2 ïðîâàéäåðà ñ ðåçåðâèðîâàíèåì êàíàëà

**Oleg** · 10-01-2007, 13:43

Ò.å. Âàì ýòî íóæíî íå äëÿ ëîêàëüíîé ñåòè, à êàê âòîðîé âíåøíèé Ip?

Âû óâåðåíû, ÷òî â îòâåòå íåâåðíûé àäðåñ? Ñêîðåå âñåãî àäðåñ âåðíûé, íî óõîäèò ñ äåôîëòíîãî èíòåðôåéñà. Ïðîâåðüòå. Åñëè ýòî òàê, òî ðåøàåòñÿ ïðîñòî.

**andycpp** · 10-01-2007, 14:21

Originally Posted by Oleg

Ò.å. Âàì ýòî íóæíî íå äëÿ ëîêàëüíîé ñåòè, à êàê âòîðîé âíåøíèé Ip?

Âû óâåðåíû, ÷òî â îòâåòå íåâåðíûé àäðåñ? Ñêîðåå âñåãî àäðåñ âåðíûé, íî óõîäèò ñ äåôîëòíîãî èíòåðôåéñà. Ïðîâåðüòå. Åñëè ýòî òàê, òî ðåøàåòñÿ ïðîñòî.

À êàê ñèå ïîñìîòðåòü? Ó ìåíÿ ïî÷åìó-òî òàê ñëîæèëîñü, ÷òî íåò óäàë¸ííîé ìàøèíû äëÿ ïðîâåðîê... Ïîñåìó ïðîùå, íàâåðíîå, ïîïðîáîâàòü "ðåøèòü ïðîñòî" è ïîñìîòðåòü, ñðàáîòàåò èëè íåò

Õîòÿ ÿ íå ñîâñåì ïîíèìàþ, êàê ìîæåò îêàçàòüñÿ íà äåôîëòíîì èíòåðôåéñå íå òîò àäðåñ, ÷òî íóæíî - ó ìåíÿ âåäü â nat/postrouting ñòîÿò snat'û, êîòîðûå ìåíÿþò source-àäðåñà â çàâèñèìîñòè îò òîãî, ñ êàêîãî èíòåðôåéñà èì óõîäèòü...

Code:

iptables -t nat -A POSTROUTING -j SNAT -o vlan1 -s 10.0.0.0/255.255.255.0 --to-source 82.144.206.10
iptables -t nat -A POSTROUTING -j SNAT -o vlan2 -s 10.0.0.0/255.255.255.0 --to-source 10.0.2.10

Ìîæíî, êîíå÷íî, ïîïðîáîâàòü ñäåëàòü ìàðêèðîâàíèå ïàêåòîâ â mangle/FORWARD íà îñíîâå òîãî, ñ êàêîãî ÈÏ:ïîðòà îíè ïðèøëè... Íî òîãäà íóæíî áóäåò ïðîïèñûâàòü àëãîðèòìû ðàáîòû äëÿ âñåõ ïðîòîêîëîâ (ò.å., ïî ñóòè, âðó÷íóþ ÷àñòè÷íî äåëàòü connmark) â îáùåì ñëó÷àå, õîòÿ äëÿ 25/80/443 âïîëíå ìîæåò ñðàáîòàòü, ò.ê. áîëüøå ñ ýòèõ ïîðòîâ, âðîäå êàê, íè÷åãî èäòè íå äîëæíî, êðîìå êàê smtp/http/ssl òðàôèê...

**Oleg** · 10-01-2007, 14:28

Íó òàê tcpdump íà ÷òî?

Äîáàâèòü îïöèþ -n, ñòàíóò âèäíû àäðåñà.

**andycpp** · 10-01-2007, 15:04

Êàê ÿ ïðîâåðÿþ - óäàë¸ííûé ñàéò ïîëó÷åò îòâåò ñî ìîåãî 17-ãî ïîðòà (QOTD) è ðèñóåò åãî íà ñâîåé ñòðàíè÷êå. Åñëè ñàéò ìíå íàðèñîâàë îòâåò - çíà÷èò âñ¸ îê.

