iptables

Alexey Lomazin написал(а) к All в Nov 16 16:19:28 по местному времени:

Нi, All!

Проблема: есть сеть, роутер на линуксе (ubuntu server) и два внешних линка.
Хочется сделать ресурс внутренней сети доступным по обеим внешним линкам.

Сейчас доступен только по ISP1 - догадываюсь, что из-за того, что iptabs ниасиливают раскидать сессию внутри linux7, и обратные пакеты всегда уходят на роутинг по умолчанию.


Копипасты из гугла не проходят - может у кого есть решение похожей проблемы?



Выглядит примерно так:

LAN linux7 router1/router3
[.17.1:24554] ----- [.17.7 .11.7 ]
[ .11.17 eth0 ] ------ [.11.251/ISP1] --- ISP1
[ .11.37 ] [.11.253/ISP2] --- ISP2
Proxy/Firewall
ubuntu server 16.04

.17.1 == 192.168.17.1
.17.7 == 192.168.17.7 и т.п.


Роутеры простейшие, бытовые, прошивки штатные.
На роутерах портфорвардинг:
router1 - 24554 --> 192.168.11.17:24554
router2 - 24554 --> 192.168.11.37:24554


=== /etc/network/interfaces
auto lo
iface lo inet loopback
dns-nameservers 127.0.0.1


# The primary network interface
auto eth0 eth1 eth2

iface eth0 inet static
hostname linux6
address 192.168.11.6
netmask 255.255.255.0
up route add default gw 192.168.11.251 metric 200

up ifconfig eth0:1 192.168.11.16 netmask 255.255.255.0
up ifconfig eth0:3 192.168.11.36 netmask 255.255.255.0

up rm /var/tmp/isp_cur
up rm /var/tmp/isp_force

# к eth0, NWGSM:
up ip route add default via 192.168.11.251 table 101
up ip rule add from 192.168.11.251 table 101 pref 80 fwmark 101
up ip rule add from 192.168.11.16 lookup nwgsm prio 81

# к eth0, ADSL:
up ip route add default via 192.168.11.253 table 103
up ip rule add from 192.168.11.253 table 103 pref 82 fwmark 103
up ip rule add from 192.168.11.36 lookup adsl prio 83

