Добрый вечер друзья!
В продолжении эпопеи
https://forum.ubuntu.ru/index.php?topic=174614.0Имею домашнюю локалку.
Ядро сети Asus RT-N16.
в нём 5 виланов.
vlan3 - провайдер 1 (порт1)
vlan4 - провайдер 2 (порт2)
vlan5 - гостевая сетка, с контент фильтром
vlan6 - домашняя локалка
vlan7 - subnet4/29 от провайдера 2
[root@wifi root]$ robocfg show
Switch: enabled gigabit
Port 0: 1000FD enabled stp: none vlan: 1 jumbo: off mac: 00:01:6c:ee:49:a9
Port 1: 1000FD enabled stp: none vlan: 1 jumbo: off mac: f4:6d:04:94:c8:1d
Port 2: DOWN enabled stp: none vlan: 1 jumbo: off mac: 00:00:00:00:00:00
Port 3: 100FD enabled stp: none vlan: 3 jumbo: off mac: 00:26:6c:56:9c:fd
Port 4: 100FD enabled stp: none vlan: 4 jumbo: off mac: 64:00:f1:56:5b:10
Port 8: 1000FD enabled stp: none vlan: 1 jumbo: off mac: bc:ae:c5:c4:43:33
VLANs: BCM53115 enabled mac_check mac_hash
1: vlan1: 0 1 2 3 4 8t
2: vlan2: 8t
3: vlan3: 0t 3 8t
4: vlan4: 0t 4 8t
5: vlan5: 0t 1t 8t
6: vlan6: 0t 8t
7: vlan7: 0t 1t 8t
[root@wifi root]$ [root@wifi root]$ ifconfig
br0 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:33
inet addr:192.168.10.2 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::beae:c5ff:fec4:4333/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:215647 errors:0 dropped:0 overruns:0 frame:0
TX packets:5228 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:29765227 (28.3 MiB) TX bytes:444792 (434.3 KiB)
br1 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:34
inet6 addr: fe80::beae:c5ff:fec4:4334/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:11994 errors:0 dropped:0 overruns:0 frame:0
TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2135538 (2.0 MiB) TX bytes:368 (368.0 B)
eth0 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:33
inet6 addr: fe80::beae:c5ff:fec4:4333/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:24726137 errors:0 dropped:0 overruns:0 frame:0
TX packets:9140203 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3580918698 (3.3 GiB) TX bytes:1052856619 (1004.0 MiB)
Interrupt:4 Base address:0x2000
eth1 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:33
inet6 addr: fe80::beae:c5ff:fec4:4333/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2838759 errors:0 dropped:0 overruns:0 frame:8318641
TX packets:5146538 errors:266 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:242581397 (231.3 MiB) TX bytes:1728470504 (1.6 GiB)
Interrupt:3 Base address:0x1000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MULTICAST MTU:16436 Metric:1
RX packets:789 errors:0 dropped:0 overruns:0 frame:0
TX packets:789 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:125810 (122.8 KiB) TX bytes:125810 (122.8 KiB)
vlan1 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:33
inet6 addr: fe80::beae:c5ff:fec4:4333/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2183187 errors:0 dropped:0 overruns:0 frame:0
TX packets:3962876 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:267096792 (254.7 MiB) TX bytes:484049090 (461.6 MiB)
vlan2 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:33
inet6 addr: fe80::beae:c5ff:fec4:4333/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:208063 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:32682878 (31.1 MiB)
vlan5 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:33
inet6 addr: fe80::beae:c5ff:fec4:4333/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:119716 errors:0 dropped:0 overruns:0 frame:0
TX packets:97758 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:128976090 (123.0 MiB) TX bytes:10393427 (9.9 MiB)
vlan6 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:33
inet6 addr: fe80::beae:c5ff:fec4:4333/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8656414 errors:0 dropped:0 overruns:0 frame:0
TX packets:4871501 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1872276078 (1.7 GiB) TX bytes:525730746 (501.3 MiB)
wl0.1 Link encap:Ethernet HWaddr BC:AE:C5:C4:43:34
inet6 addr: fe80::beae:c5ff:fec4:4334/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2838759 errors:0 dropped:0 overruns:0 frame:8318641
TX packets:5146538 errors:266 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:242581397 (231.3 MiB) TX bytes:1728470504 (1.6 GiB)
[root@wifi root]$ brctl show
bridge name bridge id STP enabled interfaces
br0 8000.bcaec5c44333 no vlan1
eth1
vlan2
vlan6
br1 8000.bcaec5c44334 no wl0.1
vlan5
[root@wifi root]$
Linux-маршрутизатор Atom D525, ядро 3.2.1 - самосборное. На базе Ubuntu 10.04.4.