Êàê âûãëÿäèò äî ñìåíû default route

Code:

[Admin@gate-volia root]$ tcpdump -n -i vlan1 "not port 23"
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
16:59:59.865069 IP 82.144.206.10.9251 > 72.232.51.250.80: P 1877100124:1877100680(556) ack 1705477852 win 65311
17:00:00.079639 IP 72.232.51.250.28248 > 82.144.206.10.17: S 1190268483:1190268483(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,[|tcp]>
17:00:00.081832 IP 82.144.206.10.17 > 72.232.51.250.28248: S 3216678882:3216678882(0) ack 1190268484 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]>
17:00:00.222711 IP 72.232.51.250.80 > 82.144.206.10.9251: . ack 556 win 17520
17:00:00.248309 IP 72.232.51.250.28248 > 82.144.206.10.17: . ack 1 win 16384 <nop,nop,timestamp 2338245289 0>
17:00:00.249419 IP 72.232.51.250.28248 > 82.144.206.10.17: P 1:7(6) ack 1 win 16384 <nop,nop,timestamp 2338245289 0>
17:00:00.249869 IP 82.144.206.10.17 > 72.232.51.250.28248: P 1:167(166) ack 1 win 65535 <nop,nop,timestamp 770809 2338245289>
17:00:00.250064 IP 82.144.206.10.17 > 72.232.51.250.28248: F 167:167(0) ack 1 win 65535 <nop,nop,timestamp 770809 2338245289>
17:00:00.250416 IP 82.144.206.10.17 > 72.232.51.250.28248: R 168:168(0) ack 7 win 0
17:00:00.416112 IP 72.232.51.250.28248 > 82.144.206.10.17: . ack 168 win 16384 <nop,nop,timestamp 2338245290 770809>
17:00:00.417244 IP 72.232.51.250.28248 > 82.144.206.10.17: F 7:7(0) ack 168 win 16384 <nop,nop,timestamp 2338245290 770809>
17:00:00.417665 IP 82.144.206.10.17 > 72.232.51.250.28248: R 3216679050:3216679050(0) win 0
17:00:00.417997 IP 82.144.206.10.17 > 72.232.51.250.28248: R 3216679050:3216679050(0) win 0
17:00:00.428218 IP 72.232.51.250.80 > 82.144.206.10.9251: . 1:1461(1460) ack 556 win 17520
17:00:00.429309 IP 72.232.51.250.80 > 82.144.206.10.9251: . 1461:2921(1460) ack 556 win 17520
17:00:00.429326 IP 72.232.51.250.80 > 82.144.206.10.9251: P 2921:3363(442) ack 556 win 17520
17:00:00.430300 IP 82.144.206.10.9251 > 72.232.51.250.80: . ack 2921 win 65535
17:00:00.466631 IP 82.144.206.10.9252 > 209.85.135.147.80: P 2288942072:2288942832(760) ack 830544282 win 65535
17:00:00.569572 IP 82.144.206.10.9251 > 72.232.51.250.80: . ack 3363 win 65093

È ïîñëå ñìåíû (ïî êàæäîìó èíòåðôåéñó îòäåëüíî - vlan1 - 82.144.., vlan2 - 10.0.2...)

Code:

[Admin@gate-volia root]$ tcpdump -i vlan1 -n "not port 23"
listening on vlan1, link-type EN10MB (Ethernet), capture size 68 bytes
16:54:11.671219 IP 72.232.51.250.1522 > 82.144.206.10.17: S 1724337773:1724337773(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,[|tcp]>
16:54:17.665383 IP 72.232.51.250.1522 > 82.144.206.10.17: S 1724337773:1724337773(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,[|tcp]>
16:54:29.662210 IP 72.232.51.250.1522 > 82.144.206.10.17: S 1724337773:1724337773(0) win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,[|tcp]>

