ïîìîãèòå ñ êîíôèãóðàöèåé iptables

**AYuusuke** · 14-12-2007, 20:50

Originally Posted by zap

À Âû èçó÷àëè áåññìåðòíóþ ñòðàíè÷êó: http://www.docum.org/docum.org/kptd/?

Íàâñêèäêó íå ìîãó ïîêà ñêàçàòü, íî ìíå êàæåòñÿ ÷òî ýòà çàäà÷à äîëæíà áûòü âïîëíå âûïîëíèìà. Âå÷åðîì ïðèäó äîìîé, ïîäóìàþ. Â ÷àñòíîñòè, âîçìîæíî, êàêèì-òî îáðàçîì ìîæíî ïðîñòî ãðÿçíî ïðîïàò÷èòü ïîëÿ src IP/dst IP â òàáëèöå mangle â öåïî÷êàõ PREROUTING è POSTROUTING ñîîòâåòñòâåííî. Ãì, íå ïîìíþ òî÷íî ãäå, íî âðîäå âèäåë ñðåäñòâà äëÿ ÷óòü ëè íå ïîáàéòíîãî ðåäàêòèðîâàíèÿ ñëóæåáíûõ ïîëåé IP çàãîëîâêà... èëè òî â tc áûëî...

Ñ íåòåðïåíèåì æäó âàøèõ èäåé.

Ïîêà ÿ ïîïðîáîâàë ïîýêñïåðåìåíòèðîâàòü ñ MARK öåëüþ â PREROUTING mange òàáëèöû - íå ïîëó÷àåòñÿ

.

Ìûñëü ñëåäóþùàÿ:
1) Ïðîìàðêèðóåì èíòåðåñóþùèå íàñ ïàêåòû, äâèãàþùèåñÿ â îáîèõ íàïðàâëåíèÿõ, ðàçíûìè ìàðêåðàìè;
2) Ñîçäàäèì ñâîè òàáèöû ìàðøðóòèçàöèè äëÿ ýòèõ ïàêåòîâ;
3) Áóäåì ïðîâîäèòü nat (source è destination) îáû÷íûì ñïîñîáîì äëÿ ïðîìàðêèðîâàííûõ ïàêåòîâ

Äîëæíî ïîëó÷èòñÿ ïðèáëèçèòåëüíî ñëåäóþùåå:

Code:

iptables -t mangle -I PREROUTING -d 2.0.0.0/8 -j MARK --set-mark 4
iptables -t mangle -I PREROUTING -i vlan1 -s 10.0.0.0/8 -j MARK --set-mark 5
ip route add table 4 default via 192.168.24.1
ip route add table 4 nat 2.0.0.0/8 via 10.0.0.0
ip rule add fwmark 4 table 4
ip rule add fwmark 5 nat 2.0.0.0 from 10.0.0.0/8
ip route flush cache

Òóò 192.168.30.54 - àäðåñ íà WAN ïîðòó (NAT-èòñÿ â ëîêàëüíûé ñåãìåíò 10.0.17.64/28), 192.168.24.1 ãåéòâåé â ãîðîäñêóþ ëîêàëêó, 10.0.0.0/8 èìåþùèåñÿ â ãîðîäñêîé ëîêàëêå àäðåñà. Default gateway â îñíîâíîé òàáëèöå ñäåëàí ê ñîâñåì äðóãîìó ïðîâàéäåðó, òàì íåîáõîäèìûõ íàì ñòàíöèé (èç äèàïàçîíà 10.0.0.0/8) íåò.

Ðåçóëüòàò íå óòåøèòåëüíûé (ïàêåòû èäóò òîëüêî äî ðóòåðà):

Code:

Tracing route to 2.4.43.75 over a maximum of 30 hops

  1    <1 ms    <1 ms    <1 ms  10.0.17.66
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.

10.0.17.66 - ðóòåð

Åñòü ïðåäïîëîæåíèÿ ÷òî íå íóæíî ñìåøèâàòü iproute2 è iptables... Ìîæåò ó êîãî íèáóäü åñòü ìûñëè ÷òî ÿ ñäåëàë íå òàê? Èëè åñòü êàêîé íèáóäü èíñòðóìåíò, ÷òî ïîçâîëèò áîëåå äåòàëüíî ðàññìîòðåòü ñåé ïðîöåññ?

**zap** · 15-12-2007, 12:02

Code:

ip route add table 4 nat 2.0.0.0/8 via 10.0.0.0

ß íå ñîâñåì ïîíÿë, ÷òî Âû õîòåëè ñêàçàòü ýòèì ïðàâèëîì. ×òî, àäðåñ 10.0.0.0 ýòî àäðåñ Âàøåãî ðîóòåðà? Ïî ñóòè òî, ÷åãî Âû äîáèëèñü ýòèì ïðàâèëîì - íà âñå Âàøè ïèíãè íà ëþáîé IP èç äèàïàçîíà 2.0.0.0/8 áóäåò âûñòàâëÿòüñÿ àäðåñ èñòî÷íèêà 10.0.0.0. Ýòî íàâåðíÿêà íå òî, ÷òî Âû õîòåëè. Ýòè ïàêåòû íàäî NATèòü íà âûäåëåííûé Âàì àäðåñ èç ïîäñåòè 10.0.0.0/8, ÿ òàê ïîíÿë ÷òî ýòî 10.2.2.6 (10.0.17.66?).

Âîîáùå íå âèæó ñìûñëà ìåøàòü iptables è iproute. nat îò iproute èìååò äîñòàòî÷íî îãðàíè÷åííîå ïðèìåíåíèå, iptables ïîçâîëÿåò ñäåëàòü âñ¸ òî æå ñàìîå, êðîìå ðîóòèíãà - äà è òî, â ÿäðå 2.6 iptables ìîæåò âìåøèâàòüñÿ äàæå â ðåøåíèÿ ðîóòåðà ïàêåòîâ. Äàæå ìåñòî â öåïî÷êå, ãäå âûïîëíÿåòñÿ nat ó ðîóòåðà è iptables ïðàêòè÷åñêè ñîâïàäàþò, òàê ÷òî äàæå ñ ýòèì îñîáî íå ïîèãðàåøü.

Äàëåå, äëÿ îòëàäêè tracert íå ãîäèòñÿ íèôèãà, ýòî âñ¸ ðàâíî ÷òî ïûòàòüñÿ ïîíÿòü, ïî÷åìó íå ðàáîòàåò òåëåâèçîð, áðîñàÿ â íåãî òåííèñíûå øàðèêè. Äëÿ ýòîãî óäîáíî èñïîëüçîâàòü tcpdump, îí êàê ðàç åñòü â ïðîøèâêå ðîóòåðà:

Code:

tcpdump -n -i vlan1

ïîêàæåò âñå ïàêåòû, êîòîðûå âõîäÿò è âûõîäÿò ñ WAN èíòåðôåéñà, -i vlan0 ïîêàæåò ïàêåòû, êîòîðûå òóñóþòñÿ íà LAN èíòåðôåéñå è òàê äàëåå. Êîìàíäíàÿ ñòðîêà ó tcpdump î÷åíü ãèáêàÿ, èçó÷àéòå åãî man åñëè ÷òî. Õîæäåíèå ïàêåòîâ îáû÷íî ïðîâåðÿþ ïèíãîì.

Òåïåðü î ñàìîé ñóòè. Äàâàéòå ïîïðîáóåì ñîñòàâèòü ïëàí Ïó... ýýý ðàáîò

, à òî, êàê ìíå êàæåòñÿ, Âû ïðîñòî ñëåïî ïåðåáèðàåòå âñå ôè÷è, î êîòîðûõ íàøëè èíôîðìàöèþ, îñîáî íå âäóìûâàÿñü â èõ ñìûñë :-)

1. Ïåðâûì äåëîì ïîíÿòíî, ÷òî äëÿ äîñòóïà â ëþáóþ ñåòü Âàì íåîáõîäèì îáû÷íûé SNAT. Àäðåñà èç Âàøåé âíóòðåííåé ñåòè (192.168.1.* ?) íàäî áóäåò "çàìàñêèðîâàòü" ëèáî êàê 10.1.1.5, ëèáî êàê 10.2.2.6 â çàâèñèìîñòè îò òîãî, â êàêóþ ñåòü óõîäèò ïàêåò. SNAT âûïîëíÿåòñÿ â ñàìîì-ñàìîì êîíöå, ïåðåä îòïðàâêîé ïàêåòà â ñåòü (è ñîîòâåòñòâåííî, îòâåòíûå ïàêåòû îêó÷èâàþòñÿ ñðàçó ïî ïðèõîäå ïàêåòà èç ñåòè). Ïðî NAT íà äèàïàçîí àäðåñîâ çàáóäüòå íàïðî÷ü, ýòî ôè÷à ñîâñåì äëÿ äðóãèõ ñëó÷àåâ.

iptables -t nat -I POSTROUTING -o vlan1 -j SNAT --to-source 10.1.1.5
iptables -t nat -I POSTROUTING -o vlan2 -j SNAT --to-source 10.2.2.6

2. Äàëåå, ïîíÿòíîm ÷òî äëÿ òîãî, ÷òîáû íàø ïàêåò äëÿ ëåâîé ïîäñåòè "âñîñàëñÿ" â íóæíûé íàì èíòåðôåéñ (â äàëüíåéøåì ÿ áóäó èñõîäèòü èç òîãî, ÷òî ýòî vlan2) íåîáõîäèìî óêàçàòü, ÷òî ó ýòîãî èíòåðôåéñà åñòü äîñòóï ê íàøåé 'îáìàííîé' ñåòêå:

Code:

ip r a 2.0.0.0/8 dev vlan2

Òåïåðü âñå ïàêåòû äëÿ ýòîé ïîäñåòè óéäóò â ïðàâèëüíóþ ñåòåâóþ êàðòó, è ìû èìååì øàíñû 'ïåðåõâàòèòü' èõ ïåðåä ñàìûì âûõîäîì.

