Решено: Объединение подсетей (192.168.0.1 - 192.168.3.1)

Обсуждение настройки и работы сервисов, резервирования, сетевых настроек и вопросов безопасности ОС.

Модераторы: SLEDopit, Модераторы разделов

Валентин
Сообщения: 18
ОС: openSUSE

Решено: Объединение подсетей

Сообщение Валентин »

Искал, много чего нашёл - ничего не помогает. Голову сломал, но чувствую, не там копаю.

Имеется: openSUSE 11.1

master: роутер - раздаёт интернет, форвардинг включён и работает отлично. Инет висит на 192.168.1.2 (eth1) -> 192.168.1.1 (adsl)
есть подсеть 192.168.3.0/24 (eth2)

desktop: клиентская машина (192.168.0.40/24)


Код: Выделить всё

master:~ # ifconfig
eth0      Link encap:Ethernet  HWaddr 00:07:E9:C2:40:69
          inet addr:192.168.0.1  Bcast:192.168.0.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:617975 errors:0 dropped:0 overruns:0 frame:0
          TX packets:881311 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:143494449 (136.8 Mb)  TX bytes:1014330667 (967.3 Mb)

eth0:Oute Link encap:Ethernet  HWaddr 00:07:E9:C2:40:69
          inet addr:217.168.77.140  Bcast:0.0.0.0  Mask:255.255.255.255
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1

eth1      Link encap:Ethernet  HWaddr 00:50:22:8A:98:F1
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:6100579 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5345739 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:768787943 (733.1 Mb)  TX bytes:447564922 (426.8 Mb)
          Interrupt:19 Base address:0x8800

eth2      Link encap:Ethernet  HWaddr 00:80:48:2C:2C:8A
          inet addr:192.168.3.1  Bcast:192.168.3.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:5090647 errors:0 dropped:0 overruns:0 frame:0
          TX packets:5732577 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:394031105 (375.7 Mb)  TX bytes:466055356 (444.4 Mb)
          Interrupt:17 Base address:0xcc00

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:142784 errors:0 dropped:0 overruns:0 frame:0
          TX packets:142784 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:60190701 (57.4 Mb)  TX bytes:60190701 (57.4 Mb)


Код: Выделить всё

master:~ # ip route list table all
192.168.3.0/24 via 192.168.3.1 dev eth2
192.168.1.0/24 dev eth1  proto kernel  scope link  src 192.168.1.2
192.168.0.0/24 dev eth0  proto kernel  scope link  src 192.168.0.1
169.254.0.0/16 dev eth0  scope link
127.0.0.0/8 dev lo  scope link
default via 192.168.1.1 dev eth1
local 192.168.3.1 dev eth2  table local  proto kernel  scope host  src 192.168.3.1
broadcast 192.168.3.0 dev eth2  table local  proto kernel  scope link  src 192.168.3.1
broadcast 192.168.1.0 dev eth1  table local  proto kernel  scope link  src 192.168.1.2
broadcast 192.168.0.255 dev eth0  table local  proto kernel  scope link  src 192.168.0.1
broadcast 127.255.255.255 dev lo  table local  proto kernel  scope link  src 127.0.0.1
local 192.168.1.2 dev eth1  table local  proto kernel  scope host  src 192.168.1.2
local 217.168.77.140 dev eth0  table local  proto kernel  scope host  src 217.168.77.140
local 192.168.0.1 dev eth0  table local  proto kernel  scope host  src 192.168.0.1
broadcast 192.168.3.255 dev eth2  table local  proto kernel  scope link  src 192.168.3.1
broadcast 192.168.1.255 dev eth1  table local  proto kernel  scope link  src 192.168.1.2
broadcast 192.168.0.0 dev eth0  table local  proto kernel  scope link  src 192.168.0.1
broadcast 127.0.0.0 dev lo  table local  proto kernel  scope link  src 127.0.0.1
local 127.0.0.1 dev lo  table local  proto kernel  scope host  src 127.0.0.1
local 127.0.0.0/8 dev lo  table local  proto kernel  scope host  src 127.0.0.1


Код: Выделить всё

master:~ # ip rule list
0:      from all lookup local
32766:  from all lookup main
32767:  from all lookup default


Код: Выделить всё

master:~ # iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
input_int  all  --  anywhere             anywhere
input_int  all  --  anywhere             anywhere
input_ext  all  --  anywhere             anywhere
input_ext  all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-IN-ILL-TARGET '
DROP       all  --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination
TCPMSS     tcp  --  anywhere             anywhere            tcp flags:SYN,RST/SYN TCPMSS clamp to PMTU
forward_int  all  --  anywhere             anywhere
forward_int  all  --  anywhere             anywhere
forward_ext  all  --  anywhere             anywhere
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWD-ILL-ROUTING '
DROP       all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-OUT-ERROR '

