我在docker容器中运行VPN客户端.我正在尝试通过端口8080从主机连接到在docker容器中运行的Web服务器.当我尝试连接时,我通过tcpdump在端口8080上看到我的传入数据包,但Web服务器从未看到它.
我已经为数据包的所有可能状态转换添加了iptables’-j LOG’规则,试图追踪它.我看到的数据包是：
我已经为数据包的所有可能状态转换添加了iptables’-j LOG’规则,试图追踪它.我看到的数据包是：
>表’raw’,链PREROUTING
>表’mangle’,链PREROUTING
> table’nat’,链条PREROUTING
然后……没什么.在一小段延迟之后,数据包被重新发送,我看到新数据包通过PREROUTING.没有任何东西出现在剪辑INPUT或mangle FORWARD链上 – 据我所知,这是不可能的 – 它必须击中其中一个.
有没有办法让数据包通过PREROUTING,但不能点击INPUT或FORWARD？
我的iptables如下：
root@87ff7ad8e4f9:/# iptables -t raw -L Chain PREROUTING (policy ACCEPT) target prot opt source destination NFLOG tcp -- anywhere anywhere tcp spt:http-alt nflog-prefix "raw pre-route Src incoming packet" NFLOG tcp -- anywhere anywhere tcp dpt:http-alt nflog-prefix "raw pre-route Dest incoming packet" Chain OUTPUT (policy ACCEPT) target prot opt source destination NFLOG tcp -- anywhere anywhere tcp dpt:http-alt nflog-prefix "Dest outgoing packet" NFLOG tcp -- anywhere anywhere tcp spt:http-alt nflog-prefix "Src outgoing packet" root@87ff7ad8e4f9:/# iptables -t mangle -L Chain PREROUTING (policy ACCEPT) target prot opt source destination NFLOG tcp -- anywhere anywhere tcp dpt:http-alt nflog-prefix "mangle PREROUTING Dest incoming packet" Chain INPUT (policy ACCEPT) target prot opt source destination NFLOG all -- anywhere anywhere nflog-prefix "mangle INPUT Dest incoming packet any2" Chain FORWARD (policy ACCEPT) target prot opt source destination NFLOG all -- anywhere anywhere nflog-prefix "mangle FORWARD Dest incoming packet any" Chain OUTPUT (policy ACCEPT) target prot opt source destination MARK tcp -- anywhere anywhere tcp spt:http-alt MARK set 0x1 MARK tcp -- anywhere anywhere tcp dpt:http-alt MARK set 0x1 NFLOG tcp -- anywhere anywhere tcp spt:http-alt nflog-prefix "MARK set 0x1" NFLOG tcp -- anywhere anywhere tcp dpt:http-alt nflog-prefix "Dest MARK set 0x1" Chain POSTROUTING (policy ACCEPT) target prot opt source destination root@87ff7ad8e4f9:/# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination NFLOG tcp -- anywhere anywhere tcp dpt:http-alt nflog-prefix "nat PREROUTING Dest incoming packet" Chain INPUT (policy ACCEPT) target prot opt source destination NFLOG tcp -- anywhere anywhere tcp dpt:http-alt nflog-prefix "nat INPUT Dest incoming packet" Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination root@87ff7ad8e4f9:/# iptables -t filter -L Chain INPUT (policy ACCEPT) target prot opt source destination NFLOG tcp -- anywhere anywhere nflog-prefix "connection made" NFLOG tcp -- anywhere anywhere tcp dpt:http-alt nflog-prefix "filter INPUT Dest incoming packet" Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere anywhere ACCEPT all -- anywhere 172.17.0.0/16 ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere owner GID match vpn ACCEPT udp -- anywhere anywhere owner GID match vpn DROP all -- anywhere anywhere
我的系统日志显示：
Oct 4 07:22:56 87ff7ad8e4f9 raw pre-route Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39119 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 Oct 4 07:22:56 87ff7ad8e4f9 mangle PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39119 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 Oct 4 07:22:56 87ff7ad8e4f9 nat PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39119 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 Oct 4 07:22:57 87ff7ad8e4f9 raw pre-route Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39120 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 Oct 4 07:22:57 87ff7ad8e4f9 mangle PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39120 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0 Oct 4 07:22:57 87ff7ad8e4f9 nat PREROUTING Dest incoming packet IN=eth0 OUT= MAC=02:42:ac:11:00:02:02:42:2e:2c:fd:2e:08:00 SRC=76.167.254.196 DST=172.17.0.2 LEN=60 TOS=00 PREC=0x00 TTL=63 ID=39120 DF PROTO=TCP SPT=46644 DPT=8080 SEQ=4027056663 ACK=0 WINDOW=29200 SYN URGP=0 MARK=0
