API tools faq
paste
s_schultchen

serv3c_pst_net.txt

s_schultchen
Dec 16th, 2016
148
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 14.36 KB | None | 0 0
raw download clone embed print report
  1. ############ ip a
  2. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  3. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  4. inet 127.0.0.1/8 scope host lo
  5. valid_lft forever preferred_lft forever
  6. inet6 ::1/128 scope host
  7. valid_lft forever preferred_lft forever
  8. 2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UP qlen 1000
  9. link/ether d0:50:99:a8:3b:c2 brd ff:ff:ff:ff:ff:ff
  10. inet 10.0.0.121/24 brd 10.0.0.255 scope global dynamic enp3s0
  11. valid_lft 34531sec preferred_lft 34531sec
  12. inet6 fe80::d250:99ff:fea8:3bc2/64 scope link
  13. valid_lft forever preferred_lft forever
  14. 3: enp3s0.4@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master ovs-system state UP qlen 1000
  15. link/ether d0:50:99:a8:3b:c2 brd ff:ff:ff:ff:ff:ff
  16. inet6 fe80::d250:99ff:fea8:3bc2/64 scope link
  17. valid_lft forever preferred_lft forever
  18. 4: enp3s0.5@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  19. link/ether d0:50:99:a8:3b:c2 brd ff:ff:ff:ff:ff:ff
  20. inet6 fe80::d250:99ff:fea8:3bc2/64 scope link
  21. valid_lft forever preferred_lft forever
  22. 5: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  23. link/ether 0e:50:95:ea:e1:2a brd ff:ff:ff:ff:ff:ff
  24. 8: br-int: <BROADCAST,MULTICAST> mtu 1450 qdisc noop state DOWN qlen 1000
  25. link/ether c2:67:99:47:a4:44 brd ff:ff:ff:ff:ff:ff
  26. 10: vxlan_sys_4789: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65470 qdisc noqueue master ovs-system state UNKNOWN qlen 1000
  27. link/ether 0e:e4:29:00:f8:06 brd ff:ff:ff:ff:ff:ff
  28. 11: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  29. link/ether 5a:e9:72:7f:ec:48 brd ff:ff:ff:ff:ff:ff
  30. 12: br-provider: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  31. link/ether d0:50:99:a8:3b:c2 brd ff:ff:ff:ff:ff:ff
  32. 16: qbr9241893d-c3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP qlen 1000
  33. link/ether e2:17:72:53:d6:3f brd ff:ff:ff:ff:ff:ff
  34. 17: qvo9241893d-c3@qvb9241893d-c3: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP qlen 1000
  35. link/ether 62:0e:d9:d2:a8:87 brd ff:ff:ff:ff:ff:ff
  36. inet6 fe80::600e:d9ff:fed2:a887/64 scope link
  37. valid_lft forever preferred_lft forever
  38. 18: qvb9241893d-c3@qvo9241893d-c3: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master qbr9241893d-c3 state UP qlen 1000
  39. link/ether e2:17:72:53:d6:3f brd ff:ff:ff:ff:ff:ff
  40. inet6 fe80::e017:72ff:fe53:d63f/64 scope link
  41. valid_lft forever preferred_lft forever
  42. 19: tap9241893d-c3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master qbr9241893d-c3 state UNKNOWN qlen 1000
  43. link/ether fe:16:3e:8a:3e:53 brd ff:ff:ff:ff:ff:ff
  44. inet6 fe80::fc16:3eff:fe8a:3e53/64 scope link
  45. valid_lft forever preferred_lft forever
  46.  
  47.  
  48. ############ ip r
  49. default via 10.0.0.1 dev enp3s0 proto static metric 100
  50. 10.0.0.0/24 dev enp3s0 proto kernel scope link src 10.0.0.121 metric 100
  51.  
  52.  
