NAT到127.0.0.1的数据包为何被丢弃

最新推荐文章于 2025-09-16 09:23:11 发布

原创最新推荐文章于 2025-09-16 09:23:11 发布 · 974 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#cache #filter #function #input #dst

Networking 专栏收录该内容

3 篇文章

订阅专栏

部署运行你感兴趣的模型镜像

Add a filter rule:
iptables -t nat -I PREROUTING 2000 -p icmp -j DNAT --to-destination 127.0.0.1

Ping this host, the packets are dropped.

Debug steps:
1. cat /proc/net/nf_conntrack
Nothing is shown.

2. conntrack -E
No conntrack event

3. cat cat /proc/net/stat/ip_conntrack

No clue

4. cat net/stat/rt_cache
00000005 00000124 00000064 00000000 00000000 00000002 00000042 00000000 00000004 00000005 00000000 00000000 00000000 00000000 00000000 00000001 00000000
00000042 is in_martian_dst. Review the function ip_route_input_slow() we can see that the packets are dropped through
if (ipv4_is_lbcast(daddr) || ipv4_is_zeronet(daddr) ||
    ipv4_is_loopback(daddr))
    goto martian_destination;
...
martian_destination:
    RT_CACHE_STAT_INC(in_martian_dst);

The document: 专家们公认的20个最危险的安全漏洞 shows why those packets should be dropped.

您可能感兴趣的与本文相关的镜像