Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -d 172.16.1.0/24 -j ACCEPT
- iptables -t nat -A POSTROUTING -s 172.16.1.0/24 -j MASQUERADE
- echo install br_netfilter /bin/true > /etc/modprobe.d/disable-br-netfilter.conf
- sysctl -w net.bridge.bridge-nf-call-iptables=0
- iptables -t nat -A POSTROUTING -s 172.18.0.0/16 -d 172.18.0.0/16 -j ACCEPT
- iptables -A FORWARD -i br0 -o br0 -j ACCEPT
- for ns in host1 host2 router; do
- ip netns del $ns 2>/dev/null || :
- ip netns add $ns
- ip -n $ns link set lo up
- done
- ip netns exec router sysctl -q -w net.ipv4.conf.default.forwarding=1
- ip -n router link add bridge0 type bridge
- ip -n router link set bridge0 up
- ip -n router address add 192.168.0.1/24 dev bridge0
- for i in 1 2; do
- ip -n host$i link add eth0 type veth peer netns router port$i
- ip -n host$i link set eth0 up
- ip -n host$i address add 192.168.0.10$i/24 dev eth0
- ip -n host$i route add default via 192.168.0.1
- ip -n router link set port$i up master bridge0
- done
- #to mimic a standard NAT router, iptables rule voluntarily made as it is to show the last "effect"
- ip -n router link add name eth0 type dummy
- ip -n router link set eth0 up
- ip -n router address add 192.0.2.100/24 dev eth0
- ip -n router route add default via 192.0.2.1
- ip netns exec router iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j MASQUERADE
- modprobe br_netfilter
- sysctl -w net.bridge.bridge-nf-call-iptables=0
- ip netns exec router iptables -A FORWARD -p icmp --icmp-type echo-request
- ip netns exec router iptables -A FORWARD -p icmp --icmp-type echo-reply
- # ip netns exec host1 ping -n -c2 192.168.0.102
- PING 192.168.0.102 (192.168.0.102) 56(84) bytes of data.
- 64 bytes from 192.168.0.102: icmp_seq=1 ttl=64 time=0.047 ms
- 64 bytes from 192.168.0.102: icmp_seq=2 ttl=64 time=0.058 ms
- --- 192.168.0.102 ping statistics ---
- 2 packets transmitted, 2 received, 0% packet loss, time 1017ms
- rtt min/avg/max/mdev = 0.047/0.052/0.058/0.009 ms
- # ip netns exec router iptables -v -S FORWARD
- -P FORWARD ACCEPT -c 0 0
- -A FORWARD -p icmp -m icmp --icmp-type 8 -c 0 0
- -A FORWARD -p icmp -m icmp --icmp-type 0 -c 0 0
- # sysctl -w net.bridge.bridge-nf-call-iptables=1
- net.bridge.bridge-nf-call-iptables = 1
- # ip netns exec host1 ping -n -c2 192.168.0.102
- PING 192.168.0.102 (192.168.0.102) 56(84) bytes of data.
- 64 bytes from 192.168.0.102: icmp_seq=1 ttl=64 time=0.094 ms
- 64 bytes from 192.168.0.102: icmp_seq=2 ttl=64 time=0.163 ms
- --- 192.168.0.102 ping statistics ---
- 2 packets transmitted, 2 received, 0% packet loss, time 1006ms
- rtt min/avg/max/mdev = 0.094/0.128/0.163/0.036 ms
- # ip netns exec router iptables -v -S FORWARD
- -P FORWARD ACCEPT -c 4 336
- -A FORWARD -p icmp -m icmp --icmp-type 8 -c 2 168
- -A FORWARD -p icmp -m icmp --icmp-type 0 -c 2 168
- # ip netns exec host1 ping -n -c2 192.168.0.102
- PING 192.168.0.102 (192.168.0.102) 56(84) bytes of data.
- --- 192.168.0.102 ping statistics ---
- 2 packets transmitted, 0 received, 100% packet loss, time 1008ms
- # ip netns exec router iptables -v -S FORWARD
- -P FORWARD DROP -c 2 168
- -A FORWARD -p icmp -m icmp --icmp-type 8 -c 4 336
- -A FORWARD -p icmp -m icmp --icmp-type 0 -c 2 168
- # ip netns exec router iptables -A FORWARD -i bridge0 -o bridge0 -j ACCEPT
- # ip netns exec host1 ping -n -c2 192.168.0.102
- PING 192.168.0.102 (192.168.0.102) 56(84) bytes of data.
- 64 bytes from 192.168.0.102: icmp_seq=1 ttl=64 time=0.132 ms
- 64 bytes from 192.168.0.102: icmp_seq=2 ttl=64 time=0.123 ms
- --- 192.168.0.102 ping statistics ---
- 2 packets transmitted, 2 received, 0% packet loss, time 1024ms
- rtt min/avg/max/mdev = 0.123/0.127/0.132/0.012 ms
- # ip netns exec router iptables -v -S FORWARD
- -P FORWARD DROP -c 0 0
- -A FORWARD -p icmp -m icmp --icmp-type 8 -c 6 504
- -A FORWARD -p icmp -m icmp --icmp-type 0 -c 4 336
- -A FORWARD -i bridge0 -o bridge0 -c 4 336 -j ACCEPT
- # ip netns exec host2 tcpdump -l -n -s0 -i eth0 -p icmp
- tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
- listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
- 02:16:11.068795 IP 192.168.0.1 > 192.168.0.102: ICMP echo request, id 9496, seq 1, length 64
- 02:16:11.068817 IP 192.168.0.102 > 192.168.0.1: ICMP echo reply, id 9496, seq 1, length 64
- 02:16:12.088002 IP 192.168.0.1 > 192.168.0.102: ICMP echo request, id 9496, seq 2, length 64
- 02:16:12.088063 IP 192.168.0.102 > 192.168.0.1: ICMP echo reply, id 9496, seq 2, length 64
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement