一文详解Linux netfilter与VRF及其总结


本文摘自PHP中文网,作者藏色散人,侵删。

实验环境如下图所示:
e17dc4c8a80b12e1ef3bba4619548e2.png

配置如下:

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

#!/bin/bash

sudo ip netns add ns1

sudo ip link add ns1veth1 type veth peer name eth0 netns ns1

sudo ip netns add ns2

sudo ip link add ns2veth1 type veth peer name eth0 netns ns2

sudo ip link set ns1veth1 master vrftest

sudo ip link set ns2veth1 master vrftest

sudo ip link set ns2veth1 up

sudo ip link set ns1veth1 up

sudo ip addr add 1.1.1.254/24 dev ns1veth1

sudo ip addr add 2.2.2.254/24 dev ns2veth1

sudo ip netns exec ns2 ip addr add 2.2.2.1/24 dev eth0

sudo ip netns exec ns1 ip addr add 1.1.1.1/24 dev eth0

sudo ip netns exec ns1 ip link set eth0 up

sudo ip netns exec ns1 ip link set lo up

sudo ip netns exec ns1 ip route add default via 1.1.1.254 dev eth0

sudo ip netns exec ns2 ip link set eth0 up

sudo ip netns exec ns2 ip link set lo up

sudo ip netns exec ns2 ip route add default via 2.2.2.254 dev eth0

sudo iptables -t mangle -A PREROUTING   -s 1.1.1.1 -j LOG --log-prefix="vrf-test-prerouting"

sudo iptables -t mangle -A FORWARD      -s 1.1.1.1 -j LOG --log-prefix="vrf-test-forward"

sudo iptables -t mangle -A POSTROUTING  -s 1.1.1.1 -j LOG --log-prefix="vrf-test-postrouting"

sudo iptables -t mangle -A PREROUTING   -d 1.1.1.1 -j LOG --log-prefix="vrf-test-prerouting"

sudo iptables -t mangle -A FORWARD      -d 1.1.1.1 -j LOG --log-prefix="vrf-test-forward"

sudo iptables -t mangle -A POSTROUTING  -d 1.1.1.1 -j LOG --log-prefix="vrf-test-postrouting"

sudo iptables -t mangle -A INPUT        -d 1.1.1.1 -j LOG --log-prefix="vrf-test-localin"

sudo iptables -t mangle -A INPUT        -s 1.1.1.1 -j LOG --log-prefix="vrf-test-localin"

sudo iptables -t mangle -A OUTPUT       -s 1.1.1.1 -j LOG --log-prefix="vrf-test-localout"

sudo iptables -t mangle -A OUTPUT       -d 1.1.1.1 -j LOG --log-prefix="vrf-test-localout"

外网访问本机

ns1 ping 网关1.1.1.254

1

2

3

4

5

6

7

8

admin@ubuntu:~$ sudo ip netns exec ns1 ping 1.1.1.254 -c 1      

PING 1.1.1.254 (1.1.1.254) 56(84) bytes of data.

64 bytes from 1.1.1.254: icmp_seq=1 ttl=64 time=0.064 ms

 

--- 1.1.1.254 ping statistics ---

1 packets transmitted, 1 received, 0% packet loss, time 0ms

rtt min/avg/max/mdev = 0.064/0.064/0.064/0.000 ms

admin@ubuntu:~$

查看log

1

2

3

4

5

6

7

Nov 20 20:34:10 ubuntu kernel: [180403.527204] vrf-test-preroutingIN=ns1veth1 OUT= MAC=b2:f8:2a:13:31:75:6e:17:d5:b2:55:14:08:00 SRC=1.1.1.1 DST=1.1.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=32492 DF PROTO=ICMP TYPE=8 CODE=0 ID=33955 SEQ=1

Nov 20 20:34:10 ubuntu kernel: [180403.527213] vrf-test-preroutingIN=vrftest OUT= MAC=b2:f8:2a:13:31:75:6e:17:d5:b2:55:14:08:00 SRC=1.1.1.1 DST=1.1.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=32492 DF PROTO=ICMP TYPE=8 CODE=0 ID=33955 SEQ=1

Nov 20 20:34:10 ubuntu kernel: [180403.527220] vrf-test-localinIN=vrftest OUT= MAC=b2:f8:2a:13:31:75:6e:17:d5:b2:55:14:08:00 SRC=1.1.1.1 DST=1.1.1.254 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=32492 DF PROTO=ICMP TYPE=8 CODE=0 ID=33955 SEQ=1

Nov 20 20:34:10 ubuntu kernel: [180403.527231] vrf-test-localoutIN= OUT=vrftest SRC=1.1.1.254 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=54845 PROTO=ICMP TYPE=0 CODE=0 ID=33955 SEQ=1

Nov 20 20:34:10 ubuntu kernel: [180403.527233] vrf-test-postroutingIN= OUT=vrftest SRC=1.1.1.254 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=54845 PROTO=ICMP TYPE=0 CODE=0 ID=33955 SEQ=1