[Admin@gate-volia root]$ tcpdump -i vlan2 -n "not port 23"
listening on vlan2, link-type EN10MB (Ethernet), capture size 68 bytes
16:55:03.865971 IP 10.0.2.10.9239 > 72.232.51.250.80: S 2281836523:2281836523(0) win 65535 <mss 1460,nop,nop,sackOK>
16:55:04.038738 IP 72.232.51.250.80 > 10.0.2.10.9239: S 110239721:110239721(0) ack 2281836524 win 16384 <mss 1460,nop,nop,sackOK>
16:55:04.040603 IP 10.0.2.10.9239 > 72.232.51.250.80: . ack 1 win 65535
16:55:04.040790 IP 10.0.2.10.9239 > 72.232.51.250.80: P 1:557(556) ack 1 win 65535
16:55:04.418569 IP 72.232.51.250.80 > 10.0.2.10.9239: . ack 557 win 16944
16:55:34.287409 IP 72.232.51.250.80 > 10.0.2.10.9239: . 1:1413(1412) ack 557 win 16944
16:55:34.299956 IP 72.232.51.250.80 > 10.0.2.10.9239: . 1413:2825(1412) ack 557 win 16944
16:55:34.300898 IP 10.0.2.10.9239 > 72.232.51.250.80: . ack 2825 win 65535
16:55:34.476148 IP 72.232.51.250.80 > 10.0.2.10.9239: P 2825:3145(320) ack 557 win 16944
16:55:34.617525 IP 10.0.2.10.9239 > 72.232.51.250.80: . ack 3145 win 65215

ps. ïîïðîáîâàë ìàðêèðîâàòü ïàêåòû â mangle/FORWARD è íà îñíîâå ýòîãî ðîóòèòü - íå ïîìîãëî ïî÷åìó-òî...
pps. ìîæåò êîìó ïðèãîäèòñÿ - ñàéò, ÷åðåç êîòîðûé ïðîâåðÿþ - http://www.blackcode.com/scripts/toolbox.php - òàì (äëÿ ñåáÿ) âûáèðàþ 17 ïîðò è grab banner îòìå÷àþ.

**Oleg** · 10-01-2007, 15:51

Èç òîãî, ÷òî Âû íàïèñàëè, ÿ âèæó, ÷òî ó Âàñ íå ðàáîòàåò ìàñêàðàäèíã.

Ëèáî ÿ Âîîáùå íå ïîíèìàþ, ÷òî ó Âàñ òàì çà òðàôôèê.

È çà÷åì Âû îïÿòü âåðíóëèñü ê èäåå çàìåíû äåôîëòíîãî ìàðøðóòà...

**andycpp** · 10-01-2007, 16:33

Âåðíóëñÿ ïî äîñòàòî÷íî ïðîñòîé ïðè÷èíå - ìíå íóæíà ñòàáèëüíàÿ ðàáîòà êàíàëà, à ïîêà íå íàñòðîþ âñ¸ - ÿ nvram/flash íå ä¸ðãàþ, ÷òîáû reboot âîçâðàùàë ê íà÷àëüíûì óñòàíîâêàì.

Â îáùåì, ñåòü âûãëÿäèò ãäå-òî òàê:

82.144.206.10 - ðåàëüíûé ÈÏ, êîííåêòû èíèöèèðóþòñÿ ñíàðóæè è ñ íåãî ôîðâàðäÿòñÿ ïîðòû âîâíóòðü (ïîëó÷åíèå àäðåñà ÷åðåç DHCP, íî îí íå ìîæåò èçìåíèòüñÿ)
91.õ.õ.õ - êàêîé-òî äèíàìè÷åñêèé ÈÏ, êîííåêòû èíèöèèðóþòñÿ òîëüêî îò ìåíÿ
10.0.2.0/24 - ñåòü íà àäñë-ðîóòåðå
10.0.0.0/24 - ëîêàëüíàÿ ñåòü

Çàäà÷à - îñòàâèòü 82.144.206.10 íà îáñëóæèâàíèå âõîäÿùèõ ñîåäèíåíèé (ñàéò, ïî÷òà è ò.ï.) + ðîóòèòü ÷åðåç íåãî íåñêîëüêî èñõîäÿùèõ ìàðøðóòîâ, à âñ¸ îñòàëüíîå ïóñêàòü ÷åðåç 10.0.2.10.

