API tools faq
paste
s_schultchen

serv3b_pst_net.txt

s_schultchen
Dec 16th, 2016
150
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.92 KB | None | 0 0
raw download clone embed print report
  1. ############ ip a
  2. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  3. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  4. inet 127.0.0.1/8 scope host lo
  5. valid_lft forever preferred_lft forever
  6. inet6 ::1/128 scope host
  7. valid_lft forever preferred_lft forever
  8. 2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UP qlen 1000
  9. link/ether d0:50:99:a8:3a:7a brd ff:ff:ff:ff:ff:ff
  10. inet 10.0.0.115/24 brd 10.0.0.255 scope global dynamic enp3s0
  11. valid_lft 34535sec preferred_lft 34535sec
  12. inet6 fe80::d250:99ff:fea8:3a7a/64 scope link
  13. valid_lft forever preferred_lft forever
  14. 3: enp3s0.5@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  15. link/ether d0:50:99:a8:3a:7a brd ff:ff:ff:ff:ff:ff
  16. inet6 fe80::d250:99ff:fea8:3a7a/64 scope link
  17. valid_lft forever preferred_lft forever
  18. 4: enp3s0.4@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master ovs-system state UP qlen 1000
  19. link/ether d0:50:99:a8:3a:7a brd ff:ff:ff:ff:ff:ff
  20. inet6 fe80::d250:99ff:fea8:3a7a/64 scope link
  21. valid_lft forever preferred_lft forever
  22. 5: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  23. link/ether 0a:b2:9c:07:cf:01 brd ff:ff:ff:ff:ff:ff
  24. 7: br-int: <BROADCAST,MULTICAST> mtu 1450 qdisc noop state DOWN qlen 1000
  25. link/ether 3a:42:ab:91:fd:44 brd ff:ff:ff:ff:ff:ff
  26. 8: vxlan_sys_4789: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65470 qdisc noqueue master ovs-system state UNKNOWN qlen 1000
  27. link/ether be:5e:0c:8b:58:d5 brd ff:ff:ff:ff:ff:ff
  28. 9: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  29. link/ether ca:2c:18:20:8a:4f brd ff:ff:ff:ff:ff:ff
  30. 10: br-provider: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  31. link/ether d0:50:99:a8:3a:7a brd ff:ff:ff:ff:ff:ff
  32. 12: qbrd35a232f-c1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP qlen 1000
  33. link/ether d6:1d:f1:8e:44:83 brd ff:ff:ff:ff:ff:ff
  34. 13: qvod35a232f-c1@qvbd35a232f-c1: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP qlen 1000
  35. link/ether 2a:03:05:8c:d8:32 brd ff:ff:ff:ff:ff:ff
  36. inet6 fe80::2803:5ff:fe8c:d832/64 scope link
  37. valid_lft forever preferred_lft forever
  38. 14: qvbd35a232f-c1@qvod35a232f-c1: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master qbrd35a232f-c1 state UP qlen 1000
  39. link/ether d6:1d:f1:8e:44:83 brd ff:ff:ff:ff:ff:ff
  40. inet6 fe80::d41d:f1ff:fe8e:4483/64 scope link
  41. valid_lft forever preferred_lft forever
  42. 15: tapd35a232f-c1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master qbrd35a232f-c1 state UNKNOWN qlen 1000
  43. link/ether fe:16:3e:4d:fe:b6 brd ff:ff:ff:ff:ff:ff
  44. inet6 fe80::fc16:3eff:fe4d:feb6/64 scope link
  45. valid_lft forever preferred_lft forever
  46.  
  47.  
  48. ############ ip r
  49. default via 10.0.0.1 dev enp3s0 proto static metric 100
  50. 10.0.0.0/24 dev enp3s0 proto kernel scope link src 10.0.0.115 metric 100
  51.  
  52.  
  53. ############ ip netns
  54. qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41
  55. ############ ip netns exec NAMESPACE ip a
  56.  
  57.  