3. Äëÿ èçìåíåíèÿ àäðåñîâ ñ 2.0.0.0/8 â 10.0.0.0/8 è îáðàòíî DNAT îïÿòü æå íå ãîäèòñÿ ñîâñåì. Âî-ïåðâûõ --to-destination ïîíèìàåò òîëüêî äèàïàçîí àäðåñîâ (10.0.0.0-10.255.255.255), âî-âòîðûõ îí ïîäìåíÿåò àäðåñà àáñîëþòíî íåçàêîíîìåðíî, òî åñòü 2.2.2.2 ìîæåò îêàçàòüñÿ çàìåí¸ííûì íà 10.5.9.7 è ýòî áóäåò àáñîëþòíî ïðàâèëüíîé ðàáîòîé ìîäóëÿ.

4. Ê ñîæàëåíèþ, ÿ ïðîñìîòðåë êàêèå åñòü âîçìîæíîñòè ó òàáëèöû mangle, è â ñâî¸ì 'ñòàíäàðòíîì' ñîñòîÿíèè îíà ìàëî íà ÷òî ñïîñîáíà - ìîæíî ìåíÿòü TTL, TOS è ìàðêèðîâàòü ïàêåòû è ýòî âñ¸. Òàêèì îáðàçîì, åäèíñòâåííûé äîñòóïíûé ñïîñîá ñäåëàòü òî, ÷òî íàì íàäî - öåëü NETMAP. Ê ñ÷àñòüþ, îíà ó íàñ èìååòñÿ, ïóñòü è â êàêîì-òî íåïîíÿòíî-ìîäèôèöèðîâàííîì âèäå.

Ïî èäåå, äîëæíî áûòü ÷òî-òî âðîäå:

Code:

iptables -t nat -I PREROUTING -s 10.0.0.0/8 -i vlan2 -j NETMAP --to 2.0.0.0/8
iptables -t nat -I POSTROUTING -d 2.0.0.0/8 -o vlan2 -j NETMAP --to 10.0.0.0/8

Íå çàáóäüòå çàãðóçèòü ìîäóëü ipt_NETMAP.o, îí (ó ìåíÿ?) ïî÷åìó-òî íå ïîäãðóæàåòñÿ àâòîìàòè÷åñêè êîìàíäîé iptables:

Code:

insmod /lib/modules/2.4.20/kernel/net/ipv4/netfilter/ipt_NETMAP.o

Ïîñëå ýòîãî âûøåóêàçàííûå ïðàâèëà çàãðóçèëèñü áåç ïðîáëåì, íî âîò ïîïûòêà ïîñìîòðåòü êàêîâ ðåçóëüòàò ìåíÿ íåñêîëüêî îçàäà÷èëî:

Code:

[zap@gate|/lib/modules/2.4.20/kernel/net/ipv4/netfilter]tcpdump -n -i vlan1 icmp
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
03:26:46.769396 IP 10.0.0.0 > 2.1.2.3: icmp 64: echo request seq 5
03:26:47.769206 IP 10.0.0.0 > 2.1.2.3: icmp 64: echo request seq 6
03:26:48.769035 IP 10.0.0.0 > 2.1.2.3: icmp 64: echo request seq 7
03:26:49.768860 IP 10.0.0.0 > 2.1.2.3: icmp 64: echo request seq 8

Òî åñòü ïî êàêîé-òî ïðè÷èíå ìîäóëü NETMAP â ëîá çàìåíèëî source IP íà ïàðàìåòð --to (ïðè÷¸ì äàæå áåç ó÷¸òà ìàñêè!). Â îáùåì, íàäî ðàçáèðàòüñÿ ñ èñõîäíèêàìè NETMAP, ýòî åäèíñòâåííûé ðåàëüíûé âàðèàíò, êîòîðûé ÿ âèæó. Çàâòðà ñêà÷àþ, ïîêîâûðÿþñü à ñåãîäíÿ óæå ïîçäíî

**AYuusuke** · 15-12-2007, 13:39

zap, cïàñèáî çà îòâåò!

Âèäèìî ÿ ïëîõî ñôîðìóëîðîâàòü ñâîþ ïðîáëåìó è ïëîõî ðàññêàçàë î ïîïûòêàõ. Â îîáùèõ ÷åðòàõ âû ïðàâèëüíî ïîíÿëè, ÷òî ìíå íóæíî, íî âîò ñ êîíêðåòíûìè àäðåñàìè/ìàñêàìè íå âñå õîðîøî.
Ñêîðåå âñåãî ýòî ïðîèçîøëî èç çà òîãî, ÷òî â 2-õ ïîñëåäíèõ ïîñòàõ ÿ èñïîëüçîâàë ðàçíûå ïîäñåòè äëÿ èëëþñòðàöèè òîãî ÷òî ÿ õî÷ó ñäåëàòü. Ïîïðîáóþ ïåðåôîðìóëðîâàòü çàíîâî, ìàêñèìàëüíî ïðèáëèçèâøèñü ê òîìó, ÷òî ó ìåíÿ åñòü ñåé÷àñ.

Åñòü ïîäêëþ÷åíèå ê 2-ì ïðîâàéäåðàì:
- ïðîâàéäåð A âûäàë 2 áëîêà àäðåñîâ (10.0.17.64/28 è 89.223.97.248/29), ñî øëþçàìè 10.0.17.65 è 89.223.97.249 ñîîòâåòñòâåííî, äëÿ äîñòóïà â èíòåòåðíåò;
- ïðîâàéäåð B äàë îäèí IP (192.168.30.54) ñî øëþçîì 192.168.24.1 äëÿ äîñòóïà â ñâîþ ëîêàëêó (192.168.0.0/16, 10.0.0.0/8 è åùå íåñêîëüêî ïîäñåòåé) (èíòåðíåò òàì òîæå åñòü, íî ÿ åãî íå èñïîëüçóþ)
(89.223.97.248/29 ðàññìàòðèâàòü îòäåëü íå èìååò ñìûñëà)

Êàáåëü A ïîäêëþ÷åí â WAN ïîðò ðóòåðà (íàñòðîéêè íà static ip), êàáåëü B â LAN ïîðò.
Ðåçóëüòàò ïðèáëèçèòåëüíî ñëåäóþùèé:

Code:

[admin@anthy root]$ ip route
192.168.24.1 dev vlan1  scope link
89.223.97.248/29 dev br0  proto kernel  scope link  src 89.223.97.254
10.0.17.64/28 dev br0  proto kernel  scope link  src 10.0.17.66
192.168.24.0/21 dev vlan1  proto kernel  scope link  src 192.168.30.54
85.249.160.0/20 via 192.168.24.1 dev vlan1  metric 2
192.168.0.0/16 via 192.168.24.1 dev vlan1  metric 2
1.0.0.0/8 via 192.168.24.1 dev vlan1  metric 2
10.0.0.0/8 via 192.168.24.1 dev vlan1  metric 2
127.0.0.0/8 dev lo  scope link
default via 89.223.97.249 dev br0

Ëîêàëüíûé ñåãìåíò 10.0.17.64/28, DHCP ìîåãî ðóòåðà ðàçäàåò àäðåñà â ýòîì äèàïàçîíå.

Òàê ÿ õîæó â èíòåðíåò:

Code:

Òðàññèðîâêà ìàðøðóòà ê ya.ru [213.180.204.8]
ñ ìàêñèìàëüíûì ÷èñëîì ïðûæêîâ 30:

  1     1 ms     1 ms     1 ms  10.0.17.66
  2     1 ms     1 ms     1 ms  10.0.17.65
  3     4 ms     4 ms     4 ms  81.222.220.97
  4     4 ms     5 ms     6 ms  10.54.0.1
  5     5 ms     6 ms     5 ms  194.226.196.1
  6     5 ms     6 ms     7 ms  217.170.94.241
  7     5 ms     6 ms     8 ms  81.222.2.1
  8    14 ms    14 ms    13 ms  81.222.15.1
  9    14 ms    15 ms    14 ms  81.222.7.162
 10    19 ms    15 ms    13 ms  87.250.233.99
 11    15 ms    15 ms    17 ms  213.180.201.222
 12    16 ms    16 ms    14 ms  213.180.204.8

Òðàññèðîâêà çàâåðøåíà.

, à òàê - â ëîêàëêó

Code:

Òðàññèðîâêà ìàðøðóòà ê 10.4.43.75 ñ ìàêñèìàëüíûì ÷èñëîì ïðûæêîâ 30

  1     1 ms     1 ms     1 ms  10.0.17.66
  2     2 ms     2 ms     2 ms  192.168.24.1
  3     2 ms     2 ms     2 ms  10.250.0.2
  4     *      740 ms     *     10.250.2.1
  5     2 ms     2 ms     1 ms  10.4.43.75

Òðàññèðîâêà çàâåðøåíà.

