71 lines
1.9 KiB
Markdown
71 lines
1.9 KiB
Markdown
|
## 功能
|
|||
|
|
|
|||
|
|
并联环境下实现GTP路由封堵功能。
|
|||
|
|
|
|||
|
|
**实现**
|
|||
|
|
|
|||
|
|
将 “=> MAC => IPv4/IPv6 => UDP => GTP1 => IPv4/IPv6 => TCP/UDP“ 中的 "IPv4/IPv6 => UDP => GTP1" 协议层剥离。
|
|||
|
|
|
|||
|
|
**例子**
|
|||
|
|
|
|||
|
|
原数据包为：
|
|||
|
|
|
|||
|
|
``` shel
|
|||
|
|
Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
|
|||
|
|
Ethernet II, Src: JuniperN_4d:d3:51 (08:81:f4:4d:d3:51), Dst: c8:67:d9:18:80:c3 (c8:67:d9:18:80:c3)
|
|||
|
|
Internet Protocol Version 4, Src: 10.166.20.10, Dst: 10.2.3.35
|
|||
|
|
User Datagram Protocol, Src Port: 2152, Dst Port: 2152
|
|||
|
|
GPRS Tunneling Protocol
|
|||
|
|
Internet Protocol Version 4, Src: 10.58.121.62, Dst: 217.76.78.112
|
|||
|
|
Transmission Control Protocol, Src Port: 52144, Dst Port: 443, Seq: 1, Ack: 1, Len: 0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
经过 NFQ 过滤后变为：
|
|||
|
|
|
|||
|
|
``` shel
|
|||
|
|
Frame 1: 90 bytes on wire (720 bits), 90 bytes captured (720 bits)
|
|||
|
|
Ethernet II, Src: JuniperN_4d:d3:51 (08:81:f4:4d:d3:51), Dst: c8:67:d9:18:80:c3 (c8:67:d9:18:80:c3)
|
|||
|
|
Internet Protocol Version 4, Src: 10.58.121.62, Dst: 217.76.78.112
|
|||
|
|
Transmission Control Protocol, Src Port: 52144, Dst Port: 443, Seq: 1, Ack: 1, Len: 0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 构造测试环境
|
|||
|
|
|
|||
|
|
``` shell
|
|||
|
|
# 清空 iptables
|
|||
|
|
iptables -F -t nat
|
|||
|
|
iptables -F -t filter
|
|||
|
|
iptables -F -t mangle
|
|||
|
|
iptables -F -t raw
|
|||
|
|
ip6tables -F -t nat
|
|||
|
|
ip6tables -F -t filter
|
|||
|
|
ip6tables -F -t mangle
|
|||
|
|
ip6tables -F -t raw
|
|||
|
|
|
|||
|
|
# 增加 iptables
|
|||
|
|
/usr/sbin/iptables -A OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
|||
|
|
/usr/sbin/ip6tables -A OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
|||
|
|
|
|||
|
|
# 删除 iptables
|
|||
|
|
/usr/sbin/iptables -D OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
|||
|
|
/usr/sbin/ip6tables -D OUTPUT -o eno2 -p udp --dport 2152 -j NFQUEUE --queue-num 1
|
|||
|
|
|
|||
|
|
# 调试 iptables
|
|||
|
|
/usr/sbin/iptables -A OUTPUT -o eno2 -j LOG
|
|||
|
|
/usr/sbin/ip6tables -A OUTPUT -o eno2 -j LOG
|
|||
|
|
|
|||
|
|
# make
|
|||
|
|
yum install -y libnetfilter_queue-devel
|
|||
|
|
make
|
|||
|
|
./nfq_filter_gtp
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## 局限
|
|||
|
|
|
|||
|
|
/MAC/IPv6 的 first next header 必须为 UDP，否则跳过。
|
|||
|
|
|
|||
|
|
## TODO
|
|||
|
|
|
|||
|
|
// support service
|
|||
|
|
// support filestat
|