  53. ############ ip netns
  54. qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41
  55. qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e
  56. qdhcp-8b050beb-3e0e-40ee-a74c-588ba57fd882
  57. ############ ip netns exec NAMESPACE ip a
  58.  
  59.  
  60. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip a
  61. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  62. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  63. inet 127.0.0.1/8 scope host lo
  64. valid_lft forever preferred_lft forever
  65. inet6 ::1/128 scope host
  66. valid_lft forever preferred_lft forever
  67. 20: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  68. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  69. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  70. valid_lft forever preferred_lft forever
  71. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  72. valid_lft forever preferred_lft forever
  73.  
  74.  
  75.  
  76. ############ip netns exec qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e ip a
  77. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  78. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  79. inet 127.0.0.1/8 scope host lo
  80. valid_lft forever preferred_lft forever
  81. inet6 ::1/128 scope host
  82. valid_lft forever preferred_lft forever
  83. 14: tapc0f9b952-3e: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1000
  84. link/ether fa:16:3e:b7:9d:21 brd ff:ff:ff:ff:ff:ff
  85. inet 10.0.1.101/24 brd 10.0.1.255 scope global tapc0f9b952-3e
  86. valid_lft forever preferred_lft forever
  87. inet 169.254.169.254/16 brd 169.254.255.255 scope global tapc0f9b952-3e
  88. valid_lft forever preferred_lft forever
  89. inet6 fe80::f816:3eff:feb7:9d21/64 scope link
  90. valid_lft forever preferred_lft forever
  91.  
  92.  
  93.  
  94. ############ip netns exec qdhcp-8b050beb-3e0e-40ee-a74c-588ba57fd882 ip a
  95. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  96. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  97. inet 127.0.0.1/8 scope host lo
  98. valid_lft forever preferred_lft forever
  99. inet6 ::1/128 scope host
  100. valid_lft forever preferred_lft forever
  101. 13: tap9ccf8713-c3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  102. link/ether fa:16:3e:84:5e:e9 brd ff:ff:ff:ff:ff:ff
  103. inet 10.0.12.3/24 brd 10.0.12.255 scope global tap9ccf8713-c3
  104. valid_lft forever preferred_lft forever
  105. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap9ccf8713-c3
  106. valid_lft forever preferred_lft forever
  107. inet6 fe80::f816:3eff:fe84:5ee9/64 scope link
  108. valid_lft forever preferred_lft forever
  109.  
  110. ############ ip netns exec NAMESPACE ip r
  111.  
  112.  
  113. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip r
  114. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  115. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  116. inet 127.0.0.1/8 scope host lo
  117. valid_lft forever preferred_lft forever
  118. inet6 ::1/128 scope host
  119. valid_lft forever preferred_lft forever
  120. 20: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  121. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  122. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  123. valid_lft forever preferred_lft forever
  124. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  125. valid_lft forever preferred_lft forever
  126.  
  127.  
  128.  
  129. ############ip netns exec qdhcp-dfd8f472-a79a-4344-a2e6-ad7d303ad51e ip r
  130. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  131. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  132. inet 127.0.0.1/8 scope host lo
  133. valid_lft forever preferred_lft forever
  134. inet6 ::1/128 scope host
  135. valid_lft forever preferred_lft forever
  136. 14: tapc0f9b952-3e: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN qlen 1000
  137. link/ether fa:16:3e:b7:9d:21 brd ff:ff:ff:ff:ff:ff
  138. inet 10.0.1.101/24 brd 10.0.1.255 scope global tapc0f9b952-3e
  139. valid_lft forever preferred_lft forever
  140. inet 169.254.169.254/16 brd 169.254.255.255 scope global tapc0f9b952-3e
  141. valid_lft forever preferred_lft forever
  142. inet6 fe80::f816:3eff:feb7:9d21/64 scope link
  143. valid_lft forever preferred_lft forever
  144.  
  145.  
  146.  
