API tools faq
paste
s_schultchen

serv2b_pst_net.txt

s_schultchen
Dec 16th, 2016
166
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.64 KB | None | 0 0
raw download clone embed print report
  1. ############ ip a
  2. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  3. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  4. inet 127.0.0.1/8 scope host lo
  5. valid_lft forever preferred_lft forever
  6. inet6 ::1/128 scope host
  7. valid_lft forever preferred_lft forever
  8. 2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UP qlen 1000
  9. link/ether d0:50:99:a8:3b:98 brd ff:ff:ff:ff:ff:ff
  10. inet 10.0.0.113/24 brd 10.0.0.255 scope global dynamic enp3s0
  11. valid_lft 34533sec preferred_lft 34533sec
  12. inet6 fe80::d250:99ff:fea8:3b98/64 scope link
  13. valid_lft forever preferred_lft forever
  14. 3: enp3s0.5@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  15. link/ether d0:50:99:a8:3b:98 brd ff:ff:ff:ff:ff:ff
  16. inet6 fe80::d250:99ff:fea8:3b98/64 scope link
  17. valid_lft forever preferred_lft forever
  18. 4: enp3s0.4@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master ovs-system state UP qlen 1000
  19. link/ether d0:50:99:a8:3b:98 brd ff:ff:ff:ff:ff:ff
  20. inet6 fe80::d250:99ff:fea8:3b98/64 scope link
  21. valid_lft forever preferred_lft forever
  22. 5: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  23. link/ether 42:0d:f0:0f:a5:87 brd ff:ff:ff:ff:ff:ff
  24. 7: br-int: <BROADCAST,MULTICAST> mtu 1450 qdisc noop state DOWN qlen 1000
  25. link/ether b2:2e:d8:c5:ce:4d brd ff:ff:ff:ff:ff:ff
  26. 9: vxlan_sys_4789: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65470 qdisc noqueue master ovs-system state UNKNOWN qlen 1000
  27. link/ether da:44:ac:84:fa:51 brd ff:ff:ff:ff:ff:ff
  28. 10: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  29. link/ether 96:bd:bf:c7:3e:40 brd ff:ff:ff:ff:ff:ff
  30. 11: br-provider: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  31. link/ether d0:50:99:a8:3b:98 brd ff:ff:ff:ff:ff:ff
  32. 14: qbr9a40a930-3c: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP qlen 1000
  33. link/ether 16:ad:bb:aa:ef:dc brd ff:ff:ff:ff:ff:ff
  34. 15: qvo9a40a930-3c@qvb9a40a930-3c: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP qlen 1000
  35. link/ether 32:18:5d:d7:f2:92 brd ff:ff:ff:ff:ff:ff
  36. inet6 fe80::3018:5dff:fed7:f292/64 scope link
  37. valid_lft forever preferred_lft forever
  38. 16: qvb9a40a930-3c@qvo9a40a930-3c: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master qbr9a40a930-3c state UP qlen 1000
  39. link/ether 16:ad:bb:aa:ef:dc brd ff:ff:ff:ff:ff:ff
  40. inet6 fe80::14ad:bbff:feaa:efdc/64 scope link
  41. valid_lft forever preferred_lft forever
  42. 17: tap9a40a930-3c: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master qbr9a40a930-3c state UNKNOWN qlen 1000
  43. link/ether fe:16:3e:dc:b4:51 brd ff:ff:ff:ff:ff:ff
  44. inet6 fe80::fc16:3eff:fedc:b451/64 scope link
  45. valid_lft forever preferred_lft forever
  46.  
  47.  
  48. ############ ip r
  49. default via 10.0.0.1 dev enp3s0 proto static metric 100
  50. 10.0.0.0/24 dev enp3s0 proto kernel scope link src 10.0.0.113 metric 100
  51.  
  52.  
  53. ############ ip netns
  54. qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41
  55. qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e
  56. ############ ip netns exec NAMESPACE ip a
  57.  
  58.  
  59. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip a
  60. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  61. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  62. inet 127.0.0.1/8 scope host lo
  63. valid_lft forever preferred_lft forever
  64. inet6 ::1/128 scope host
  65. valid_lft forever preferred_lft forever
  66. 18: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  67. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  68. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  69. valid_lft forever preferred_lft forever
  70. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  71. valid_lft forever preferred_lft forever
  72.  
  73.  
  74.  
