API tools faq
paste
s_schultchen

serv3a_pst_net.txt

s_schultchen
Dec 16th, 2016
158
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 12.63 KB | None | 0 0
raw download clone embed print report
  1. ############ ip a
  2. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  3. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  4. inet 127.0.0.1/8 scope host lo
  5. valid_lft forever preferred_lft forever
  6. inet6 ::1/128 scope host
  7. valid_lft forever preferred_lft forever
  8. 2: enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9000 qdisc pfifo_fast state UP qlen 1000
  9. link/ether d0:50:99:a3:b0:cc brd ff:ff:ff:ff:ff:ff
  10. inet 10.0.0.109/24 brd 10.0.0.255 scope global dynamic enp3s0
  11. valid_lft 34532sec preferred_lft 34532sec
  12. inet6 fe80::d250:99ff:fea3:b0cc/64 scope link
  13. valid_lft forever preferred_lft forever
  14. 3: enp3s0.5@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP qlen 1000
  15. link/ether d0:50:99:a3:b0:cc brd ff:ff:ff:ff:ff:ff
  16. inet6 fe80::d250:99ff:fea3:b0cc/64 scope link
  17. valid_lft forever preferred_lft forever
  18. 4: enp3s0.4@enp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master ovs-system state UP qlen 1000
  19. link/ether d0:50:99:a3:b0:cc brd ff:ff:ff:ff:ff:ff
  20. inet6 fe80::d250:99ff:fea3:b0cc/64 scope link
  21. valid_lft forever preferred_lft forever
  22. 5: ovs-system: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  23. link/ether 0a:b6:1a:0f:26:03 brd ff:ff:ff:ff:ff:ff
  24. 6: vxlan_sys_4789: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 65470 qdisc noqueue master ovs-system state UNKNOWN qlen 1000
  25. link/ether ca:74:ec:bb:76:e0 brd ff:ff:ff:ff:ff:ff
  26. 7: br-tun: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  27. link/ether 96:04:22:4a:9e:40 brd ff:ff:ff:ff:ff:ff
  28. 10: br-int: <BROADCAST,MULTICAST> mtu 1450 qdisc noop state DOWN qlen 1000
  29. link/ether 7e:e6:59:55:d5:40 brd ff:ff:ff:ff:ff:ff
  30. 11: br-provider: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
  31. link/ether d0:50:99:a3:b0:cc brd ff:ff:ff:ff:ff:ff
  32. 14: qbr3ad7bfef-96: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UP qlen 1000
  33. link/ether 52:5a:db:ed:dc:3f brd ff:ff:ff:ff:ff:ff
  34. 15: qvo3ad7bfef-96@qvb3ad7bfef-96: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master ovs-system state UP qlen 1000
  35. link/ether 66:a9:47:a1:c9:04 brd ff:ff:ff:ff:ff:ff
  36. inet6 fe80::64a9:47ff:fea1:c904/64 scope link
  37. valid_lft forever preferred_lft forever
  38. 16: qvb3ad7bfef-96@qvo3ad7bfef-96: <BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP> mtu 1450 qdisc noqueue master qbr3ad7bfef-96 state UP qlen 1000
  39. link/ether 52:5a:db:ed:dc:3f brd ff:ff:ff:ff:ff:ff
  40. inet6 fe80::505a:dbff:feed:dc3f/64 scope link
  41. valid_lft forever preferred_lft forever
  42. 17: tap3ad7bfef-96: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc pfifo_fast master qbr3ad7bfef-96 state UNKNOWN qlen 1000
  43. link/ether fe:16:3e:ae:cb:89 brd ff:ff:ff:ff:ff:ff
  44. inet6 fe80::fc16:3eff:feae:cb89/64 scope link
  45. valid_lft forever preferred_lft forever
  46.  
  47.  
  48. ############ ip r
  49. default via 10.0.0.1 dev enp3s0 proto static metric 100
  50. 10.0.0.0/24 dev enp3s0 proto kernel scope link src 10.0.0.109 metric 100
  51.  
