OpenForum RSS: iptables+vpn+routing

iptables+vpn+routing (millionaire_kg)

Fri, 11 Apr 2014 13:15:44 GMT

>>> � �� openvpn � �� ip
>>> � �� , �� .
>> ��-� �� ip ��
>> � �� iptables �� ip?
> �� , � ��
> � �� ip , �� snat ��
> �� .
> �� ip

��, �� 2 �� .

iptables+vpn+routing (reader)

Thu, 03 Apr 2014 13:47:01 GMT

>> � �� openvpn � �� ip
>> � �� , �� .
> ��-� �� ip ��
> � �� iptables �� ip?

�� , � �� ip , �� snat �� .
�� ip

iptables+vpn+routing (millionaire_kg)

Thu, 03 Apr 2014 13:39:41 GMT

> � �� openvpn � �� ip
> � �� , �� .

��-� �� ip �� iptables �� ip?

iptables+vpn+routing (reader)

Thu, 03 Apr 2014 13:27:37 GMT

>[�� ]
>> �� ip ��
>>> 16:31:26.106524 IP 192.168.1.33.40451 > xxx.xxx.xxx.xxx.1195: UDP, length 61
>>> 16:31:40.084715 IP 192.168.1.33.40444 > xxx.xxx.xxx.xxx.1194: UDP, length 61
>>> 16:31:50.199419 IP xxx.xxx.xxx.xxx.1194 > 192.168.1.33.40444: UDP, length 61
>>> 16:31:52.104762 IP xxx.xxx.xxx.xxx.1195 > 192.168.1.33.40451: UDP, length 61
>>> 16:31:56.302011 IP 192.168.1.33.40451 > xxx.xxx.xxx.xxx.1195: UDP, length 61
> ��, �� , �� TCP ��
> �� UDP. � ��
> ��, �� . �� 1194
> � 1195 �� .

Apr 1 16:28:09 gwital kernel: [ 3010.330899] udp 1195 CONNMARK 2IN= OUT=eth2 SRC=192.168.1.33 DST=xxx.xxx.xxx.xxx LEN=70 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=57522 DPT=1195 LEN=50 MARK=0x4ab

�� 192.168.1.33

��
iptables -t nat -A POSTROUTING -p u

iptables+vpn+routing (millionaire_kg)

Thu, 03 Apr 2014 12:34:03 GMT

>[�� ]
> �� 192.168.1.33, �� 192.168.1.33, snat ��
> ��.
> �� ?
> �� TCP.
> �� ip ��
>> 16:31:26.106524 IP 192.168.1.33.40451 > xxx.xxx.xxx.xxx.1195: UDP, length 61
>> 16:31:40.084715 IP 192.168.1.33.40444 > xxx.xxx.xxx.xxx.1194: UDP, length 61
>> 16:31:50.199419 IP xxx.xxx.xxx.xxx.1194 > 192.168.1.33.40444: UDP, length 61
>> 16:31:52.104762 IP xxx.xxx.xxx.xxx.1195 > 192.168.1.33.40451: UDP, length 61
>> 16:31:56.302011 IP 192.168.1.33.40451 > xxx.xxx.xxx.xxx.1195: UDP, length 61

��, �� , �� TCP �� UDP. � �� , �� . �� 1194 � 1195 �� .

iptables+vpn+routing (reader)

Thu, 03 Apr 2014 09:23:39 GMT

>[�� ]
> �� eth2
>> ip -4 route list table main
> ��
> default via ip-��1 dev eth1
> default via ip-��2 dev eth2
>> ip -4 route list table all
> ��
>> ��
>> ip -4 -s route list table cache
> tcpdump -n -i eth1 host xxx.xxx.xxx.xxx

�� vpn?
> tcpdump -n -i eth1 host xxx.xxx.xxx.xxx
> tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
> listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes
> 16:31:10.258122 IP 192.168.1.33.40444 > xxx.xxx.xxx.xxx.1194: UDP, length 61
> 16:31:20.746341 IP xxx.xxx.xxx.xxx.1194 > 192.168.1.33.40444: UDP, length 61
> 16:31:21.990280 IP xxx.xxx.xxx.xxx.1195 > 192.168.1.33.40451: UDP, length 61

�� , � �� ?
�� 192.168.1.33, �� 192.168.1.33, snat �� .

�� ?
�� TCP.
��

iptables+vpn+routing (millionaire_kg)

Thu, 03 Apr 2014 06:23:00 GMT

> ip -4 rule

0: from all lookup local
32764: from all fwmark 0x4ab lookup vpn1195.out
32765: from all fwmark 0x4aa lookup vpn1194.out
32766: from all lookup main
32767: from all lookup default

> ip -4 route list table vpn1194.out

�� eth1
> ip -4 route list table vpn1195.out

�� eth2
> ip -4 route list table main

��
default via ip-��1 dev eth1
default via ip-��2 dev eth2

> ip -4 route list table all

��

> ��
> ip -4 -s route list table cache

tcpdump -n -i eth1 host xxx.xxx.xxx.xxx

tcpdump -n -i eth1 host xxx.xxx.xxx.xxx
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2, link-type EN10MB (Ethernet), capture size 65535 bytes
16:31:10.258122 IP 192.168.1.33.40444 > xxx.xxx.xxx.xxx.1194: UDP, length 61
16:31:20.746341 IP xxx.xxx.xxx.xxx.1194 > 192.168.1.33.40444: UDP, length 61
16:31:21.990280 IP xxx.xxx.

iptables+vpn+routing (reader)

Wed, 02 Apr 2014 11:44:49 GMT

>>> /sbin/ip route add default dev eth1 table vpn1194.out
>>> /sbin/ip route add default dev eth2 table vpn1195.out
>> � �� , �� ip ��
>> ��
>> tcpdump -n -i eth1 host xxx.xxx.xxx.xxx
>> tcpdump -n -i eth2 host 109.195.86.203 �� ip ��
>> ��
>> tcpdump -n -i any host 109.195.86.203
> � �� ip ��
> � �� tcpdump �� .

� �� vpn? �� cache ��

ip -4 rule
ip -4 route list table vpn1194.out
ip -4 route list table vpn1195.out
ip -4 route list table main
ip -4 route list table all

��
ip -4 -s route list table cache

iptables+vpn+routing (millionaire_kg)

Wed, 02 Apr 2014 10:50:22 GMT

>> /sbin/ip route add default dev eth1 table vpn1194.out
>> /sbin/ip route add default dev eth2 table vpn1195.out
> � �� , �� ip ��
> ��
> tcpdump -n -i eth1 host xxx.xxx.xxx.xxx
> tcpdump -n -i eth2 host 109.195.86.203 �� ip ��
> ��
> tcpdump -n -i any host 109.195.86.203

� �� ip ��

� �� tcpdump �� .