Äëÿ òåõ, êòî íå ÷èòàë ïðåäûäóùåå, ïðè âûïîëíåíèè ñëåäóþùèõ êîìàíä ñðàçó ïîñëå reboot'à (íàïðèìåð, äëÿ ôîðâàðäà 17-ãî ïîðòà)

Code:

robocfg vlan 0 ports "2 3 4 5t" vlan 2 ports "1 5t"
vconfig add eth0 2
ifconfig vlan2 10.0.2.10 netmask 255.255.255.0 broadcast 10.0.2.255 up

iptables -t nat -A PREROUTING -j VSERVER -d 10.0.2.10

iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -j SNAT -o vlan1 -s 10.0.0.0/24 --to-source 82.144.206.10
iptables -t nat -A POSTROUTING -j SNAT -o vlan2 -s 10.0.0.0/24 --to-source 10.0.2.10
iptables -t nat -A POSTROUTING -j MASQUERADE -o br0 -s 10.0.0.0/24 -d 10.0.0.0/24

iptables -t nat -A VSERVER -j DNAT -p tcp --dport 17 --to 10.0.0.100:17

iptables -t mangle -A FORWARD -j MARK --set-mark 82 -i br0 -s 10.0.0.100 -p tcp --sport 17

ip route add 82.144.206.0/25 dev vlan1 table 82
ip route add 10.0.0.0/24 dev br0 table 82
ip route add default via 82.144.206.1 prio 82 table 82

ip rule add fwmark 82 table 82 prio 82
ip route del default
ip route add default via 10.0.2.1

âñ¸ ðàáîòàåò êàê è çàäóìàíî, êðîìå ôîðâàðäèíãà ïîðòîâ, âåðíåå êàê, îíè-òî ôîðâàðäÿòñÿ - ïàêåò íà êîìï ïðèõîäèò, îò âîò îòâåò îò êîìïà óõîäèò ÷åðåç äðóãîé ìàðøðóò (è, ñîîòâ, íà âûõîäå ïîñëå SNAT'à - ñ äðóãèì ÈÏ-àäðåñîì), ÷òî äåëàåò íåâîçìîæíûì TCP-ñîåäèíåíèÿ è ò.ï.
ß âèæó ðåøåíèå ïðîáëåìû ÷åðåç èñïîëüçîâàèå CONNMARK äëÿ ìàðêèðîâêè âõîäÿùèõ ÷åðåç 82.144.206.10 ïàêåòîâ è íà îñíîâå ìåòêè - èñõîäÿùåãî ðîóòèíãà. Íî ïðîáëåìà â òîì, ÷òî CONNMARK îòñóòñòâóåò â iptables ïðîøèâêè, è íå ôàêò, ÷òî ýòî åäèíñòâåííîå (è ïðàâèëüíîå) ðåøåíèå - ò.ê. ìàðêèðîâêà â mangle/FORWARD íå ïîìîãàåò, ÷òî íåñêîëüêî ñòðàííî...

**andycpp** · 14-01-2007, 17:14

Any thoughts?

ß òóò òàê ïîäóìàë, ÷òî, âîçìîæíî, íóæíî ïðîáëåìó ðåøàòü ïóò¸ì îòêàçà îò DNAT/SNAT â iptables, è èñïîëüçîâàíèåì òîëüêî iproute2 ñ åãî âîçìîæíîñòüþ nat'à... È ïîðòû, íà êîòîðûå ôîðâàðä èä¸ò îòñåêàòü ñ ïîìîùüþ iptables...

×òî ñêàæóò ãóðó? Çàâòðà ïîïðîáóþ ýòó èäåþ...

Íå ïîìîãëî... Ó ìåíÿ ïîòèõîíüêó ñêëàäûâàåòñÿ âïå÷àòëåíèå, ÷òî ÷òî-òî â ïðîøèâêå íå òàê ðàáîòàåò, êàê äîëæíî â ñîîòâ. ñ äîêóìåíòàöèåé, ïðè ñìåíå default route... Â ÷àñòíîñòè, ïåðåñòà¸ò ðàáîòàòü DNAT ïî÷åìó-òî... À ïî÷åìó?

