今さらながらiptables基本（その５）&久しぶりにGNS3（その35）：Ubuntu NAT環境下でForward（２）

# IP以外のForward
「[今さらながらiptables基本（その４）：Ubuntu NAT環境下でForward（１）](https://qiita.com/infinite1oop/items/043b77c11c03dbcfcfe2)」の続き。IP以外のForward（ここではL2TPおよびGRE）を実施。

## L2TP
### ネットワーク
![L2TP_topology.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/5974b942-3f31-0403-74b9-5cad0bd04412.png)
LubuntuでNAT、ルーター間でL2TPトンネルを構築。NAT外側からNAT内側へのStatic NAT。末端のPCどうしが同一ネットワークセグメントである。

### 設定
#### Lubuntu
```
$ sudo iptables -t nat -A PREROUTING -i enp0s3 -p l2tp -j DNAT --to-destination 192.168.1.11
$ sudo iptables -P FORWARD DROP
$ sudo iptables -A FORWARD -i enp0s3 -p l2tp -j ACCEPT
$ sudo iptables -A FORWARD -s 192.168.1.11 -p l2tp -j ACCEPT
```
考え方は前回と同様。プロトコルとしてL2TPを指定し（-p l2tp）、L2TP以外はFORWARDにてフィルタリングする。最終的な設定状況は下記。
```
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     l2tp --  anywhere             anywhere            
ACCEPT     l2tp --  192.168.1.11         anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   
$
$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       l2tp --  anywhere             anywhere             to:192.168.1.11

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
```

#### ルーターR1
関連するところのみ記載。以下同様。
```
pseudowire-class L2TP
 encapsulation l2tpv3
 ip local interface FastEthernet0/0

interface FastEthernet0/0
 ip address 172.16.1.11 255.255.255.0

interface FastEthernet0/1
 no ip address
 xconnect 172.16.1.254 1 encapsulation l2tpv3 pw-class L2TP sequencing both

ip route 0.0.0.0 0.0.0.0 FastEthernet0/0
```
- L2TP接続先として、LubuntuのNAT外側のIPアドレス172.16.1.254を指定
- デフォルトルートの指定

#### ルーターR2
```
pseudowire-class L2TP
 encapsulation l2tpv3
 ip local interface FastEthernet0/0

interface FastEthernet0/0
 ip address 192.168.1.11 255.255.255.0

interface FastEthernet0/1
 no ip address
 xconnect 172.16.1.11 1 encapsulation l2tpv3 pw-class L2TP sequencing both

ip route 0.0.0.0 0.0.0.0 192.168.1.254
```
- L2TP接続先として、R1のIPアドレス172.16.1.11を指定
- デフォルトルートとしてLubuntuのNAT内側のIPアドレス192.168.1.254を指定（I/F指定ではうまく動作せず）

#### ルーター設定状況
##### R1
```
R1#show ip route 
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 0.0.0.0 to network 0.0.0.0

     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.1.0 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 is directly connected, FastEthernet0/0
R1#
R1#show l2tun    

%No active L2F tunnels

L2TP Tunnel and Session Information Total tunnels 1 sessions 1

LocID RemID Remote Name   State  Remote Address  Port  Sessions L2TP Class/ 
                                                                VPDN Group 
9580  61783 R2            est    172.16.1.254    0     1        l2tp_default_cl

LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID   
                                 Vcid, Circuit                                  
23800      23872      9580       1, Fa0/1             est    00:02:40 1      

%No active PPTP tunnels
```
##### R2
```
R2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 192.168.1.254 to network 0.0.0.0

C    192.168.1.0/24 is directly connected, FastEthernet0/0
S*   0.0.0.0/0 [1/0] via 192.168.1.254
               is directly connected, FastEthernet0/0
R2#
R2#show l2tun

%No active L2F tunnels

L2TP Tunnel and Session Information Total tunnels 1 sessions 1

LocID RemID Remote Name   State  Remote Address  Port  Sessions L2TP Class/ 
                                                                VPDN Group 
61783 9580  R1            est    172.16.1.11     0     1        l2tp_default_cl

LocID      RemID      TunID      Username, Intf/      State  Last Chg Uniq ID   
                                 Vcid, Circuit                                  
23872      23800      61783      1, Fa0/1             est    00:03:02 1      

%No active PPTP tunnels
```