  58. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip a
  59. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  60. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  61. inet 127.0.0.1/8 scope host lo
  62. valid_lft forever preferred_lft forever
  63. inet6 ::1/128 scope host
  64. valid_lft forever preferred_lft forever
  65. 16: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  66. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  67. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  68. valid_lft forever preferred_lft forever
  69. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  70. valid_lft forever preferred_lft forever
  71.  
  72. ############ ip netns exec NAMESPACE ip r
  73.  
  74.  
  75. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip r
  76. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  77. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  78. inet 127.0.0.1/8 scope host lo
  79. valid_lft forever preferred_lft forever
  80. inet6 ::1/128 scope host
  81. valid_lft forever preferred_lft forever
  82. 16: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  83. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  84. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  85. valid_lft forever preferred_lft forever
  86. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  87. valid_lft forever preferred_lft forever
  88.  
  89. ############ iptables-save
  90. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:31 2016
  91. *nat
  92. :PREROUTING ACCEPT [717:92345]
  93. :INPUT ACCEPT [687:89200]
  94. :OUTPUT ACCEPT [2648:188471]
  95. :POSTROUTING ACCEPT [2673:191141]
  96. :neutron-openvswi-OUTPUT - [0:0]
  97. :neutron-openvswi-POSTROUTING - [0:0]
  98. :neutron-openvswi-PREROUTING - [0:0]
  99. :neutron-openvswi-float-snat - [0:0]
  100. :neutron-openvswi-snat - [0:0]
  101. :neutron-postrouting-bottom - [0:0]
  102. -A PREROUTING -j neutron-openvswi-PREROUTING
  103. -A OUTPUT -j neutron-openvswi-OUTPUT
  104. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  105. -A POSTROUTING -j neutron-postrouting-bottom
  106. -A neutron-openvswi-snat -j neutron-openvswi-float-snat
  107. -A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-openvswi-snat
  108. COMMIT
  109. # Completed on Fri Dec 16 20:19:31 2016
  110. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:31 2016
  111. *mangle
  112. :PREROUTING ACCEPT [316331:115338872]
  113. :INPUT ACCEPT [316120:115319068]
  114. :FORWARD ACCEPT [224:25161]
  115. :OUTPUT ACCEPT [283790:87978935]
  116. :POSTROUTING ACCEPT [284014:88004096]
  117. :neutron-openvswi-FORWARD - [0:0]
  118. :neutron-openvswi-INPUT - [0:0]
  119. :neutron-openvswi-OUTPUT - [0:0]
  120. :neutron-openvswi-POSTROUTING - [0:0]
  121. :neutron-openvswi-PREROUTING - [0:0]
  122. :neutron-openvswi-mark - [0:0]
  123. -A PREROUTING -j neutron-openvswi-PREROUTING
  124. -A INPUT -j neutron-openvswi-INPUT
  125. -A FORWARD -j neutron-openvswi-FORWARD
  126. -A OUTPUT -j neutron-openvswi-OUTPUT
  127. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  128. -A neutron-openvswi-PREROUTING -j neutron-openvswi-mark
  129. COMMIT
  130. # Completed on Fri Dec 16 20:19:31 2016
  131. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:31 2016
  132. *raw
  133. :PREROUTING ACCEPT [316331:115338872]
  134. :OUTPUT ACCEPT [283790:87978935]
  135. :neutron-openvswi-OUTPUT - [0:0]
  136. :neutron-openvswi-PREROUTING - [0:0]
  137. -A PREROUTING -j neutron-openvswi-PREROUTING
  138. -A OUTPUT -j neutron-openvswi-OUTPUT
  139. -A neutron-openvswi-PREROUTING -m physdev --physdev-in qvbd35a232f-c1 -j CT --zone 1
  140. -A neutron-openvswi-PREROUTING -m physdev --physdev-in tapd35a232f-c1 -j CT --zone 1
  141. COMMIT
  142. # Completed on Fri Dec 16 20:19:31 2016
  143. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:31 2016
