• (OK) CORE nodes access Internet—虚拟节点访问互联网—commands


    [root@localhost core]# systemctl start core-daemon.service

    ---------------------------------------------------------------------------
    [root@localhost core]# core-gui

    ----------------------
    /root/.core/configs/m-MPE-manet.imn
    ----------------------
    Under the Session Menu, the Options... dialog has an option to set a control network prefix.
    This can be set to a network prefix such as 172.16.0.0/24. A bridge will be created on the host machine having the last address in the prefix range (e.g. 172.16.0.254), and each node will have an extra ctrl0 control interface configured with an address corresponding to its node number (e.g. 172.16.0.3 for n3.)

    ----------------------
    [root@localhost core]# ifconfig
    enp13s0: flags=4163  mtu 1500
            inet 192.168.0.100  netmask 255.255.255.0  broadcast 192.168.0.255
            inet6 fe80::3e97:eff:fef0:b5bb  prefixlen 64  scopeid 0x20
            ether 3c:97:0e:f0:b5:bb  txqueuelen 1000  (Ethernet)
            RX packets 424786  bytes 474479916 (452.4 MiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 402854  bytes 46953257 (44.7 MiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    b.ctrl0net.6a: flags=4163  mtu 1500
            inet 172.16.0.254  netmask 255.255.255.0  broadcast 0.0.0.0
            inet6 fe80::bc49:1ff:fe27:a95  prefixlen 64  scopeid 0x20
            ether 16:32:81:19:ca:43  txqueuelen 1000  (Ethernet)
            RX packets 149  bytes 12753 (12.4 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 84  bytes 8808 (8.6 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    ----------------------
    [root@localhost core]# route -n
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    0.0.0.0         192.168.0.1     0.0.0.0         UG    100    0        0 enp13s0
    172.16.0.0      0.0.0.0         255.255.255.0   U     0      0        0 b.ctrl0net.6a
    192.168.0.0     0.0.0.0         255.255.255.0   U     100    0        0 enp13s0
    192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

    ----------------------
    [root@localhost 桌面]# . iptables_core.sh
    [root@localhost 桌面]# cat iptables_core.sh

    点击(此处)折叠或打开

    1. #!/bin/bash
    2. echo 1 > /proc/sys/net/ipv4/ip_forward
    3. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
    4. echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all
    5. echo 1 > /proc/sys/net/ipv4/tcp_syncookies

    7. #网卡：上外、下内
    8. #上外 192.168.0.100
    9. #下内 172.16.0.254
    10. #INET_IF="ppp0"
    11. INET_IF="enp13s0"
    12. LAN_IF="b.ctrl0net.6a"
    13. INET_IP="192.168.0.100"
    14. LAN_IP="172.16.0.254"
    15. LAN_IP_RANGE="172.16.0.0/24"
    16. #LAN_WWW="172.16.0.6"
    17. IPT="/sbin/iptables"
    18. #TC="/sbin/tc"
    19. MODPROBE="/sbin/modprobe"

    21. $MODPROBE ip_tables
    22. $MODPROBE iptable_nat
    23. $MODPROBE ip_nat_ftp
    24. $MODPROBE ip_nat_irc
    25. $MODPROBE ipt_mark
    26. $MODPROBE ip_conntrack
    27. $MODPROBE ip_conntrack_ftp
    28. $MODPROBE ip_conntrack_irc
    29. $MODPROBE ipt_MASQUERADE

    31. for TABLE in filter nat mangle ; do
    32. $IPT -t $TABLE -F
    33. $IPT -t $TABLE -X
    34. $IPT -t $TABLE -Z
    35. done

    37. $IPT -P INPUT DROP
    38. $IPT -P OUTPUT ACCEPT
    39. $IPT -P FORWARD DROP
    40. $IPT -t nat -P PREROUTING ACCEPT
    41. $IPT -t nat -P OUTPUT ACCEPT
    42. $IPT -t nat -P POSTROUTING ACCEPT

    44. # 拒绝INTERNET客户访问
    45. #$IPT -A INPUT -i $INET_IF -m state --state RELATED,ESTABLISHED -j ACCEPT
    46. $IPT -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    47. #$IPT -A INPUT -i $INET_IF -p tcp -s 123.5.0.0/16 --dport 22 -j ACCEPT
    48. $IPT -A INPUT -p tcp --dport 22 -j ACCEPT
    49. $IPT -A INPUT -i $INET_IF -m state --state NEW,INVALID -j DROP