В нем есть некоторый софт, но к IPv6 отношение не имеющий.
/etc/network/interfaces
root@localhost:~# cat /etc/network/interfaces
auto lo eth0 vlan3 vlan4 vlan5 vlan6 vlan7 vlan7:0 nbn tt ul 6to4
iface lo inet loopback
pre-up iptables-restore </etc/iptables.rules
iface eth0 inet manual
iface vlan3 inet static
address 10.113.73.31
netmask 255.255.255.0
hwaddress ether 00:80:48:2d:1e:46
vlan-raw-device eth0
post-up /etc/init.d/bird restart
post-up ip r a 10.112.1.1 via 10.113.73.253 dev $IFACE
post-up ip r a 10.112.2.1 via 10.113.73.253 dev $IFACE
iface vlan4 inet dhcp
hwaddress ether 00:01:6c:ee:49:a9
vlan-raw-device eth0
iface vlan5 inet static
address 192.168.100.1
netmask 255.255.255.224
vlan-raw-device eth0
post-up /usr/sbin/wondershaper $IFACE 4096 4096
iface vlan6 inet static
address 192.168.10.1
netmask 255.255.255.0
vlan-raw-device eth0
iface vlan6 inet6 static
address 2a01:d0:8124::1
netmask 64
iface vlan7 inet static
address 213.141.136.41
netmask 255.255.255.248
vlan-raw-device eth0
iface vlan7 inet6 static
address 2a01:d0:8124:1::1
netmask 64
iface vlan7:0 inet static
address 213.141.136.46
netmask 255.255.255.248
iface nbn inet ppp
provider nbn
iface tt inet ppp
pre-up modprobe pptp
post-down sleep 3 && rmmod pptp
provider tt
iface ul inet ppp
provider ul
iface 6to4 inet6 v4tunnel
up ip l s dev $IFACE mtu 1280
post-up sysctl -p
address 2a01:d0:ffff:124::2
netmask 64
gateway 2a01:d0:ffff:124::1
endpoint 62.205.132.12
local 213.141.136.41
ttl 255
root@localhost:~# Фактическая сетевая конфигурация
root@localhost:~# ifconfig
6to4 Link encap:IPv6-in-IPv4
inet6 addr: fe80::d58d:8829/128 Scope:Link
inet6 addr: 2a01:d0:ffff:124::2/64 Scope:Global
UP POINTOPOINT RUNNING NOARP MTU:1280 Metric:1
RX packets:11583 errors:0 dropped:0 overruns:0 frame:0
TX packets:3695 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1910435 (1.9 MB) TX bytes:400840 (400.8 KB)
eth0 Link encap:Ethernet HWaddr 70:71:bc:d5:37:00
UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1
RX packets:71992242 errors:0 dropped:100 overruns:0 frame:0
TX packets:61136027 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:2659984555 (2.6 GB) TX bytes:631849518 (631.8 MB)
Interrupt:44 Base address:0xc000
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:1874054 errors:0 dropped:0 overruns:0 frame:0
TX packets:1874054 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:272814397 (272.8 MB) TX bytes:272814397 (272.8 MB)
ppp0 Link encap:Point-to-Point Protocol
inet addr:176.195.170.120 P-t-P:212.1.254.115 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1372 Metric:1
RX packets:14782638 errors:0 dropped:0 overruns:0 frame:0
TX packets:14961470 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:3
RX bytes:3768337746 (3.7 GB) TX bytes:1799559541 (1.7 GB)
vlan3 Link encap:Ethernet HWaddr 00:80:48:2d:1e:46
inet addr:10.113.73.31 Bcast:10.113.73.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2761566 errors:0 dropped:21367 overruns:0 frame:0
TX packets:2105688 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:952667126 (952.6 MB) TX bytes:323820953 (323.8 MB)
vlan4 Link encap:Ethernet HWaddr 00:01:6c:ee:49:a9
inet addr:10.16.52.63 Bcast:10.16.127.255 Mask:255.255.128.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:56808497 errors:0 dropped:0 overruns:0 frame:0
TX packets:42100073 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:32962506850 (32.9 GB) TX bytes:20622680146 (20.6 GB)
