Changes between Initial Version and Version 1 of TipAndDoc/VM/network/masquerade


Ignore:
Timestamp:
Jun 25, 2009 10:25:13 PM (16 years ago)
Author:
mitty
Comment:

--

Legend:

Unmodified
Added
Removed
Modified

  • TipAndDoc/VM/network/masquerade

    v1 v1  
     1[[PageOutline]] 
     2 
     3 = iptablesによるIP MASQUERADE = 
     4 * [http://www.atmarkit.co.jp/flinux/rensai/iptables02/iptables02c.html ＠IT：natテーブルを利用したLinuxルータの作成（3/6）] 
     5 
     6 * " wiki:TipAndDoc/network/vmtest#networkmap のネットワークを使用 
     7 
     8 * 到達テスト用IP => 202.12.27.33 (M.ROOT-SERVERS.NET.) 
     9 
     10 = without MASQUERADE = 
     11 
     12 == case 1 == 
     13 * router -> centos-outer -(NAPT)-> WAN 
     14 
     15 * ubuntu-router:~$ ping 202.12.27.33 -c 1 
     16{{{ 
     17PING 202.12.27.33 (202.12.27.33) 56(84) bytes of data. 
     18 
     19--- 202.12.27.33 ping statistics --- 
     201 packets transmitted, 0 received, 100% packet loss, time 0ms 
     21}}} 
     22   1. ubuntu-router:eth0 
     23{{{ 
     2421:36:03.484785 IP 10.0.0.254 > 202.12.27.33: ICMP echo request, id 60949, seq 1, length 64 
     25}}} 
     26   1. centos-outer:eth1 
     27{{{ 
     2821:36:03.419741 IP 10.0.0.254 > 202.12.27.33: ICMP echo request, id 60949, seq 1, length 64 
     29}}} 
     30   1. centos-outer:eth0 
     31{{{ 
     3221:36:03.420277 IP 10.0.0.254 > 202.12.27.33: ICMP echo request, id 60949, seq 1, length 64 
     33}}} 
     34 
     35 == case 2 == 
     36 * ubuntu-outer -> router(redirect) -> centos-outer -(NAPT)-> WAN 
     37 
     38 * ubuntu-outer:~$ ping 202.12.27.33 -c 1 
     39{{{ 
     40PING 202.12.27.33 (202.12.27.33) 56(84) bytes of data. 
     41From 10.0.0.254: icmp_seq=1 Redirect Host(New nexthop: 10.0.0.20) 
     42 
     43--- 202.12.27.33 ping statistics --- 
     441 packets transmitted, 0 received, 100% packet loss, time 0ms 
     45}}} 
     46   1. ubuntu-outer:eth1 
     47{{{ 
     4821:28:12.959737 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 53525, seq 1, length 64 
     4921:28:12.965215 IP 10.0.0.254 > 10.0.0.10: ICMP redirect 202.12.27.33 to host 10.0.0.20, length 92 
     50}}} 
     51   1. ubuntu-router:eth0 
     52{{{ 
     5321:28:12.962459 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 53525, seq 1, length 64 
     5421:28:12.965204 IP 10.0.0.254 > 10.0.0.10: ICMP redirect 202.12.27.33 to host 10.0.0.20, length 92 
     5521:28:12.974739 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 53525, seq 1, length 64 
     56}}} 
     57   1. centos-outer:eth1 
     58{{{ 
     5921:28:12.915534 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 53525, seq 1, length 64 
     60}}} 
     61   1. centos-outer:eth0 
     62{{{ 
     6321:28:12.915855 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 53525, seq 1, length 64 
     64}}} 
     65 
     66 == case 3 == 
     67 * ubuntu-inner-AB -> router -> centos-outer -(NAPT)-> WAN 
     68 
     69 * ubuntu-inner-AB:~$ ping 202.12.27.33 -c 1 
     70{{{ 
     71PING 202.12.27.33 (202.12.27.33) 56(84) bytes of data. 
     72 
     73--- 202.12.27.33 ping statistics --- 
