IPTABLES Introduction

1. IPTABLES (I) HungWei Chiu

2. HungWei Chiu •MTS @ ONF •SDNDS-TW/CNTUG •Linux/Network/Container/ Kubernetes •Kuberentes Courses @Hiskio

3. Why IPTABLES

4. IPTABLES Series Introduction to IPTABLES Learn IPTABLES by Docker environment. Implementation of IPTABLES User Space/Kernel Space Implement our own iptables modules Kubernetes Service discussion Layer4 load-balancing, why ? Modify the kernel module to make it support Layer7, really ?

5. Today

6. Environment ContainerA ContainerA Linux Bridge Eth0 Eth0 Eth0 Veth0 Veth1 Host to Container Container to Container Container to WAN

7. Architecture iptables iptables-save Iptables-xxxx

8. IPTABLES/EBTABLES Example iptables -t nat -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER ebtables -t filter -I INPUT --log --log-prefix 'ctc/ebtable/filter-input' --log-level debug Components Chain. -> Insert/Append (-I/-A) Table Match (Module) -> build-in/module Target (Module). -> build-in/module

9. Chain (EBTABLES) INPUT Frames destined for the bridge itself FORWARD Frames being forwarded by the bridges OUTPUT Locally-generated Routed frames PREROUTING (PREFORWARDING) Altering frames as soon as they come in POSTROUTING (POSTFORWARDING) Altering frames as they are about to go out BROUTING Traversed very early, route or bridge frame.

10. Tables (EBTABLES) Filter Filter frames NAT Change the MAC Address broute Make the decision (bridge/route)

11. DNAT DNAT SNAT SNAT ContainerA ContainerA Linux Bridge Eth0 Eth0 Veth0 Veth1

12. Observe Flows We use the target LOG to log the packet information and then learn the packer ﬂow in different situation. ebtables -t broute -I BROUTING --log --log-preﬁx 'ctc/ebtable/ broute-BROUTING' --log-level debug We focus on Host to container Container to container

13. Container to Container

14. Scripts Setup ebtables rules ./ebtables.sh Modify kernel module Add printk(....) Need to rebuild the kernel module and re-install Generate trafﬁc to container. sudo dmesg -c (clean buffer) sudo docker exec netutils ping 172.18.0.2 -c1 sudo dmesg -c

16. Host to Container

17. Scripts Setup ebtables rules ./ebtables.sh Modify kernel module Add printk(....) Need to rebuild the kernel module and re-install Generate trafﬁc to container. sudo dmesg -c (clean buffer) sudo ping 172.18.0.2 -c1 sudo dmesg -c

18. Host to Container PING

19. Host to Container PING

20. Before IPTABLES

21. Example (docker -p) Iperf server Linux Bridge 172.17.8.111 172.18.0.4 Veth0 MacBook VM 172.17.8.1 Iperf client In Virtual Machine docker run -d --name iperf -p 12345:5201 --entrypoint iperf3 hwchiu/ netutils -s -p 5201 In MAC iperf3 -c 172.17.8.111 12345 Iptables will do DNAT to redirect packets iptables-save -t nat -c -A DOCKER ! -i docker0 -p tcp -m tcp --dport 12345 -j DNAT --to- destination 172.18.0.4:5201

22. Conntrack Connection Tracking Connection-> application level. Track the connection: Request tuple -> Replay tuple Tuple: src_ip, dest_ip, src_port, dest_port

23. Conntrack Iperf server Linux Bridge 172.17.8.111 172.18.0.4 Veth0 MacBook VM 172.17.8.1 Iperf client Request tuple 172.17.8.1:53426 -> 172.17.8.111:12345 Reply 172.18.0.4:5201 -> 172.17.8.1:53426 Iptables do NAT only once and then conntrack handles the rest of packets.

24. Tables (IBTABLES) Raw For non-tracking packets. (Before conntrack) Mangle Change packet's information Filter Filter packets NAT Change IP address (SNAT/DNAT)

25. Chain (IPTABLES) INPUT Packets destined to local sockets FORWARD Packets being routed OUTPUT Locally-generated packets PREROUTING Altering packets as soon as they come in POSTROUTING Altering packets as they are about to go out

26. DNAT DNAT SNAT SNAT

27. Others http://xkr47.outerspace.dyndns.org/netfilter/packet_flow/packet_flow10.png

28. Observe Flows We use the target LOG to log the packet information and then learn the packer ﬂow in different situation. iptables -t mangle -I PREROUTING -p tcp -d 172.18.0.0/16 -j LOG --log-preﬁx '/ iptable/mangle-PREROUTE' --log-level debug We focus on Container to container Host to container WAN to container

30. Scripts Setup ebtables rules ./ebtables.sh ./iptables.sh Generate trafﬁc to container. sudo dmesg -c (clean buffer): sudo docker exec netutils ping 172.18.0.2 -c 1 sudo dmesg -c > test

32. No NAT in Reply Packet

33. Have You Seen This? sudo sysctl net.bridge.bridge-nf-call-iptables=1 echo '1' > /proc/sys/net/bridge/bridge-nf-call-iptables Try to repeat this case with value '0'

34. Host to Container

35. Scripts Setup ebtables rules ./ebtables.sh ./iptables.sh Generate trafﬁc to container. sudo dmesg -c (clean buffer): ping 172.18.0.2 -c 1 sudo dmesg -c > test

36. ICMP Request to Container PING

37. ICMP Reply From Container PING

38. Others What is Bridge Check? Different Function Handler netdev_rx_handler_register br_handle_frame

39. WAN to Container

40. Scripts Setup ebtables rules ./ebtables.sh ./iptables.sh Generate trafﬁc to container. sudo dmesg -c (clean buffer): sudo docker exec netutils ping 8.8.8.8 -c 1 sudo dmesg -c > test

41. ICMP Request to WAN PING

42. ICMP Reply From WAN PING

43. Tcpdump

44. How To Debug No Simple Way Strong knowledge of TCP/IP Capture Packets by TCPDUMP Check IPTables rules Use the log module to capture packets (watch out match rules). Check other build-in services. ARPTables Routing Tables TC (Trafﬁc Shaping) Modify the Linux Kernel to print out packet information.

45. Q&A

IPTABLES Introduction

宏瑋 邱

IPTABLES Introduction

宏瑋邱