  52.  
  53. ############ ip netns
  54. qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41
  55. qdhcp-8b050beb-3e0e-40ee-a74c-588ba57fd882
  56. ############ ip netns exec NAMESPACE ip a
  57.  
  58.  
  59. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip a
  60. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  61. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  62. inet 127.0.0.1/8 scope host lo
  63. valid_lft forever preferred_lft forever
  64. inet6 ::1/128 scope host
  65. valid_lft forever preferred_lft forever
  66. 18: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  67. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  68. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  69. valid_lft forever preferred_lft forever
  70. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  71. valid_lft forever preferred_lft forever
  72.  
  73.  
  74.  
  75. ############ip netns exec qdhcp-8b050beb-3e0e-40ee-a74c-588ba57fd882 ip a
  76. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  77. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  78. inet 127.0.0.1/8 scope host lo
  79. valid_lft forever preferred_lft forever
  80. inet6 ::1/128 scope host
  81. valid_lft forever preferred_lft forever
  82. 12: tap200a7727-41: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  83. link/ether fa:16:3e:52:eb:3d brd ff:ff:ff:ff:ff:ff
  84. inet 10.0.12.4/24 brd 10.0.12.255 scope global tap200a7727-41
  85. valid_lft forever preferred_lft forever
  86. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap200a7727-41
  87. valid_lft forever preferred_lft forever
  88. inet6 fe80::f816:3eff:fe52:eb3d/64 scope link
  89. valid_lft forever preferred_lft forever
  90.  
  91. ############ ip netns exec NAMESPACE ip r
  92.  
  93.  
  94. ############ip netns exec qrouter-47b2f138-3130-4ab8-9c96-0f402190fe41 ip r
  95. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  96. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  97. inet 127.0.0.1/8 scope host lo
  98. valid_lft forever preferred_lft forever
  99. inet6 ::1/128 scope host
  100. valid_lft forever preferred_lft forever
  101. 18: qr-c08eeda3-3b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  102. link/ether fa:16:3e:1e:f9:ee brd ff:ff:ff:ff:ff:ff
  103. inet 10.0.12.1/24 brd 10.0.12.255 scope global qr-c08eeda3-3b
  104. valid_lft forever preferred_lft forever
  105. inet6 fe80::f816:3eff:fe1e:f9ee/64 scope link
  106. valid_lft forever preferred_lft forever
  107.  
  108.  
  109.  
  110. ############ip netns exec qdhcp-8b050beb-3e0e-40ee-a74c-588ba57fd882 ip r
  111. 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
  112. link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
  113. inet 127.0.0.1/8 scope host lo
  114. valid_lft forever preferred_lft forever
  115. inet6 ::1/128 scope host
  116. valid_lft forever preferred_lft forever
  117. 12: tap200a7727-41: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1450 qdisc noqueue state UNKNOWN qlen 1000
  118. link/ether fa:16:3e:52:eb:3d brd ff:ff:ff:ff:ff:ff
  119. inet 10.0.12.4/24 brd 10.0.12.255 scope global tap200a7727-41
  120. valid_lft forever preferred_lft forever
  121. inet 169.254.169.254/16 brd 169.254.255.255 scope global tap200a7727-41
  122. valid_lft forever preferred_lft forever
  123. inet6 fe80::f816:3eff:fe52:eb3d/64 scope link
  124. valid_lft forever preferred_lft forever
  125.  