Up. Òàê ÷òî, íèêòî íå äåëàë àíàëîãè÷íóþ òîïîëîãèþ ñåòè, èëè ÷åãî?
Åñëè äåëàëè è îíî ðàáîòàëî - ïîäåëèòåñü êîíôèãàìè... Ïîòîìó ÷òî ó ìåíÿ òâîð÷åñêèé çàòûÃ.

**andycpp** · 20-01-2007, 11:04

Íåñìîòðÿ íà ãëþê â ïðîøèâêå ñ fwmark, ÿ òàêè äîáèëñÿ ñâîåãî. Ê ñîæåëàíèþ, òîëüêî íàñòðîéêîé ðîóòåðà îáîéòèñü íå óäàëîñü (íàäåþñü, ïîñëå èñïðàâëåíèþ ãëþêîâ â ïðîøèâêå ñ fwmark + CONNMARK, âñ¸ ìîæíî áóäåò ñäåëàòü òîëüêî íà ðîóòåðå, áåç äîáàâëåíèÿ IP).
Íà âíóòðèñåòåâûõ ñåðâåðàõ ÿ äîáàâèë ïî åù¸ îäíîìó IP-àäðåñó (10.0.0.5Õ) ïîñëå ÷åãî äîáàâèë ip rule add from 10.0.0.5X, è âñ¸ çàðàáîòàëî.

Âèíäà âûáèðàåò îñíîâíîé IP-àäðåñ äëÿ âñåõ íîâûõ ñîåäèíåíèé, òàê ÷òî åñëè ïðîèñõîäèò âûõîä â èíåò, òî îí èä¸ò ñ àäðåñà 10.0.0.10Õ, íî åñëè êîííåêò ïðèõîäèò íà âòîðîé IP-àäðåñ, òî è îòâåò, åñòåñòâåííî, èä¸ò ñ íåãî, è îòâåò ýòîò ìû óæå ðîóòèì òàê, êàê íàì íàäî.

Â êîìàíäàõ íà ðîóòåðå ýòî âûãëÿäèò òàê âîò:

Code:

robocfg vlan 0 ports "2 3 4 5t" vlan 2 ports "1 5t"
vconfig add eth0 2
ifconfig vlan2 hw ether 00:88:00:88:00:88
ifconfig vlan2 192.168.1.15 netmask 255.255.255.0 broadcast 192.168.1.255 up

iptables -t nat -A PREROUTING -j VSERVER -d 192.168.1.15

iptables -t nat -F POSTROUTING
iptables -t nat -A POSTROUTING -j SNAT -o vlan1 -s 10.0.0.0/24 --to-source 82.144.206.10
iptables -t nat -A POSTROUTING -j SNAT -o vlan2 -s 10.0.0.0/24 --to-source 192.168.1.15
iptables -t nat -A POSTROUTING -j MASQUERADE -o br0 -s 10.0.0.0/24 -d 10.0.0.0/24

ip route add 82.144.206.0/25 dev vlan2 table 82
ip route add 10.0.0.0/24 dev br0 table 82
ip route add default via 82.144.206.1 prio 82 table 82

ip rule add from 10.0.0.50 table 82 prio 82
ip rule add from 10.0.0.51 table 82 prio 82

ip route delete default
ip route add default via 192.168.1.1

âñ¸ ýòî çàïèñàòü íóæíî â post-firewall

**exxon** · 02-04-2007, 11:18

Àíàëîãè÷íàÿ êîíôèãóðàöèÿ ñ àíàëîãè÷íûìè ïðîáëåìàìè

âîçëàãàë áîëüøèå ïðîáëåìû íà ïåðåêîìïèëÿöèþ ïðîøèâêè, è òîëüêî ïîòîì âûÿñíèë ÷òî CONNMARK íå ïîääåðæèâàåòñÿ