### 検証
末端のPCどうし（PC1-PC2）の疎通確認。
```
PC1> ping 10.1.1.2
84 bytes from 10.1.1.2 icmp_seq=1 ttl=64 time=40.697 ms
84 bytes from 10.1.1.2 icmp_seq=2 ttl=64 time=31.995 ms
84 bytes from 10.1.1.2 icmp_seq=3 ttl=64 time=38.812 ms
84 bytes from 10.1.1.2 icmp_seq=4 ttl=64 time=38.552 ms
84 bytes from 10.1.1.2 icmp_seq=5 ttl=64 time=36.882 ms
```
この時のWiresharkで取得したデータの状況。まずは、NAT外側。
![L2TP_outside.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/27dc2a3d-0ba5-9537-8010-33283dd61f4b.png)
NAT内側。
![L2TP_inside.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/e39ab5a9-60a1-7d39-2bb9-d933977bbc94.png)
IPアドレスを置き換えて、L2TPが転送されていることがわかる。ARPやICMPの状況は下記となる。
![L2TP_arp.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/a7364041-a50f-0cbc-ae7f-6cd8a758945b.png)
![L2TP_ping.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/dd9e236d-39c5-8274-e3e5-7917a8e69188.png)
当然のことながら、L2TP上にARPやICMPが見える。

なお、PC3からLubuntuへの疎通はあるが、PC2への疎通はない（IP Forwardは未許可）。
```
PC3> ping 172.16.1.254
84 bytes from 172.16.1.254 icmp_seq=1 ttl=64 time=0.449 ms
84 bytes from 172.16.1.254 icmp_seq=2 ttl=64 time=0.553 ms
84 bytes from 172.16.1.254 icmp_seq=3 ttl=64 time=0.525 ms
84 bytes from 172.16.1.254 icmp_seq=4 ttl=64 time=0.515 ms
84 bytes from 172.16.1.254 icmp_seq=5 ttl=64 time=0.461 ms

PC3> ping 192.168.1.11
192.168.1.11 icmp_seq=1 timeout
192.168.1.11 icmp_seq=2 timeout
192.168.1.11 icmp_seq=3 timeout
192.168.1.11 icmp_seq=4 timeout
192.168.1.11 icmp_seq=5 timeout
```

## GRE
### ネットワーク
![GRE_topology.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/8eca932e-b430-14d5-94de-ca2fc811bd7f.png)
LubuntuでNAT、ルーター間でGREトンネルを構築。NAT外側からNAT内側へのStatic NAT。

### 設定
#### Lubuntu
```
$ sudo iptables -t nat -A PREROUTING -i enp0s3 -p gre -j DNAT --to-destination 192.168.1.11
$ sudo iptables -P FORWARD DROP
$ sudo iptables -A FORWARD -i enp0s3 -p gre -j ACCEPT
$ sudo iptables -A FORWARD -s 192.168.1.11 -p gre -j ACCEPT
```
プロトコルとしてGREを指定し（-p gre）、GRE以外はFORWARDにてフィルタリングする。最終的な設定状況は下記。
```
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
ACCEPT     gre  --  anywhere             anywhere            
ACCEPT     gre  --  192.168.1.11         anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
$
$ sudo iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
DNAT       gre  --  anywhere             anywhere             to:192.168.1.11

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination  
```

#### ルーターR1
```
interface Tunnel0
 ip address 10.0.3.1 255.255.255.0
 tunnel source FastEthernet0/0
 tunnel destination 172.16.1.254
!
interface FastEthernet0/0
 ip address 172.16.1.11 255.255.255.0
!
interface FastEthernet0/1
 ip address 10.0.1.254 255.255.255.0

router eigrp 11
 network 10.0.0.0 0.0.3.255
 auto-summary
```
- GREトンネルアドレス、送信先I/F、宛先IPアドレス（LubuntuのNAT外側のIPアドレス172.16.1.254）を指定
- EIGRP設定

#### ルーターR2
```
interface Tunnel0
 ip address 10.0.3.2 255.255.255.0
 tunnel source FastEthernet0/0
 tunnel destination 172.16.1.11
!
interface FastEthernet0/0
 ip address 192.168.1.11 255.255.255.0
!
interface FastEthernet0/1
 ip address 10.0.2.254 255.255.255.0

router eigrp 11
 network 10.0.0.0 0.0.3.255
 auto-summary

ip route 172.16.1.11 255.255.255.255 192.168.1.254
```
- GREトンネルアドレス、送信先I/F、宛先IPアドレス（R1のIPアドレス172.16.1.11）を指定
- EIGRP設定
- トンネル宛先IPアドレスへのスタティックルート指定