  126. ############ iptables-save
  127. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:28 2016
  128. *nat
  129. :PREROUTING ACCEPT [586:84210]
  130. :INPUT ACCEPT [556:81065]
  131. :OUTPUT ACCEPT [3020:219810]
  132. :POSTROUTING ACCEPT [3045:222480]
  133. :neutron-openvswi-OUTPUT - [0:0]
  134. :neutron-openvswi-POSTROUTING - [0:0]
  135. :neutron-openvswi-PREROUTING - [0:0]
  136. :neutron-openvswi-float-snat - [0:0]
  137. :neutron-openvswi-snat - [0:0]
  138. :neutron-postrouting-bottom - [0:0]
  139. -A PREROUTING -j neutron-openvswi-PREROUTING
  140. -A OUTPUT -j neutron-openvswi-OUTPUT
  141. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  142. -A POSTROUTING -j neutron-postrouting-bottom
  143. -A neutron-openvswi-snat -j neutron-openvswi-float-snat
  144. -A neutron-postrouting-bottom -m comment --comment "Perform source NAT on outgoing traffic." -j neutron-openvswi-snat
  145. COMMIT
  146. # Completed on Fri Dec 16 20:19:28 2016
  147. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:28 2016
  148. *mangle
  149. :PREROUTING ACCEPT [295864:73094115]
  150. :INPUT ACCEPT [295653:73074311]
  151. :FORWARD ACCEPT [224:25161]
  152. :OUTPUT ACCEPT [268459:66486890]
  153. :POSTROUTING ACCEPT [268683:66512051]
  154. :neutron-openvswi-FORWARD - [0:0]
  155. :neutron-openvswi-INPUT - [0:0]
  156. :neutron-openvswi-OUTPUT - [0:0]
  157. :neutron-openvswi-POSTROUTING - [0:0]
  158. :neutron-openvswi-PREROUTING - [0:0]
  159. :neutron-openvswi-mark - [0:0]
  160. -A PREROUTING -j neutron-openvswi-PREROUTING
  161. -A INPUT -j neutron-openvswi-INPUT
  162. -A FORWARD -j neutron-openvswi-FORWARD
  163. -A OUTPUT -j neutron-openvswi-OUTPUT
  164. -A POSTROUTING -j neutron-openvswi-POSTROUTING
  165. -A neutron-openvswi-PREROUTING -j neutron-openvswi-mark
  166. COMMIT
  167. # Completed on Fri Dec 16 20:19:28 2016
  168. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:28 2016
  169. *raw
  170. :PREROUTING ACCEPT [295864:73094115]
  171. :OUTPUT ACCEPT [268459:66486890]
  172. :neutron-openvswi-OUTPUT - [0:0]
  173. :neutron-openvswi-PREROUTING - [0:0]
  174. -A PREROUTING -j neutron-openvswi-PREROUTING
  175. -A OUTPUT -j neutron-openvswi-OUTPUT
  176. -A neutron-openvswi-PREROUTING -m physdev --physdev-in qvb3ad7bfef-96 -j CT --zone 1
  177. -A neutron-openvswi-PREROUTING -m physdev --physdev-in tap3ad7bfef-96 -j CT --zone 1
  178. COMMIT
  179. # Completed on Fri Dec 16 20:19:28 2016
  180. # Generated by iptables-save v1.4.21 on Fri Dec 16 20:19:28 2016
  181. *filter
  182. :INPUT ACCEPT [295654:73074413]
  183. :FORWARD ACCEPT [0:0]
  184. :OUTPUT ACCEPT [268460:66486992]
  185. :neutron-filter-top - [0:0]
  186. :neutron-openvswi-FORWARD - [0:0]
  187. :neutron-openvswi-INPUT - [0:0]
  188. :neutron-openvswi-OUTPUT - [0:0]
  189. :neutron-openvswi-i3ad7bfef-9 - [0:0]
  190. :neutron-openvswi-local - [0:0]
  191. :neutron-openvswi-o3ad7bfef-9 - [0:0]
  192. :neutron-openvswi-s3ad7bfef-9 - [0:0]
  193. :neutron-openvswi-sg-chain - [0:0]
  194. :neutron-openvswi-sg-fallback - [0:0]
  195. -A INPUT -j neutron-openvswi-INPUT
  196. -A FORWARD -j neutron-filter-top
  197. -A FORWARD -j neutron-openvswi-FORWARD
  198. -A OUTPUT -j neutron-filter-top
  199. -A OUTPUT -j neutron-openvswi-OUTPUT
  200. -A neutron-filter-top -j neutron-openvswi-local
