[iptables] 基于iptables实现的跨网络通信

描述

在很多业务场景下，会遇上很多诡异的需求，不仅限于文章提及的需求，还有各种五花八门的需求，大部份的这些需求的产生都是来源于以前设计、规划上导致的问题。所以我们都会想尽办法为客户解决问题，维护好客户的关系。

环境信息

OS: Centos7及以上

需求

因特殊原因。用户需要在主机A访问到10.0.44.0/24的业务网段，主机A 又不能直接使用到业务网。 所以只能利用主机B，采用snat的方式进行转发主机A业务请求访问到业务网。

实现方法

# 在主机A添加静态路由，访问10.0.44.0/24流量都从eth0出去，并且下一跳地址是10.0.43.101

$ cat >  /etc/sysconfig/network-scripts/route-eth0 << EOF10.0.44.0/24 via 10.0.43.101 dev eth0EOF

# 在主机B的eth1网卡进行抓包查看，发现icmp包已经过来了。

$ tcpdump -i eth1 host 10.0.44.1tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on eth1, link-type EN10MB (Ethernet), capture size 262144 bytes08:40:09.351088 IP host-10-0-43-15 > gateway: ICMP echo request, id 21356, seq 229, length 6408:40:10.351100 IP host-10-0-43-15 > gateway: ICMP echo request, id 21356, seq 230, length 6408:40:11.351091 IP host-10-0-43-15 > gateway: ICMP echo request, id 21356, seq 231, length 6408:40:12.351090 IP host-10-0-43-15 > gateway: ICMP echo request, id 21356, seq 232, length 6408:40:13.351060 IP host-10-0-43-15 > gateway: ICMP echo request, id 21356, seq 233, length 64

# 但在主机B的eth0的网卡并没有发现icmp包, 这是什么原因？怀疑是

port_security

的问题和

ip_forward

。

$ tcpdump -i eth0 host 10.0.44.1tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes

# 关闭主机B eth0和eth1 的

port_security

, 在openstack 环境下的配置。

# 找到port id$ neutron port-list | grep 10.0.43.101neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.| 648c8165-f3e6-42a4-b6cc-0a38cecc5bec |                     | 363b136093524567863320fa0c95b069 | fa:16:3e:8a:63:c9 | {"subnet_id": "9ff8ad43-7b53-4cc2-acbd-74ec6fed3adf", "ip_address": "10.0.43.101"}   |$ neutron port-list | grep 10.0.44.63neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.| 0b5db09f-3699-4df5-8517-01e7ff665468 |                     | 363b136093524567863320fa0c95b069 | fa:16:3e:f3:1e:42 | {"subnet_id": "97800cd2-06f7-4c9a-aa3b-f9b7a6fe6419", "ip_address": "10.0.44.63"}    |# 关闭端口的安全组$ openstack port set --disable-port-security --no-security-group 0b5db09f-3699-4df5-8517-01e7ff665468$ openstack port set --disable-port-security --no-security-group 648c8165-f3e6-42a4-b6cc-0a38cecc5bec

# 主机B配置ip_forward出于安全考虑，Linux系统默认是禁止数据包转发的。所谓转发就是当主机拥有多块网卡时，其中一块收到数据包，根据数据包的目的ip地址将数据包发往本机另一块网卡，该网卡根据路由表继续发送数据包(通常这是需要路由器来实现的功能)。

$ echo 1 > /proc/sys/net/ipv4/ip_forward$ cat >> /etc/sysctl.conf << EOFnet.ipv4.ip_forward = 1EOF$ sysctl -p

# 在主机B eth0口抓包发现包已经过来了，但是发现只有

request

包没有

replay

响应的包。仔细分析发现源IP是

10.0.43.15

去访问10.0.44.1肯定是不通，因为10.0.44.0/24网络上连交换机没有10.0.43.0/24的路由返回来。

$ tcpdump -i eth0 host 10.0.44.1tcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes09:16:20.099852 IP host-10-0-43-15 > gateway: ICMP echo request, id 21418, seq 385, length 6409:16:20.230831 IP host-10-0-43-15 > gateway: ICMP echo request, id 21449, seq 51, length 6409:16:21.099843 IP host-10-0-43-15 > gateway: ICMP echo request, id 21418, seq 386, length 6409:16:24.099845 IP host-10-0-43-15 > gateway: ICMP echo request, id 21418, seq 389, length 64

# 在主机B iptables配置源10.0.44.0/24地址转换成10.0.44.63出去, 对于不是很熟iptables的同学了解此文章[浅聊iptables]

$ iptables -t nat -A POSTROUTING   -d 10.0.44.0/24  -o eth0 -j SNAT --to 10.0.44.63$ iptables -t nat -L -n -vChain PREROUTING (policy ACCEPT 4 packets, 336 bytes)pkts bytes target     prot opt in     out     source               destinationChain INPUT (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destinationChain OUTPUT (policy ACCEPT 6 packets, 470 bytes)pkts bytes target     prot opt in     out     source               destinationChain POSTROUTING (policy ACCEPT 6 packets, 470 bytes)pkts bytes target     prot opt in     out     source               destination4   336 SNAT       all  --  *      eth0    0.0.0.0/0            10.0.44.0/24         to:10.0.44.63

# 在主机A发现去访问10.0.44.1的icmp通了。

$ ping 10.0.44.1PING 10.0.44.1 (10.0.44.1) 56(84) bytes of data.64 bytes from 10.0.44.1: icmp_seq=1 ttl=253 time=1.19 ms64 bytes from 10.0.44.1: icmp_seq=2 ttl=253 time=0.852 ms64 bytes from 10.0.44.1: icmp_seq=3 ttl=253 time=0.809 ms64 bytes from 10.0.44.1: icmp_seq=4 ttl=253 time=0.886 ms