网站建设流程图解,wordpress博客发布软件,产品品牌策划方案,微信网站建设价格计算节点上iptables安全组分析
之前介绍过neutron 安全组基于iptables 和 ct 实现#xff0c;分析一下计算节点上面的neutron 安全组的iptables#xff0c;加深一下理解iptables以及安全组的实现。#xff08;PS: 如下基于openstack stein)
查看某计算节点上面的iptables
…计算节点上iptables安全组分析
之前介绍过neutron 安全组基于iptables 和 ct 实现分析一下计算节点上面的neutron 安全组的iptables加深一下理解iptables以及安全组的实现。PS: 如下基于openstack stein)
查看某计算节点上面的iptables
#iptables -nvL分别查看INPUT /FORWARD/OUTPUT 链的规则查看iptables发现INPUT/FORWARD都有规则
1、INPUT 链
概况来说虚机的INPUT规则全都转给了虚机的安全组链
Chain INPUT (policy ACCEPT 4914K packets, 2696M bytes)pkts bytes target prot opt in out source destination 251M 48G neutron-openvswi-INPUT all -- * * 0.0.0.0/0 0.0.0.0/0 INPUT 链将来源是所有的都转给了 neutron-openvswi-INPUT 子链
Chain neutron-openvswi-INPUT (1 references)pkts bytes target prot opt in out source destination 0 0 neutron-openvswi-o323ef4ca-8 all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap323ef4ca-8a --physdev-is-bridged /* Direct incoming traffic from VM to the security group chain. */0 0 neutron-openvswi-oa937d188-d all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tapa937d188-d6 --physdev-is-bridged /* Direct incoming traffic from VM to the security group chain. */由上面可以看出neutron-openvswi-INPUT链中将来自是 tap323ef4ca-8a和 tapa937d188-d6的流入转给了neutron-openvswi-o323ef4ca-8和 neutron-openvswi-oa937d188-d 两个安全组子链再看下这俩安全组子链
Chain neutron-openvswi-o323ef4ca-8 (2 references)pkts bytes target prot opt in out source destination 2 656 RETURN udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:67 /* Allow DHCP client traffic. */460K 109M neutron-openvswi-s323ef4ca-8 all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:68 dpt:67 /* Allow DHCP client traffic. */0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 /* Prevent DHCP Spoofing by VM. */231K 94M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */229K 15M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 /* priority:1 */0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */
Chain neutron-openvswi-oa937d188-d (2 references)pkts bytes target prot opt in out source destination 2 656 RETURN udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:67 /* Allow DHCP client traffic. */428K 108M neutron-openvswi-sa937d188-d all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:68 dpt:67 /* Allow DHCP client traffic. */0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 /* Prevent DHCP Spoofing by VM. */213K 94M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */215K 14M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 /* priority:1 */0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */**2. FORWARD链 **
FORWARD 链先跳到neutron-filter-top子链上neutron-filter-top链会又跳到neutron-openvswi-local而neutron-openvswi-local链是空链因此会返回到母链 FORWARD 上因此这里第一条规则其实没啥用。
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)pkts bytes target prot opt in out source destination
1505K 824M neutron-filter-top all -- * * 0.0.0.0/0 0.0.0.0/0
1505K 824M neutron-openvswi-FORWARD all -- * * 0.0.0.0/0 0.0.0.0/0 700 75498 DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0 700 75498 DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0 420 44194 ACCEPT all -- * * 192.168.1.0/24 0.0.0.0/0 280 31304 ACCEPT all -- * * 0.0.0.0/0 192.168.1.0/24 Chain neutron-filter-top (2 references)pkts bytes target prot opt in out source destination 283M 57G neutron-openvswi-local all -- * * 0.0.0.0/0 0.0.0.0/0 Chain neutron-openvswi-local (1 references)pkts bytes target prot opt in out source destination返回到 FORWARD 链后继续匹配第 2 条规则跳转到了neutron-openvswi-FORWARD我们查看该链的规则:
