API tools faq
paste
s_schultchen

serv2c_pst_net.txt

s_schultchen
Dec 16th, 2016
144
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.41 KB | None | 0 0
raw download clone embed print report
  1. ############ ip a
  2. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  3. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  4. inet 127.0.0.1/8 scope host lo
  5. valid_lft forever preferred_lft forever
  6. inet6 ::1/128 scope host
  7. valid_lft forever preferred_lft forever
  8. 2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UP qlen 1000
  9. link/ether d0:50:99:a8:3b:7c brd ff:ff:ff:ff:ff:ff
  10. inet 10.0.0.119/24 brd 10.0.0.255 scope global dynamic enp3s0
  11. valid_lft 34530sec preferred_lft 34530sec
  12. inet6 fe80::d250:99ff:fea8:3b7c/64 scope link
  13. valid_lft forever preferred_lft forever
  14. 3: enp3s0.5@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  15. link/ether d0:50:99:a8:3b:7c brd ff:ff:ff:ff:ff:ff
  16. inet6 fe80::d250:99ff:fea8:3b7c/64 scope link
  17. valid_lft forever preferred_lft forever
  18. 4: enp3s0.4@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master ovs-system state UP qlen 1000
  19. link/ether d0:50:99:a8:3b:7c brd ff:ff:ff:ff:ff:ff
  20. inet6 fe80::d250:99ff:fea8:3b7c/64 scope link
  21. valid_lft forever preferred_lft forever
  22. 5: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  23. link/ether e6:db:21:51:41:89 brd ff:ff:ff:ff:ff:ff
  24. 7: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  25. link/ether ca:3f:4f:0c:42:44 brd ff:ff:ff:ff:ff:ff
  26. 8: qr-3527d469-3b: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  27. link/ether 2a:a7:5a:8a:e7:ff brd ff:ff:ff:ff:ff:ff
  28. 10: br-int: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  29. link/ether 96:20:64:2c:4c:42 brd ff:ff:ff:ff:ff:ff
  30. 11: br-provider: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  31. link/ether d0:50:99:a8:3b:7c brd ff:ff:ff:ff:ff:ff
  32. 13: qbr686c1316-d0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  33. link/ether b6:37:81:49:46:c2 brd ff:ff:ff:ff:ff:ff
  34. 14: qvo686c1316-d0@qvb686c1316-d0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue master ovs-system state UP qlen 1000
  35. link/ether a2:4d:5c:79:73:3c brd ff:ff:ff:ff:ff:ff
  36. inet6 fe80::a04d:5cff:fe79:733c/64 scope link
  37. valid_lft forever preferred_lft forever
  38. 15: qvb686c1316-d0@qvo686c1316-d0: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1500 qdisc noqueue master qbr686c1316-d0 state UP qlen 1000
  39. link/ether b6:37:81:49:46:c2 brd ff:ff:ff:ff:ff:ff
  40. inet6 fe80::b437:81ff:fe49:46c2/64 scope link
  41. valid_lft forever preferred_lft forever
  42. 17: vxlan_sys_4789: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65470 qdisc noqueue master ovs-system state UNKNOWN qlen 1000
  43. link/ether 1e:d0:07:3d:53:54 brd ff:ff:ff:ff:ff:ff
  44.  
  45.  
  46. ############ ip r
  47. default via 10.0.0.1 dev enp3s0 proto static metric 100
  48. 10.0.0.0/24 dev enp3s0 proto kernel scope link src 10.0.0.119 metric 100
  49.  
  50.  
  51. ############ ip netns
  52. qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41
  53. qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e
  54. ############ ip netns exec NAMESPACE ip a
  55.  
  56.  
  57. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip a
  58. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  59. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  60. inet 127.0.0.1/8 scope host lo
  61. valid_lft forever preferred_lft forever
  62. inet6 ::1/128 scope host
  63. valid_lft forever preferred_lft forever
  64. 16: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  65. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  66. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  67. valid_lft forever preferred_lft forever
  68. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  69. valid_lft forever preferred_lft forever
  70.  
  71.  
  72.  