     741 packets transmitted, 0 received, 100% packet loss, time 0ms 
     75}}} 
     76   1. ubuntu-inner-AB:eth1 
     77{{{ 
     7820:50:23.110897 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 4372, seq 1, length 64 
     79}}} 
     80   1. ubuntu-router:eth2 
     81{{{ 
     8220:50:23.125749 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 4372, seq 1, length 64 
     83}}} 
     84   1. ubuntu-router:eth0 
     85{{{ 
     8620:50:23.134574 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 4372, seq 1, length 64 
     87}}} 
     88   1. centos-outer:eth1 
     89{{{ 
     9020:50:23.090600 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 4372, seq 1, length 64 
     91}}} 
     92   1. centos-outer:eth0 
     93{{{ 
     9420:50:23.092625 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 4372, seq 1, length 64 
     95}}} 
     96 
     97 = IP MASQUERADE = 
     98 * 上記のcase1, 2は、centos-outerにIP MASQUERADEの設定をすれば解決する 
     99   * centos-outer ~]$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE 
     100   * centos-outer ~]$ sudo iptables -t nat -L -v 
     101{{{ 
     102Chain PREROUTING (policy ACCEPT 21 packets, 3810 bytes) 
     103 pkts bytes target     prot opt in     out     source               destination 
     104 
     105Chain POSTROUTING (policy ACCEPT 4 packets, 336 bytes) 
     106 pkts bytes target     prot opt in     out     source               destination 
     107    0     0 MASQUERADE  all  --  any    eth0    anywhere             anywhere 
     108 
     109Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) 
     110 pkts bytes target     prot opt in     out     source               destination 
     111}}} 
     112 
     113 == case 1 == 
     114 * ubuntu-router:~$ ping 202.12.27.33 -c 1 
     115{{{ 
     116PING 202.12.27.33 (202.12.27.33) 56(84) bytes of data. 
     11764 bytes from 202.12.27.33: icmp_seq=1 ttl=239 time=16.3 ms 
     118 
     119--- 202.12.27.33 ping statistics --- 
     1201 packets transmitted, 1 received, 0% packet loss, time 0ms 
     121rtt min/avg/max/mdev = 16.394/16.394/16.394/0.000 ms 
     122}}} 
     123   1. ubuntu-router:eth0 
     124{{{ 
     12521:52:23.674784 IP 10.0.0.254 > 202.12.27.33: ICMP echo request, id 29462, seq 1, length 64 
     12621:52:23.686245 IP 202.12.27.33 > 10.0.0.254: ICMP echo reply, id 29462, seq 1, length 64 
     127}}} 
     128   1. centos-outer:eth1 
     129{{{ 
     13021:52:23.585426 IP 10.0.0.254 > 202.12.27.33: ICMP echo request, id 29462, seq 1, length 64 
     13121:52:23.600322 IP 202.12.27.33 > 10.0.0.254: ICMP echo reply, id 29462, seq 1, length 64 
     132}}} 
     133   1. centos-outer:eth0 
     134{{{ 
     13521:52:23.586646 IP 192.168.40.20 > 202.12.27.33: ICMP echo request, id 29462, seq 1, length 64 
     13621:52:23.600260 IP 202.12.27.33 > 192.168.40.20: ICMP echo reply, id 29462, seq 1, length 64 
     137}}} 
     138 
     139 == case 2 == 
     140 * ubuntu-outer:~$ ping 202.12.27.33 -c 1 
     141{{{ 
     142PING 202.12.27.33 (202.12.27.33) 56(84) bytes of data. 
     143From 10.0.0.254: icmp_seq=1 Redirect Host(New nexthop: 10.0.0.20) 