Chain neutron-openvswi-FORWARD (1 references)pkts bytes target prot opt in out source destination 334K 306M neutron-openvswi-sg-chain all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap323ef4ca-8a --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */482K 115M neutron-openvswi-sg-chain all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap323ef4ca-8a --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */309K 304M neutron-openvswi-sg-chain all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tapa937d188-d6 --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */449K 114M neutron-openvswi-sg-chain all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tapa937d188-d6 --physdev-is-bridged /* Direct traffic from the VM interface to the security group chain. */0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap344c3926-f5 --physdev-is-bridged /* Accept all packets when port is trusted. */0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap344c3926-f5 --physdev-is-bridged /* Accept all packets when port is trusted. */该链上一共有 6条规则前4条都是虚机port对应的tap设备网卡的进出规则。
tapa937d188-d6是虚拟机 port 对应的 tap 设备名称为 tapportUUID 前 11 位)前4条 规则表明无论是从这个 tap 设备进的还是出的包都进入子链neutron-openvswi-sg-chain处理。
我们继续查看neutron-openvswi-sg-chain查看链:
Chain neutron-openvswi-sg-chain (4 references)pkts bytes target prot opt in out source destination 334K 306M neutron-openvswi-i323ef4ca-8 all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tap323ef4ca-8a --physdev-is-bridged /* Jump to the VM specific chain. */482K 115M neutron-openvswi-o323ef4ca-8 all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tap323ef4ca-8a --physdev-is-bridged /* Jump to the VM specific chain. */309K 304M neutron-openvswi-ia937d188-d all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-out tapa937d188-d6 --physdev-is-bridged /* Jump to the VM specific chain. */449K 114M neutron-openvswi-oa937d188-d all -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in tapa937d188-d6 --physdev-is-bridged /* Jump to the VM specific chain. */
1574K 839M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 从规则我们可以看出
--physdev-out表示从 tapa937d188-d6出来发往虚拟机的包通过子链neutron-openvswi-ia937d188-d处理即虚拟机入访流量。--physdev-in表示从虚拟机发出进入 tap323ef4ca-8a 的包通过子链neutron-openvswi-i323ef4ca-8处理即虚拟机出访流量。
**2.1 安全组入方向规则 **
Chain neutron-openvswi-ia937d188-d (1 references)pkts bytes target prot opt in out source destination 309K 304M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */0 0 RETURN udp -- * * 0.0.0.0/0 172.16.1.118 udp spt:67 dpt:68 /* priority:1 */2 684 RETURN udp -- * * 0.0.0.0/0 255.255.255.255 udp spt:67 dpt:68 /* priority:1 */5 436 RETURN icmp -- * * 0.0.0.0/0 0.0.0.0/0 /* priority:1 */78 3160 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 /* priority:1 */0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 /* priority:1 */0 0 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp multiport dports 1:65535 /* priority:1 */0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp multiport dports 1:65535 /* priority:1 */0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */**2.1 安全组出方向规则 **
Chain neutron-openvswi-oa937d188-d (2 references)pkts bytes target prot opt in out source destination 2 656 RETURN udp -- * * 0.0.0.0 255.255.255.255 udp spt:68 dpt:67 /* Allow DHCP client traffic. */449K 114M neutron-openvswi-sa937d188-d all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 RETURN udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:68 dpt:67 /* Allow DHCP client traffic. */0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp spt:67 dpt:68 /* Prevent DHCP Spoofing by VM. */222K 99M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED /* Direct packets associated with a known session to the RETURN chain. */226K 15M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0 /* priority:1 */0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID /* Drop packets that appear related to an existing connection (e.g. TCP ACK/FIN) but do not have an entry in conntrack. */0 0 neutron-openvswi-sg-fallback all -- * * 0.0.0.0/0 0.0.0.0/0 /* Send unmatched traffic to the fallback chain. */
