Jump to content
Калькуляторы

Mistike NAT in Linux "Дырявый NAT"

Reply to this topic

stechkh   

stechkh
Posted

Имеется XEN под Debian и виртуальные машины Centos. В каждой машине поднят GRE туннель через которые работают удаленные клиенты с адресами из сети 192.168.63/24. В виртуальной машине есть правила iptables

# iptables -t nat -nvL

Chain PREROUTING (policy ACCEPT 4350 packets, 272K bytes)

pkts bytes target prot opt in out source destination

 

Chain POSTROUTING (policy ACCEPT 1646 packets, 105K bytes)

pkts bytes target prot opt in out source destination

2461 123K MASQUERADE all -- * * 192.168.63.0/24 0.0.0.0/0

0 0 DROP all -- * eth0 192.168.63.0/24 0.0.0.0/0

 

Chain OUTPUT (policy ACCEPT 1780 packets, 116K bytes)

pkts bytes target prot opt in out source destination

 

Тем не менее на интерфейсе eth0 иногда появляются "непроначенные" пакеты

 

[root@desk-205 ~]# tcpdump -e -vv -n -i eth0 src net 192.168.63.0/24
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
12:39:21.340984 00:16:36:54:95:10 > 10:bf:48:d7:f2:9e, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 126, id 4482, offset 0, flags [DF], proto: TCP (6), length: 40) 192.168.63.205.cvc > 54.240.162.56.http: R, cksum 0x8f73 (correct), 571202517:571202517(0) ack 1376055474 win 0
12:39:21.345733 00:16:36:54:95:10 > 10:bf:48:d7:f2:9e, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 126, id 4484, offset 0, flags [DF], proto: TCP (6), length: 40) 192.168.63.205.cma > 23.51.112.143.http: R, cksum 0x091b (correct), 2383671785:2383671785(0) ack 2045059121 win 0

 

Они же есть на мастере на xenbr0

# tcpdump -e -vv -n -i xenbr0 src net 192.168.63.192/27
tcpdump: listening on xenbr0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:39:21.824974 00:16:36:54:95:10 > 10:bf:48:d7:f2:9e, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 126, id 4482, offset 0, flags [DF], proto TCP (6), length 40)
   192.168.63.205.1495 > 54.240.162.56.80: Flags [R.], cksum 0x8f73 (correct), seq 571202517, ack 1376055474, win 0, length 0
13:39:21.830062 00:16:36:54:95:10 > 10:bf:48:d7:f2:9e, ethertype IPv4 (0x0800), length 54: (tos 0x0, ttl 126, id 4484, offset 0, flags [DF], proto TCP (6), length 40)
   192.168.63.205.1050 > 23.51.112.143.80: Flags [R.], cksum 0x091b (correct), seq 2383671785, ack 2045059121, win 0, length 0

 

Можно ли как-то подавить этот трафик?

Share this post

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
Followers 0
Go to topic listing Программное обеспечение, биллинг и *unix системы