Åñòü âîçìîæíîñòü ïîäêëþ÷èòü åùå îäíó ëîêàëêó (òàì òîæå äàäóò òîëüêî 1 IP), ãäå òîæå áóäåò äèàïàçîí 10.0.0.0/8.
Ïîêà ïîäêëþ÷åíèÿ íåò, ÿ ýêñïåðèìåíòèðóþ ñëåäóþùèì îáðàçîì:

Code:

ip route delete 10.0.0.0/8

âñå ïàêåòû íà 10.0.0.0/8 íà÷èíàþò èäòè â èíåò

Code:

Òðàññèðîâêà ìàðøðóòà ê 10.4.43.75 ñ ìàêñèìàëüíûì ÷èñëîì ïðûæêîâ 30

  1     2 ms     1 ms     1 ms  10.0.17.66
  2     2 ms     2 ms     1 ms  10.0.17.65
  3    11 ms   112 ms     5 ms  81.222.220.97
  4     *     ^C

Íàçîâåì äàííóþ êîíôèãóðàöèþ áàçîâîé. Çàäà÷à - ñäåëàòü òàê, ÷òî áû:
- ïàêåòû èäóùèå èç ëîêàëüíîãî ñåãìåíòà íà 2.0.0.0/8 óõîäèëè â vlan1 ñ ñîîòâåòñòâóþùåé ïåðåêîäèðîâêîé
- ó ïàêåòîì èäóùèõ ñ vlan1 ïåðå êîäèðóåòñÿ source ïîëå 10.0.0.0/8 â 2.0.0.0/8 (destination ïåðå êîäèðóåòñÿ îáû÷íûì MASQUERADE/DNAT â çàâèñèìîñòè îò íàïðàâëåíèÿ â êîòîðîì óñòàíîâëåíî ñîåäèíåíèå)

------------------------------------------------------------

Òåïåðü îòâå÷àþ íà âàøå ñîîáùåíèå:

ip route add table 4 nat 2.0.0.0/8 via 10.0.0.0 äîëæíî ïåðåêîäèðîâàòü ïîëå destination èç 2.0.0.0/8 â 10.0.0.0/8 äëÿ âñåõ ïàêåòîâ,
ïðîìàðêèðîâàííûõ 4-êîé (http://linux-ip.net/html/nat-stateless.html example 5.2)

ß áû òîæå íå õîòåë ñìåøèâàòü iproute2 è iptables, íóæíîãî ìíå ïðåîáðàçîâàíèÿ ÿ íå ñìîã äîáèòüñÿ ñ ïîìîøüþ iptables...

Ïðî tcpdump ñïàñèáî, áóäó ïîëüçîâàòüñÿ.

Íàñ÷åò "1." êîíå÷íî æå âû ïðàâû, ó ìåíÿ îíî òàê è äåëàåòñÿ. Òóò âîïðîñîâ îñîáûõ íåò.

"2." - ýòîãî ÿ ïîïûòàëñÿ äîáèòüñÿ îòäåëüíîé òàáëèöåé ìàðøðóòèçàöèè (table 4) äëÿ ïîìå÷åííûõ ïàêåòîâ. Ïîïðîáóþ è âàø âàðèàíò.

"3." - òóò ÿ ðóêîâîäñòâîâàëñÿ ñòàòüåé http://lists.netfilter.org/pipermail...ch/008924.html è ìíå ïîêàçàëîñü ÷òî åñëè ðàçìåð ïîäñåòåé
ñîâïàäàåò, äîëæíî áûòü ïðÿìîå ïðåîáðàçîâàíèå. ß áûë íå ïðàâ? Êîíå÷íî åñëè ðàçìåðû äèàïàçîíîâ ðàçíûå - áóäåò ÷åõàðäà êàê âû è íàïèñàëè (â ÷åì ÿ ïàðó ðàç óáåæäàëñÿ).

"4." - îïðåäåëåííóþ ïîïûòêó èñïîëüçîâàíèÿ NETMAP ÿ äåëàë (ïàðó ñîîáùåíèé íèæå), íî ðåçóëüòàòà ÿ íå äîáèëñÿ. Òàê æå Îëåã ãîâîðèë î òîì ÷òî àñóñîâöû ïîäïðàâèëè ýòó öåëü...
Êàê ìíå êàæåòñÿ ìîÿ êîíñòðóêöèÿ èç "ip route add nat" è "ip rule add nat" äîëæíû áûòü òîæäåñòâåííî ðàâíà âàøåìó iptables NETMAP. Ýòî íå òàê?

Æäó îòâåòà.

Òåïåðü ñòàòèñòèêà ñ ïîìîøüþ tcpdump ìîåãî âàðèàíòà ñ ip route nat (íà áàçîâóþ êîíôèãóðàöèþ íàêàòûâàþ íàñòðîéêè èõ ïðîøëîãî ïîñòà):

Code:

Òðàññèðîâêà ìàðøðóòà ê 2.4.43.75 ñ ìàêñèìàëüíûì ÷èñëîì ïðûæêîâ 30

  1     1 ms     1 ms    <1 ìñ  10.0.17.66
  2     *        *        *     Ïðåâûøåí èíòåðâàë îæèäàíèÿ äëÿ çàïðîñà.
  3     *        *     ^C

(äîëæíî áûòü êàê â íà÷àëå ïîñòà)

Code:

[admin@anthy root]$ tcpdump -n -i vlan1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
16:14:40.167239 IP 192.168.30.54 > 10.4.43.75: ICMP echo request, id 1, seq 488, length 72
16:14:40.169695 IP 192.168.24.1 > 192.168.30.54: ICMP time exceeded in-transit, length 36
16:14:43.897703 IP 192.168.30.54 > 10.4.43.75: ICMP echo request, id 1, seq 489, length 72
16:14:43.898984 IP 192.168.24.1 > 192.168.30.54: ICMP time exceeded in-transit, length 36
16:14:47.896878 IP 192.168.30.54 > 10.4.43.75: ICMP echo request, id 1, seq 490, length 72
16:14:47.897902 IP 192.168.24.1 > 192.168.30.54: ICMP time exceeded in-transit, length 36
16:14:51.896701 IP 192.168.30.54 > 10.4.43.75: ICMP echo request, id 1, seq 491, length 72
16:14:51.897705 IP 10.250.0.2 > 192.168.30.54: ICMP time exceeded in-transit, length 36
16:14:55.932562 IP 192.168.30.54 > 10.4.43.75: ICMP echo request, id 1, seq 492, length 72
16:14:55.933766 IP 10.250.0.2 > 192.168.30.54: ICMP time exceeded in-transit, length 36
16:14:59.900137 IP 192.168.30.54 > 10.4.43.75: ICMP echo request, id 1, seq 493, length 72
16:14:59.902178 IP 10.250.0.2 > 192.168.30.54: ICMP time exceeded in-transit, length 36

12 packets captured
12 packets received by filter
0 packets dropped by kernel

Èíòåðåñíûé ðåçóëüòàò, íå òàê ëè? Ïî êðàéíåé ìåðå 2.0.0.0/8->10.0.0.0/8 ïðåîáðàçîâàíèå ïðîèñõîäèò ïðàâèëüíî (îäíîâðåìåííî è source ïîëå ñòàâèòñÿ êàê íàäî), ïàêåòû óõîäÿò íà íóæíûé èíòåðôåéñ, íî âîò îòâåòû ãäå òî çàñòðåâàþò...
Åñòü êàêèå íèáóäü ìûñëè?

**zap** · 15-12-2007, 23:41

Originally Posted by AYuusuke

Âèäèìî ÿ ïëîõî ñôîðìóëîðîâàòü ñâîþ ïðîáëåìó è ïëîõî ðàññêàçàë î ïîïûòêàõ. Â îîáùèõ ÷åðòàõ âû ïðàâèëüíî ïîíÿëè, ÷òî ìíå íóæíî, íî âîò ñ êîíêðåòíûìè àäðåñàìè/ìàñêàìè íå âñå õîðîøî.

ß ñíà÷àëà õîòåë ïîïðîñèòü ðàçüÿñíåíèé, íî ïîòîì ïîäóìàë ÷òî íåçà÷åì òðàòèòü âðåìÿ âïóñòóþ, ëó÷øå ïðîñòî ïîïûòàþñü äîãàäàòüñÿ

Originally Posted by AYuusuke

Åñòü ïîäêëþ÷åíèå ê 2-ì ïðîâàéäåðàì:
- ïðîâàéäåð A âûäàë 2 áëîêà àäðåñîâ (10.0.17.64/28 è 89.223.97.248/29)

Ãì, ïðîâàéäåð âûäåëèë Âàì àæ 16 ñåðûõ è 8 ðåàëüíûõ àäðåñîâ? Âåñüìà íåòèïè÷íî

Originally Posted by AYuusuke

Êàáåëü A ïîäêëþ÷åí â WAN ïîðò ðóòåðà (íàñòðîéêè íà static ip), êàáåëü B â LAN ïîðò.

Ìîæåò èìååò ñìûñë ïåðåðàçáèòü ïîðòû íà ðîóòåðå? Òî åñòü, ñäåëàòü ïîðò WAN1, WAN2 è îñòàâøèåñÿ òðè ïîðòà îáüåäèíèòü â LAN? Èëè, ñ ó÷¸òîì åù¸ îäíîãî ïîòåíöèàëüíîãî ïðîâàéäåðà, ðàçáèòü èìåþùèåñÿ 5 ïîðòîâ íà WAN1, WAN2, WAN3 è äâà ïîðòà îñòàâèòü íà LAN? Òàêèì îáðàçîì Âû ïîëó÷èòå ñâîþ ïðèâàòíóþ ïîäñåòü, ãäå íå áóäóò áåãàòü ëåâûå áðîàäêàñòû îò ïðîâàéäåðà è ãäå íå íàäî çàùèùàòüñÿ ôàéðâîëîì, ïëþñ Âàì íå ïîíàäîáèòñÿ öåëûé áëîê àäðåñîâ îò ïåðâîãî ïðîâàéäåðà, áóäåò äîñòàòî÷íî 1 âûäåëåííîãî àäðåñà îò êàæäîãî ïðîâàéäåðà?

Originally Posted by AYuusuke

Code:

85.249.160.0/20 via 192.168.24.1 dev vlan1  metric 2

Îáàíà... âèæó çíàêîìûå öèôðû

ìåæäó ïðî÷èì, ìîé àäðåñ 85.249.169.28

Originally Posted by AYuusuke

Ëîêàëüíûé ñåãìåíò 10.0.17.64/28, DHCP ìîåãî ðóòåðà ðàçäàåò àäðåñà â ýòîì äèàïàçîíå.