Nov 20 20:34:10 ubuntu kernel: [180403.527235] vrf-test-localoutIN= OUT=ns1veth1 SRC=1.1.1.254 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=54845 PROTO=ICMP TYPE=0 CODE=0 ID=33955 SEQ=1

Nov 20 20:34:10 ubuntu kernel: [180403.527242] vrf-test-postroutingIN= OUT=ns1veth1 SRC=1.1.1.254 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=54845 PROTO=ICMP TYPE=0 CODE=0 ID=33955 SEQ=1

从log可以看出:

请求报文经过的hook点顺序如下:

序号hook点输入接口输出接口
1PREROUTINGns1veth1
2PREROUTINGvrftest
3INPUTvrftest

应答报文经过的hook点顺序如下:

序号hook点输入接口输出接口
1OUTPUTvrftest
2POSTROUTINGvrftest
3OUTPUTns1veth1
4POSTROUTINGns1veth1

转发报文

ns1 ping ns2

1

2

3

4

5

6

7

8

admin@ubuntu:~$ sudo ip netns exec ns1 ping 2.2.2.1 -c 1

PING 2.2.2.1 (2.2.2.1) 56(84) bytes of data.

64 bytes from 2.2.2.1: icmp_seq=1 ttl=63 time=0.063 ms

 

--- 2.2.2.1 ping statistics ---

1 packets transmitted, 1 received, 0% packet loss, time 0ms

rtt min/avg/max/mdev = 0.063/0.063/0.063/0.000 ms

admin@ubuntu:~$

查看log

1

2

3

4

5

6

7

8

Nov 20 20:28:31 ubuntu kernel: [180065.076713] vrf-test-preroutingIN=ns1veth1 OUT= MAC=b2:f8:2a:13:31:75:6e:17:d5:b2:55:14:08:00 SRC=1.1.1.1 DST=2.2.2.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=38312 DF PROTO=ICMP TYPE=8 CODE=0 ID=33948 SEQ=1

Nov 20 20:28:31 ubuntu kernel: [180065.076722] vrf-test-preroutingIN=vrftest OUT= MAC=b2:f8:2a:13:31:75:6e:17:d5:b2:55:14:08:00 SRC=1.1.1.1 DST=2.2.2.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=38312 DF PROTO=ICMP TYPE=8 CODE=0 ID=33948 SEQ=1

Nov 20 20:28:31 ubuntu kernel: [180065.076730] vrf-test-forwardIN=vrftest OUT=ns2veth1 MAC=b2:f8:2a:13:31:75:6e:17:d5:b2:55:14:08:00 SRC=1.1.1.1 DST=2.2.2.1 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=38312 DF PROTO=ICMP TYPE=8 CODE=0 ID=33948 SEQ=1

Nov 20 20:28:31 ubuntu kernel: [180065.076732] vrf-test-postroutingIN= OUT=ns2veth1 SRC=1.1.1.1 DST=2.2.2.1 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=38312 DF PROTO=ICMP TYPE=8 CODE=0 ID=33948 SEQ=1

Nov 20 20:28:31 ubuntu kernel: [180065.076746] vrf-test-preroutingIN=ns2veth1 OUT= MAC=02:25:0e:fe:52:35:ba:19:4d:37:ac:8b:08:00 SRC=2.2.2.1 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=47601 PROTO=ICMP TYPE=0 CODE=0 ID=33948 SEQ=1

Nov 20 20:28:31 ubuntu kernel: [180065.076749] vrf-test-preroutingIN=vrftest OUT= MAC=02:25:0e:fe:52:35:ba:19:4d:37:ac:8b:08:00 SRC=2.2.2.1 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=47601 PROTO=ICMP TYPE=0 CODE=0 ID=33948 SEQ=1

Nov 20 20:28:31 ubuntu kernel: [180065.076752] vrf-test-forwardIN=vrftest OUT=ns1veth1 MAC=02:25:0e:fe:52:35:ba:19:4d:37:ac:8b:08:00 SRC=2.2.2.1 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=47601 PROTO=ICMP TYPE=0 CODE=0 ID=33948 SEQ=1

Nov 20 20:28:31 ubuntu kernel: [180065.076753] vrf-test-postroutingIN= OUT=ns1veth1 SRC=2.2.2.1 DST=1.1.1.1 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=47601 PROTO=ICMP TYPE=0 CODE=0 ID=33948 SEQ=1

从log可以看出:

阅读剩余部分

相关阅读 >>

详解centos7防火墙设置

Linux实现开机启动程序或脚本的详解

Linux如何远程连接其他Linux

Linux下如何移动文件到指定目录

Linux安装软件命令是什么

Linux云计算可以做什么

Linux解压gz文件的命令是什么

Linux进程杀不掉

如何理解独立云磁盘和可用区faq的区别

mac和Linux区别

更多相关阅读请进入《Linux》频道 >>



打赏

取消

感谢您的支持,我会继续努力的!

扫码支持
扫码打赏,您说多少就多少

打开支付宝扫一扫,即可进行扫码打赏哦

分享从这里开始,精彩与您同在

评论

管理员已关闭评论功能...