= Сообщение: 3373 из 8555 ========================================= RU.LINUX =
От : Alexey Lomazin 2:5038/13 02 Nov 16 16:19:28
Кому : All 02 Nov 16 16:19:28
Тема : iptables
FGHI : area://RU.LINUX?msgid=2:5038/13+5819e7e1
= Кодировка сообщения определена как: CP866 ==================================
Ответ: area://RU.LINUX?msgid=2:5020/545+581b1f9f
Ответ: area://RU.LINUX?msgid=2:5037/7+5839cc3a
==============================================================================
Hi, All!
Проблема: есть сеть, роутер на линуксе (ubuntu server) и два внешних линка.
Хочется сделать ресурс внутренней сети доступным по обеим внешним линкам.
Сейчас доступен только по ISP1 - догадываюсь, что из-за того, что iptabs ниасиливают раскидать сессию внутри linux7, и обратные пакеты всегда уходят на роутинг по умолчанию.
Копипасты из гугла не проходят - может у кого есть решение похожей проблемы?
Выглядит примерно так:
LAN linux7 router1/router3
[.17.1:24554] ----- [.17.7 .11.7 ]
[ .11.17 eth0 ] ------ [.11.251/ISP1] --- ISP1
[ .11.37 ] [.11.253/ISP2] --- ISP2
Proxy/Firewall
ubuntu server 16.04
.17.1 == 192.168.17.1
.17.7 == 192.168.17.7 и т.п.
Роутеры простейшие, бытовые, прошивки штатные.
Hа роутерах портфорвардинг:
router1 - 24554 --> 192.168.11.17:24554
router2 - 24554 --> 192.168.11.37:24554
=== /etc/network/interfaces
auto lo
iface lo inet loopback
dns-nameservers 127.0.0.1
# The primary network interface
auto eth0 eth1 eth2
iface eth0 inet static
hostname linux6
address 192.168.11.6
netmask 255.255.255.0
up route add default gw 192.168.11.251 metric 200
up ifconfig eth0:1 192.168.11.16 netmask 255.255.255.0
up ifconfig eth0:3 192.168.11.36 netmask 255.255.255.0
up rm /var/tmp/isp_cur
up rm /var/tmp/isp_force
# к eth0, NWGSM:
up ip route add default via 192.168.11.251 table 101
up ip rule add from 192.168.11.251 table 101 pref 80 fwmark 101
up ip rule add from 192.168.11.16 lookup nwgsm prio 81
# к eth0, ADSL:
up ip route add default via 192.168.11.253 table 103
up ip rule add from 192.168.11.253 table 103 pref 82 fwmark 103
up ip rule add from 192.168.11.36 lookup adsl prio 83
mtu 1388
iface eth1 inet static
address 192.168.17.6
netmask 255.255.248.0
pre-up iptables-restore < /etc/iptables.rules
pre-up modprobe ip_nat_ftp
===
=== /etc/iproute2/rt_tables
101 nwgsm
103 adsl
===
=== /etc/iptables.rules
# Generated by iptables-save v1.4.21 on Fri Nov 21 12:28:19 2014
*mangle
:PREROUTING ACCEPT [65:5834]
:INPUT ACCEPT [13:724]
:FORWARD ACCEPT [24:3538]
:OUTPUT ACCEPT [11:616]
:POSTROUTING ACCEPT [11:2212]
COMMIT
# Completed on Fri Nov 21 12:28:19 2014
# Generated by iptables-save v1.4.21 on Fri Nov 21 12:28:19 2014
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 24554 -j DNAT --to-destination 192.168.17.1:24554
-A POSTROUTING -o eth0 -j SNAT --to-source 192.168.11.7
COMMIT
# Completed on Fri Nov 21 12:28:19 2014
# Generated by iptables-save v1.4.21 on Fri Nov 21 12:28:19 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:bad_packets - [0:0]
:bad_tcp_packets - [0:0]
:icmp_packets - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:trusted_iface - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -j bad_packets
-A INPUT -d 224.0.0.1/32 -j DROP
-A INPUT -s 192.168.15.0/24 -i eth2 -j ACCEPT
-A INPUT -s 192.168.16.0/21 -i eth1 -j ACCEPT
-A INPUT -s 192.168.15.0/24 -i eth1 -j ACCEPT
-A INPUT -s 192.168.16.0/21 -i eth2 -j ACCEPT
-A INPUT -s 192.168.24.0/24 -i eth1 -j ACCEPT
-A INPUT -s 192.168.24.0/24 -i eth2 -j ACCEPT
-A INPUT -s 192.168.25.0/24 -i eth1 -j ACCEPT
-A INPUT -s 192.168.25.0/24 -i eth2 -j ACCEPT
-A INPUT -d 192.168.15.255/32 -i eth2 -j ACCEPT
-A INPUT -d 192.168.23.255/32 -i eth1 -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth0 -p tcp -j tcp_inbound
-A INPUT -i eth0 -p udp -j udp_inbound
-A INPUT -i eth0 -p icmp -j icmp_packets
-A INPUT -m pkttype --pkt-type broadcast -j DROP
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "INPUT packet died: " --log-level 7
