通过日志跟踪iptables处理过程

Update:2014-09-24

基础信息

iptables包处理流程

跟踪数据包在iptables各表、链中的流转过程，便于理解netfilter的处理流程，从而更有效地理解Openstack中各种iptables规则定义。

测试中iptables设置为全ACCEPT方式，并且清除了所有Openstack的规则，只添加日志记录规则。

设置脚本

由于宿主机其它的通讯量很多，为避免记录大量无关日志，在INPUT、OUTPUT链中只记录了所关心的172.17.51.0/24网段流量。 

#!/bin/sh
loglan=172.17.51.0/24
case "$1" in
"set")
    echo "set log..."
    iptables -F
    iptables -X
    iptables -Z
    iptables -F -t nat
    iptables -X -t nat
    iptables -Z -t nat
    iptables -F -t mangle
    iptables -X -t mangle
    iptables -Z -t mangle
    iptables -P INPUT ACCEPT
    iptables -P OUTPUT ACCEPT
    iptables -P FORWARD ACCEPT

    iptables -t filter -A INPUT -d $loglan -j LOG --log-prefix "IPTABLES_filter_INPUT-d:" --log-level 4
    iptables -t filter -A INPUT -s $loglan -j LOG --log-prefix "IPTABLES_filter_INPUT-s:" --log-level 4
    iptables -t filter -A OUTPUT -d $loglan -j LOG --log-prefix "IPTABLES_filter_OUTPUT-d:" --log-level 4
    iptables -t filter -A OUTPUT -s $loglan -j LOG --log-prefix "IPTABLES_filter_OUTPUT-s:" --log-level 4
    iptables -t filter -A FORWARD -j LOG --log-prefix "IPTABLES_filter_FORWARD:" --log-level 4

    iptables -t nat -A PREROUTING -j LOG --log-prefix "IPTABLES_nat_PREROUTING:" --log-level 4
    iptables -t nat -A POSTROUTING -j LOG --log-prefix "IPTABLES_nat_POSTROUTING:" --log-level 4
    iptables -t nat -A OUTPUT -j LOG --log-prefix "IPTABLES_nat_OUTPUT:" --log-level 4
    ;;
"unset")
    echo "unset log..."
    iptables -F
    iptables -X
    iptables -Z
    iptables -F -t nat
    iptables -X -t nat
    iptables -Z -t nat
    iptables -F -t mangle
    iptables -X -t mangle
    iptables -Z -t mangle
    iptables -P INPUT ACCEPT
    iptables -P OUTPUT ACCEPT
    iptables -P FORWARD ACCEPT
    ;;
*)
    echo "$0 set|unset"
    ;;
esac
exit 0

日志结果

外部访问http

设置好日志策略后，从外部网络用curl访问http://172.17.51.3 (只会产生一个请求)，截取日志内容如下：

实验环境中，入流量直接从物理网关转到虚拟机，未经过宿主机的iptables规则链？

bridge和vlan中的流量并不会经过iptables？ 

# FORWARD
# 虚拟机172.17.51.3回应浏览器的包，在br51上进行FORWARD,OUT接口是eth1.46(宿主机缺省路由接口)
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=60 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=14480 RES=0x00 ACK SYN URGP=0 

# PREROUTING
# 172.17.51.3 eth0 HWaddr FA:16:3E:95:FF:38，和下面的MAC并不一致？
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_nat_PREROUTING:IN=br51 OUT= MAC=fa:16:3e:3d:5a:37:fa:16:3e:95:ff:38:08:00 SRC=172.17.51.3 DST=192.168.0.247 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=35547 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK URGP=0 

# FORWARD
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=35547 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK URGP=0 

# POSTROUTING
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_nat_POSTROUTING:IN= OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=35547 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK URGP=0 

# FORWARD
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=2948 TOS=0x00 PREC=0x00 TTL=63 ID=35548 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK URGP=0 
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=1500 TOS=0x00 PREC=0x00 TTL=63 ID=35550 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK URGP=0 
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=864 TOS=0x00 PREC=0x00 TTL=63 ID=35551 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK PSH URGP=0 
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=35552 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK FIN URGP=0 
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=192.168.0.247 LEN=52 TOS=0x00 PREC=0x00 TTL=63 ID=35553 DF PROTO=TCP SPT=80 DPT=44301 WINDOW=122 RES=0x00 ACK URGP=0 

# POSTROUTING
<4>Sep 24 12:22:08 node-12 kernel: IPTABLES_nat_PREROUTING:IN=br36 OUT= MAC=fa:16:3e:26:4c:48:fa:16:3e:1f:9e:63:08:00 SRC=172.17.36.5 DST=172.17.36.4 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=UDP SPT=68 DPT=67 LEN=308

icmp测试

# PREROUTING
<4>Sep 24 13:44:35 node-12 kernel: IPTABLES_nat_PREROUTING:IN=br51 OUT= MAC=fa:16:3e:3d:5a:37:fa:16:3e:95:ff:38:08:00 SRC=172.17.51.3 DST=172.17.19.1 LEN=84 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=13831 SEQ=1

# FORWARD
<4>Sep 24 13:44:35 node-12 kernel: IPTABLES_filter_FORWARD:IN=br51 OUT=eth1.46 SRC=172.17.51.3 DST=172.17.19.1 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=13831 SEQ=1 

# POSTROUTING
<4>Sep 24 13:44:35 node-12 kernel: IPTABLES_nat_POSTROUTING:IN= OUT=eth1.46 SRC=172.17.51.3 DST=172.17.19.1 LEN=84 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=ICMP TYPE=8 CODE=0 ID=13831 SEQ=1

其它