  73. ############ip netns exec qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e ip a
  74. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  75. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  76. inet 127.0.0.1/8 scope host lo
  77. valid_lft forever preferred_lft forever
  78. inet6 ::1/128 scope host
  79. valid_lft forever preferred_lft forever
  80. 12: tap11c70c76-69: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1000
  81. link/ether fa:16:3e:02:92:93 brd ff:ff:ff:ff:ff:ff
  82. inet 10.0.1.103/24 brd 10.0.1.255 scope global tap11c70c76-69
  83. valid_lft forever preferred_lft forever
  84. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap11c70c76-69
  85. valid_lft forever preferred_lft forever
  86. inet6 fe80::f816:3eff:fe02:9293/64 scope link
  87. valid_lft forever preferred_lft forever
  88.  
  89. ############ ip netns exec NAMESPACE ip r
  90.  
  91.  
  92. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip r
  93. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  94. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  95. inet 127.0.0.1/8 scope host lo
  96. valid_lft forever preferred_lft forever
  97. inet6 ::1/128 scope host
  98. valid_lft forever preferred_lft forever
  99. 16: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  100. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  101. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  102. valid_lft forever preferred_lft forever
  103. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  104. valid_lft forever preferred_lft forever
  105.  
  106.  
  107.  
  108. ############ip netns exec qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e ip r
  109. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  110. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  111. inet 127.0.0.1/8 scope host lo
  112. valid_lft forever preferred_lft forever
  113. inet6 ::1/128 scope host
  114. valid_lft forever preferred_lft forever
  115. 12: tap11c70c76-69: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1000
  116. link/ether fa:16:3e:02:92:93 brd ff:ff:ff:ff:ff:ff
  117. inet 10.0.1.103/24 brd 10.0.1.255 scope global tap11c70c76-69
  118. valid_lft forever preferred_lft forever
  119. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap11c70c76-69
  120. valid_lft forever preferred_lft forever
  121. inet6 fe80::f816:3eff:fe02:9293/64 scope link
  122. valid_lft forever preferred_lft forever
  123.  
  124. ############ iptables-save
  125. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:32 2016
  126. *raw
  127. :PREROUTING ACCEPT [318716:102610210]
  128. :OUTPUT ACCEPT [285788:60262507]
  129. :neutron-openvswi-OUTPUT - [0:0]
  130. :neutron-openvswi-PREROUTING - [0:0]
  131. -A PREROUTING -j neutron-openvswi-PREROUTING
  132. -A OUTPUT -j neutron-openvswi-OUTPUT
  133. -A neutron-openvswi-PREROUTING -m physdev --physdev-in qvb686c1316-d0 -j CT --zone 1
  134. -A neutron-openvswi-PREROUTING -m physdev --physdev-in tap686c1316-d0 -j CT --zone 1
  135. COMMIT
  136. # Completed on Fri Dec 16 20:19:32 2016
  137. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:32 2016
  138. *nat
  139. :PREROUTING ACCEPT [545:78428]
  140. :INPUT ACCEPT [540:77953]
  141. :OUTPUT ACCEPT [2972:206435]
  142. :POSTROUTING ACCEPT [2972:206435]
  143. :neutron-openvswi-OUTPUT - [0:0]
  144. :neutron-openvswi-POSTROUTING - [0:0]
  145. :neutron-openvswi-PREROUTING - [0:0]
  146. :neutron-openvswi-float-snat - [0:0]
  147. :neutron-openvswi-snat - [0:0]
  148. :neutron-postrouting-bottom - [0:0]
  149. -A PREROUTING -j neutron-openvswi-PREROUTING
  150. -A OUTPUT -j neutron-openvswi-OUTPUT
  151. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  152. -A POSTROUTING -j neutron-postrouting-bottom
  153. -A neutron-openvswi-snat -j neutron-openvswi-float-snat
  154. -A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-openvswi-snat
  155. COMMIT
  156. # Completed on Fri Dec 16 20:19:32 2016
  157. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:32 2016
  158. *mangle
  159. :PREROUTING ACCEPT [318716:102610210]
  160. :INPUT ACCEPT [318711:102609735]
  161. :FORWARD ACCEPT [0:0]
  162. :OUTPUT ACCEPT [285788:60262507]
  163. :POSTROUTING ACCEPT [285788:60262507]
  164. :neutron-openvswi-FORWARD - [0:0]
  165. :neutron-openvswi-INPUT - [0:0]