  147. ############ip netns exec qdhcp-8b050beb-3e0e-40ee-a74c-588ba57fd882 ip r
  148. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  149. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  150. inet 127.0.0.1/8 scope host lo
  151. valid_lft forever preferred_lft forever
  152. inet6 ::1/128 scope host
  153. valid_lft forever preferred_lft forever
  154. 13: tap9ccf8713-c3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  155. link/ether fa:16:3e:84:5e:e9 brd ff:ff:ff:ff:ff:ff
  156. inet 10.0.12.3/24 brd 10.0.12.255 scope global tap9ccf8713-c3
  157. valid_lft forever preferred_lft forever
  158. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap9ccf8713-c3
  159. valid_lft forever preferred_lft forever
  160. inet6 fe80::f816:3eff:fe84:5ee9/64 scope link
  161. valid_lft forever preferred_lft forever
  162.  
  163. ############ iptables-save
  164. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:33 2016
  165. *raw
  166. :PREROUTING ACCEPT [334288:119318314]
  167. :OUTPUT ACCEPT [303126:72357351]
  168. :neutron-openvswi-OUTPUT - [0:0]
  169. :neutron-openvswi-PREROUTING - [0:0]
  170. -A PREROUTING -j neutron-openvswi-PREROUTING
  171. -A OUTPUT -j neutron-openvswi-OUTPUT
  172. -A neutron-openvswi-PREROUTING -m physdev --physdev-in qvb9241893d-c3 -j CT --zone 1
  173. -A neutron-openvswi-PREROUTING -m physdev --physdev-in tap9241893d-c3 -j CT --zone 1
  174. COMMIT
  175. # Completed on Fri Dec 16 20:19:33 2016
  176. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:33 2016
  177. *nat
  178. :PREROUTING ACCEPT [786:98760]
  179. :INPUT ACCEPT [756:95615]
  180. :OUTPUT ACCEPT [3405:251079]
  181. :POSTROUTING ACCEPT [3430:253749]
  182. :neutron-openvswi-OUTPUT - [0:0]
  183. :neutron-openvswi-POSTROUTING - [0:0]
  184. :neutron-openvswi-PREROUTING - [0:0]
  185. :neutron-openvswi-float-snat - [0:0]
  186. :neutron-openvswi-snat - [0:0]
  187. :neutron-postrouting-bottom - [0:0]
  188. -A PREROUTING -j neutron-openvswi-PREROUTING
  189. -A OUTPUT -j neutron-openvswi-OUTPUT
  190. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  191. -A POSTROUTING -j neutron-postrouting-bottom
  192. -A neutron-openvswi-snat -j neutron-openvswi-float-snat
  193. -A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-openvswi-snat
  194. COMMIT
  195. # Completed on Fri Dec 16 20:19:34 2016
  196. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:34 2016
  197. *mangle
  198. :PREROUTING ACCEPT [334288:119318314]
  199. :INPUT ACCEPT [334077:119298510]
  200. :FORWARD ACCEPT [224:25161]
  201. :OUTPUT ACCEPT [303126:72357351]
  202. :POSTROUTING ACCEPT [303350:72382512]
  203. :neutron-openvswi-FORWARD - [0:0]
  204. :neutron-openvswi-INPUT - [0:0]
  205. :neutron-openvswi-OUTPUT - [0:0]
  206. :neutron-openvswi-POSTROUTING - [0:0]
  207. :neutron-openvswi-PREROUTING - [0:0]
  208. :neutron-openvswi-mark - [0:0]
  209. -A PREROUTING -j neutron-openvswi-PREROUTING
  210. -A INPUT -j neutron-openvswi-INPUT
  211. -A FORWARD -j neutron-openvswi-FORWARD
  212. -A OUTPUT -j neutron-openvswi-OUTPUT
  213. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  214. -A neutron-openvswi-PREROUTING -j neutron-openvswi-mark
  215. COMMIT
  216. # Completed on Fri Dec 16 20:19:34 2016
  217. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:34 2016
  218. *filter
  219. :INPUT ACCEPT [334077:119298510]
  220. :FORWARD ACCEPT [0:0]
  221. :OUTPUT ACCEPT [303126:72357351]
  222. :neutron-filter-top - [0:0]
  223. :neutron-openvswi-FORWARD - [0:0]
  224. :neutron-openvswi-INPUT - [0:0]