Chain forward_ext (1 references)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp parameter-problem
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp timestamp-reply
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp address-mask-reply
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp protocol-unreachable
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp redirect
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 PKTTYPE = multicast LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT '
DROP       all  --  anywhere             anywhere            PKTTYPE = multicast
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT '
LOG        icmp --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT '
LOG        udp  --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT '
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 state INVALID LOG level warning tcp-options ip-options prefix `SFW2-FWDext-DROP-DEFLT-INV '
DROP       all  --  anywhere             anywhere

Chain forward_int (2 references)
target     prot opt source               destination
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp echo-reply
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp destination-unreachable
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp time-exceeded
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp parameter-problem
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp timestamp-reply
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp address-mask-reply
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp protocol-unreachable
ACCEPT     icmp --  anywhere             anywhere            state RELATED,ESTABLISHED icmp redirect
ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            state NEW,RELATED,ESTABLISHED
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 PKTTYPE = multicast LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT '
DROP       all  --  anywhere             anywhere            PKTTYPE = multicast
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT '
LOG        icmp --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT '
LOG        udp  --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT '
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 state INVALID LOG level warning tcp-options ip-options prefix `SFW2-FWDint-DROP-DEFLT-INV '
reject_func  all  --  anywhere             anywhere

Chain input_ext (2 references)
target     prot opt source               destination
DROP       all  --  anywhere             anywhere            PKTTYPE = broadcast
ACCEPT     icmp --  anywhere             anywhere            icmp source-quench
ACCEPT     icmp --  anywhere             anywhere            icmp echo-request
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:27960 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:27960
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:53 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:53
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:80 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:80
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:443 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:443
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:143 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:143
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:993 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:993
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:110 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:110
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:995 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:995
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:25 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:25
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:22 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:22
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpt:21 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:21
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp dpts:40000:40500 flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-ACC-TCP '
ACCEPT     tcp  --  anywhere             anywhere            tcp dpts:40000:40500
ACCEPT     udp  --  anywhere             anywhere            udp dpt:27960
ACCEPT     udp  --  anywhere             anywhere            udp dpt:53
ACCEPT     udp  --  anywhere             anywhere            udp dpt:20
reject_func  tcp  --  anywhere             anywhere            tcp dpt:113 state NEW
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 PKTTYPE = multicast LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
DROP       all  --  anywhere             anywhere            PKTTYPE = multicast
LOG        tcp  --  anywhere             anywhere            limit: avg 3/min burst 5 tcp flags:FIN,SYN,RST,ACK/SYN LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
LOG        icmp --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
LOG        udp  --  anywhere             anywhere            limit: avg 3/min burst 5 LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT '
LOG        all  --  anywhere             anywhere            limit: avg 3/min burst 5 state INVALID LOG level warning tcp-options ip-options prefix `SFW2-INext-DROP-DEFLT-INV '
DROP       all  --  anywhere             anywhere

Chain input_int (2 references)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain reject_func (2 references)
target     prot opt source               destination
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset
REJECT     udp  --  anywhere             anywhere            reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere            reject-with icmp-proto-unreachable


С роутера пингуется подсеть 192.168.3.0/24 отлично

Код: Выделить всё

master:~ # ping 192.168.3.50
PING 192.168.3.50 (192.168.3.50) 56(84) bytes of data.
64 bytes from 192.168.3.50: icmp_seq=1 ttl=127 time=2.37 ms
64 bytes from 192.168.3.50: icmp_seq=2 ttl=127 time=0.235 ms

--- 192.168.3.50 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 0.235/1.307/2.379/1.072 ms


С клиентской машины пингуется eth2 роутера

Код: Выделить всё

desktop:/home/snake # ping 192.168.3.1
PING 192.168.3.1 (192.168.3.1) 56(84) bytes of data.
64 bytes from 192.168.3.1: icmp_seq=1 ttl=64 time=0.341 ms
64 bytes from 192.168.3.1: icmp_seq=2 ttl=64 time=0.306 ms
^C
--- 192.168.3.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.306/0.323/0.341/0.025 ms


Но не пингуется далее. Причём умирает на 192.168.0.1 (!)

Код: Выделить всё

desktop:/home/snake # ping 192.168.3.50
PING 192.168.3.50 (192.168.3.50) 56(84) bytes of data.
From 192.168.0.1: icmp_seq=1 Destination Protocol Unreachable
From 192.168.0.1 icmp_seq=1 Destination Protocol Unreachable
From 192.168.0.1 icmp_seq=2 Destination Protocol Unreachable
^C
--- 192.168.3.50 ping statistics ---
2 packets transmitted, 0 received, +3 errors, 100% packet loss, time 999ms


GW на desktop стоит на 192.168.0.1

И какого происходит вот это:

Код: Выделить всё

master:~ # ip route get 192.168.3.50 iif eth0 from 192.168.0.40
192.168.3.50 from 192.168.0.40 dev eth2  src 192.168.0.1
    cache <src-direct>  mtu 1500 advmss 1460 hoplimit 64 iif eth0


Почему уходит на 192.168.0.1?