vlan5 Link encap:Ethernet HWaddr 70:71:bc:d5:37:00
inet addr:192.168.100.1 Bcast:192.168.100.31 Mask:255.255.255.224
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:122692 errors:0 dropped:321 overruns:0 frame:0
TX packets:151769 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:10417931 (10.4 MB) TX bytes:163194005 (163.1 MB)
vlan6 Link encap:Ethernet HWaddr 70:71:bc:d5:37:00
inet addr:192.168.10.1 Bcast:192.168.10.255 Mask:255.255.255.0
inet6 addr: fe80::7271:bcff:fed5:3700/64 Scope:Link
inet6 addr: 2a01:d0:8124::1/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:375885 errors:0 dropped:0 overruns:0 frame:0
TX packets:532765 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:41994420 (41.9 MB) TX bytes:515016049 (515.0 MB)
vlan7 Link encap:Ethernet HWaddr 70:71:bc:d5:37:00
inet addr:213.141.136.41 Bcast:213.141.136.47 Mask:255.255.255.248
inet6 addr: fe80::7271:bcff:fed5:3700/64 Scope:Link
inet6 addr: 2a01:d0:8124:1::1/64 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:2545 errors:0 dropped:0 overruns:0 frame:0
TX packets:40004 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:336049 (336.0 KB) TX bytes:2019233 (2.0 MB)
vlan7:0 Link encap:Ethernet HWaddr 70:71:bc:d5:37:00
inet addr:213.141.136.46 Bcast:213.141.136.47 Mask:255.255.255.248
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
root@localhost:~# Таблица роутинга IPv4, исключая маршруты по RIPv2
root@localhost:~# ip -4 r |grep -v bird
default dev ppp0 scope link src 213.141.136.41
10.16.0.0/17 dev vlan4 proto kernel scope link src 10.16.52.63
10.112.1.1 via 10.113.73.253 dev vlan3
10.112.2.1 via 10.113.73.253 dev vlan3
10.113.73.0/24 dev vlan3 proto kernel scope link src 10.113.73.31
46.72.0.0/15 dev ppp0 scope link
79.111.0.0/16 dev ppp0 scope link
79.120.0.0/17 dev ppp0 scope link
89.20.128.0/19 dev ppp0 scope link
95.220.0.0/15 dev ppp0 scope link
176.192.0.0/14 dev ppp0 scope link
192.168.10.0/24 dev vlan6 proto kernel scope link src 192.168.10.1
192.168.100.0/27 dev vlan5 proto kernel scope link src 192.168.100.1
212.1.224.0/19 dev ppp0 scope link
212.1.254.115 dev ppp0 proto kernel scope link src 176.195.170.120
213.141.128.0/19 dev ppp0 scope link
213.141.136.40/29 dev vlan7 proto kernel scope link src 213.141.136.41
root@localhost:~# Таблица роутинга IPv6
root@localhost:~# ip -6 r
2a01:d0:8124::/64 dev vlan6 proto kernel metric 256
2a01:d0:8124:1::/64 dev vlan7 proto kernel metric 256
2a01:d0:ffff:124::1 dev 6to4 metric 1024 mtu 1280
2a01:d0:ffff:124::/64 via :: dev 6to4 proto kernel metric 256
fe80::/64 dev vlan7 proto kernel metric 256
fe80::/64 dev vlan6 proto kernel metric 256
fe80::/64 via :: dev 6to4 proto kernel metric 256
default via 2a01:d0:ffff:124::1 dev 6to4 metric 1024
root@localhost:~# Правила iptables-save IPv4
root@localhost:~# iptables-save
# Generated by iptables-save v1.4.4 on Sat Feb 18 23:01:22 2012
*filter
:INPUT DROP [15344:1653541]
:FORWARD ACCEPT [950111:491100598]
:OUTPUT ACCEPT [6580464:1300590148]
:BAD - [0:0]
:DDoS - [0:0]
:SSH - [0:0]
-A INPUT -m state --state INVALID -j BAD
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i vlan3 -p udp -m udp --dport 520 -j ACCEPT
-A INPUT -i vlan5 -j ACCEPT
-A INPUT -i vlan6 -j ACCEPT
-A INPUT -i vlan7 -j ACCEPT
-A INPUT ! -i eth0 -p tcp -m multiport --dports 22,80,1411,2411,4111,5190 -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j DDoS