  75. ############ip netns exec qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e ip a
  76. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  77. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  78. inet 127.0.0.1/8 scope host lo
  79. valid_lft forever preferred_lft forever
  80. inet6 ::1/128 scope host
  81. valid_lft forever preferred_lft forever
  82. 12: tap61749873-a9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1000
  83. link/ether fa:16:3e:8a:3e:24 brd ff:ff:ff:ff:ff:ff
  84. inet 10.0.1.100/24 brd 10.0.1.255 scope global tap61749873-a9
  85. valid_lft forever preferred_lft forever
  86. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap61749873-a9
  87. valid_lft forever preferred_lft forever
  88. inet6 fe80::f816:3eff:fe8a:3e24/64 scope link
  89. valid_lft forever preferred_lft forever
  90.  
  91. ############ ip netns exec NAMESPACE ip r
  92.  
  93.  
  94. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip r
  95. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  96. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  97. inet 127.0.0.1/8 scope host lo
  98. valid_lft forever preferred_lft forever
  99. inet6 ::1/128 scope host
  100. valid_lft forever preferred_lft forever
  101. 18: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  102. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  103. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  104. valid_lft forever preferred_lft forever
  105. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  106. valid_lft forever preferred_lft forever
  107.  
  108.  
  109.  
  110. ############ip netns exec qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e ip r
  111. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  112. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  113. inet 127.0.0.1/8 scope host lo
  114. valid_lft forever preferred_lft forever
  115. inet6 ::1/128 scope host
  116. valid_lft forever preferred_lft forever
  117. 12: tap61749873-a9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1000
  118. link/ether fa:16:3e:8a:3e:24 brd ff:ff:ff:ff:ff:ff
  119. inet 10.0.1.100/24 brd 10.0.1.255 scope global tap61749873-a9
  120. valid_lft forever preferred_lft forever
  121. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap61749873-a9
  122. valid_lft forever preferred_lft forever
  123. inet6 fe80::f816:3eff:fe8a:3e24/64 scope link
  124. valid_lft forever preferred_lft forever
  125.  
  126. ############ iptables-save
  127. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:30 2016
  128. *raw
  129. :PREROUTING ACCEPT [351343:126055972]
  130. :OUTPUT ACCEPT [318577:66931010]
  131. :neutron-openvswi-OUTPUT - [0:0]
  132. :neutron-openvswi-PREROUTING - [0:0]
  133. -A PREROUTING -j neutron-openvswi-PREROUTING
  134. -A OUTPUT -j neutron-openvswi-OUTPUT
  135. -A neutron-openvswi-PREROUTING -m physdev --physdev-in qvb9a40a930-3c -j CT --zone 1
  136. -A neutron-openvswi-PREROUTING -m physdev --physdev-in tap9a40a930-3c -j CT --zone 1
  137. COMMIT
  138. # Completed on Fri Dec 16 20:19:30 2016
  139. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:30 2016
  140. *nat
  141. :PREROUTING ACCEPT [706:91072]
  142. :INPUT ACCEPT [676:87927]
  143. :OUTPUT ACCEPT [2810:198782]
  144. :POSTROUTING ACCEPT [2835:201452]
  145. :neutron-openvswi-OUTPUT - [0:0]
  146. :neutron-openvswi-POSTROUTING - [0:0]
  147. :neutron-openvswi-PREROUTING - [0:0]
  148. :neutron-openvswi-float-snat - [0:0]
  149. :neutron-openvswi-snat - [0:0]
  150. :neutron-postrouting-bottom - [0:0]
  151. -A PREROUTING -j neutron-openvswi-PREROUTING
  152. -A OUTPUT -j neutron-openvswi-OUTPUT
  153. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  154. -A POSTROUTING -j neutron-postrouting-bottom
  155. -A neutron-openvswi-snat -j neutron-openvswi-float-snat
  156. -A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-openvswi-snat
  157. COMMIT
  158. # Completed on Fri Dec 16 20:19:30 2016
  159. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:30 2016
  160. *mangle
  161. :PREROUTING ACCEPT [351345:126068359]
  162. :INPUT ACCEPT [351134:126048555]
  163. :FORWARD ACCEPT [224:25161]
  164. :OUTPUT ACCEPT [318579:66943397]
  165. :POSTROUTING ACCEPT [318803:66968558]
  166. :neutron-openvswi-FORWARD - [0:0]
  167. :neutron-openvswi-INPUT - [0:0]
  168. :neutron-openvswi-OUTPUT - [0:0]