    51. for DNS in $(grep ^n /etc/resolv.conf|awk '{print $2}'); do
    52. $IPT -A INPUT -p tcp -s $DNS --sport domain -j ACCEPT
    53. $IPT -A INPUT -p udp -s $DNS --sport domain -j ACCEPT
    54. done

    56. # anti bad scaning
    57. $IPT -A INPUT -i $INET_IF -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
    58. $IPT -A INPUT -i $INET_IF -p tcp --tcp-flags ALL ALL -j DROP
    59. $IPT -A INPUT -i $INET_IF -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP
    60. $IPT -A INPUT -i $INET_IF -p tcp --tcp-flags ALL NONE -j DROP
    61. $IPT -A INPUT -i $INET_IF -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
    62. $IPT -A INPUT -i $INET_IF -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP

    64. #$IPT -t nat -A PREROUTING -d $INET_IP -p tcp --dport 8008 -j DNAT --to-destination $LAN_WWW:8008
    65. #$IPT -t nat -A PREROUTING -d $INET_IP -p tcp --dport 22 -j DNAT --to-destination $LAN_WWW:22

    67. if [ $INET_IF = "ppp0" ] ; then
    68. $IPT -t nat -A POSTROUTING -o $INET_IF -s $LAN_IP_RANGE -j MASQUERADE
    69. else
    70. $IPT -t nat -A POSTROUTING -o $INET_IF -s $LAN_IP_RANGE -j SNAT --to-source $INET_IP
    71. fi

    73. #no limit
    74. #$IPT -A FORWARD -s 192.168.1.216 -m mac --mac-source 00:15:17:F7:AB:84 -j ACCEPT
    75. #$IPT -A FORWARD -d 192.168.1.216 -j ACCEPT

    77. #$IPT -A FORWARD -p tcp -d ! $LAN_IP_RANGE -m multiport --dports ! 20,21,22,25,53,80,110,443,8080 -j DROP
    78. #$IPT -A FORWARD -p udp -d ! $LAN_IP_RANGE -m multiport --dports ! 20,21,22,25,53,80,110,443,8080 -j DROP

    80. #MAC、IP地址绑定
    81. #$IPT -A FORWARD -s 192.168.1.11 -m mac --mac-source 44-87-FC-44-B9-6E -j ACCEPT

    83. $IPT -A FORWARD -s 172.16.0.1 -j ACCEPT
    84. $IPT -A FORWARD -s 172.16.0.2 -j ACCEPT
    85. $IPT -A FORWARD -s 172.16.0.3 -j ACCEPT
    86. $IPT -A FORWARD -s 172.16.0.4 -j ACCEPT
    87. $IPT -A FORWARD -s 172.16.0.5 -j ACCEPT
    88. $IPT -A FORWARD -s 172.16.0.6 -j ACCEPT
    89. $IPT -A FORWARD -s 172.16.0.7 -j ACCEPT
    90. $IPT -A FORWARD -s 172.16.0.8 -j ACCEPT
    91. $IPT -A FORWARD -s 172.16.0.9 -j ACCEPT
    92. $IPT -A FORWARD -s 172.16.0.10 -j ACCEPT
    93. $IPT -A FORWARD -s 172.16.0.11 -j ACCEPT
    94. $IPT -A FORWARD -s 172.16.0.12 -j ACCEPT

    96. $IPT -A FORWARD -d 172.16.0.1 -j ACCEPT
    97. $IPT -A FORWARD -d 172.16.0.2 -j ACCEPT
    98. $IPT -A FORWARD -d 172.16.0.3 -j ACCEPT
    99. $IPT -A FORWARD -d 172.16.0.4 -j ACCEPT
    100. $IPT -A FORWARD -d 172.16.0.5 -j ACCEPT
    101. $IPT -A FORWARD -d 172.16.0.6 -j ACCEPT
    102. $IPT -A FORWARD -d 172.16.0.7 -j ACCEPT
    103. $IPT -A FORWARD -d 172.16.0.8 -j ACCEPT
    104. $IPT -A FORWARD -d 172.16.0.9 -j ACCEPT
    105. $IPT -A FORWARD -d 172.16.0.10 -j ACCEPT
    106. $IPT -A FORWARD -d 172.16.0.11 -j ACCEPT
    107. $IPT -A FORWARD -d 172.16.0.12 -j ACCEPT