  144. *filter
  145. :INPUT ACCEPT [316126:115319686]
  146. :FORWARD ACCEPT [0:0]
  147. :OUTPUT ACCEPT [283796:87979553]
  148. :neutron-filter-top - [0:0]
  149. :neutron-openvswi-FORWARD - [0:0]
  150. :neutron-openvswi-INPUT - [0:0]
  151. :neutron-openvswi-OUTPUT - [0:0]
  152. :neutron-openvswi-id35a232f-c - [0:0]
  153. :neutron-openvswi-local - [0:0]
  154. :neutron-openvswi-od35a232f-c - [0:0]
  155. :neutron-openvswi-sd35a232f-c - [0:0]
  156. :neutron-openvswi-sg-chain - [0:0]
  157. :neutron-openvswi-sg-fallback - [0:0]
  158. -A INPUT -j neutron-openvswi-INPUT
  159. -A FORWARD -j neutron-filter-top
  160. -A FORWARD -j neutron-openvswi-FORWARD
  161. -A OUTPUT -j neutron-filter-top
  162. -A OUTPUT -j neutron-openvswi-OUTPUT
  163. -A neutron-filter-top -j neutron-openvswi-local
  164. -A neutron-openvswi-FORWARD -m physdev --physdev-out tapd35a232f-c1 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  165. -A neutron-openvswi-FORWARD -m physdev --physdev-in tapd35a232f-c1 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  166. -A neutron-openvswi-INPUT -m physdev --physdev-in tapd35a232f-c1 --physdev-is-bridged -m comment --comment "Direct incoming traffic from VM to the security group chain." -j neutron-openvswi-od35a232f-c
  167. -A neutron-openvswi-id35a232f-c -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  168. -A neutron-openvswi-id35a232f-c -s 10.0.12.4/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  169. -A neutron-openvswi-id35a232f-c -s 10.0.12.3/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  170. -A neutron-openvswi-id35a232f-c -s 10.0.12.2/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  171. -A neutron-openvswi-id35a232f-c -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  172. -A neutron-openvswi-id35a232f-c -p icmp -j RETURN
  173. -A neutron-openvswi-id35a232f-c -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  174. -A neutron-openvswi-id35a232f-c -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  175. -A neutron-openvswi-id35a232f-c -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  176. -A neutron-openvswi-od35a232f-c -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  177. -A neutron-openvswi-od35a232f-c -j neutron-openvswi-sd35a232f-c
  178. -A neutron-openvswi-od35a232f-c -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  179. -A neutron-openvswi-od35a232f-c -p udp -m udp --sport 67 -m udp --dport 68 -m comment --comment "Prevent DHCP Spoofing by VM." -j DROP
  180. -A neutron-openvswi-od35a232f-c -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  181. -A neutron-openvswi-od35a232f-c -p icmp -j RETURN
  182. -A neutron-openvswi-od35a232f-c -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  183. -A neutron-openvswi-od35a232f-c -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  184. -A neutron-openvswi-od35a232f-c -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  185. -A neutron-openvswi-od35a232f-c -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  186. -A neutron-openvswi-sd35a232f-c -s 10.0.12.18/32 -m mac --mac-source FA:16:3E:4D:FE:B6 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
  187. -A neutron-openvswi-sd35a232f-c -m comment --comment "Drop traffic without an IP/MAC allow rule." -j DROP
  188. -A neutron-openvswi-sg-chain -m physdev --physdev-out tapd35a232f-c1 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-id35a232f-c
  189. -A neutron-openvswi-sg-chain -m physdev --physdev-in tapd35a232f-c1 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-od35a232f-c
  190. -A neutron-openvswi-sg-chain -j ACCEPT
  191. -A neutron-openvswi-sg-fallback -m comment --comment "Default drop rule for unmatched traffic." -j DROP
  192. COMMIT
  193. # Completed on Fri Dec 16 20:19:31 2016
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!