使用 iptables 和 firejail 沙箱进行端口转发

使用 iptables 和 firejail 沙箱进行端口转发

我尝试在 firejail 沙箱中的端口 8000 上运行 HTTP 服务器,并使其可以在端口 8888 上的主机的所有接口上访问。

整个系统可以表示如下:

+----------------------------------------------------+                                       +-------------+
|                      host-112                      |                                       |  host-238   |
|                                                    |               +-------+               |             |
| +--------------------------+              +-----+  | 192.168.1.112 |       | 192.168.1.238 |   +----+    |
| |       firejail           |              |wlan0+------------------+  NAT  +-------------------+eth0|    |
| |                          |              +-----+  |               |       |               |   +----+    |
| |                          |                       |               +-------+               |             |
| |        +----+   10.0.1.2 |   10.0.1.1  +------+  |                                       |             |
| |        |eth0+--------------------------+my_br0|  |                                       |             |
| |        +----+            |             +------+  |                                       |             |
| |                          |                       |                                       |             |
| |                          |                       |                                       |             |
| |      HTTP server <---------------------------<-------------------------------------------+             |
| |      0.0.0.0:8000        |   HTTP request        |             HTTP request              +-------------+
| |                          |   10.0.1.2:8000       |          192.168.1.112:8888
| |                          |                       |
| +--------------------------+                       |
+----------------------------------------------------+

我使用这些命令来创建桥接口my_br0和 iptables 规则host-112

# Create interface
sysctl -w net.ipv4.ip_forward=1
brctl addbr my_br0
ip addr add 10.0.1.1/24 dev my_br0
ip link set my_br0 up
sysctl -w net.ipv4.conf.my_br0.route_localnet=1

# Add iptables rules
iptables -t nat -A PREROUTING -p tcp --dport 8888 -j DNAT --to-destination 10.0.1.2:8000
iptables -t nat -A OUTPUT -p tcp --dport 8888 -j DNAT --to-destination 10.0.1.2:8000
iptables -t nat -A POSTROUTING -p tcp -o my_br0 -j MASQUERADE
iptables -A FORWARD -i my_br0 -p tcp --dport 8000 -j ACCEPT
iptables -A INPUT -i my_br0 -p tcp --sport 8000 -j ACCEPT

我在 firejail 沙箱中运行 HTTP 服务器,如下所示:

firejail --noprofile --net=my_br0 --ip=10.0.1.2 python3 -m http.server 8000

当我尝试在本地主机上执行请求时,效果很好:

myself@host-112 $ curl 192.168.1.112:8888
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
...

截图wireshark

但它不适用于同一网络上的远程主机:

myself@host-238 $ curl 192.168.1.112:8888
curl: (7) Failed to connect to 192.168.1.112 port 8888: Connection timed out

截图wireshark

看来请求没有很好地转发到桥接口。

以下是 host-112 上 iptables 规则的完整列表:

# iptables -S
-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION-STAGE-1
-N DOCKER-ISOLATION-STAGE-2
-N DOCKER-USER
-A INPUT -i my_br0 -p tcp -m tcp --sport 8000 -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A FORWARD -i my_br0 -p tcp -m tcp --dport 8000 -j ACCEPT
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN

# iptables -S -t nat
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P POSTROUTING ACCEPT
-P OUTPUT ACCEPT
-N DOCKER
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A PREROUTING -p tcp -m tcp --dport 8888 -j DNAT --to-destination 10.0.1.2:8000
-A POSTROUTING -s 172.19.0.0/16 ! -o docker0 -j MASQUERADE
-A POSTROUTING -o my_br0 -p tcp -j MASQUERADE
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -p tcp -m tcp --dport 8888 -j DNAT --to-destination 10.0.1.2:8000
-A DOCKER -i docker0 -j RETURNo

# iptables -S -t mangle
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT

# iptables -S -t raw
-P PREROUTING ACCEPT
-P OUTPUT ACCEPT

# iptables -S -t security
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT

你知道我该怎么做才能让它发挥作用吗?

答案1

我通过更改规则使其发挥作用FORWARD

iptables -A FORWARD -o my_br0 -j ACCEPT
iptables -A FORWARD -i my_br0 -j ACCEPT

完整的命令列表现在是:

# Create interface
sysctl -w net.ipv4.ip_forward=1
brctl addbr my_br0
ip addr add 10.0.1.1/24 dev my_br0
ip link set my_br0 up
sysctl -w net.ipv4.conf.my_br0.route_localnet=1

# Add iptables rules
iptables -t nat -A PREROUTING -p tcp --dport 8888 -j DNAT --to-destination 10.0.1.2:8000
iptables -t nat -A OUTPUT -p tcp --dport 8888 -j DNAT --to-destination 10.0.1.2:8000
iptables -t nat -A POSTROUTING -p tcp -o my_br0 -j MASQUERADE
iptables -A FORWARD -o my_br0 -j ACCEPT
iptables -A FORWARD -i my_br0 -j ACCEPT
iptables -A INPUT -i my_br0 -p tcp --sport 8000 -j ACCEPT

相关内容