Åñëè îòäåëèòüñÿ îò WAN'îâ âûñîêîé îãíåííîé ñòåíîé, òî ìîæíî ñäåëàòü ñåáå ñïîêîéíî âíóòðè êâàðòèðû êàêîé-íèáóäü 172.16.8.0/24 è íå ïàðèòüñÿ ñ ïóáëè÷íî âèäèìûìè äèàïàçîíàìè. Êñòàòè, à ÷òî ïðîèñõîäèò êîãäà êàêîé-íèáóäü òîâàðèù èç ëîêàëêè äåëàåò çàïðîñ DHCP, åìó Âàø ñåðâàê âûäåëèò àäðåñ â Âàøåì ïðèâàòíîì äèàïàçîíå?

Originally Posted by AYuusuke

ip route add table 4 nat 2.0.0.0/8 via 10.0.0.0 äîëæíî ïåðåêîäèðîâàòü ïîëå destination èç 2.0.0.0/8 â 10.0.0.0/8 äëÿ âñåõ ïàêåòîâ,
ïðîìàðêèðîâàííûõ 4-êîé (http://linux-ip.net/html/nat-stateless.html example 5.2)

ß íå óâåðåí. Ïðèìåð çàäàí äëÿ âñåãî ëèøü îäíîãî àéïèøíåãà, òî åñòü IF DST=205.254.211.17 THEN REPLACE DST=192.168.100.17. Ïðî ðàáîòó ñ öåëûì äèàïàçîíîì òàì íåò íè ñëîâà.

Êñòàòè ñïàñèáî çà ññûëêó, ÿ òàì ïðî÷èòàë êëþ÷åâîå ñëîâî STATELESS. Îêàçûâàåòñÿ NAT ó iproute íå îòñëåæèâàåò ñîñòîÿíèå ñîåäèíåíèÿ, òî åñòü îí ïðîñòî çàìåíÿåò ïîëå àäðåñà è âñ¸ - ýòèì îí êàðäèíàëüíî îòëè÷àåòñÿ îò NAT'à iptables (íî çàòî ýòî æå ðîäíèò åãî ñ NETMAP'îì, ñîáñòâåííî NAT iproute == NETMAP iptables

. Òàê ÷òî åñëè íå âûéäåò ñ NETMAP'îì, ìîæåò ïîëó÷èòñÿ ñ iproute

Originally Posted by AYuusuke

"3." - òóò ÿ ðóêîâîäñòâîâàëñÿ ñòàòüåé http://lists.netfilter.org/pipermail...ch/008924.html è ìíå ïîêàçàëîñü ÷òî åñëè ðàçìåð ïîäñåòåé
ñîâïàäàåò, äîëæíî áûòü ïðÿìîå ïðåîáðàçîâàíèå. ß áûë íå ïðàâ? Êîíå÷íî åñëè ðàçìåðû äèàïàçîíîâ ðàçíûå - áóäåò ÷åõàðäà êàê âû è íàïèñàëè (â ÷åì ÿ ïàðó ðàç óáåæäàëñÿ).

ß íå çíàþ, ÷òî êóðèë ýòîò Mark A. Howard â ìîìåíò íàïèñàíèÿ, íî ëè÷íî ó ìåíÿ òàêîé ñèíòàêñèñ íå ïðîêàòûâàåò, è â ìàíóàëå iptables òàêîé ñèíòàêñèñ âîîáùå íå îïèñàí.

Íà ðîóòåðå:

Code:

[zap@gate|/tmp/local/root]iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o vlan0 -j SNAT --to-source 5.6.7.0/24
iptables v1.2.7a: Bad IP address `5.6.7.0/24'

Íà êîìïüþòåðå (ÿäðî 2.6.23):

Code:

[1|root@zap|~]iptables -t nat -A POSTROUTING -s 192.168.211.0/24 -o eth0 -j SNAT --to-source 5.6.7.0/24
iptables v1.3.8: Bad IP address `5.6.7.0/24'

Â ìàíóàëå íàïèñàíî, ÷òî ôîðìàò ïàðàìåòðà - "--to-source <ipaddr>-<ipaddr>".

Âîçìîæíî, ó÷èòûâàÿ ÷òî ïèñüìî íàïèñàíî â 2001ì ãîäó, ÷òî èíôîðìàöèÿ îòíîñèòñÿ ê êàêîé-òî ëûñîé âåðñèè ÿäðà. Â ëþáîì ñëó÷àå, ñîâðåìåííûé SNAT íå ãîäèòñÿ, òàê êàê è SNAT è DNAT äåëàþò STATEFUL NAT, à íàì íóæåí STATELESS NAT.

Originally Posted by AYuusuke

"4." - îïðåäåëåííóþ ïîïûòêó èñïîëüçîâàíèÿ NETMAP ÿ äåëàë (ïàðó ñîîáùåíèé íèæå), íî ðåçóëüòàòà ÿ íå äîáèëñÿ. Òàê æå Îëåã ãîâîðèë î òîì ÷òî àñóñîâöû ïîäïðàâèëè ýòó öåëü...

Ê ñîæàëåíèþ, ÿ ñåãîäíÿ âåñü äåíü ïûòàëñÿ ñêà÷àòü èñõîäíèêè ñ ñàéòà àñóñà, íî ñàéò òàê è íå çàðàáîòàë, ïîýòîìó ñ èññëåäîâàíèåì èñõîäíèêîâ ïðèä¸òñÿ ïîäîæäàòü ïîêà.

Originally Posted by AYuusuke

Êàê ìíå êàæåòñÿ ìîÿ êîíñòðóêöèÿ èç "ip route add nat" è "ip rule add nat" äîëæíû áûòü òîæäåñòâåííî ðàâíà âàøåìó iptables NETMAP. Ýòî íå òàê?

Êàê ÿ ïèñàë âûøå, iproute nat îêàçàëñÿ áðàòîì-áëèçíåöîì NETMAP, òîëüêî âðîäå áû ðàáîòàåò ïðàâèëüíî :-)

Originally Posted by AYuusuke

Code:

16:14:40.167239 IP 192.168.30.54 > 10.4.43.75: ICMP echo request, id 1, seq 488, length 72

Î êàê! Òàêè iproute nat çàìåíÿåò âñ¸ êàê íàäî, ýòî çäîðîâî.

Originally Posted by AYuusuke

Code:

16:14:40.169695 IP 192.168.24.1 > 192.168.30.54: ICMP time exceeded in-transit, length 36

Õì, à ýòî ñëó÷àéíî íå îòòîãî ÷òî TTL ñëèøêîì ìàëåíüêèé? Ïîïðîáóéòå çàäàòü tcpdump îïöèþ -v, îí äîëæåí ðàñïå÷àòàòü TTL ïàêåòà. Âîçìîæíî, ïî êàêîé-òî ïðè÷èíå TTL óìåíüøàåòñÿ äî íóëÿ ðàíüøå âðåìåíè. Ñðàâíèòå ñ TTL ïàêåòîâ, êîòîðûå äîõîäÿò äî öåëè êàê íàäî.

**AYuusuke** · 16-12-2007, 00:43

(Òîëüêî ÷òî çàìåòèë îïèñêó, êàáåëü B ïîäêëþ÷åí â LAN ïîðò, êàáåëü A - â WAN)

Íàñ÷åò 16-òè ñåðûõ è 8 ðåàëüíûõ àäðåñîâ äóìàþ ÿ ëó÷øå îñòàâëþ êàê åñòü. Äàííàÿ ñõåìû åùå ñ òåõ âðåìåí êîãäà ó ìåíÿ ñòîÿë òóïîé ñâè÷. DHCP ðàáîòàåò, ò.ê. ìíå âûäåëèëè îòäåëüíûé vlan íà îáîðóäîâàíèè ïðîâàéäåðà, è äðóãèå ïîëüçîâàòåëè â ìîé ñåãìåíò òîëüêî ñ ïîìîøüþ l3 ìàðøðóòèçàöèè õîäÿò, ñîîòâåòñòâåííî è ëèøíèõ broadcast-îâ íåò. Çàòî 5 ðåàëüíèêîâ è íèêàêîé ãîëîâíîé áîëè èç çà çàâèñøåãî ðóòåðà (ó ìåíÿ àñóñ ïåðèîäè÷åñêè âèñíåò èç çà ìîèõ ýêñïåðèìåíòîâ). Êîãäó áóäó ïîäêëþ÷àòü ñëåäóþùåãî ïðîâàéäåðà (äàäà, ÿ õî÷ó â Êîðáèíó!

) êîíå÷íî ñäåëàþ íà àñóñå åùå îäèí WAN ïîðò.

Äàâíî âû â Îçåðêàõ?

Ñ äèàïàçîíîì ip route/rule nat òî÷íî ðàáîòàåò, ïðè÷åì ñèíòàêñèñ ÿ íàïèñàë ïðàâèëüíî, åñëè íóæíî ïîïðîáóþ íàéòè ñîîòâåòñòâóþùèé tutorial...

Ïî ïîâîäó SNAT/DNAT - http://www.netfilter.org/documentati...O-6.html#ss6.2 ðàçäåë Multiple Mappings, Overlap and Clashes - òàì â ïîëå --to èñïîëüçóåòñÿ ïîäñåòü. Òóò âðîäå äîêóìåíò íå òàêîé ñòàðûé.... Õîòÿ ÿ ñ âàìè àáñîëþòíî ñîãëàñåí, ÷òî â íàøåì iptables òàêîå íå ïðîéäåò.

Ïðî Stateful è Stateless ÿ ïîêà ïëîõî ïîíèìàþ (íó êðîìå ôàêòà ÷òî â îäíîì ñëó÷àå çàïîìèíàåòñÿ è ñîïðîâîæäàåòñÿ êàæäîå ñîåäèíåíèå, à â äðóãîì - îáðàáîòêà îòäåëüíûõ ïàêåòîâ áåç êàêîé ëèáî ïàìÿòè). Íàì êîí÷åíî æå äîëæíî õâàòèòü stateless, íî ïî÷åìó ïîìåøàåò stateful ÿ íå ïîíÿë. Ïîÿñíèòå?