#### ルーター設定状況
##### R1
```
R1#show ip eigrp neighbors 
IP-EIGRP neighbors for process 11
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.0.3.2                Tu0               10 00:01:10 1269  5000  0  3
R1#    
R1#show ip eigrp topology 
IP-EIGRP Topology Table for AS(11)/ID(172.16.1.11)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 10.0.2.0/24, 1 successors, FD is 297270016
        via 10.0.3.2 (297270016/281600), Tunnel0
P 10.0.3.0/24, 1 successors, FD is 297244416
        via Connected, Tunnel0
P 10.0.1.0/24, 1 successors, FD is 281600
        via Connected, FastEthernet0/1
R1#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.16.0.0/24 is subnetted, 1 subnets
C       172.16.1.0 is directly connected, FastEthernet0/0
     10.0.0.0/24 is subnetted, 3 subnets
D       10.0.2.0 [90/297270016] via 10.0.3.2, 00:01:23, Tunnel0
C       10.0.3.0 is directly connected, Tunnel0
C       10.0.1.0 is directly connected, FastEthernet0/1
```
##### R2
```
R2#show ip eigrp neighbors 
IP-EIGRP neighbors for process 11
H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq
                                            (sec)         (ms)       Cnt Num
0   10.0.3.1                Tu0               14 00:01:53   80  5000  0  3
R2#     
R2#show ip eigrp topology 
IP-EIGRP Topology Table for AS(11)/ID(192.168.1.11)
Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,
       r - reply Status, s - sia Status 

P 10.0.2.0/24, 1 successors, FD is 281600
        via Connected, FastEthernet0/1
P 10.0.3.0/24, 1 successors, FD is 297244416
        via Connected, Tunnel0
P 10.0.1.0/24, 1 successors, FD is 297270016
        via 10.0.3.1 (297270016/281600), Tunnel0
R2#show ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is not set

     172.16.0.0/32 is subnetted, 1 subnets
S       172.16.1.11 [1/0] via 192.168.1.254
     10.0.0.0/24 is subnetted, 3 subnets
C       10.0.2.0 is directly connected, FastEthernet0/1
C       10.0.3.0 is directly connected, Tunnel0
D       10.0.1.0 [90/297270016] via 10.0.3.1, 00:02:00, Tunnel0
C    192.168.1.0/24 is directly connected, FastEthernet0/0
```

### 検証
末端のPCどうし（PC1-PC2）の疎通確認。
```
PC1> ping 10.0.2.1
10.0.2.1 icmp_seq=1 timeout
10.0.2.1 icmp_seq=2 timeout
84 bytes from 10.0.2.1 icmp_seq=3 ttl=62 time=41.458 ms
84 bytes from 10.0.2.1 icmp_seq=4 ttl=62 time=39.816 ms
84 bytes from 10.0.2.1 icmp_seq=5 ttl=62 time=39.576 ms
```
この時のWiresharkで取得したデータの状況。NAT外側。
![GRE_outside.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/975ca189-52e7-fd85-32cd-61e5bce2b155.png)
NAT内側。
![GRE_inside.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/240634a0-01a7-03d9-7a52-b8dba6a744f6.png)
EIGRPパケットのGREトンネルアドレス（10.0.3.x）の外側にルーターやLubuntuのIPアドレスが見え、GREが転送されていることがわかる。この時の末端PCどうしのICMPの状況は下記。
![GRE_ping.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/634816/5ff0a3f8-10ed-00eb-2c73-09962bf74694.png)
ルーターやLubuntuのIPアドレス内にGREヘッダおよびICMPパケットが見える。

なお、こちらも、PC3からLubuntuへの疎通はあるが、PC2への疎通はない（IP Forwardは未許可）。
```
PC3> ping 172.16.1.254
84 bytes from 172.16.1.254 icmp_seq=1 ttl=64 time=1.081 ms
84 bytes from 172.16.1.254 icmp_seq=2 ttl=64 time=0.540 ms
84 bytes from 172.16.1.254 icmp_seq=3 ttl=64 time=0.456 ms
84 bytes from 172.16.1.254 icmp_seq=4 ttl=64 time=0.474 ms
84 bytes from 172.16.1.254 icmp_seq=5 ttl=64 time=0.514 ms

PC3> ping 192.168.1.11
192.168.1.11 icmp_seq=1 timeout
192.168.1.11 icmp_seq=2 timeout
192.168.1.11 icmp_seq=3 timeout
192.168.1.11 icmp_seq=4 timeout
192.168.1.11 icmp_seq=5 timeout
```

EOF