☰

主要网络接口

tag-icon • tag-icon iptables routing netfilter iptables-redirect
主要网络接口

您好，我有一个以太网网卡接口，带有 4 个附加虚拟接口（故障转移），所有接口均配置为公共 ip4（IP-1 到 IP-5）/网络掩码 255.255.255.255/广播地址与 ip 相同：

  • eth0 -> IP-1
    • eth0:0 -> IP-2
    • eth0:1 -> IP-3
    • eth0:2 -> IP-4
    • eth0:3 -> IP-5

主要网络接口

auto eth0
iface eth0 inet static
    address IP-1
    netmask 255.255.255.255
    broadcast IP-1

    post-up route add ISP-GW dev eth0
    post-up route add default gw ISP-GW
    post-up ip addr add 192.168.100.254/24 dev eth0

    post-down route del ISP-GW dev eth0
    post-down route del default gw ISP-GW
    post-down ip addr del 192.168.100.254/24 dev eth0

故障转移5

auto eth0:3
iface eth0:3 inet static
        address IP-5
        netmask 255.255.255.255
        broadcast IP-5

& 桥接 lxc 使用的本地 IP (IP-B)

auto br0
iface br0 inet static
        network 192.168.100.0
        address 192.168.100.100       # IP-B
        gateway 192.168.100.254       $ IP-GW
        broadcast 192.168.100.255
        netmask 255.255.255.0
        bridge_ports none
        bridge_maxwait 0

测试：

# ping lcx container 
#
    $ ping 192.168.100.1 
    PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
    64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.161 ms
    64 bytes from 192.168.100.1: icmp_seq=2 ttl=64 time=0.075 ms

# ping bridge br0
#
    $ ping 192.168.100.100   
    PING 192.168.100.100 (192.168.100.100) 56(84) bytes of data.
    64 bytes from 192.168.100.100: icmp_seq=1 ttl=64 time=0.113 ms
    64 bytes from 192.168.100.100: icmp_seq=2 ttl=64 time=0.056 ms

# pink gatway / alias eth0 IP-1
#
    $ ping 192.168.100.254
    PING 192.168.100.254 (192.168.100.254) 56(84) bytes of data.
    64 bytes from 192.168.100.254: icmp_seq=1 ttl=64 time=0.048 ms
    64 bytes from 192.168.100.254: icmp_seq=2 ttl=64 time=0.090 ms

我现在想路由来自 eth0 IP5 (eth0:3) <-> br0 IP-B 的流量，并将其他流量保留在 eth0 如何设置 netfilter 规则来实现这一点？

我知道我必须添加

iptables -t nat -A POSTROUTING
iptables -t nat -A PREROUTING

规则类似？

# change public host IP-5 to private IP-B
# 
    $ iptables -t nat -A PREROUTING -d IP-5 -j DNAT --to IP-B
#
# change private IP-B to public IP-5 use SNAT instead of MASQUERADE for static IP
# 
    $ iptables -t nat -A POSTROUTING -s IP-B -j SNAT --to IP-5
#
# force to send reply to gateway where IP-GW = 192.168.100.254/16
#
    $ iptables -t nat -A POSTROUTING -o br0 -s IP-GW -d IP-5 -j SNAT --to IP-B

我还启用了 sysctl 中的转发

  • lxc容器是DEBIAN

    lxc.network.type = veth
lxc.network.name = veth0
lxc.network.flags = up
lxc.network.link = br0
lxc.network.veth.pair = veth0-sid
lxc.network.ipv4 = 192.168.100.1/24
lxc.network.ipv4.gateway = 192.168.100.254

lxc 容器路由

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.100.254 0.0.0.0         UG    0      0        0 veth0
192.168.100.0   *               255.255.255.0   U     0      0        0 veth0

veth0     Link encap:Ethernet  HWaddr xx:xx:xx:xx:xx:xx 
          inet addr:192.168.100.1  Bcast:192.168.100.255  Mask:255.255.255.0

  • 服务器是UBUNTU 15.10

    Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         ISP GW          0.0.0.0         UG    0      0        0 eth0
default         192.168.100.254 0.0.0.0         UG    0      0        0 br0
ISP GW          *               255.255.255.255 UH    0      0        0 eth0
192.168.100.0   *               255.255.255.0   U     0      0        0 br0

当我从 br0 上的外部 tcpdump ping IP-5 时未收到任何 icmp 时，我是否需要添加一些网关或静态路由？我做错了什么？

# on lcx container 
#
    $ apt update 
    Err http://http.debian.net jessie Release.gpg                         
    Could not resolve 'http.debian.net'

     W: Failed to fetch http://http.debian.net/debian/dists/jessie/Release.gpg     
       Could not resolve 'http.debian.net'


# on host :
#
     $ tcpdump -vi br0
     tcpdump: listening on br0, link-type EN10MB (Ethernet), capture size  262144 bytes
     01:54:21.370892 IP (tos 0x0, ttl 64, id 59200, offset 0, flags [DF], proto UDP (17), length 71)
       192.168.100.1.58916 > cdns.ovh.net.domain: 46783+ A? security.debian.org.local. (43)
     01:54:21.371049 IP (tos 0x0, ttl 64, id 59201, offset 0, flags [DF], proto UDP (17), length 71)
       192.168.100.1.58916 > cdns.ovh.net.domain: 65501+ AAAA? security.debian.org.local. (43)

# host ping and  tcpdump 
#
    $ ping 192.168.100.1
    PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
    64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.118 ms

    $ tcpdump -vibr0  
    tcpdump: listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
    02:07:47.168384 IP (tos 0x0, ttl 64, id 24937, offset 0, flags [DF], proto ICMP (1), length 84)
        IP-5 > 192.168.100.1: ICMP echo request, id 5199, seq 1, length 64
    02:07:47.168460 IP (tos 0x0, ttl 64, id 2157, offset 0, flags [none], proto ICMP (1), length 84)
        192.168.100.1 > IP-5: ICMP echo reply, id 5199, seq 1, length 64

    $ ping from outside IP-5  -> tcpdump on br0 no packet captured

创建路由表

# take my nic to world 
#    
     $ ip route add ISP-GW dev eth0 
     $ ip route add default via ISP-GW

     $ ip r
        default via ISP-GW dev eth0 
        ISP-GW dev eth0  scope link 

     $ ping IP-1 from outside  OK!


  # add bridge br0 route via gateway (alias of IP-1 = IP-GW) 
  #
      $ ip route add 192.168.100.100 via 192.168.100.254 

      $ ip r
         default via ISP-GW dev eth0 
         ISP-GW dev eth0  scope link 
         192.168.100.100 via 192.168.100.254 dev eth0

一个大问题？

如果我设置 DNAT 并关闭 br0，我应该从外部接收来自 IP-5 的 icmp 吗？

相关内容