GPL èñõîäíèêè îò àñóñà åñòü íà files.wl500g.info (âèäèìî íàñ èíòåðåñóåò http://files.wl500g.info/asus/wl500g/gpl/GPL_1927.zip)

TTL òàì íîðìàëüíûé, ÿ âûïîëíÿë tracert, à íå ïèíã. Ïî ëîãó ïðÿìî âèäåíî ÷òî ñíà÷àëà èäåò 3 îòâåòà îò ïåðâîãî õîïà, ïîòîì 3 îòâåòà îò âòîðîãî. Äàëüøå ÿ íàæàë ctrl-c. Òóò âðîäå íèêàêèõ ïðîáëåì.

Çàìåòèë ñëåäóþùóþ âåøü: åñëè íå óäàëÿòü ìàðøðóò 10.0.0.0/8 è ñíà÷àëà ñäåëàòü "tracert 10.4.43.75", à ïîòîì ïî÷òè ñðàçó "tracert 2.4.43.75", òî îòâåòû ïðèõîäÿò, íî ñ íå ïîìåíÿíûì source (ñ øòàòíûì, íà÷èíàþùèìñÿ ñ 10). Åñëè ïîäîæäàòü íåêîòîðîå âðåìÿ è îïÿòü ñäåëàòü "tracert 2.4.43.75", òî îòâåòà îïÿòü íå áóäåò (òóò ïîä "îòâåòîì" ÿ ïîíèìàþ äîõîäÿùèå îòâåòû îò 2-ãî, 3-ãî è ò.ï. õîïà, 1-é õîï - ðóòåð, îí âñåãäà îòâå÷àåò).

Ñîîòâåòñòâåííî ó ìåíÿ âîçíèêëî ïîäîçðåíèå, ÷òî ìîè ïðàâèëà ip route/rule nat êàêèì òî îáðàçîì ìåøàþò øòàòíîìó stateful NAT èç iptables... Ïðè òðàññèðîâêå àäðåñà "2.4.43.75" â òàáëèöå conntrack ïîÿâëÿåòñÿ ñòðî÷êà

Code:

icmp     1 23 src=10.0.17.76 dst=2.4.43.75 type=8 code=0 id=1 src=2.4.43.75 dst=192.168.30.54 type=0 code=0 id=1 use=1 mark=0

, ïðè òðàññèðîâêå íà "10.4.43.75" - ñòðî÷êà

Code:

icmp     1 29 src=10.0.17.76 dst=10.4.43.75 type=8 code=0 id=1 src=10.4.43.75 dst=192.168.30.54 type=0 code=0 id=1 use=1 mark=0

Ïîëó÷àåòñÿ ÷òî ñîïðîâîæäåíèå ñîåäèíåíèé ïðîèñõîäèò äî íàøåãî ïðåîáðàçîâàíèÿ, ÷òî âîîáùåì òî ïðàâèëüíî. Íî ïî÷åìó îáðàòíûå ïàêåòû íå ïðîëåçàþò?

(åñëè ÿ îïÿòü íå ïîíÿòíî ðàññêàçàë ïðî ìîé ýêñïåðèìåíò ñ îäíîâðåìåííîé òðàññèðîâêîé àäðåñîâ 2.4.43.75 è 10.4.43.75 - ãîâîðèòå, ÿ ðàñïèøó ïîäðîáíåå è ñ êàðòèíêàìè)

**zap** · 16-12-2007, 11:25

Originally Posted by AYuusuke

(Òîëüêî ÷òî çàìåòèë îïèñêó, êàáåëü B ïîäêëþ÷åí â LAN ïîðò, êàáåëü A - â WAN)

Õì, ïî-ìîåìó Âû îïÿòü îïèñàëèñü =) Íàâåðíîå âñ¸-òàêè êàáåëü A â LAN, êàáåëü B - â WAN?

Originally Posted by AYuusuke

Íàñ÷åò 16-òè ñåðûõ è 8 ðåàëüíûõ àäðåñîâ äóìàþ ÿ ëó÷øå îñòàâëþ êàê åñòü.

Æàäíîñòü, êîíå÷íî, íå ïîðîê ;-)

Originally Posted by AYuusuke

ýêñïåðèìåíòîâ). Êîãäó áóäó ïîäêëþ÷àòü ñëåäóþùåãî ïðîâàéäåðà (äàäà, ÿ õî÷ó â Êîðáèíó!

) êîíå÷íî ñäåëàþ íà àñóñå åùå îäèí WAN ïîðò.

Òàê ìîæíî óæå ñåé÷àñ îòöåïèòü îäèí èç LAN ïîðòîâ, è ñäåëàòü WAN2. Ýêñïåðèìåíòû ëó÷øå ïðîâîäèòü â óñëîâèÿõ, ìàêñèìàëüíî ïðèáëèæåííûõ ê áîåâûì

Originally Posted by AYuusuke

Äàâíî âû â Îçåðêàõ?

Ñ 2003ãî ãîäà.

Originally Posted by AYuusuke

Ñ äèàïàçîíîì ip route/rule nat òî÷íî ðàáîòàåò, ïðè÷åì ñèíòàêñèñ ÿ íàïèñàë ïðàâèëüíî, åñëè íóæíî ïîïðîáóþ íàéòè ñîîòâåòñòâóþùèé tutorial...

Íó, âîîáùå ãîâîðÿ, ýòî ëîãè÷íî, ó÷èòûâàÿ òîò ôàêò ÷òî iproute ýòî ñêîðåå èíñòðóìåíò äëÿ óïðàâëåíèÿ ìàññîâûìè ñêîïëåíèÿìè êîìïüþòåðîâ à íå äëÿ óïðàâëåíèÿ ïî îäíîìó

Originally Posted by AYuusuke

Ïî ïîâîäó SNAT/DNAT - http://www.netfilter.org/documentati...O-6.html#ss6.2 ðàçäåë Multiple Mappings, Overlap and Clashes - òàì â ïîëå --to èñïîëüçóåòñÿ ïîäñåòü. Òóò âðîäå äîêóìåíò íå òàêîé ñòàðûé.... Õîòÿ ÿ ñ âàìè àáñîëþòíî ñîãëàñåí, ÷òî â íàøåì iptables òàêîå íå ïðîéäåò.

Îáðàòíàÿ ñòîðîíà òîãî, ÷òî äëÿ Ëèíóêñà î÷åíü ìíîãî òåõíè÷åñêîé äîêóìåíòàöèè è èíôîðìàöèè â ñåòè - òî, ÷òî â ñåòè ïîëíî óñòàðåâøåé äîêóìåíòàöèè. Ó íàñ íà ôîðóìå ðåãóëÿðíî âñïëûâàåò êàêîé-íèáóäü ïîëüçîâàòåëü, êîòîðûé ïûòàåòñÿ íàñòðîèòü VPN ïî òóòîðèàëàì äåñÿòèëåòíåé äàâíîñòè è òîìó ïîäîáíîå. Ïðàâäà, ýòî ñêîðåå êàñàåòñÿ òîãî ïèñüìà 2001ãî ãîäà :-)

×òî æå äî ðàçäåëà "Multiple Mappings, Overlap and Clashes", òî êàê ðàç òàì íàïèñàíî îáðàòíîå - ÷òî "NAT code is clever enough", ÷òîáû ïîäìåíÿòü àéïèøíåãè è ïîðòû íà ÷òî ïîïàëî :-) À ïðèìåð ñ -j SNAT --to 1.2.3.0/24 âîîáùå íåêîððåêòåí, ÿ óäèâëÿþñü îòêóäà ýòà îøèáêà êî÷óåò èç ìàíóàëà â ìàíóàë... âåäü íà ðîóòåðå ÿäðî âðåì¸í öàðÿ Ãîðîõà, è òî îíî òàêîé ñèíòàêñèñ íå ïîíèìàåò.

Originally Posted by AYuusuke

Ïðî Stateful è Stateless ÿ ïîêà ïëîõî ïîíèìàþ (íó êðîìå ôàêòà ÷òî â îäíîì ñëó÷àå çàïîìèíàåòñÿ è ñîïðîâîæäàåòñÿ êàæäîå ñîåäèíåíèå, à â äðóãîì - îáðàáîòêà îòäåëüíûõ ïàêåòîâ áåç êàêîé ëèáî ïàìÿòè). Íàì êîí÷åíî æå äîëæíî õâàòèòü stateless, íî ïî÷åìó ïîìåøàåò stateful ÿ íå ïîíÿë. Ïîÿñíèòå?

Âû ïðàâèëüíî ïîíèìàåòå, ïðîñòî íàäî ñäåëàòü åù¸ îäèí øàã è ïîíÿòü, çà÷åì îí çàïîìèíàåò êàæäîå ñîåäèíåíèå. À çàïîìèíàíèå äåëàåòñÿ ïîòîìó, ÷òî àäðåñà è/èëè ïîðòû ìîãóò çàìåíÿòüñÿ, òî åñòü íå ñóùåñòâóåò ñïîñîáà îïðåäåëèòü ïàðó SRC IP/PORT <-> DST IP/PORT áåç ëèíåéíîãî çàïîìèíàíèÿ âñåõ óñòàíîâëåííûõ ñîåäèíåíèé. Ñîîòâåòñòâåííî, ñàì ôàêò, ÷òî NAT åñòü STATEFUL óæå ãîâîðèò íàì î òîì, ÷òî ìàïïèíã íå 1:1.