-A INPUT ! -i eth0 -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -j SSH
-A INPUT ! -i eth0 -p tcp -m multiport --dports 6925,43251,43252 -j ACCEPT
-A INPUT ! -i eth0 -p udp -m multiport --dports 43251,43252 -j ACCEPT
-A INPUT -d 10.113.73.31/32 -p tcp -m multiport --dports 22,80,1411,2411,4111,5190 -j ACCEPT
-A INPUT -d 213.141.136.41/32 -p tcp -m multiport --dports 22,80,1411 -j ACCEPT
-A INPUT -d 213.141.136.46/32 -p tcp -m multiport --dports 22,2411,4111 -j ACCEPT
-A FORWARD -m state --state INVALID -j BAD
-A FORWARD -p udp -m udp --dport 53 -j REJECT --reject-with icmp-port-unreachable
-A OUTPUT -m state --state INVALID -j BAD
-A BAD -j DROP
-A DDoS -m recent --set --name ddos --rsource
-A DDoS -m recent --update --seconds 1 --hitcount 15 --name ddos --rsource -j DROP
-A DDoS -j RETURN
-A SSH -m recent --set --name ssh_brute --rsource
-A SSH -m recent --update --seconds 3600 --hitcount 3 --name ssh_brute --rsource -j LOG --log-prefix "SSH Probe: " --log-level 6
-A SSH -m recent --update --seconds 3600 --hitcount 3 --name ssh_brute --rsource -j REJECT --reject-with icmp-port-unreachable
-A SSH -j RETURN
COMMIT
# Completed on Sat Feb 18 23:01:22 2012
# Generated by iptables-save v1.4.4 on Sat Feb 18 23:01:22 2012
*nat
:PREROUTING ACCEPT [173617:23512952]
:INPUT ACCEPT [20131:1149943]
:OUTPUT ACCEPT [90413:6453512]
:POSTROUTING ACCEPT [91197:6499687]
-A PREROUTING ! -i eth0 -p udp -m udp --dport 25500 -j DNAT --to-destination 192.168.10.193:25500
-A PREROUTING ! -i eth0 -p tcp -m tcp --dport 25500 -j DNAT --to-destination 192.168.10.193:25500
-A PREROUTING ! -i eth0 -p tcp -m tcp --dport 26003 -j DNAT --to-destination 192.168.10.172:26003
-A PREROUTING ! -i eth0 -p udp -m udp --dport 26003 -j DNAT --to-destination 192.168.10.172:26003
-A PREROUTING -d 213.141.136.46/32 -p tcp -m multiport --dports 1209,1411,411 -j DNAT --to-destination 213.141.136.46:4111
-A PREROUTING -d 213.141.136.41/32 -p tcp -m multiport --dports 1209,4111,411 -j DNAT --to-destination 213.141.136.41:1411
-A PREROUTING -d 10.113.73.31/32 -p tcp -m multiport --dports 1209,4111,411 -j REDIRECT --to-ports 1411
-A PREROUTING ! -d 192.168.0.0/16 -i vlan5 -p tcp -m multiport --dports 21,25,80,443,8000,8080 -j DNAT --to-destination 192.168.100.1:8081
-A POSTROUTING -s 192.168.10.0/24 -j MASQUERADE
COMMIT
# Completed on Sat Feb 18 23:01:22 2012
# Generated by iptables-save v1.4.4 on Sat Feb 18 23:01:22 2012
*mangle
:PREROUTING ACCEPT [7577945:848860118]
:INPUT ACCEPT [6483300:336993075]
:FORWARD ACCEPT [951539:491160334]
:OUTPUT ACCEPT [6580485:1300592043]
:POSTROUTING ACCEPT [7531309:1791919196]
-A PREROUTING -i vlan6 -j TTL --ttl-inc 1
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat Feb 18 23:01:22 2012
root@localhost:~#
Фактическая конфигурация NAT правил iptables IPv4
root@localhost:~# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 172K packets, 23M bytes)
pkts bytes target prot opt in out source destination
25 4399 DNAT udp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:25500 to:192.168.10.193:25500
1603 80624 DNAT tcp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25500 to:192.168.10.193:25500
27 1372 DNAT tcp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:26003 to:192.168.10.172:26003
0 0 DNAT udp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:26003 to:192.168.10.172:26003