  169. :neutron-openvswi-POSTROUTING - [0:0]
  170. :neutron-openvswi-PREROUTING - [0:0]
  171. :neutron-openvswi-mark - [0:0]
  172. -A PREROUTING -j neutron-openvswi-PREROUTING
  173. -A INPUT -j neutron-openvswi-INPUT
  174. -A FORWARD -j neutron-openvswi-FORWARD
  175. -A OUTPUT -j neutron-openvswi-OUTPUT
  176. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  177. -A neutron-openvswi-PREROUTING -j neutron-openvswi-mark
  178. COMMIT
  179. # Completed on Fri Dec 16 20:19:30 2016
  180. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:30 2016
  181. *filter
  182. :INPUT ACCEPT [351136:126060942]
  183. :FORWARD ACCEPT [0:0]
  184. :OUTPUT ACCEPT [318581:66955784]
  185. :neutron-filter-top - [0:0]
  186. :neutron-openvswi-FORWARD - [0:0]
  187. :neutron-openvswi-INPUT - [0:0]
  188. :neutron-openvswi-OUTPUT - [0:0]
  189. :neutron-openvswi-i9a40a930-3 - [0:0]
  190. :neutron-openvswi-local - [0:0]
  191. :neutron-openvswi-o9a40a930-3 - [0:0]
  192. :neutron-openvswi-s9a40a930-3 - [0:0]
  193. :neutron-openvswi-sg-chain - [0:0]
  194. :neutron-openvswi-sg-fallback - [0:0]
  195. -A INPUT -j neutron-openvswi-INPUT
  196. -A FORWARD -j neutron-filter-top
  197. -A FORWARD -j neutron-openvswi-FORWARD
  198. -A OUTPUT -j neutron-filter-top
  199. -A OUTPUT -j neutron-openvswi-OUTPUT
  200. -A neutron-filter-top -j neutron-openvswi-local
  201. -A neutron-openvswi-FORWARD -m physdev --physdev-out tap9a40a930-3c --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  202. -A neutron-openvswi-FORWARD -m physdev --physdev-in tap9a40a930-3c --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  203. -A neutron-openvswi-INPUT -m physdev --physdev-in tap9a40a930-3c --physdev-is-bridged -m comment --comment "Direct incoming traffic from VM to the security group chain." -j neutron-openvswi-o9a40a930-3
  204. -A neutron-openvswi-i9a40a930-3 -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  205. -A neutron-openvswi-i9a40a930-3 -s 10.0.12.4/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  206. -A neutron-openvswi-i9a40a930-3 -s 10.0.12.3/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  207. -A neutron-openvswi-i9a40a930-3 -s 10.0.12.2/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  208. -A neutron-openvswi-i9a40a930-3 -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  209. -A neutron-openvswi-i9a40a930-3 -p icmp -j RETURN
  210. -A neutron-openvswi-i9a40a930-3 -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  211. -A neutron-openvswi-i9a40a930-3 -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  212. -A neutron-openvswi-i9a40a930-3 -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  213. -A neutron-openvswi-o9a40a930-3 -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  214. -A neutron-openvswi-o9a40a930-3 -j neutron-openvswi-s9a40a930-3
  215. -A neutron-openvswi-o9a40a930-3 -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  216. -A neutron-openvswi-o9a40a930-3 -p udp -m udp --sport 67 -m udp --dport 68 -m comment --comment "Prevent DHCP Spoofing by VM." -j DROP
  217. -A neutron-openvswi-o9a40a930-3 -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  218. -A neutron-openvswi-o9a40a930-3 -p icmp -j RETURN
  219. -A neutron-openvswi-o9a40a930-3 -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  220. -A neutron-openvswi-o9a40a930-3 -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  221. -A neutron-openvswi-o9a40a930-3 -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  222. -A neutron-openvswi-o9a40a930-3 -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  223. -A neutron-openvswi-s9a40a930-3 -s 10.0.12.10/32 -m mac --mac-source FA:16:3E:DC:B4:51 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
  224. -A neutron-openvswi-s9a40a930-3 -m comment --comment "Drop traffic without an IP/MAC allow rule." -j DROP
  225. -A neutron-openvswi-sg-chain -m physdev --physdev-out tap9a40a930-3c --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-i9a40a930-3
  226. -A neutron-openvswi-sg-chain -m physdev --physdev-in tap9a40a930-3c --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-o9a40a930-3
  227. -A neutron-openvswi-sg-chain -j ACCEPT
  228. -A neutron-openvswi-sg-fallback -m comment --comment "Default drop rule for unmatched traffic." -j DROP
  229. COMMIT
  230. # Completed on Fri Dec 16 20:19:30 2016
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!