Íó è ïëþñ ê òîìó, êàæäîå ñîåäèíåíèå æð¸ò ðåñóðñû. Âîçìîæíî, äëÿ ìàëåíüêîé äîìàøíåé ñåòè ýòî íå òàê ñòðàøíî (õîòÿ ðåñóðñîâ ó ðîóòåðà íå òàê óæ ìíîãî), à âîò äëÿ øëþçà òèïà íàøåãî îçåðêîâñêîãî (ìåæäó ïðî÷èì, ó íàñ êàê ðàç èìååòñÿ äîñòóï â äâå äðóãèå ãîðîäñêèå ëîêàëêè ïî àäðåñàì 1.x.x.x è 2.x.x.x, õîòÿ ó íèõ â ëîêàëêàõ èñïîëüçóåòñÿ àäðåñàöèÿ 10.x.x.x) ýòî óæîñíà.

Originally Posted by AYuusuke

GPL èñõîäíèêè îò àñóñà åñòü íà files.wl500g.info (âèäèìî íàñ èíòåðåñóåò http://files.wl500g.info/asus/wl500g/gpl/GPL_1927.zip)

Çäîðîâî, óæå êà÷àþ. Íà oleg.wl500g.info ïðèâåäåíà óñòàðåâøàÿ èíôîðìàöèÿ î òîì, ÷òî íóæíû èñõîäíèêè GPL_1817.zip, ÿ áåçóñïåøíî ïûòàëñÿ èõ íàéòè íà ñàéòå àñóñà :-)

Originally Posted by AYuusuke

TTL òàì íîðìàëüíûé, ÿ âûïîëíÿë tracert, à íå ïèíã. Ïî ëîãó ïðÿìî âèäåíî ÷òî ñíà÷àëà èäåò 3 îòâåòà îò ïåðâîãî õîïà, ïîòîì 3 îòâåòà îò âòîðîãî. Äàëüøå ÿ íàæàë ctrl-c. Òóò âðîäå íèêàêèõ ïðîáëåì.

Î êàê èíòåðåñíî, îêàçûâàåòñÿ:

Originally Posted by Wikipedia

The Time Exceeded Message is an ICMP message which is generated by a gateway to inform the source of a discarded datagram due to the time to live field reaching zero. [...]

Time exceeded messages are used by the traceroute utility to identify gateways on the path between two hosts.

Òî åñòü time exceeded ýòî øòàòíàÿ "ôèøêà" traceroute, îí íàìåðåííî âûñòàâëÿåò íèçêèé TTL, ÷òîáû âûÿâëÿòü øëþçû. Çðÿ Âû âñ¸-òàêè íå ïðèñìîòðåëèñü ê âûõëîïó tcpdump -v. Âîò ïðèìåð ìîåãî traceroute äî îäíîãî èç øëþçîâ ïðîâàéäåðà:

Code:

[2|root@zap|~]traceroute -z 1 -I 192.168.240.1
traceroute to 192.168.240.1 (192.168.240.1), 30 hops max, 40 byte packets
 1  gate.home.lan (192.168.1.1)  0.464 ms  0.433 ms  0.431 ms
 2  vlan16-DGS5.ozerki.net (85.249.169.1)  22.548 ms  19.714 ms  9.128 ms
 3  DGS1.ozerki.lan (192.168.240.1)  16.148 ms  21.245 ms  21.045 ms

Ïðè ýòîì íà øëþçå âñ¸ î÷åíü ñõîäíî ñ Âàøåé ñèòóàöèåé:

Code:

[zap@gate|/tmp/local/root]tcpdump -vn -i vlan1 icmp            
tcpdump: listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
14:23:49.493446 IP (tos 0x0, ttl   5, id 64239, offset 0, flags [none], length: 68) 85.249.169.28 > 194.87.0.50: icmp 48: echo request seq 18
14:23:49.504422 IP (tos 0x0, ttl 251, id 37013, offset 0, flags [none], length: 56) 85.249.160.1 > 192.168.1.2: icmp 36: time exceeded in-transit
14:23:53.193230 IP (tos 0x0, ttl   1, id 64243, offset 0, flags [none], length: 68) 85.249.169.28 > 194.87.0.50: icmp 48: echo request seq 4
14:23:53.210666 IP (tos 0x0, ttl  30, id 0, offset 0, flags [none], length: 56) 85.249.169.1 > 192.168.1.2: icmp 36: time exceeded in-transit
14:24:07.948034 IP (tos 0x0, ttl   1, id 63648, offset 0, flags [none], length: 68) 85.249.169.28 > 192.168.240.1: icmp 48: echo request seq 4
14:24:07.963909 IP (tos 0x0, ttl  30, id 0, offset 0, flags [none], length: 56) 85.249.169.1 > 192.168.1.2: icmp 36: time exceeded in-transit
14:24:08.947740 IP (tos 0x0, ttl   1, id 63649, offset 0, flags [none], length: 68) 85.249.169.28 > 192.168.240.1: icmp 48: echo request seq 5
14:24:08.962690 IP (tos 0x0, ttl  30, id 0, offset 0, flags [none], length: 56) 85.249.169.1 > 192.168.1.2: icmp 36: time exceeded in-transit
14:24:09.947528 IP (tos 0x0, ttl   1, id 63650, offset 0, flags [none], length: 68) 85.249.169.28 > 192.168.240.1: icmp 48: echo request seq 6
14:24:09.963014 IP (tos 0x0, ttl  30, id 0, offset 0, flags [none], length: 56) 85.249.169.1 > 192.168.1.2: icmp 36: time exceeded in-transit
14:24:10.947347 IP (tos 0x0, ttl   2, id 63651, offset 0, flags [none], length: 68) 85.249.169.28 > 192.168.240.1: icmp 48: echo request seq 7
14:24:10.949408 IP (tos 0x0, ttl 254, id 63651, offset 0, flags [none], length: 68) 192.168.240.1 > 85.249.169.28: icmp 48: echo reply seq 7
14:24:11.947143 IP (tos 0x0, ttl   2, id 63652, offset 0, flags [none], length: 68) 85.249.169.28 > 192.168.240.1: icmp 48: echo request seq 8
14:24:11.948523 IP (tos 0x0, ttl 254, id 63652, offset 0, flags [none], length: 68) 192.168.240.1 > 85.249.169.28: icmp 48: echo reply seq 8
14:24:12.946996 IP (tos 0x0, ttl   2, id 63653, offset 0, flags [none], length: 68) 85.249.169.28 > 192.168.240.1: icmp 48: echo request seq 9
14:24:12.959689 IP (tos 0x0, ttl 254, id 63653, offset 0, flags [none], length: 68) 192.168.240.1 > 85.249.169.28: icmp 48: echo reply seq 9

Ïîñìîòðèòå íà TTL èñõîäÿùèõ ïàêåòîâ

È îáðàòèòå âíèìàíèå, ÷òî time-limit exceeded èäóò ïî òðè øòóêè, êàê ðàç ñêîëüêî ïîïûòîê äåëàåò traceroute íà êàæäûé õîï.

Èòàê âûâîä: èñõîäÿùèé òðàôôèê ó Âàñ âðîäå áû ðàáîòàåò êàê íàäî, çíà÷èò çàòûê ïðîèñõîäèò íà îáðàòíîì ïóòè.

Originally Posted by AYuusuke

Çàìåòèë ñëåäóþùóþ âåøü

Âîçìîæíî ýòî ñâÿçàíî ñ òåì, ÷òî TCP/IP ñòåê ðàáîòàåò àñèíõðîííî è êýøèðóåò äîôèãà ÷åãî; íå çðÿ âî âñåõ ïðèìåðàõ iproute âñ¸ âðåìÿ ñîâåòóþò äåëàòü ip route flush cache ïîñëå êàæäîãî èçìåíåíèÿ òàáëèöû ìàðøðóòîâ.

Originally Posted by AYuusuke

Ïîëó÷àåòñÿ ÷òî ñîïðîâîæäåíèå ñîåäèíåíèé ïðîèñõîäèò äî íàøåãî ïðåîáðàçîâàíèÿ, ÷òî âîîáùåì òî ïðàâèëüíî. Íî ïî÷åìó îáðàòíûå ïàêåòû íå ïðîëåçàþò?

Âîò ýòî è åñòü ñëåäóþùàÿ çàäà÷à :-)

**AYuusuke** · 16-12-2007, 11:53

Äà, êîíå÷íî æå ÿ îïÿòü îïèñàëñÿ (âñåòàêè 3 ÷àñà íî÷è áûëî). Íó ïîõîæå è òàê ïîíÿòíî êàêîé êàáåëü â êàêîé ïîðò ïîäêëþ÷åí

Ïðî âòîðîé WAN ïîðò êîíå÷íî ìîæíî ïîïðîáîâàòü, íî ê ñîæàëåíèþ íå ñåé÷àñ. Ïîêà âñå ïîðòû àñóñà çàíÿòû (ÿ íå ñ ïðîñòà áðàë äèàïàçîí íà 16 ïëþøåâûõ àäðåñîâ), íóæíî èëè åùå ñâè÷ ïîêóïàòü èëè åùå êàáåëè ïðîêëàäûâàòü... ïîêà ïîâðåìåíþ ñ ýòèì.

ß ïðàâèëüíî ïîíÿë ÷òî åñëè ïîëó÷èòñÿ íåîáõîäèìîå ìíå ïðåîáðàçîâàíèå ðåàëèçîâàòü ñ ïîìîøüþ êàêîãî òî stateful nat-à, òî ñèëüíî õóæå íå áóäåò? Ó ìåíÿ äîìà íå òàê ìíîãî êîìïîâ (ñëåäîâàòåëüíî è îáùåå êîë-âî ñîåäèíåíèé, êîòîðûå áóäóò ñîïðîâîæäàòüñÿ ðóòåðîì íå î÷åí âåëèêî), äîëæíî ïîòÿíóòü...