    ---------------------------------------------------------------------------
    下面在 CORE虚拟节点 中操作
    ---------------------------------------------------------------------------
    [root@n6 n6.conf]# ifconfig
    ctrl0: flags=4163  mtu 1500
            inet 172.16.0.6  netmask 255.255.255.0  broadcast 0.0.0.0
            inet6 fe80::216:3eff:fec0:b7a4  prefixlen 64  scopeid 0x20
            ether 00:16:3e:c0:b7:a4  txqueuelen 1000  (Ethernet)
            RX packets 143  bytes 15449 (15.0 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 60  bytes 5273 (5.1 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    eth0: flags=4163  mtu 1500
            inet 10.0.0.6  netmask 255.255.255.255  broadcast 0.0.0.0
            inet6 a::6  prefixlen 128  scopeid 0x0
            inet6 fe80::200:ff:feaa:5  prefixlen 64  scopeid 0x20
            ether 00:00:00:aa:00:05  txqueuelen 1000  (Ethernet)
            RX packets 8182  bytes 904248 (883.0 KiB)
            RX errors 0  dropped 0  overruns 0  frame 0
            TX packets 2735  bytes 301738 (294.6 KiB)
            TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

    ----------------------
    [root@n6 n6.conf]# route add default gw 172.16.0.254
    [root@n6 n6.conf]# route -n          
    Kernel IP routing table
    Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
    0.0.0.0         172.16.0.254    0.0.0.0         UG    0      0        0 ctrl0
    10.0.0.1        10.0.0.5        255.255.255.255 UGH   4      0        0 eth0
    10.0.0.2        10.0.0.5        255.255.255.255 UGH   4      0        0 eth0
    10.0.0.3        10.0.0.5        255.255.255.255 UGH   3      0        0 eth0
    10.0.0.4        10.0.0.5        255.255.255.255 UGH   3      0        0 eth0
    10.0.0.5        0.0.0.0         255.255.255.255 UH    1      0        0 eth0
    10.0.0.7        0.0.0.0         255.255.255.255 UH    1      0        0 eth0
    10.0.0.8        10.0.0.5        255.255.255.255 UGH   4      0        0 eth0
    10.0.0.9        0.0.0.0         255.255.255.255 UH    1      0        0 eth0
    10.0.0.10       10.0.0.5        255.255.255.255 UGH   2      0        0 eth0
    10.0.0.11       10.0.0.5        255.255.255.255 UGH   5      0        0 eth0
    172.16.0.0      0.0.0.0         255.255.255.0   U     0      0        0 ctrl0

    [root@n6 n6.conf]# cat /etc/resolv.conf
    # Generated by NetworkManager
    nameserver 10.3.9.4
    nameserver 10.3.9.5
    nameserver 10.3.9.6

    [root@n6 n6.conf]# ping www.bupt.edu.cn
    PING www.bupt.edu.cn (10.3.9.254) 56(84) bytes of data.
    64 bytes from 10.3.9.254: icmp_seq=1 ttl=58 time=0.751 ms
    64 bytes from 10.3.9.254: icmp_seq=2 ttl=58 time=0.727 ms
    64 bytes from 10.3.9.254: icmp_seq=3 ttl=58 time=0.936 ms
    ^C
    --- www.bupt.edu.cn ping statistics ---
    3 packets transmitted, 3 received, 0% packet loss, time 2002ms
    rtt min/avg/max/mdev = 0.727/0.804/0.936/0.098 ms
    [root@n6 n6.conf]#

    ---------------------------------------------------------------------------
    至此，CORE虚拟节点访问互联网 成功


    <script>window._bd_share_config={"common":{"bdSnsKey":{},"bdText":"","bdMini":"2","bdMiniList":false,"bdPic":"","bdStyle":"0","bdSize":"16"},"share":{}};with(document)0[(getElementsByTagName('head')[0]||body).appendChild(createElement('script')).src='http://bdimg.share.baidu.com/static/api/js/share.js?v=89860593.js?cdnversion='+~(-new Date()/36e5)];</script>
    阅读(13) | 评论(0) | 转发(0) |
    0

    上一篇：Open VSwitch—离开VMware的SDN之父Martin Casado是神马大神

    下一篇：Docker—PaaS—微服务

    相关热门文章
    给主人留下些什么吧！~~
    评论热议
  • 相关阅读:
    java中并发包简要分析01
    java中的集合包简要分析
    多线程学习——终结任务
    大型高并发高负载网站的系统架构
    An expression evaluator
    java公式解析器学习与开发（2）——前缀表达式
    java公式解析器学习与开发（1）
    程序员遇到bug时常见的30种反应
    图论--SCC强连通缩点--Tarjan
    图论--割边--Tarjan模板
  • 原文地址：https://www.cnblogs.com/ztguang/p/12649580.html
Copyright © 2020-2023  润新知