìåð, íå âêëþ÷åí ëè â âèíäå øàðèíã ñîåäèíåíèÿ)? Âîîáùå, äëÿ óâåðåííîñòè ëó÷øå áû ïîñòàâèòü íå 0

Ïðîâåðèë èç ëîêàëêè íà ýòîò âíåøíèé àäðåñ (êàê áû ïîëó÷àåòñÿ èç ëîêàëêè â ýòó æå ëîêàëêó, íî ÷åðåç âíåøíèé àäðåñ) - âñå ðàáîòàåò. Íå ðàáîòàåò DMZ òîëüêî ïðè îáðàùåíèè èçâíå.

ýòî íè÷åãî íå ïîêàçûâàåò, êðîìå òîãî ÷òî â ËÀÍ ðàáîòàåò.

**anikss** · 02-12-2007, 21:15

Ñïàñèáî çà îòâåò!

Originally Posted by al37919

DMZ âêëþ÷èë â web-IF?

ß íå íàøåë ïóíêòà "Âêëþ÷èòü/âûêëþ÷èòü DMZ", íî àäðåñ òàì ïðîïèñàí (äóìàþ, ýòî è ÿâëÿåòñÿ òðèããåðîì íà âêëþ÷åíèå).

Originally Posted by al37919

ïðîâàéäåð íå çàêðûâàåò ïîðòû?
WAN IP ðåàëüíûé? (ïîõîæå äà)
óäàåòñÿ ëè ïîäêëþ÷èòüñÿ èçâíå ê ðîóòåðó?
íà êîìïå ôàéðâîë âûêëþ÷åí?
íåò ëè ãäå êîíôëèêòà àäðåñîâ 192.168.0.Õ (íàïðèìåð, íå âêëþ÷åí ëè â âèíäå øàðèíã ñîåäèíåíèÿ)?

Äà òàì ïðîáëåìà ñïåöèôè÷íàÿ ó ìåíÿ... È DMZ è Virtual Server ðàáîòàþò, íî ðàáîòàþò òîëüêî íà WLAN.
Âñå ýòî îáíàðóæèâàåòñÿ, åñëè ïîäêëþ÷èòü îäèí è òîò æå êîìïüþòåð ñíà÷àëà ïî WI-Fi, à ïîòîì ïî LAN è ñðàâíèòü, êàê âñå ðàáîòàåò. Ðàáîòàåò òîëüêî â ïåðâîì ñëó÷àå.

Originally Posted by al37919

Âîîáùå, äëÿ óâåðåííîñòè ëó÷øå áû ïîñòàâèòü íå 0

Ñïàñèáî, ýòî ïîïðîáóþ.

**Mam(O)n** · 02-12-2007, 23:42

Originally Posted by anikss

4 433 DNAT all -- * * 0.0.0.0/0 0.0.0.0/0 to:192.168.0.1

192.168.0.1 ýòî ÷åé ip?

**anikss** · 03-12-2007, 09:10

Originally Posted by Mam(O)n

192.168.0.1 ýòî ÷åé ip?

Ìàøèíû, êîòîðàÿ ïî LAN ïîäêëþ÷åíà. WLAN-ìàøèíà èìååò IP 192.168.0.2

**al37919** · 03-12-2007, 09:43

à ðîóòåð êàêîé èìååò LAN IP?

**anikss** · 03-12-2007, 10:03

Originally Posted by al37919

à ðîóòåð êàêîé èìååò LAN IP?

192.168.0.50

**lexass** · 25-12-2007, 19:51

äà ôèã çíàåò...
â Virtual Server List
ïðîêèíóò 80 íà 192.168.1.1 lighttpd - äîñòóï èç âíå åñòü
à âîò FTP ñåðâåð: vsftpd 20 è 21 íåò

[admin@WL-500g root]$ iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
VSERVER all -- anywhere 10-2-33-19.users.mns.ru
NETMAP udp -- anywhere 10-2-33-19.users.mns.ruudp spt:6112 192 .168.1.0/24
autofw tcp -- anywhere anywhere tcp dpt:16567 autofw tcp dpt:16567 to:16567
autofw udp -- anywhere anywhere udp dpt:1200 autofw udp dpt:1200 to:1200
autofw tcp -- anywhere anywhere tcp dpt:30001 autofw tcp dpt:30001 to:30001
autofw udp -- anywhere anywhere udp dpt:30002 autofw udp dpt:30002 to:30002

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
NETMAP udp -- 192.168.1.0/24 anywhere udp dpt:6112 10.2.33 .19/32
MASQUERADE all -- !10-2-33-19.users.mns.ru anywhere
MASQUERADE all -- 192.168.1.0/24 192.168.1.0/24

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain VSERVER (1 references)
target prot opt source destination
DNAT tcp -- anywhere anywhere tcp dpt:27016 to:192 .168.1.2:27016
DNAT udp -- anywhere anywhere udp dpt:27016 to:192 .168.1.2:27016
DNAT tcp -- anywhere anywhere tcp dpts:ftp-data:ft p to:192.168.1.1:21
DNAT tcp -- anywhere anywhere tcp dpt:www to:192.1 68.1.1:80

Thread: Íå ïîëó÷àåòñÿ íàñòðîèòü Virtual DMZ

Thread Tools

Rate This Thread

Display

Íå ðàáîòàåò Virtual DMZ

Similar Threads

Mini PCI mod: äåëàåì èç WL-500gPv1 WL-500W è ïîëó÷àåì Wi-Fi N !

Íå ïîëó÷àåòñÿ îòêðûòü 80 ïîðò

Îòïðàâêà è ïîëó÷åíèå SMS ñ ðîóòåðà

Virtual serial port (CDC Class)

Íå ïîäêëþ÷àåòñÿ USB HDD

Tags for this Thread

Posting Permissions