iptables MASQUERADE
글쓴이: pwy1575 / 작성시간: 금, 2017/12/08 - 6:26오후
안녕하세요
iptables nat 에 대해 문의드립니다.
아래와 같이 dcb0 인터페이스로 나가는 패킷에 대해 MASQUERADE 규칙을 적용하였습니다.
제가 이해 하기로는 dcb0를 통해 나가는 모든 패킷은 dcb0 interface가 가지는 IP로 src 가 바뀌어 나가는 걸로 알고 있습니다.
Chain POSTROUTING (policy ACCEPT 69 packets, 4782 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * dcb0 0.0.0.0/0 0.0.0.0/0 하지만 src IP 가 변경 되지 않고 기존의 src IP로 나가는 증상을 볼 수 있었습니다.
*라우팅 테이블 및 iptables / ifconfig 첨부합니다.
# ifconfig
br0 Link encap:Ethernet HWaddr 24:D1:3F:11:FC:A1
inet addr:192.168.50.57 Bcast:192.168.50.255 Mask:255.255.255.0
inet6 addr: fe80::26d1:3fff:fe11:fca1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:424 errors:0 dropped:0 overruns:0 frame:0
TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:128530 (125.5 KiB) TX bytes:3328 (3.2 KiB)
dcb0 Link encap:Ethernet HWaddr CA:FE:00:11:FC:A1
inet addr:9.9.1.15 Bcast:9.9.1.255 Mask:255.255.255.0
inet6 addr: fe80::c8fe:ff:fe11:fca1/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1438 Metric:1
RX packets:23 errors:0 dropped:0 overruns:0 frame:0
TX packets:237 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1606 (1.5 KiB) TX bytes:109208 (106.6 KiB)Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 192.168.225.1 255.255.255.255 UGH 0 0 0 usb0 211.184.18.68 192.168.225.1 255.255.255.255 UGH 0 0 0 usb0 192.168.225.0 * 255.255.255.0 U 0 0 0 usb0 192.168.50.0 * 255.255.255.0 U 0 0 0 br0 9.9.1.0 * 255.255.255.0 U 0 0 0 dcb0 127.0.0.0 * 255.0.0.0 U 0 0 0 lo default 192.168.225.1 0.0.0.0 UG 0 0 0 usb0 default 9.9.1.254 0.0.0.0 UG 1 0 0 dcb0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- dcb0 * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmp type 8
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
435 133K ACCEPT all -- br0 * 192.168.50.0/24 0.0.0.0/0 state NEW
0 0 ACCEPT all -- lo * 127.0.0.1 0.0.0.0/0 state NEW
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
# iptables -t nat -L -nv
Chain PREROUTING (policy ACCEPT 147 packets, 12492 bytes)
pkts bytes target prot opt in out source destination
9 435 DNAT tcp -- usb0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:6000 to:192.168.50.57:23
Chain POSTROUTING (policy ACCEPT 121 packets, 8100 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * dcb0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 21 packets, 1619 bytes)
pkts bytes target prot opt in out source destination 위 증상이 왜 발생하는지 짐작 가시는분 조언 부탁드리겠습니다.
감사합니다.
Forums:
댓글 달기