4278 222K DNAT tcp -- * * 0.0.0.0/0 213.141.136.46 multiport dports 1209,1411,411 to:213.141.136.46:4111
6836 351K DNAT tcp -- * * 0.0.0.0/0 213.141.136.41 multiport dports 1209,4111,411 to:213.141.136.41:1411
753 40109 REDIRECT tcp -- * * 0.0.0.0/0 10.113.73.31 multiport dports 1209,4111,411 redir ports 1411
1274 65584 DNAT tcp -- vlan5 * 0.0.0.0/0 !192.168.0.0/16 multiport dports 21,25,80,443,8000,8080 to:192.168.100.1:8081
Chain INPUT (policy ACCEPT 20008 packets, 1144K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 88813 packets, 6337K bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 89592 packets, 6383K bytes)
pkts bytes target prot opt in out source destination
8819 763K MASQUERADE all -- * * 192.168.10.0/24 0.0.0.0/0
root@localhost:~#Фактическая конфигурация FILTER правил iptables IPv4
root@localhost:~# iptables -nvL
Chain INPUT (policy DROP 15051 packets, 1626K bytes)
pkts bytes target prot opt in out source destination
680 79133 BAD all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
6308K 323M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701
85 4322 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
76952 5549K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
5435 2482K ACCEPT udp -- vlan3 * 0.0.0.0/0 0.0.0.0/0 udp dpt:520
1644 111K ACCEPT all -- vlan5 * 0.0.0.0/0 0.0.0.0/0
7516 547K ACCEPT all -- vlan6 * 0.0.0.0/0 0.0.0.0/0
118 24814 ACCEPT all -- vlan7 * 0.0.0.0/0 0.0.0.0/0
12926 689K DDoS tcp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 multiport dports 22,80,1411,2411,4111,5190 tcp flags:0x17/0x02
2527 151K SSH tcp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 flags:0x17/0x02
1400 70016 ACCEPT tcp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 multiport dports 6925,43251,43252
0 0 ACCEPT udp -- !eth0 * 0.0.0.0/0 0.0.0.0/0 multiport dports 43251,43252
257 14737 ACCEPT tcp -- * * 0.0.0.0/0 10.113.73.31 multiport dports 22,80,1411,2411,4111,5190
2120 114K ACCEPT tcp -- * * 0.0.0.0/0 213.141.136.41 multiport dports 22,80,1411
7958 408K ACCEPT tcp -- * * 0.0.0.0/0 213.141.136.46 multiport dports 22,2411,4111
Chain FORWARD (policy ACCEPT 950K packets, 491M bytes)
pkts bytes target prot opt in out source destination
1412 58708 BAD all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
16 1028 REJECT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 reject-with icmp-port-unreachable
Chain OUTPUT (policy ACCEPT 6528K packets, 1293M bytes)
pkts bytes target prot opt in out source destination
11 503 BAD all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
Chain BAD (3 references)
pkts bytes target prot opt in out source destination
2103 138K DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DDoS (1 references)
pkts bytes target prot opt in out source destination
12926 689K all -- * * 0.0.0.0/0 0.0.0.0/0 recent: SET name: ddos side: source
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 recent: UPDATE seconds: 1 hit_count: 15 name: ddos side: source
12926 689K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain SSH (1 references)
pkts bytes target prot opt in out source destination
2527 151K all -- * * 0.0.0.0/0 0.0.0.0/0 recent: SET name: ssh_brute side: source
2516 151K LOG all -- * * 0.0.0.0/0 0.0.0.0/0 recent: UPDATE seconds: 3600 hit_count: 3 name: ssh_brute side: source LOG flags 0 level 6 prefix `SSH Probe: '