Ïðî öèôðîâñêèå 1.0.0.0/8 àäðåñà ÿ êîí÷åíî æå çíàþ. Òî ÷òî íàøè àäìèíû ñìîãëè òàêîå ñäåëàòü è ïîñëóæèëî ïîâîäîì ïîïðîáîâàòü ýòî æå ñäåëàòü ñàìîìó. Èìåþùèåñÿ àëüòåðíàòèâû - ïîòåðÿòü âåñü àíòõèëë ïðè ïîäêëþ÷åíèè ê êîðáèíå èëè æå ðóêàìè èñêàòü èñïîëüçóþùèåñÿ ïîäñåòè è ïðîïèñûâàòü íà êàæäóþ èç íèõ ñâîå ïðàâèëî ìàðøðóòèçàöèè (à îíè æå åùå è ìåíÿþòñÿ ñî âðåìåíåì, äà è êàêèå òî òî÷íî áóäóò ïåðåñåêàòüñÿ), ìíå íå î÷åíü íðàâèòñÿ.

Íàñ÷åò âõîäÿùèõ ïàêåòîâ: ìîæåòå ïîñîâåòîâàòü êàêóþ ëèáî óòèëèòó èëè êîìàíäó ëîãèðîâàíèÿ, êîòîðàÿ áû ïîêàçàëà íà êàêîì ýòàïå âõîäÿùèå ïàêåòû îòáðàñûâàþòñÿ? ß ÷òî òî ñëûøàë ïðî âîçìîæíîñòü ëîãèðîâàíèÿ èç iptables, íî êàêóþ öåëü ïèñàòü, â êàêîé òàáëèöå è â êàêîé öåïî÷êå ìíå ïëîõî ïîíÿòíî. Ïîìîæåòå?

Ó âàñ åñòü ìûñëè, ïî÷åìó íå ñðàáàòûâàåò îáðàòíîå ïðåîáðàçîâàíèå 10.0.0.0/8->2.0.0.0/8 ?

Code:

iptables -t mangle -I PREROUTING -i vlan1 -s 10.0.0.0/8 -j MARK --set-mark 5
ip rule add fwmark 5 nat 2.0.0.0 from 10.0.0.0/8

Ïðàâèëà íàïèñàíû äî ñìåøíîãî ïðîñòûìè, âñå ïðåîáðàçîâàíèå äîëæíû áûòü stateless... Ïî÷åìó æå íå ðàáîàòåò..

**zap** · 16-12-2007, 12:22

Originally Posted by AYuusuke

Òî ÷òî íàøè àäìèíû ñìîãëè òàêîå ñäåëàòü è ïîñëóæèëî ïîâîäîì ïîïðîáîâàòü ýòî æå ñäåëàòü ñàìîìó.

Íó, ó àäìèíîâ, ÿ äóìàþ, NETMAP ðàáîòàåò ïðàâèëüíî :-)

Originally Posted by AYuusuke

ß ïðàâèëüíî ïîíÿë ÷òî åñëè ïîëó÷èòñÿ íåîáõîäèìîå ìíå ïðåîáðàçîâàíèå ðåàëèçîâàòü ñ ïîìîøüþ êàêîãî òî stateful nat-à, òî ñèëüíî õóæå íå áóäåò? Ó ìåíÿ äîìà íå òàê ìíîãî êîìïîâ (ñëåäîâàòåëüíî è îáùåå êîë-âî ñîåäèíåíèé, êîòîðûå áóäóò ñîïðîâîæäàòüñÿ ðóòåðîì íå î÷åí âåëèêî), äîëæíî ïîòÿíóòü...

ß áû íå ñòàë, íî â ïðèíöèïå êîíå÷íî ýòî áóäåò ðàáîòàòü.

Originally Posted by AYuusuke

Íàñ÷åò âõîäÿùèõ ïàêåòîâ: ìîæåòå ïîñîâåòîâàòü êàêóþ ëèáî óòèëèòó èëè êîìàíäó ëîãèðîâàíèÿ, êîòîðàÿ áû ïîêàçàëà íà êàêîì ýòàïå âõîäÿùèå ïàêåòû îòáðàñûâàþòñÿ? ß ÷òî òî ñëûøàë ïðî âîçìîæíîñòü ëîãèðîâàíèÿ èç iptables, íî êàêóþ öåëü ïèñàòü, â êàêîé òàáëèöå è â êàêîé öåïî÷êå ìíå ïëîõî ïîíÿòíî. Ïîìîæåòå?

Ýòî äîñòàòî÷íî ïðîñòî, íî ÿ íå óâåðåí ÷òî ýòî äàñò èñêîìûé îòâåò.

iptables -A xxx -j LOG

ïðè ýòîì ïàêåòû áóäóò óõîäèòü â æóðíàë ÿäðà (dmesg ëèáî âêëþ÷èòå klogd íà /var/log/messages).

Originally Posted by AYuusuke

Ó âàñ åñòü ìûñëè, ïî÷åìó íå ñðàáàòûâàåò îáðàòíîå ïðåîáðàçîâàíèå 10.0.0.0/8->2.0.0.0/8 ?

Âîçìîæíî, îíî ñðàáàòûâàåò íî, íàïðèìåð ñëèøêîì ïîçäíî (ïîñëå ïðèíÿòèÿ ðåøåíèÿ î ðîóòèíãå?). Ìîæåò îíî íå â òîò èíòåðôåéñ óõîäèò? Äëÿ ïðîôèëàêòèêè ïîñìîòðèòå tcpdump íà äðóãèõ èíòåðôåéñàõ, è íå ïîëüçóéòå Âû ýòîò tracert, îí äà¸ò êó÷ó íåíóæíûõ ýôôåêòîâ. Ïðîñòîé ïèíã; îäèí ïàêåò òóäà - îäèí îáðàòíî. Âñ¸ ïðåäåëüíî ÿñíî, à tracert âîí êàêèå ñþðïðèçû âûêèäûâàåò

Originally Posted by AYuusuke

Code:

iptables -t mangle -I PREROUTING -i vlan1 -s 10.0.0.0/8 -j MARK --set-mark 5
ip rule add fwmark 5 nat 2.0.0.0 from 10.0.0.0/8

Ìîæåò ïîïðîáîâàòü ñíà÷àëà ñäåëàòü ïðîñòîå ïðàâèëî:

Code:

ip rule add nat 2.0.0.0 from 10.0.0.0/8

Âîçìîæíî mangle îòðàáàòûâàåò óæå ïîñëå òîãî, êàê ñðàáàòûâàåò ip rule?

Ïîêîïàþñü ïîïîçæå â èñõîäíèêàõ, ïîñìîòðþ ÷òî òàì ñ NETMAP. Âîçìîæíî, ìîæíî áóäåò îòêàçàòüñÿ îò iproute.

**AYuusuke** · 16-12-2007, 13:43

Ïîêà âû åùå íå ðàçîáðàëèñü ñ NETMAP, ÿ ïîñòàâèë åùå ýêñïåðèìåíò. Òåñòèðîâàë òîëüêî iproute2 ïðàâèëà (íèæå ïî òåêñòó âèäíî).

Ïèíãóþ àäðåñ â àíòõèëëå, ïîòîìó íåêîòîðûå ïàêåòû òåðÿþòñÿ, íó âû ñàìè çíàåòå êàêàÿ ó îçåðêîâ ëèíêîâêà ñ àíòõèëëîì

"ping 10.20.36.183" (íàñòðîéêè ïî óìîë÷àíèþ):

Code:

[admin@anthy root]$ tcpdump -n -i vlan1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
15:58:03.115315 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 459, length 40
15:58:03.117777 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 459, length 40
15:58:04.117792 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 460, length 40
15:58:08.729143 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 461, length 40
15:58:08.745746 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 461, length 40
15:58:09.731992 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 462, length 40
[admin@anthy root]$ tcpdump -n -i br0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 68 bytes
15:58:03.115153 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 459, length 40
15:58:03.117992 IP 10.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 459, length 40
15:58:04.117633 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 460, length 40
15:58:08.728976 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 461, length 40
15:58:08.745886 IP 10.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 461, length 40
15:58:09.731827 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 462, length 40

Äåëàåì

Code:

ip route add nat 2.0.0.0/8 via 10.0.0.0
ip rule add nat 2.0.0.0 from 10.0.0.0/8
ip route flush cache

Êîíå÷íî ýòî ïðàâèëî ñîâñåì íå òî ÷òî ìíå íóæíî, íî áóäåì ïðîâåðÿòü êàê ýòî ïðîñòîå ïðåîáðàçîâàíèå ðàáîòàåò ñàìî ïî ñåáå. Ïî÷òè ÷òî ïðèìåð èç êíèæêè.

"ping 10.20.36.183":

Code:

[admin@anthy root]$ tcpdump -n -i vlan1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
16:02:27.112499 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 467, length 40
16:02:27.114954 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 467, length 40
16:02:31.691791 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 468, length 40
16:02:36.691114 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 469, length 40
16:02:41.690412 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 470, length 40
16:02:41.691577 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 470, length 40
[admin@anthy root]$ tcpdump -n -i br0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 68 bytes
16:02:27.112332 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 467, length 40
16:02:27.115121 IP 2.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 467, length 40
16:02:31.691623 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 468, length 40
16:02:36.690946 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 469, length 40
16:02:41.690244 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 470, length 40
16:02:41.691717 IP 2.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 470, length 40

Ïîäìåíà source ïîëÿ ðàáîòàåò. Íà õîñòå â îêíå ïèíãà "Ïðåâûøåí èíòåðâàë îæèäàíèÿ äëÿ çàïðîñà". Ïîêà âñå ïðàâèëüíî.