  201. -A neutron-openvswi-FORWARD -m physdev --physdev-out tap3ad7bfef-96 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  202. -A neutron-openvswi-FORWARD -m physdev --physdev-in tap3ad7bfef-96 --physdev-is-bridged -m comment --comment "Direct traffic from the VM interface to the security group chain." -j neutron-openvswi-sg-chain
  203. -A neutron-openvswi-INPUT -m physdev --physdev-in tap3ad7bfef-96 --physdev-is-bridged -m comment --comment "Direct incoming traffic from VM to the security group chain." -j neutron-openvswi-o3ad7bfef-9
  204. -A neutron-openvswi-i3ad7bfef-9 -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  205. -A neutron-openvswi-i3ad7bfef-9 -s 10.0.12.4/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  206. -A neutron-openvswi-i3ad7bfef-9 -s 10.0.12.3/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  207. -A neutron-openvswi-i3ad7bfef-9 -s 10.0.12.2/32 -p udp -m udp --sport 67 -m udp --dport 68 -j RETURN
  208. -A neutron-openvswi-i3ad7bfef-9 -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  209. -A neutron-openvswi-i3ad7bfef-9 -p icmp -j RETURN
  210. -A neutron-openvswi-i3ad7bfef-9 -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  211. -A neutron-openvswi-i3ad7bfef-9 -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  212. -A neutron-openvswi-i3ad7bfef-9 -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  213. -A neutron-openvswi-o3ad7bfef-9 -s 0.0.0.0/32 -d 255.255.255.255/32 -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  214. -A neutron-openvswi-o3ad7bfef-9 -j neutron-openvswi-s3ad7bfef-9
  215. -A neutron-openvswi-o3ad7bfef-9 -p udp -m udp --sport 68 --dport 67 -m comment --comment "Allow DHCP client traffic." -j RETURN
  216. -A neutron-openvswi-o3ad7bfef-9 -p udp -m udp --sport 67 -m udp --dport 68 -m comment --comment "Prevent DHCP Spoofing by VM." -j DROP
  217. -A neutron-openvswi-o3ad7bfef-9 -m state --state RELATED,ESTABLISHED -m comment --comment "Direct packets associated with a known session to the RETURN chain." -j RETURN
  218. -A neutron-openvswi-o3ad7bfef-9 -p icmp -j RETURN
  219. -A neutron-openvswi-o3ad7bfef-9 -p udp -m udp -m multiport --dports 1:65535 -j RETURN
  220. -A neutron-openvswi-o3ad7bfef-9 -p tcp -m tcp -m multiport --dports 1:65535 -j RETURN
  221. -A neutron-openvswi-o3ad7bfef-9 -m state --state INVALID -m comment --comment "Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack." -j DROP
  222. -A neutron-openvswi-o3ad7bfef-9 -m comment --comment "Send unmatched traffic to the fallback chain." -j neutron-openvswi-sg-fallback
  223. -A neutron-openvswi-s3ad7bfef-9 -s 10.0.12.15/32 -m mac --mac-source FA:16:3E:AE:CB:89 -m comment --comment "Allow traffic from defined IP/MAC pairs." -j RETURN
  224. -A neutron-openvswi-s3ad7bfef-9 -m comment --comment "Drop traffic without an IP/MAC allow rule." -j DROP
  225. -A neutron-openvswi-sg-chain -m physdev --physdev-out tap3ad7bfef-96 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-i3ad7bfef-9
  226. -A neutron-openvswi-sg-chain -m physdev --physdev-in tap3ad7bfef-96 --physdev-is-bridged -m comment --comment "Jump to the VM specific chain." -j neutron-openvswi-o3ad7bfef-9
  227. -A neutron-openvswi-sg-chain -j ACCEPT
  228. -A neutron-openvswi-sg-fallback -m comment --comment "Default drop rule for unmatched traffic." -j DROP
  229. COMMIT
  230. # Completed on Fri Dec 16 20:19:28 2016
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!