Я уже устал искать решение...
Спасибо сказали:
Вернуться к началу
Аватара пользователя
TuLiss
Сообщения: 1611
Статус: 01100
ОС: Gentoo,Ubuntu,MacOS X

Re: Решено: Объединение подсетей

Сообщение TuLiss »

Покажите роутинг на GW и на самом ADSL, так же какой роутинг получает клиент.
Чтение man'нов в слух ещЁ никому не помогало!...
kernel 4.2
chmod -x `which chmod`
War, war never changes...
Спасибо сказали:
Вернуться к началу
DSS
Сообщения: 390

Re: Решено: Объединение подсетей

Сообщение DSS »

Валентин писал(а): ↑
03.04.2009 00:43
Но не пингуется далее. Причём умирает на 192.168.0.1 (!)

Код: Выделить всё

desktop:/home/snake # ping 192.168.3.50
PING 192.168.3.50 (192.168.3.50) 56(84) bytes of data.
From 192.168.0.1: icmp_seq=1 Destination Protocol Unreachable
From 192.168.0.1 icmp_seq=1 Destination Protocol Unreachable
From 192.168.0.1 icmp_seq=2 Destination Protocol Unreachable
^C
--- 192.168.3.50 ping statistics ---
2 packets transmitted, 0 received, +3 errors, 100% packet loss, time 999ms


GW на desktop стоит на 192.168.0.1

И какого происходит вот это:

Код: Выделить всё

master:~ # ip route get 192.168.3.50 iif eth0 from 192.168.0.40
192.168.3.50 from 192.168.0.40 dev eth2  src 192.168.0.1
    cache <src-direct>  mtu 1500 advmss 1460 hoplimit 64 iif eth0


Почему уходит на 192.168.0.1?

А что Вас удивляет?!
На клиентской машине ровно так и должно быть. На ней должно иметься всего два маршрута: в свою подсеть и маршрут по умолчанию. Он у неё, очевидно, не может быть абсолютно никаким, кроме 192.168.0.1.

cat /etc/sysconfig/SuSEfirewall2 | grep FW_DEV_INT покажите.

А ещё лучше - покажите вот это:
cat /etc/sysconfig/SuSEfirewall2 | egrep FW_DEV_EXT\|FW_DEV_INT\|FW_FORWARD | grep -v \#
Спасибо сказали:
Вернуться к началу
Валентин
Сообщения: 18
ОС: openSUSE

Re: Решено: Объединение подсетей

Сообщение Валентин »

Код: Выделить всё

cat /etc/sysconfig/SuSEfirewall2 | grep FW_DEV_INT
FW_DEV_INT="'eth0' eth0 eth2"
# internal or dmz interfaces in FW_DEV_INT or FW_DEV_DMZ.
# Requires: FW_DEV_INT or FW_DEV_DMZ, FW_ROUTE, FW_MASQ_DEV
# Requires: FW_DEV_INT


Код: Выделить всё

cat /etc/sysconfig/SuSEfirewall2 | egrep FW_DEV_EXT\|FW_DEV_INT\|FW_FORWARD | grep -v \#
FW_DEV_EXT="'eth1' eth1"
FW_DEV_INT="'eth0' eth0 eth2"
FW_FORWARD=""
FW_FORWARD_REJECT=""
FW_FORWARD_DROP=""
FW_FORWARD_MASQ=""
FW_FORWARD_ALWAYS_INOUT_DEV=""
Спасибо сказали:
Вернуться к началу
DSS
Сообщения: 390

Re: Решено: Объединение подсетей

Сообщение DSS »

Попробуйте так:

FW_DEV_EXT="eth1"
FW_DEV_INT="'eth0 eth2"
FW_FORWARD="192.168.0.0/24,192.168.3.0/24 192.168.3.0/24,192.168.0.0/24"
Спасибо сказали:
Вернуться к началу
Валентин
Сообщения: 18
ОС: openSUSE

Re: Решено: Объединение подсетей

Сообщение Валентин »

DSS писал(а): ↑
03.04.2009 10:21
Попробуйте так:

FW_DEV_EXT="eth1"
FW_DEV_INT="'eth0 eth2"
FW_FORWARD="192.168.0.0/24,192.168.3.0/24 192.168.3.0/24,192.168.0.0/24"


Помогло! Спасибо!
Спасибо сказали:
Вернуться к началу

Вернуться в «Администрирование»