îòñþäà äâà âîïðîñà
1) Áîëåå ïðîñòîå ðåøåíèå íå ïîÿâèëîñü?
2) åñòü ëè âîçìîæíîñòü "ïîäìåíèòü" ÿäðî 2.4.20 íà 2.6.÷òîíèáóäü, èëè ýòî â ïðèíöèïå íåâîçìîæíî?
3) Îëåã ïèñàë
"Ñêîðåå âñåãî àäðåñ âåðíûé, íî óõîäèò ñ äåôîëòíîãî èíòåðôåéñà. Ïðîâåðüòå. Åñëè ýòî òàê, òî ðåøàåòñÿ ïðîñòî."

ó ìåíÿ èìåííî òàê.
êàê ýòî ìîæíî ðåøèòü áåç CONNMARK?

**andycpp** · 02-04-2007, 11:55

ß ïîêà î ðåøåíèè ïðîùå íè÷åãî íå çíàþ

Íàñòðîèë íà äâîéíûå ÈÏ - ìèíóñû î÷åâèäíû (íóæíî òðîãàòü êîìïû, âìåñòî òîëüêî ðîóòåðà), íî åñòü è ñèëüíûé ïëþñ - î÷åíü ïðîñòî (áåç ïèíàíèÿ ðîóòåðà) òàêèì îáðàçîì íà êîìïå âûáðàòü, êàêîé êàíàë èñïîëüçîâàòü - áèíäèøüñÿ ê îäíîìó ÈÏ - èä¸ò òóäà, ê äðóãîìó - ñþäà

Òàê èëè èíà÷å - êîíôèãóðàöèÿ ðàáîòàåò ñ íà÷àëà ãîäà áåçîòêàçíî, íî íóæíî ñëåäèòü, êàêîé ÈÏ þçàåò ñîôò. Åäèíñòâåííî ÷òî - UPnP ëó÷øå îòêëþ÷èòü, ïîòîìó êàê èíà÷å ìîæåò ñëó÷àéíî îòêðûòü ïîðòû íå òàê, ãäå íóæíî.

**liss555** · 02-04-2007, 17:15

Originally Posted by gaaronk

íó äà. ÿ ñåáå òàê è ñäåëàë äëÿ ïðåìèóìà. ó ìåíÿ òðè wan - äëÿ ìèðîâîãî òðàôôèêà, äëÿ ua-ix è ðåçåðâ.

À ìîæíî ëè ñêà÷àòü ïðîøèâêó?
Èáî ñáîðêó ïðîøèâêè íå îñëèëþ

Ó ìåíÿ òî æå ïðåìèóì, òîëüêî 2 wan ïîðòà íàäî

**owld** · 25-05-2007, 23:38

Âîò òàêàÿ êîíôèãóðàöèÿ ñäåëàíà êàê íà êàðòèíêå:
Èòåðôåéñû ïîäíÿòû ( àäðåñà âñå ñòàòè÷åñêèå , íî ýòî íå âàæíî ) :
Kernel IP routing table:

Code:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.0.1      *               255.255.255.255 UH    0      0        0 ppp0
192.168.1.0     *               255.255.255.0   U     0      0        0 br0
83.167.107.0    *               255.255.255.0   U     0      0        0 vlan2
10.9.247.0      *               255.255.255.0   U     0      0        0 vlan1
77.50.0.0       *               255.255.0.0     U     0      0        0 vlan1
10.0.0.0        *               255.0.0.0       U     0      0        0 vlan1
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         172.16.0.1      0.0.0.0         UG    0      0        0 ppp0

PPP ëèíê ðàáîòàåò ÷åðåç VLAN1.

