由网络不通引发的rp_filter内核参数思考

网络拓扑

net_topo.png
问题现象
虚机B ping 虚机A的192.168.212.6的ip无arp reply数据包

正常数据包流向

1. 数据包从B的eth0口出

   sip:192.168.210.16 dip:192.168.212.6 smac:fa:16:3e:a7:cb:76 dmac:fa:16:3e:1a:7d:33
   

2. 数据包到达router后将源MAC修改成net2网关的MAC
3. 数据包从A的eth2进

   sip:192.168.210.16 dip:192.168.212.6 smac:fa:16:3e:c1:70:53 dmac:fa:16:3e:41:8f:fb
   

4. B做arp reply的数据包先做路由选择，从eth0做回包

   sip:192.168.212.6 dip:192.168.210.16 smac:fa:16:3e:3f:c5:04 dmac:fa:16:3e:a7:cb:76
   

5. A从eth0收到arp reply的数据包

   sip:192.168.212.6 dip:192.168.210.16 smac:fa:16:3e:3f:c5:04 dmac:fa:16:3e:a7:cb:76
   

无arp reply数据包原因
虚机默认rp_filter为1，这样进来的arp request数据包会做反向校验，发现数据包回程的网卡和进入的网卡不符，所以校验不通过将数据包丢弃

rp_filter.png

rp_filter参数理解
Linux内核网络参数说明

rp_filter - INTEGER
    0 - No source validation.
    1 - Strict mode as defined in RFC3704 Strict Reverse Path
        Each incoming packet is tested against the FIB and if the interface
        is not the best reverse path the packet check will fail.
        By default failed packets are discarded.
    2 - Loose mode as defined in RFC3704 Loose Reverse Path
        Each incoming packet's source address is also tested against the FIB
        and if the source address is not reachable via any interface
        the packet check will fail.

    Current recommended practice in RFC3704 is to enable strict mode
    to prevent IP spoofing from DDos attacks. If using asymmetric routing
    or other complicated routing, then loose mode is recommended.

    The max value from conf/{all,interface}/rp_filter is used
    when doing source validation on the {interface}.

    Default value is 0. Note that some distributions enable it
    in startup scripts.

• 0 - 不做校验
• 1 - 严格模式，对每个进来的数据包都进行反向校验，如果回程数据包网卡不是最佳反向路径的网卡校验不通过，将进入的数据包丢弃
• 2 - 松散模式，对每个进来的数据包都进行反向校验，如果回程数据包通过任意网卡都不可达，则校验不通过，将进入的数据包丢弃