Æäåì ìèíóòó è äåëàåì "ping 2.20.36.183":

Code:

[admin@anthy root]$ tcpdump -n -i vlan1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
16:05:51.007108 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 477, length 40
16:05:51.023498 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 477, length 40
16:05:55.662083 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 478, length 40
16:05:55.664256 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 478, length 40
16:06:00.661375 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 479, length 40
16:06:00.666117 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 479, length 40
16:06:05.660651 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 480, length 40
16:06:05.671859 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 480, length 40
[admin@anthy root]$ tcpdump -n -i br0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 68 bytes
16:05:51.006936 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 477, length 40
16:05:55.661919 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 478, length 40
16:06:00.661200 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 479, length 40
16:06:05.660478 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 480, length 40

Îòâåòû çàñòðÿëè ãäå òî âíóòðè ðóòåðà.

Äåëàåì "ping 10.20.36.183 -w 50" è ñðàçó ïîñëå ýòîãî "ping 2.20.36.183 -w 50":

Code:

[admin@anthy root]$ tcpdump -n -i vlan1 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
16:09:19.885091 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 506, length 40
16:09:19.895111 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 506, length 40
16:09:21.134841 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 507, length 40
16:09:21.138853 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 507, length 40
16:09:22.633631 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 508, length 40
16:09:24.133358 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 509, length 40
16:09:27.552651 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 510, length 40
16:09:27.555015 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 510, length 40
16:09:28.555700 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 511, length 40
16:09:29.633477 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 512, length 40
16:09:29.637206 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 512, length 40
16:09:30.639318 IP 192.168.30.54 > 10.20.36.183: ICMP echo request, id 1, seq 513, length 40
16:09:30.649347 IP 10.20.36.183 > 192.168.30.54: ICMP echo reply, id 1, seq 513, length 40
[admin@anthy root]$ tcpdump -n -i br0 icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 68 bytes
16:09:19.884839 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 506, length 40
16:09:19.895262 IP 2.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 506, length 40
16:09:21.134610 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 507, length 40
16:09:21.139002 IP 2.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 507, length 40
16:09:22.633392 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 508, length 40
16:09:24.133184 IP 10.0.17.76 > 10.20.36.183: ICMP echo request, id 1, seq 509, length 40
16:09:27.552409 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 510, length 40
16:09:27.555158 IP 2.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 510, length 40
16:09:28.555522 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 511, length 40
16:09:29.633313 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 512, length 40
16:09:29.637353 IP 2.20.36.183 > 10.0.17.76: ICMP echo reply, id 1, seq 512, length 40
16:09:30.639144 IP 10.0.17.76 > 2.20.36.183: ICMP echo request, id 1, seq 513, length 40

Ðàáîòàåò è ïîäìåíà source è ïîäìåíà destination. Íà õîñòå â îêíå ping-à âèäíû îòâåòû

Êàê ÿ èíòåðïðåòèðóþ ïîëó÷åííûé ðåçóëüòàò: ãäå òî âñå ðàâíî èñïîëüçóåòñÿ stateful ïðåîáðàçîâàíèå, è ïîêà íåò çàïðîñà íà 10.x.x.x, íàøè îòâåòû ñ 2.x.x.x èãíîðèðóþòñÿ. Êîãäà ïðîõîäèò îäèí çàïðîñ íà 10.x.x.x - ïîÿâëÿåòñÿ çàïèñü â êàêîé òî òàáëèöå, è íàøè îòâåòû íà çàïðîñ óæå íà àäðåñ 2.x.x.x ïðèõîäÿò îáðàòíî ïî "ñîåäèíåíèþ", îñòàâøåìóñÿ îò çàïðîñà íà 10.x.x.x.

Ïîñåìó âîïðîñ: åñëè ìîè ðàññóæäåíèÿ âåðíû, òî êàê íàçûâàåòñÿ ýòà òàáëèöà è ãäå ïðî íåå ìîæíî ïðî÷èòàòü?

Òàê æå ïîñìîòðåë ÷òî ïðîèñõîäèò íà äðóãèõ èíòåðôåéñàõ - òàì âñå íîðìàëüíî, íàøè ïîòåðÿâøèåñÿ ïàêåòû íà íåïðàâèëüíûé èíòåðôåéñ íå óõîäÿò.

**dup!** · 29-12-2007, 15:59

To: Oleg
ß ñòîëêíóëñÿ ñ òàêîé æå ïðîáëåìîé NETMAP äåéñòâèòåëüíî áèòûé (ïðîøèâêà 1.9.2.7-8). Ó ìåíÿ ýòî ïðîÿâëÿåòñÿ òåì ÷òî ÿ íå ìîãó ïîñòàèòü ïðàâèëà äëÿ öåïî÷êè OUTPUT:

Code:

# iptables -t nat -A OUTPUT -d 192.168.0.0/16 -j NETMAP --to 10.24.0.0/16
iptables: Invalid argument

À ïðàâèëà äëÿ öåïî÷êè PREROUTING/POSTROUTING:

Code:

# iptables -t nat -A PREROUTING -d 192.168.0.0/16 -j NETMAP --to 10.24.0.0/16

Ñòàâÿòñÿ íî íåâåðíî ðàáîòàþò. Òðàíñëÿöèÿ àäðåñà ïðîèñõîäèò íî ìëàäøèå 16 áèò ñîäåðæàò ìóñîð, à íå òî ÷òî áûëî â îðèãèíàëüíîì àäðåñå.

Ýòî ìîæíî êàê-òî èñïðàâèòü, òàê ÷òîáû NETMAP ðàáîòàë êàê ïîëîæåíî?

**AntiMelk** · 31-12-2007, 15:48

Âñåõ ñ íîâûì ãîäîì !

×òî-òî íèêàê íå ìîãó íàéòè ïîäõîäÿùåå ïðàâèëî. Íóæíî ÷òîáû ìàøèíû ñ âíóòðåííåé ñåòè ìîãëè ïîäêëþ÷àòüñÿ ê vpn.

Çàðàíåå ñïàñèáî.

**MMike** · 31-12-2007, 18:31

Ýòî íå ïðàâèëî iptables, a ìîäóëü conntrack ( connection tracking). ×òî-òî òèïà ip_conntrack_pptp, êàê òî÷íî íàçûâàåòñÿ ó Îëåãà â ïðîøèâêå ñêàçàòü íå ìîãó, íåò æåëåçêè ïîä ðóêîé. Ïîñìîòðè ó ñåáÿ â /lib/modules/<version>/kernel/net/ ....

Ýòî åñëè êàñàòåëüíî pptp. IPSec ðàáîòàåò è áåç òðåêèíãà ...

**AntiMelk** · 31-12-2007, 19:44

Originally Posted by MMike

Ýòî íå ïðàâèëî iptables, a ìîäóëü conntrack ( connection tracking). ×òî-òî òèïà ip_conntrack_pptp, êàê òî÷íî íàçûâàåòñÿ ó Îëåãà â ïðîøèâêå ñêàçàòü íå ìîãó, íåò æåëåçêè ïîä ðóêîé. Ïîñìîòðè ó ñåáÿ â /lib/modules/<version>/kernel/net/ ....

Ýòî åñëè êàñàòåëüíî pptp. IPSec ðàáîòàåò è áåç òðåêèíãà ...

Áëèí, íåñòûêîâî÷êà âûøëà, ó ìåíÿ debian, contrack ñòîèò èëè ïî ó ìîë÷àíèþ åñòü â òàìîøíåì iptables...

**MMike** · 01-01-2008, 10:16

Äà ó íàñ â Debiane

ëåæàò òóò /lib/modules/<version>/kernel/net/netfilter/

ïî óìîë÷àíèþ â 2.6.23 åñòü òàêèå:
nf_conntrack_amanda.ko
nf_conntrack_ftp.ko
nf_conntrack_h323.ko
nf_conntrack_irc.ko
nf_conntrack_pptp.ko íóæíûé íàì äåéñòâèòåëüíî åñòü
nf_conntrack_proto_gre.ko
nf_conntrack_proto_sctp.ko
nf_conntrack_proto_udplite.ko
nf_conntrack_sane.ko
nf_conntrack_sip.ko
nf_conntrack_tftp.ko

Ó Îëåãà â ïðîøèâêå, äà è âîîáùå ïî ìîåìó â 2.4ì ÿäðå äîëæåí íàçûâàòüñÿ ip_conntrack_pptp.

Òàê ÷òî èùèòå è îáðÿùèòå

**AntiMelk** · 02-01-2008, 09:10

Originally Posted by MMike

Äà ó íàñ â Debiane

ëåæàò òóò /lib/modules/<version>/kernel/net/netfilter/

ïî óìîë÷àíèþ â 2.6.23 åñòü òàêèå:
nf_conntrack_amanda.ko
nf_conntrack_ftp.ko
nf_conntrack_h323.ko
nf_conntrack_irc.ko
nf_conntrack_pptp.ko íóæíûé íàì äåéñòâèòåëüíî åñòü
nf_conntrack_proto_gre.ko
nf_conntrack_proto_sctp.ko
nf_conntrack_proto_udplite.ko
nf_conntrack_sane.ko
nf_conntrack_sip.ko
nf_conntrack_tftp.ko

Ó Îëåãà â ïðîøèâêå, äà è âîîáùå ïî ìîåìó â 2.4ì ÿäðå äîëæåí íàçûâàòüñÿ ip_conntrack_pptp.

Òàê ÷òî èùèòå è îáðÿùèòå

Òàê... ñòðàííî ÷òî-òî íåò íóæíîãî ôàéëà...

xt_conntrack.ko - ñàìîå ïîõîæåå

ÿäðî 2.6.18.

Thread: ïîìîãèòå ñ êîíôèãóðàöèåé iptables

Thread Tools

Display

iptables, ïðàâèëî äëÿ pptp

Similar Threads

How to run two webservers

How to automatically start post-boot?

SSH and iptables trouble

WL-500gx WAN & LAN Filter example

How to configure Firewall/iptables

Tags for this Thread

Posting Permissions