  225. :neutron-openvswi-OUTPUT - [0:0]
  226. :neutron-openvswi-i9241893d-c - [0:0]
  227. :neutron-openvswi-local - [0:0]
  228. :neutron-openvswi-o9241893d-c - [0:0]
  229. :neutron-openvswi-s9241893d-c - [0:0]
  230. :neutron-openvswi-sg-chain - [0:0]
  231. :neutron-openvswi-sg-fallback - [0:0]
  232. -A INPUT -j neutron-openvswi-INPUT
  233. -A FORWARD -j neutron-filter-top
  234. -A FORWARD -j neutron-openvswi-FORWARD
  235. -A OUTPUT -j neutron-filter-top
  236. -A OUTPUT -j neutron-openvswi-OUTPUT
  237. -A neutron-filter-top -j neutron-openvswi-local
  238. -A neutron-openvswi-FORWARD -m physdev --physdev-out tap9241893d-c3 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  239. -A neutron-openvswi-FORWARD -m physdev --physdev-in tap9241893d-c3 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  240. -A neutron-openvswi-INPUT -m physdev --physdev-in tap9241893d-c3 --physdev-is-bridged -m comment --comment "Direct incoming traffic from VM to the security group chain." -j neutron-openvswi-o9241893d-c
  241. -A neutron-openvswi-i9241893d-c -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  242. -A neutron-openvswi-i9241893d-c -s 10.0.12.4/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  243. -A neutron-openvswi-i9241893d-c -s 10.0.12.3/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  244. -A neutron-openvswi-i9241893d-c -s 10.0.12.2/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  245. -A neutron-openvswi-i9241893d-c -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  246. -A neutron-openvswi-i9241893d-c -p icmp -j RETURN
  247. -A neutron-openvswi-i9241893d-c -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  248. -A neutron-openvswi-i9241893d-c -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  249. -A neutron-openvswi-i9241893d-c -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  250. -A neutron-openvswi-o9241893d-c -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  251. -A neutron-openvswi-o9241893d-c -j neutron-openvswi-s9241893d-c
  252. -A neutron-openvswi-o9241893d-c -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  253. -A neutron-openvswi-o9241893d-c -p udp -m udp --sport 67 -m udp --dport 68 -m comment --comment "Prevent DHCP Spoofing by VM." -j DROP
  254. -A neutron-openvswi-o9241893d-c -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  255. -A neutron-openvswi-o9241893d-c -p icmp -j RETURN
  256. -A neutron-openvswi-o9241893d-c -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  257. -A neutron-openvswi-o9241893d-c -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  258. -A neutron-openvswi-o9241893d-c -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  259. -A neutron-openvswi-o9241893d-c -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  260. -A neutron-openvswi-s9241893d-c -s 10.0.12.16/32 -m mac --mac-source FA:16:3E:8A:3E:53 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
  261. -A neutron-openvswi-s9241893d-c -m comment --comment "Drop traffic without an IP/MAC allow rule." -j DROP
  262. -A neutron-openvswi-sg-chain -m physdev --physdev-out tap9241893d-c3 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-i9241893d-c
  263. -A neutron-openvswi-sg-chain -m physdev --physdev-in tap9241893d-c3 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-o9241893d-c
  264. -A neutron-openvswi-sg-chain -j ACCEPT
  265. -A neutron-openvswi-sg-fallback -m comment --comment "Default drop rule for unmatched traffic." -j DROP
  266. COMMIT
  267. # Completed on Fri Dec 16 20:19:34 2016
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!