☰

配置详细信息

tag-icon • tag-icon linux networking router iptables xen
配置详细信息

我们收到了 Hetzner 网络团队的电子邮件，要求我们不要使用属于子网的虚拟机的 MAC 地址。

我们将Xen服务器主机配置为路由器使用本指南。

在询问了更多详细信息后，Hetzner 支持人员回答说，通常情况下，虚拟机管理程序的网络配置应该只允许数据包使用真实 NIC 的 MAC 地址离开系统。但是，如果您没有发现问题，您可以尝试使用 IPtables 阻止这些传出的数据包。

所以我们的问题是：

如果有人在使用 Hetzner 或其他专用服务器提供商时遇到此类问题。
您是如何解决的？使用 iptables 进行阻止是唯一的方法吗？

谢谢

配置详细信息

主机/路由器配置：

[root@xenserver-custom ~]# cat /etc/sysctl.conf

net.ipv4.ip_forward = 1  
net.ipv6.conf.all.forwarding=1

net.ipv4.conf.default.proxy_arp = 0  

net.ipv4.conf.all.send_redirects = 0  
net.ipv4.conf.default.send_redirects = 0  
net.ipv4.conf.lo.send_redirects = 0  
net.ipv4.conf.xenbr0.send_redirects = 0  

[root@xenserver-custom network-scripts]# ip addr add 85.91.107.177/28 dev xenbr0

[root@xenserver-custom ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether 0c:c4:7a:e7:dc:33  txqueuelen 1000  (Ethernet)
        RX packets 4704816217  bytes 6002063739181 (5.4 TiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 6294828922  bytes 7643975899027 (6.9 TiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1  (Local Loopback)
        RX packets 518545683  bytes 6322784653872 (5.7 TiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 518545683  bytes 6322784653872 (5.7 TiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vifxxxx

.....................

xenbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 115.35.61.184  netmask 255.255.255.192  broadcast 115.35.61.191
        ether 0c:c4:7a:e7:dc:33  txqueuelen 1  (Ethernet)
        RX packets 3070611738  bytes 8670969429554 (7.8 TiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2680055664  bytes 9822630727363 (8.9 TiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@xenserver-enginatics1 sysconfig]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP qlen 1000
    link/ether 0c:c4:7a:e7:dc:33 brd ff:ff:ff:ff:ff:ff
3: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1
    link/ether 72:ab:90:89:cf:cb brd ff:ff:ff:ff:ff:ff
4: xenbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1
    link/ether 0c:c4:7a:e7:dc:33 brd ff:ff:ff:ff:ff:ff
    inet 115.35.61.184/26 brd 115.35.61.191 scope global dynamic xenbr0
       valid_lft 37373sec preferred_lft 37373sec
    inet 85.91.107.177/28 scope global xenbr0
       valid_lft forever preferred_lft forever
31: vif15.0: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
44: vif21.0: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc mq master ovs-system state UP qlen 32
    link/ether fe:ff:ff:ff:ff:ff brd ff:ff:ff:ff:ff:ff
..........

VM 客户机配置

[root@r1213a network-scripts]# cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
TYPE=Ethernet
ONBOOT=yes
NM_CONTROLLED=yes
BOOTPROTO=static
IPADDR=85.91.107.184
PREFIX=28
GATEWAY=85.91.107.177
DNS1=213.133.98.98
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no

[root@r1213a network-scripts]# ifconfig
eth0      Link encap:Ethernet  HWaddr B6:8F:14:74:A6:B6
          inet addr:85.91.107.184  Bcast:85.91.107.191  Mask:255.255.255.240
          inet6 addr: fe80::b48f:14ff:fe74:a6b6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:27122939 errors:0 dropped:2 overruns:0 frame:0
          TX packets:2218911 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5404322465 (5.0 GiB)  TX bytes:1061055301 (1011.9 MiB)

[root@r1213a ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
    link/ether b6:8f:14:74:a6:b6 brd ff:ff:ff:ff:ff:ff
    inet 85.91.107.184/28 brd 85.91.107.191 scope global eth0
    inet6 fe80::b48f:14ff:fe74:a6b6/64 scope link
       valid_lft forever preferred_lft forever

[root@r1213a network-scripts]# ip route
default via 85.91.107.177 dev eth0
85.91.107.176/28 dev eth0  proto kernel  scope link  src 85.91.107.184

[root@r1213a network-scripts]# traceroute google.com
traceroute to google.com (172.217.18.110), 30 hops max, 60 byte packets
 1  xenserver.localdomain (85.91.107.177)  0.081 ms  0.029 ms  0.039 ms
 2  static.129.61.69.159.clients.your-server.de (159.69.61.129)  0.390 ms  0.410 ms  0.370 ms
 3  core22.fsn1.hetzner.com (213.239.245.121)  0.393 ms  0.416 ms  0.424 ms
 4  core0.fra.hetzner.com (213.239.252.33)  5.207 ms  5.184 ms core0.fra.hetzner.com (213.239.252.29)  5.049 ms
 5  72.14.218.94 (72.14.218.94)  5.273 ms  5.249 ms 72.14.218.176 (72.14.218.176)  4.990 ms
 6  108.170.251.193 (108.170.251.193)  5.139 ms *  5.019 ms
 7  209.85.241.75 (209.85.241.75)  5.834 ms 216.239.40.58 (216.239.40.58)  5.092 ms 172.253.64.119 (172.253.64.119)  5.707 ms
 8  108.170.251.144 (108.170.251.144)  15.292 ms zrh04s05-in-f110.1e100.net (172.217.18.110)  4.952 ms  4.903 ms

答案1

我也曾遇到过来自 Hetzner 的这些电子邮件并且找到了解决方案。

在 Hetzner 中，您有两种类型的附加 IP 地址可用于专用服务器：单个 IPv4 和 IPv4 子网。对于每个单个 IP，您都会获得一个 MAC 地址，并且必须在新的 VM 实例的网络接口上使用该 MAC。对于每个附加子网，您必须设置一个新网络，并在该网络和eth0服务器的默认网络（与 关联）之间设置路由。

在 XenServer 中，可以使用 Linux 控制台完成此操作：

xe network-create name-label="Additional network" name-description="46.xx.yy.zz/28"

这将在 XenServer 中创建一个连接到新网桥的新网络（xapi0默认情况下）。然后将网络的第一个可用 IP 地址（根据其网络掩码）分配给该网桥：

ip addr add 46.xx.yy.1/28 dev xapi0

现在，您可以添加具有自动生成 MAC 的新 VM，并将其连接到新创建的网络（而不是默认网络）。流量将在 XenServer 内部进行交换和路由。

经过这样的设置，我得到了 Hetzner 网络团队的确认，只有允许的 MAC 在交换机端口上可见。

相关内容