-A FORWARD -d 192.168.16.0/21 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.15.0/24 -i eth2 -j ACCEPT
-A FORWARD -d 192.168.15.0/24 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.16.0/21 -i eth2 -j ACCEPT
-A FORWARD -d 192.168.24.0/24 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.25.0/24 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.24.0/24 -i eth2 -j ACCEPT
-A FORWARD -d 192.168.25.0/24 -i eth2 -j ACCEPT
-A FORWARD -j bad_packets
-A FORWARD -i eth1 -p tcp -j tcp_outbound
-A FORWARD -i eth2 -p tcp -j tcp_outbound
-A FORWARD -i eth1 -p tcp -j tcp_outbound
-A FORWARD -i eth2 -p tcp -j tcp_outbound
-A FORWARD -i eth1 -p udp -j udp_outbound
-A FORWARD -i eth2 -p udp -j udp_outbound
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -d 192.168.17.1/32 -p tcp -m tcp --dport 24554 -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "FORWARD packet died: " --log-level 7
-A OUTPUT -p icmp -m state --state INVALID -j LOG --log-prefix "invalid icmp: " --log-level 7
-A OUTPUT -p icmp -m state --state INVALID -j DROP
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 192.168.17.7/32 -j ACCEPT
-A OUTPUT -s 192.168.15.7/32 -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
-A OUTPUT -o eth2 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "OUTPUT packet died: " --log-level 7
-A bad_packets -s 192.168.15.0/24 -i eth0 -j DROP
-A bad_packets -s 192.168.16.0/21 -i eth0 -j DROP
-A bad_packets -m state --state INVALID -j LOG --log-prefix "Invalid packet: " --log-level 7
-A bad_packets -m state --state INVALID -j DROP
-A bad_packets -p tcp -j bad_tcp_packets
-A bad_packets -j RETURN
-A bad_tcp_packets -i eth1 -p tcp -j RETURN
-A bad_tcp_packets -i eth2 -p tcp -j RETURN
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOG --log-prefix "Stealth scan: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOG --log-prefix "Stealth scan: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j LOG --log-prefix "Stealth scan: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j LOG --log-prefix "Stealth scan: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Stealth scan: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOG --log-prefix "Stealth scan: " --log-level 7
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A bad_tcp_packets -p tcp -j RETURN
-A icmp_packets -p icmp -f -j LOG --log-prefix "ICMP Fragment: " --log-level 7
-A icmp_packets -p icmp -f -j DROP
-A icmp_packets -p icmp -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -j RETURN
-A tcp_inbound -p tcp -m tcp --dport 1194 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 514 -j ACCEPT
-A tcp_inbound -p tcp -j RETURN
-A tcp_outbound -p tcp -j ACCEPT
-A udp_inbound -p udp -m udp --dport 137 -j DROP
-A udp_inbound -p udp -m udp --dport 138 -j DROP
-A udp_inbound -p udp -m udp --dport 1194 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 514 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 1812 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 67 -j ACCEPT
-A udp_inbound -p udp -j RETURN
-A udp_outbound -p udp -j ACCEPT
COMMIT
# Completed on Fri Nov 21 12:28:19 2014
===
Копал в примерно следующем направлении, успеха не добился:
===
$IPT --table mangle --append INPUT --protocol tcp --dport 24554 --match state --state NEW --match mac --mac-source 00:1c:f0:ff:ff:ff --jump MARK --set-mark 101
$IPT --table mangle --append INPUT --protocol tcp --dport 24554 --match state --state NEW --match mac --mac-source 1c:af:f7:ff:ff:ff --jump MARK --set-mark 103
$IPT --table mangle --append INPUT --jump CONNMARK --save-mark
$IPT --table mangle --append INPUT --match state --state ESTABLISHED,RELATED --jump CONNMARK --restore-mark
$IPT -t nat -A PREROUTING -i $INET_IFACE -p TCP --destination-port 24554 -j DNAT --to 192.168.17.1:24554
===
Bye, All!
[Team СПН98] [Team ДМPT] [Team M>]
--- GoldED+/W32-MINGW 1.1.5-b20150715
* Origin: жп.вп. расшифровывается как "лицом назад" (2:5038/13)
|
