На роутерах установлены шейперы (а обоих исходящий трафик режется, но один во внешний мир, второй внутрь)
Система должна работать хитроумным способом --
На первом роутере поднят nat, второй роутер работает бриджем, соответсвенно для маршрутов от и к клиентам он "прозрачный". Так надо )))
Роутер, который настроен бриджем должен шейпить конкретные адреса локальной сети, но чтобы он мог видеть клиентские адреса - порты этих клиентов надо прокинуть через первый роутер... Голова уже вспухла, добиться положительного результата не могу
Конфиг фаирвола с роутера с nat'ом --
Код: Выделить всё
#! /bin/sh
PRIVATE_NETS="
10.0.0.0/32
10.0.0.0/8
172.16.0.0/12
192.168.0.0/16
"
SMTP_SERVERS="
***.***.34.98
"
PROXY_OUTGOING="
***.***.34.98
"
TPROXY_PORTS="8080"
MASQ_OUT_ADDR=***.***.34.90
UNLIM_MASQ_OUT_ADDR=**.**.***.162
UNLIM_IFACE=eth4
PATH=/usr/bin:/bin:/usr/sbin:/sbin:
WORLD_IFACES=eth0
iptables -N world-in
iptables -N world-out
for iface in $WORLD_IFACES; do
iptables -A FORWARD -i $iface -j world-in
iptables -A FORWARD -o $iface -j world-out
iptables -A INPUT -i $iface -j world-in
iptables -A OUTPUT -o $iface -j world-out
done
#
# World input
#
# Filter out certain packets for the sake of security:
# No NFS (tpc/udp 2049) from the outer world.
# No lpd from the outer world
# No syslog from outer world.
# Protect NetBIOS filesharing hosts from outside attacks at least
iptables -A world-in -p udp --dport 111 -j REJECT
iptables -A world-in -p tcp --dport 111 -j REJECT
iptables -A world-in -p udp --dport 2049 -j REJECT
iptables -A world-in -p tcp --dport 2049 -j REJECT
iptables -A world-in -p udp --dport syslog -j REJECT
iptables -A world-in -p tcp --dport printer -j REJECT
# Microsoft networking. Mostly used by viruses and suchlike.
# Block both ways.
iptables -A FORWARD -p tcp --dport 135:139 -j REJECT
iptables -A FORWARD -p udp --dport 135:139 -j REJECT
iptables -A FORWARD -p tcp --dport 444:445 -j REJECT
iptables -A FORWARD -p udp --dport 444:445 -j REJECT
# Anti-spoofing: filter out all packets that have src from our nets
# but come from outside.
#
iptables -N spoof-in
iptables -A world-in -j spoof-in
for x in $MYNETS
do
iptables -A spoof-in -s $x -j REJECT
done
# Anti-spamming: block inbound smtp connections to any internal
# servers except julien, which will have to be equipped to filter out
# spam.
iptables -N smtp-in
iptables -A world-in -p tcp --dport 25 -j smtp-in
for x in $SMTP_SERVERS
do
iptables -A smtp-in -d $x -j RETURN
done
iptables -A smtp-in -j REJECT
# attacks
NET_PROHIBITED="REJECT --reject-with icmp-net-prohibited"
#
# World output
#
# Never send packets from private hosts to outside
# (Slavich's ns sending queries to root nameservers, for one)
# BTW, block any packets doing to alien private nets along
# the default route
NET_UNREACHABLE="REJECT --reject-with icmp-net-unreachable"
