NAT到127.0.0.1的数据包为何被丢弃


Add a filter rule:
iptables -t nat -I PREROUTING 2000 -p icmp -j DNAT --to-destination 127.0.0.1

Ping this host, the packets are dropped.

Debug steps:
1. cat /proc/net/nf_conntrack
Nothing is shown.

2. conntrack -E
No conntrack event


3. cat cat /proc/net/stat/ip_conntrack

No clue


4. cat net/stat/rt_cache
00000005  00000124 00000064 00000000 00000000 00000002 00000042 00000000  00000004 00000005 00000000 00000000 00000000 00000000 00000000 00000001 00000000
00000042 is in_martian_dst. Review the function ip_route_input_slow() we can see that the packets are dropped through
if (ipv4_is_lbcast(daddr) || ipv4_is_zeronet(daddr) ||
    ipv4_is_loopback(daddr))
    goto martian_destination;
...
martian_destination:
    RT_CACHE_STAT_INC(in_martian_dst);


The document: 专家们公认的20个最危险的安全漏洞 shows why those packets should be dropped.
  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值