Âîò iptables :

Code:

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          state INVALID
    7   288 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0          state NEW
    0     0 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0          state NEW
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0          udp spt:67 dpt:68
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp dpt:21
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     all  --  br0    br0     0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0          state INVALID
    0     0 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp flags:0x06/0x02 tcpmss match 1453:65535TCPMSS set 1452
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          state RELATED,ESTABLISHED
    0     0 DROP       all  --  !br0   ppp0    0.0.0.0/0            0.0.0.0/0
    0     0 DROP       all  --  !br0   vlan1   0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0          ctstate DNAT

Chain OUTPUT (policy ACCEPT 4 packets, 261 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain MACS (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain SECURITY (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp flags:0x16/0x02 limit: avg 1/sec burst 5
    0     0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp flags:0x17/0x04 limit: avg 1/sec burst 5
    0     0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0          limit: avg 5/sec burst 5
    0     0 RETURN     icmp --  *      *       0.0.0.0/0            0.0.0.0/0          limit: avg 5/sec burst 5
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logaccept (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0          state NEW LOG flags 7 level 4 prefix `ACCEPT '
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0          state NEW LOG flags 7 level 4 prefix `DROP '
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0

Âîò iptables -t nat:

Code:

Chain PREROUTING (policy ACCEPT 1687 packets, 374K bytes)
 pkts bytes target     prot opt in     out     source               destination
   78 11404 VSERVER    all  --  *      *       0.0.0.0/0            83.167.107.Y
   76  6736 VSERVER    all  --  *      *       0.0.0.0/0            77.50.63.X
  160 11868 VSERVER    all  --  *      *       0.0.0.0/0            10.9.247.Z
    0     0 NETMAP     udp  --  *      *       0.0.0.0/0            77.50.63.X      udp spt:6112 192.168.1.0/24

Chain POSTROUTING (policy ACCEPT 430 packets, 25851 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 NETMAP     udp  --  *      *       192.168.1.0/24       0.0.0.0/0          udp dpt:6112 77.50.63.X/32
  205 11035 MASQUERADE  all  --  *      ppp0   !77.50.63.X         0.0.0.0/0
    0     0 MASQUERADE  all  --  *      vlan2  !83.167.107.Y        0.0.0.0/0
   16   888 MASQUERADE  all  --  *      vlan1  !10.9.247.Z          0.0.0.0/0
    4   530 MASQUERADE  all  --  *      br0     192.168.1.0/24       192.168.1.0/24

Chain OUTPUT (policy ACCEPT 385 packets, 23629 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain VSERVER (3 references)
 pkts bytes target     prot opt in     out     source               destination
   93  5312 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0          tcp dpt:80 to:192.168.1.3:80

Êàê âèäíî èç öåïî÷åê , ïîäíÿò âèðòóàëüíûé web ñåðâåð.
Ïðîáëåìà â òîì, ÷òî äëÿ èíòåðôåéñà ppp0 - ( 77.50.63.X ) âåá ñåðâåð ðàáîòàåò - ÿ ìîãó çàéòè èçâíå íà 80 ïîðò è ïðîáðàñûâàþñü DNAT îì íà âíóòðåííèé 192.168.1.3.
Íà âòîðîì èíòåðôåéñå ( 83.167.107.Y ) âèðòóàëüíûé âåá ñåðâåð ÍÅ ðàáîòàåò.

1) Çàïóñêàåì tcpdump íà èíòåôåéñå âåá ñåðâåðà , ïûòàåìñÿ çàéòè íà 80 ïîðò ( 83.167.107.Y ) - òèøèíà. Ïàêåòîâ íåò.

Íà÷èíàþ ïîî÷åðåäíî âêëþ÷àòü ëîããèðîâàíèå íà öåïî÷êàõ, ïàêåòû óñïå÷íî äîõîäÿò äî öåïî÷êè :

Chain VSERVER (3 references)
pkts bytes target prot opt in out source destination
93 5312 DNAT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.1.3:80

òî,åñòü DNAT ðàáîòàåò.

Ïî÷åìó îíè íå îòïðàâëÿþòñÿ íà br0 ? Íåïîíÿòíî.
Source ó íèõ îñòàåòñÿ ïðåæíèì ( âíåøíèé àäðåñ èç èíòåðíåòà ) à destination èçìåíåí íà 192.168.1.3.
Íà br0 íåò íè÷åãî, ïðîñòî òèøèíà.

