在 AWS VPC 中看不到来自内部 -> 外部防火墙的数据包

2024-5-29 • tag-icon

我正在设置一个带有外部/内部防火墙的 AWS VPC，以保护 DMZ 中的主机（对于 Internet->DMZ 和 DMZ->Internet 流量）和本地网络上的主机（对于 DMZ->本地、本地->DMZ），以及本地->互联网流量）。由于 OpenBSD 现在有 Xen 驱动程序，因此我创建了两个 OpenBSD 6.1 VM，并根据下图对其进行配置。外部防火墙vegeta可以与互联网正常通信。然而，内部防火墙，布尔玛不能。

如果我在 bulma 上并执行以下操作：

$ telnet 50.194.72.148 80

然后我希望看到 vegeta:xnf3 上的数据包，这是 bulma 的默认路由，但我没有。我可以从 bulma ssh 到 vegeta ，所以数据包正在通过。而且，我的 pf 防火墙规则即使默认情况下阻止所有内容，也会允许流量并记录所有其他故障。但是，pf 没有表现出任何值得注意的失败。我是否只是缺少一些 AWS 配置才能使其正常工作？

bulma 上的路由表：

bulma# route -n show -inet
Routing tables

Internet:
Destination        Gateway            Flags   Refs      Use   Mtu  Prio Iface
default            192.168.15.238     UGS        0      209     -     8 xnf0 
224/4              127.0.0.1          URS        0        0 32768     8 lo0  
127/8              127.0.0.1          UGRS       0        0 32768     8 lo0  
127.0.0.1          127.0.0.1          UHhl       1       22 32768     1 lo0  
192.168.15.0/28    192.168.15.14      UCn        2        0     -     4 xnf1 
192.168.15.1       0a:8f:0f:99:77:46  UHLc       0     5668     -     3 xnf1 
192.168.15.2       0a:8f:0f:99:77:46  UHLc       0        3     -     3 xnf1 
192.168.15.14      0a:cb:41:73:83:ca  UHLl       0     6052     -     1 xnf1 
192.168.15.15      192.168.15.14      UHb        0        0     -     1 xnf1 
192.168.15.224/28  192.168.15.228     UCn        2        0     -     4 xnf0 
192.168.15.225     0a:28:c7:f3:88:0c  UHLc       0     5671     -     3 xnf0 
192.168.15.228     0a:15:e5:12:a4:28  UHLl       0     5806     -     1 xnf0 
192.168.15.238     0a:c4:41:0e:06:74  UHLch      5      113     -     3 xnf0 
192.168.15.239     192.168.15.228     UHb        0        0     -     1 xnf0

bulma 上的 /etc/pf.conf：

dmz_if = "xnf0"
int_if = "xnf1"

icmp_types = "{ echoreq, unreach }"

table <aws_nets> const { 192.168.15.0/24 }

set block-policy return
set skip on lo

block log all
block in quick inet6 all

# Allow ping and path MTU discovery
pass  in log inet proto icmp all icmp-type $icmp_types keep state
pass out log on $dmz_if inet proto { udp, icmp } all keep state

# Allow anything on the NAT interface
pass  in log on $dmz_if inet from <aws_nets> to any
pass out log on $dmz_if inet from $dmz_if:network to any

# Allow anything on the internal interface
pass out log on $int_if inet from $int_if:network to any

# Nat
match out log on $dmz_if inet from $int_if:network to any \
  nat-to ($dmz_if:0)
pass out log on $dmz_if from any to any

# Allow ssh
pass  in log on $dmz_if inet proto tcp from $dmz_if:network to \
  $dmz_if:0 port = ssh
pass out log on $dmz_if inet proto tcp from $dmz_if:network to \
  $dmz_if:network port = ssh

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

vegeta 上的 /etc/pf.conf：

ext_if = "xnf0"
dmz_if = "xnf3"

icmp_types = "{ echoreq, unreach }"

table <aws_nets> const { 192.168.15.192/28, 192.168.15.208/28, \
                         192.168.15.224/28 }

set block-policy return
set skip on lo

block log all
block in quick inet6 all

# Allow ping and path MTU discovery
pass  in log inet proto icmp all icmp-type $icmp_types keep state
pass out log on $ext_if inet proto { udp, icmp } all keep state

# Allow anything on the NAT interface
pass  in log on $dmz_if inet from <aws_nets> to any

# Nat
match out log on $ext_if inet from $dmz_if:network to any \
  nat-to ($ext_if:0)
pass out log on $ext_if from any to any

# Allow ssh
pass  in log on $ext_if inet proto tcp from any to \
  any port = ssh
pass  in log on $dmz_if inet proto tcp from any to \
  any port = ssh
pass out log on $dmz_if inet proto tcp from $dmz_if:network to \
  $dmz_if:network port = ssh

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

答案1

好吧，这完全取决于您观看数据包的接口。 pf 在 xnf0 上运行，并将来自 nat 的所有数据包视为仅来自 xnf3。尝试在 vegeta 上的 xnf3 上运行 iftop 监视器，再次进行测试，看看会发生什么。

# pkg_add -v iftop
# iftop -i xnf3

另请检查您在 bluma 上的路线：

# netstat -rn -f inet

确保您的默认网关设置为 192.168.15.238

答案1

相关内容