  166. :neutron-openvswi-OUTPUT - [0:0]
  167. :neutron-openvswi-POSTROUTING - [0:0]
  168. :neutron-openvswi-PREROUTING - [0:0]
  169. :neutron-openvswi-mark - [0:0]
  170. -A PREROUTING -j neutron-openvswi-PREROUTING
  171. -A INPUT -j neutron-openvswi-INPUT
  172. -A FORWARD -j neutron-openvswi-FORWARD
  173. -A OUTPUT -j neutron-openvswi-OUTPUT
  174. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  175. -A neutron-openvswi-PREROUTING -j neutron-openvswi-mark
  176. COMMIT
  177. # Completed on Fri Dec 16 20:19:32 2016
  178. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:32 2016
  179. *filter
  180. :INPUT ACCEPT [318712:102609850]
  181. :FORWARD ACCEPT [0:0]
  182. :OUTPUT ACCEPT [285788:60262507]
  183. :neutron-filter-top - [0:0]
  184. :neutron-openvswi-FORWARD - [0:0]
  185. :neutron-openvswi-INPUT - [0:0]
  186. :neutron-openvswi-OUTPUT - [0:0]
  187. :neutron-openvswi-i686c1316-d - [0:0]
  188. :neutron-openvswi-local - [0:0]
  189. :neutron-openvswi-o686c1316-d - [0:0]
  190. :neutron-openvswi-s686c1316-d - [0:0]
  191. :neutron-openvswi-sg-chain - [0:0]
  192. :neutron-openvswi-sg-fallback - [0:0]
  193. -A INPUT -j neutron-openvswi-INPUT
  194. -A FORWARD -j neutron-filter-top
  195. -A FORWARD -j neutron-openvswi-FORWARD
  196. -A OUTPUT -j neutron-filter-top
  197. -A OUTPUT -j neutron-openvswi-OUTPUT
  198. -A neutron-filter-top -j neutron-openvswi-local
  199. -A neutron-openvswi-FORWARD -m physdev --physdev-out tap686c1316-d0 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  200. -A neutron-openvswi-FORWARD -m physdev --physdev-in tap686c1316-d0 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  201. -A neutron-openvswi-INPUT -m physdev --physdev-in tap686c1316-d0 --physdev-is-bridged -m comment --comment "Direct incoming traffic from VM to the security group chain." -j neutron-openvswi-o686c1316-d
  202. -A neutron-openvswi-i686c1316-d -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  203. -A neutron-openvswi-i686c1316-d -s 10.0.1.103/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  204. -A neutron-openvswi-i686c1316-d -s 10.0.1.100/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  205. -A neutron-openvswi-i686c1316-d -s 10.0.1.102/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  206. -A neutron-openvswi-i686c1316-d -s 10.0.1.101/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  207. -A neutron-openvswi-i686c1316-d -p icmp -j RETURN
  208. -A neutron-openvswi-i686c1316-d -p tcp -m tcp --dport 22 -j RETURN
  209. -A neutron-openvswi-i686c1316-d -m set --match-set NIPv43be0d12d-6abb-4370-be6d- src -j RETURN
  210. -A neutron-openvswi-i686c1316-d -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  211. -A neutron-openvswi-i686c1316-d -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  212. -A neutron-openvswi-o686c1316-d -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  213. -A neutron-openvswi-o686c1316-d -j neutron-openvswi-s686c1316-d
  214. -A neutron-openvswi-o686c1316-d -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  215. -A neutron-openvswi-o686c1316-d -p udp -m udp --sport 67 -m udp --dport 68 -m comment --comment "Prevent DHCP Spoofing by VM." -j DROP
  216. -A neutron-openvswi-o686c1316-d -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  217. -A neutron-openvswi-o686c1316-d -j RETURN
  218. -A neutron-openvswi-o686c1316-d -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  219. -A neutron-openvswi-o686c1316-d -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  220. -A neutron-openvswi-s686c1316-d -s 10.0.1.106/32 -m mac --mac-source FA:16:3E:A2:BE:6D -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
  221. -A neutron-openvswi-s686c1316-d -m comment --comment "Drop traffic without an IP/MAC allow rule." -j DROP
  222. -A neutron-openvswi-sg-chain -m physdev --physdev-out tap686c1316-d0 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-i686c1316-d
  223. -A neutron-openvswi-sg-chain -m physdev --physdev-in tap686c1316-d0 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-o686c1316-d
  224. -A neutron-openvswi-sg-chain -j ACCEPT
  225. -A neutron-openvswi-sg-fallback -m comment --comment "Default drop rule for unmatched traffic." -j DROP
  226. COMMIT
  227. # Completed on Fri Dec 16 20:19:32 2016
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!