     14464 bytes from 202.12.27.33: icmp_seq=1 ttl=239 time=18.2 ms 
     145 
     146--- 202.12.27.33 ping statistics --- 
     1471 packets transmitted, 1 received, 0% packet loss, time 0ms 
     148rtt min/avg/max/mdev = 18.232/18.232/18.232/0.000 ms 
     149}}} 
     150   1. ubuntu-outer:eth1 
     151{{{ 
     15221:54:52.110334 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 42518, seq 1, length 64 
     15321:54:52.112754 IP 10.0.0.254 > 10.0.0.10: ICMP redirect 202.12.27.33 to host 10.0.0.20, length 92 
     15421:54:52.128234 IP 202.12.27.33 > 10.0.0.10: ICMP echo reply, id 42518, seq 1, length 64 
     155}}} 
     156   1. ubuntu-router:eth0 
     157{{{ 
     15821:54:52.110893 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 42518, seq 1, length 64 
     15921:54:52.112704 IP 10.0.0.254 > 10.0.0.10: ICMP redirect 202.12.27.33 to host 10.0.0.20, length 92 
     16021:54:52.113196 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 42518, seq 1, length 64 
     161}}} 
     162   1. centos-outer:eth1 
     163{{{ 
     16421:54:52.033678 IP 10.0.0.10 > 202.12.27.33: ICMP echo request, id 42518, seq 1, length 64 
     16521:54:52.048781 IP 202.12.27.33 > 10.0.0.10: ICMP echo reply, id 42518, seq 1, length 64 
     166}}} 
     167   1. centos-outer:eth0 
     168{{{ 
     16921:54:52.035689 IP 192.168.40.20 > 202.12.27.33: ICMP echo request, id 42518, seq 1, length 64 
     17021:54:52.048112 IP 202.12.27.33 > 192.168.40.20: ICMP echo reply, id 42518, seq 1, length 64 
     171}}} 
     172 
     173 == case 3 == 
     174 * ubuntu-inner-AB -> router -> centos-outer -(NAPT)-> WAN 
     175 * この場合、WAN -(NAPT)-> centos-outer で帰ってきたパケットを10.2.0.30(ubuntu-inner-AB)に送り返そうとするが、centos-outerのデフォルトゲートウェイがあるネットワークはeth0の向きなので、ubuntu-inner-ABがあるeth1ではなくeth0にパケットが送出されてしまう。 
     176   * MASQUERADEに併せて、centos-outerにstatic routeの設定が必要 
     177 
     178 * ubuntu-inner-AB:~$ ping 202.12.27.33 -c 1 
     179{{{ 
     180PING 202.12.27.33 (202.12.27.33) 56(84) bytes of data. 
     181 
     182--- 202.12.27.33 ping statistics --- 
     1831 packets transmitted, 0 received, 100% packet loss, time 0ms 
     184}}} 
     185   1. ubuntu-inner-AB:eth1 
     186{{{ 
     18720:56:09.881451 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 15892, seq 1, length 64 
     188}}} 
     189   1. ubuntu-router:eth2 
     190{{{ 
     19120:56:09.895738 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 15892, seq 1, length 64 
     192}}} 
     193   1. ubuntu-router:eth0 
     194{{{ 
     19520:56:09.896113 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 15892, seq 1, length 64 
     196}}} 
     197   1. centos-outer:eth1 
     198{{{ 
     19920:56:09.861559 IP 10.2.0.30 > 202.12.27.33: ICMP echo request, id 15892, seq 1, length 64 
     200}}} 
     201   1. centos-outer:eth0 
     202{{{ 
     20320:56:09.863646 IP 192.168.40.20 > 202.12.27.33: ICMP echo request, id 15892, seq 1, length 64 
     20420:56:09.876772 IP 202.12.27.33 > 192.168.40.20: ICMP echo reply, id 15892, seq 1, length 64 
     20520:56:09.878089 IP 202.12.27.33 > 10.2.0.30: ICMP echo reply, id 15892, seq 1, length 64 
     206}}}