iptables -N reject-exotic-protocols
iptables -A reject-exotic-protocols -p tcp -j RETURN
iptables -A reject-exotic-protocols -p udp -j RETURN
iptables -A reject-exotic-protocols -p icmp -j RETURN
iptables -A reject-exotic-protocols -j $NET_UNREACHABLE
for NET in $PRIVATE_NETS; do
iptables -A world-out -d $NET -j REJECT
if [ $NET = "10.0.0.0/8" ] # masqueraded addresses
then
iptables -A world-out -s $NET -j reject-exotic-protocols
else
iptables -A world-out -s $NET -j REJECT
fi
done
# In case of network failure packets addressed to my network will go along the
# default route. Don't let them go out and become external traffic
for NET in $MYNETS; do
iptables -A world-out -d $NET -j REJECT
done
# CA-96.21.tcp_syn_flooding. Kill packets that have src outside our
# networks but coming from inside.
iptables -N spoof-out
iptables -A world-out -j spoof-out
for x in $MYNETS; do
iptables -A spoof-out -s $x -j RETURN
done
iptables -A spoof-out -j DROP
# Masquerade for all private addr clients
iptables -t nat -N masq
iptables -t nat -A POSTROUTING -s 10.0.0.0/8 -j masq
for NET in $MYNETS; do
iptables -t nat -A masq -d $NET -j RETURN
done
function UNLIM_NAT_RULE {
iptables -t nat -A masq -o $UNLIM_IFACE $*
}
UNLIM_NAT_RULE -p tcp -j SNAT --to-source $UNLIM_MASQ_OUT_ADDR:40000-60000
UNLIM_NAT_RULE -p udp -j SNAT --to-source $UNLIM_MASQ_OUT_ADDR:40000-60000
UNLIM_NAT_RULE -p icmp -j SNAT --to-source $UNLIM_MASQ_OUT_ADDR
iptables -t nat -A masq -p tcp -j SNAT --to-source $MASQ_OUT_ADDR:40000-60000
iptables -t nat -A masq -p udp -j SNAT --to-source $MASQ_OUT_ADDR:40000-60000
iptables -t nat -A masq -p icmp -j SNAT --to-source $MASQ_OUT_ADDR
#
# Copy packets to netlink for nadmin acquisition.
# With iptables, this provides accounting for both masqueraded and
# regular traffic.
#
iptables -I world-in -j ULOG --ulog-cprange 68
iptables -A world-out -j ULOG --ulog-cprange 68
Код: Выделить всё
# tcpdump -lni eth1 host 10.52.16.9 -c100
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
0 packets captured
0 packets received by filter
0 packets dropped by kernel
В то время, как на первом роутере с "натом" это выглядит так --
Код: Выделить всё
~# tcpdump -lni eth4 host 10.52.16.9 -c100
tcpdump: listening on eth4
17:32:50.003356 10.52.16.9.10609 > 192.168.255.241.22: . ack 3866960797 win 65163 (DF)
17:32:50.195429 10.52.16.9.10609 > 192.168.255.241.22: . ack 109 win 65055 (DF)
17:32:50.396734 10.52.16.9.10609 > 192.168.255.241.22: . ack 209 win 64955 (DF)
17:32:50.598040 10.52.16.9.10609 > 192.168.255.241.22: . ack 309 win 64855 (DF)
17:32:50.799339 10.52.16.9.10609 > 192.168.255.241.22: . ack 409 win 64755 (DF)
17:32:51.000642 10.52.16.9.10609 > 192.168.255.241.22: . ack 509 win 64655 (DF)
17:32:51.201951 10.52.16.9.10609 > 192.168.255.241.22: . ack 609 win 64555 (DF)
17:32:51.403253 10.52.16.9.10609 > 192.168.255.241.22: . ack 709 win 64455 (DF)
17:32:51.604571 10.52.16.9.10609 > 192.168.255.241.22: . ack 809 win 64355 (DF)
17:32:51.805874 10.52.16.9.10705 > 66.199.250.170.8911: S 3950452253:3950452253(0) win 65535 <mss 1460,nop,nop,sackOK> (DF)
17:32:51.805927 10.52.16.9.10609 > 192.168.255.241.22: . ack 909 win 64255 (DF)
17:32:52.007170 10.52.16.9.10609 > 192.168.255.241.22: . ack 1129 win 65535 (DF)
12 packets received by filter
0 packets dropped by kernel