ß áû ïîíèìàë, åñëè áû ïåðâûé âõîäÿùèé ïàêåò SYN äîøåë áû äî âíóòðåííåãî ñåðâåðà, è îí áû îòâåòèë, íî ÿ íè÷åãî íå âèæó.

Òåïåðü âíèìàíèå õèíò:
Ìåíÿþ default route â òàáëèöå ìàðøðóòèöàöèè íà VLAN2 è 83.167.107.Y,
âèðòóàëüíûé ñåðâåð íà èíòåðôåéñå VLAN2 íà÷èíàåò ðàáîòàòü, à íà ppp0 - ïåðåñòàåò.

Â ÷åì ïðîáëåìà, êòî ïîäñêàæåò ?

PS - èç ëîêàëüíîé ñåòè ( 10.0.0.0 ) òî ÷òî íà êàðòèíêå îáîçíà÷åíî LOCALNET ïîðòôîðâàðäèíã ðàáîòàåò ïðè ëþáîì äåôîëòíîì ãåéòâåå

**liss555** · 27-05-2007, 08:17

Ñêàæåì òàê ÷àñòè÷íî.
Ó ìåíÿ
vlan1 - ppp0
vlan2 - ppp1
òàê ïðè çàïóñêå èíîãäà ppp1 äîëãî çàïóñêàåòñÿ,
ïðèõîäèòñÿ ðóêàìè çàïóñêàòü ñêðèïò äîáàâëåíèÿ ðîóòîâ + ïðàâèë äëÿ iptables.

**owld** · 01-06-2007, 02:31

êàæåòñÿ ÿ äîêàïàëñÿ â ÷åì ïðîáëåìà.
îêàçûâàåòñÿ, ïî óìîë÷àíèþ â ÿäðå âêëþ÷åí rp_filter. Ýòî èç çà íåãî ïàêåò ïîñëå DNAT äðîïàëñÿ íå ïîïàäàÿ â ðîóòèíãîâûå òàáëèöû.

Ëå÷èòñÿ âîò òàê:
echo "0" > /proc/sys/net/ipv4/conf/all/rp_filter
ãäå íèòü â post-boot

Ïîñëå îòêëþ÷åíèÿ, âñå çàðàáîòàëî êàê è îæèäàëîñü

- SYN ïðèõîäèò íà ñåðâàê, ACK - óëåòàåò ïî äåôîëòíîìó ìàðøðóòó, è TCP ñîåäèíåíèå ÍÅ óñòàíàâëèâàåòñÿ. Êðîìå íàçíà÷åíèÿ âòîðîãî IP äëÿ ñåðâåðà êòî íèòü çíàåò ìåòîäû ðåøåíèÿ ?

äà, íàñòðîèë ïîêà c äâóìÿ àëèàñàìè íà èíòåðôåéñàõ íà ñåðâåðå, âñå ðàáîòàåò. Åñëè èíòåðåñíî , ðàññêàæó êàê

**Avg0n** · 04-06-2008, 15:15

Ñèòóàöèÿ ó ìåíÿ òàêàÿ: åñòü äâà ïðîâàéäåðà (Ethernet è PPPoE) è ìîÿ ìàëåíüêàÿ ëîêàëêà. Âîçìîæíî ëè íàñòðîèòü ðîóòåð òàê, ÷òîáû ÷àñòü êîìïüþòåðîâ èç ëîêàëêè õîäèëà â èíòåðíåò ÷åðåç îäíîãî ïðîâàéäåðà, à îñòàâøèåñÿ - ÷åðåç äðóãîãî è ïðè ýòîì êîìïüþòåðû âèäåëè ðàñøàðåíûå ðåñóðñû äðóã äðóãà âíóòðè ëîêàëêè? È åñëè òàêîå âîçìîæíî, òî êàê ýòî âîïëîòèòü?

Thread: 2 ïðîâàéäåðà ñ ðåçåðâèðîâàíèåì êàíàëà

Thread Tools

Rate This Thread

Display

2 ISP + PPOE + VSERVER íå ðàáîòàåò

2 WAN íà wl500gP

Tags for this Thread

Posting Permissions