2516 151K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 recent: UPDATE seconds: 3600 hit_count: 3 name: ssh_brute side: source reject-with icmp-port-unreachable
11 552 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
root@localhost:~# Правила и фиктическая конфигурация ip6tables
root@localhost:~# ip6tables-save
# Generated by ip6tables-save v1.4.4 on Sat Feb 18 22:58:46 2012
*mangle
:PREROUTING ACCEPT [1554795:671033078]
:INPUT ACCEPT [46920:8884958]
:FORWARD ACCEPT [1449434:648907293]
:OUTPUT ACCEPT [265251:25010546]
:POSTROUTING ACCEPT [1716220:674101943]
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Sat Feb 18 22:58:46 2012
# Generated by ip6tables-save v1.4.4 on Sat Feb 18 22:58:46 2012
*filter
:INPUT ACCEPT [47662:9358511]
:FORWARD ACCEPT [1453712:649177968]
:OUTPUT ACCEPT [268196:25260923]
COMMIT
# Completed on Sat Feb 18 22:58:46 2012
root@localhost:~# ip6tables -t mangle -nvL
Chain PREROUTING (policy ACCEPT 1555K packets, 671M bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 46922 packets, 8885K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 1450K packets, 649M bytes)
pkts bytes target prot opt in out source destination
195K 14M TCPMSS tcp * * ::/0 ::/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU
Chain OUTPUT (policy ACCEPT 265K packets, 25M bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 1716K packets, 674M bytes)
pkts bytes target prot opt in out source destination
root@localhost:~# ip6tables -nvL
Chain INPUT (policy ACCEPT 47664 packets, 9359K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 1454K packets, 649M bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 268K packets, 25M bytes)
pkts bytes target prot opt in out source destination
root@localhost:~# Конфигурация radvd
root@localhost:~# cat /etc/radvd.conf |egrep -v '^#|^$'
interface vlan6 {
AdvSendAdvert on;
prefix 2a01:d0:8124::/64 {
AdvOnLink on;
AdvAutonomous on;
};
RDNSS 2a01:d0:8124::1 {
};
};
interface vlan7 {
AdvSendAdvert on;
prefix 2a01:d0:8124:1::/64 {
AdvOnLink on;
AdvAutonomous on;
};
RDNSS 2a01:d0:8124::1 {
};
};
В качестве TFTP, DNS и DHCP - dnsmasq. Т.к dhcp-сервер и tftp в нём не умеет IPv6, показывать посчитал ненужным. Впрочем, настройки тривиальные.
Столкнулся со следущей проблемой:
В Linux отклично открываются все хосты IPv6, нет проблем. Есть ноут под W7, который ведёт себя оч странно. IPv6 там живёт своей жизнью, хочет, может открыть хост, хочет, не откроет - закономерности нет.
Под спойлером я упомянул TFTP. Так вот, я имею возможность загрузится с ноутбука по сети (PXE), с дистрибутивом Ubuntu 10.04.3 в Live mode.
В этом варианте загрузки страницы отлично открываются, т. е проблема не железная.
Что пробовал:
Менять mtu на интерфейсе. Переустанавливал протокол IPv6
Если кто-нибудь сталкивался с аналогичной ситуацией, или увидел ошибку в конфигурации, которая может повлиять на работу IPv6, прошу совета.
В виндузятный форум не стал писать, там наверняка не поймут таких конфигов.Продублировал. Актуально.
Пользователь решил продолжить мысль 19 Февраля 2012, 21:54:04:
Выяснил. W7 самовольно дописывает несуществующий шлюз. Далее на другом форуме.
Пользователь решил продолжить мысль 19 Февраля 2012, 22:12:09:
Решено. W7 почему то цеплял не только DG на маршрутизаторе, но и на мосте br0 Asus'a. Отцепил от Asus IPv6. Заработало.
Тема: [Решено] Странности IPv6. Windows must die. (Прочитано 1819 раз)