mtu 1388

iface eth1 inet static
address 192.168.17.6
netmask 255.255.248.0

pre-up iptables-restore < /etc/iptables.rules
pre-up modprobe ipnatftp
===


=== /etc/iproute2/rt_tables
101 nwgsm
103 adsl
===

=== /etc/iptables.rules
# Generated by iptables-save v1.4.21 on Fri Nov 21 12:28:19 2014
*mangle
:PREROUTING ACCEPT [65:5834]
:INPUT ACCEPT [13:724]
:FORWARD ACCEPT [24:3538]
:OUTPUT ACCEPT [11:616]
:POSTROUTING ACCEPT [11:2212]
COMMIT
# Completed on Fri Nov 21 12:28:19 2014
# Generated by iptables-save v1.4.21 on Fri Nov 21 12:28:19 2014
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -i eth0 -p tcp -m tcp --dport 24554 -j DNAT --to-destination 192.168.17.1:24554
-A POSTROUTING -o eth0 -j SNAT --to-source 192.168.11.7
COMMIT
# Completed on Fri Nov 21 12:28:19 2014
# Generated by iptables-save v1.4.21 on Fri Nov 21 12:28:19 2014
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:bad_packets - [0:0]
:badtcppackets - [0:0]
:icmp_packets - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:trusted_iface - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -j bad_packets
-A INPUT -d 224.0.0.1/32 -j DROP
-A INPUT -s 192.168.15.0/24 -i eth2 -j ACCEPT
-A INPUT -s 192.168.16.0/21 -i eth1 -j ACCEPT
-A INPUT -s 192.168.15.0/24 -i eth1 -j ACCEPT
-A INPUT -s 192.168.16.0/21 -i eth2 -j ACCEPT
-A INPUT -s 192.168.24.0/24 -i eth1 -j ACCEPT
-A INPUT -s 192.168.24.0/24 -i eth2 -j ACCEPT
-A INPUT -s 192.168.25.0/24 -i eth1 -j ACCEPT
-A INPUT -s 192.168.25.0/24 -i eth2 -j ACCEPT
-A INPUT -d 192.168.15.255/32 -i eth2 -j ACCEPT
-A INPUT -d 192.168.23.255/32 -i eth1 -j ACCEPT
-A INPUT -i eth0 -m state --state RELATED,ESTABLISНED -j ACCEPT
-A INPUT -i eth0 -p tcp -j tcp_inbound
-A INPUT -i eth0 -p udp -j udp_inbound
-A INPUT -i eth0 -p icmp -j icmp_packets
-A INPUT -m pkttype --pkt-type broadcast -j DROP
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "INPUT packet died: " --log-level 7
-A FORWARD -d 192.168.16.0/21 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.15.0/24 -i eth2 -j ACCEPT
-A FORWARD -d 192.168.15.0/24 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.16.0/21 -i eth2 -j ACCEPT
-A FORWARD -d 192.168.24.0/24 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.25.0/24 -i eth1 -j ACCEPT
-A FORWARD -d 192.168.24.0/24 -i eth2 -j ACCEPT
-A FORWARD -d 192.168.25.0/24 -i eth2 -j ACCEPT
-A FORWARD -j bad_packets
-A FORWARD -i eth1 -p tcp -j tcp_outbound
-A FORWARD -i eth2 -p tcp -j tcp_outbound
-A FORWARD -i eth1 -p tcp -j tcp_outbound
-A FORWARD -i eth2 -p tcp -j tcp_outbound
-A FORWARD -i eth1 -p udp -j udp_outbound
-A FORWARD -i eth2 -p udp -j udp_outbound
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISНED -j ACCEPT
-A FORWARD -d 192.168.17.1/32 -p tcp -m tcp --dport 24554 -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "FORWARD packet died: " --log-level 7
-A OUTPUT -p icmp -m state --state INVALID -j LOG --log-prefix "invalid icmp: " --log-level 7
-A OUTPUT -p icmp -m state --state INVALID -j DROP
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 192.168.17.7/32 -j ACCEPT
-A OUTPUT -s 192.168.15.7/32 -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
-A OUTPUT -o eth2 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "OUTPUT packet died: " --log-level 7
-A bad_packets -s 192.168.15.0/24 -i eth0 -j DROP
-A bad_packets -s 192.168.16.0/21 -i eth0 -j DROP
-A bad_packets -m state --state INVALID -j LOG --log-prefix "Invalid packet: " --log-level 7
-A bad_packets -m state --state INVALID -j DROP
-A badpackets -p tcp -j bad_tcppackets
-A bad_packets -j RETURN
-A badtcppackets -i eth1 -p tcp -j RETURN
-A badtcppackets -i eth2 -p tcp -j RETURN
-A badtcppackets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn: " --log-level 7
-A badtcppackets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG NONE -j LOG --log-prefix "Stealth scan: " --log-level 7
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG NONE -j DROP
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG FIN,SYN,RST,PSН,ACK,URG -j LOG --log-prefix "Stealth scan: " --log-level 7
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG FIN,SYN,RST,PSН,ACK,URG -j DROP
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG FIN,PSН,URG -j LOG --log-prefix "Stealth scan: " --log-level 7
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG FIN,PSН,URG -j DROP
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG FIN,SYN,RST,ACK,URG -j LOG --log-prefix "Stealth scan: " --log-level 7
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSН,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A badtcppackets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Stealth scan: " --log-level 7
-A badtcppackets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOG --log-prefix "Stealth scan: " --log-level 7
-A badtcppackets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A badtcppackets -p tcp -j RETURN
-A icmp_packets -p icmp -f -j LOG --log-prefix "ICMP Fragment: " --log-level 7
-A icmp_packets -p icmp -f -j DROP
-A icmp_packets -p icmp -j ACCEPT
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -j RETURN
-A tcp_inbound -p tcp -m tcp --dport 1194 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 22 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 514 -j ACCEPT
-A tcp_inbound -p tcp -j RETURN
-A tcp_outbound -p tcp -j ACCEPT
-A udp_inbound -p udp -m udp --dport 137 -j DROP
-A udp_inbound -p udp -m udp --dport 138 -j DROP
-A udp_inbound -p udp -m udp --dport 1194 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 514 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 1812 -j ACCEPT
-A udp_inbound -p udp -m udp --dport 67 -j ACCEPT
-A udp_inbound -p udp -j RETURN
-A udp_outbound -p udp -j ACCEPT
COMMIT
# Completed on Fri Nov 21 12:28:19 2014
===


Копал в примерно следующем направлении, успеха не добился:
===
$IPT --table mangle --append INPUT --protocol tcp --dport 24554 --match state --state NEW --match mac --mac-source 00:1c:f0:ff:ff:ff --jump MARK --set-mark 101
$IPT --table mangle --append INPUT --protocol tcp --dport 24554 --match state --state NEW --match mac --mac-source 1c:af:f7:ff:ff:ff --jump MARK --set-mark 103

$IPT --table mangle --append INPUT --jump CONNMARK --save-mark
$IPT --table mangle --append INPUT --match state --state ESTABLISНED,RELATED --jump CONNMARK --restore-mark

$IPT -t nat -A PREROUTING -i $INET_IFACE -p TCP --destination-port 24554 -j DNAT --to 192.168.17.1:24554
===



Bye, All!
[Team СПН98] [Team ДМPT] [Team M>]
--- GoldED+/W32-MINGW 1.1.5-b20150715