faketcp 模式下宿主机防火墙如何设置? #55

jiangtiandao · 2017-09-17T14:01:03Z

尝试放通 server 监听端口的 tcp
log 显示
[INFO] (re) sent tcp syn
[ERROR] ]xx.xxx.xxx.xxx,xxxxx]rst==1

测试发现 --net=host 参数不再需要只需要开放tcp 监听端口即可
镜像内安装 iptables 后 -a 也可用需要 --cap-add=NET_ADMIN 以便添加 iptables

wangyu- · 2017-09-17T14:02:29Z

docker的宿主机？

加上-g选项，会生成一条iptables规则。然后把这条iptables手动加上。

jiangtiandao · 2017-09-17T14:18:25Z

generated iptables rule:
iptables -I -p tcp -m tcp --dport 10999 -j DROP
iptables v1.4.21: Invalid rule number tcp' Try iptables -h' or 'iptables --help' for more information.

iptables 加不上

jiangtiandao · 2017-09-17T14:19:07Z

这是windows 虚拟机显示的log

wangyu- · 2017-09-17T14:23:15Z

是-g的Bug，生成规则时候落下了INPUT

你用 iptables -I INPUT -p tcp -m tcp --dport 10999 -j DROP，在-I 后面加上INPUT.

==update==
已经修复了，发布了一版新的release。但是虚拟机里的udp2raw还是旧的，如果有需要可以自己更新一下(scp进去)。

jiangtiandao · 2017-09-18T00:17:06Z

iptables 加了
client 还是上面那样
server 端一直是
[2017-09-18 00:09:28][INFO][ ]received syn,sent syn ack back

这是我用的dockerfile
https://github.com/jiangtiandao/ss-libev-kcptun-udp2raw
现在是部署在阿里云vps上测试
准备用在一个我需要管理的电信IDC的Windows服务器上linux虚拟机里面，降低延迟减少断线
只用kcptun 的话
我的ISP移动的udp qos 很奇怪一开始几秒能跑到1m/s
后来就只有50k/s 延迟也上来了ssh和sftp也经常掉

wangyu- · 2017-09-18T02:56:24Z

server 端一直是
[2017-09-18 00:09:28][INFO][ ]received syn,sent syn ack back

你的虚拟机或者docker应该不是桥接网卡，全都换成桥接网卡试一下。

jiangtiandao · 2017-09-18T03:02:31Z

518ea461a8e8 sslibevkcptunudp2raw_default bridge local

jiangtiandao · 2017-09-18T03:06:07Z

docker network ls
显示是桥接

wangyu- · 2017-09-18T03:07:50Z

windows上的虚拟机这边呢？

wangyu- · 2017-09-18T03:21:17Z

如果还是无法连通的话，你先试一下不用docker，直接在VPS上运行udp2raw server。先用最简单的环境调试通了，再迁移到docker。

jiangtiandao · 2017-09-18T03:27:16Z

windows上的虚拟机访问麻烦现在是在阿里云上测试

wangyu- · 2017-09-18T03:29:35Z

现在client和server分别都是什么环境，详细说一下。

wangyu- · 2017-09-18T03:30:28Z

client和server上有什么iptables规则

jiangtiandao · 2017-09-18T03:30:28Z

是不是 SO_SNDBUFFORCE 的问题？
SO_SNDBUFFORCE 要求 CAP_NET_ADMIN 而docker 里面的root 没有这个CAP

wangyu- · 2017-09-18T03:32:50Z

现在默认的情况已经不用SO_SNDBUFFORCE了。只有用了--force-sock-buf才是SO_SNDBUFFORCE

docker 里面

你先不用docker，直接在宿主机上运行，争取先调试通。

wangyu- · 2017-09-18T03:45:54Z

另外可以试一下，在两边加上--lower-level auto

现在client和server分别都是什么环境，详细说一下。

我现在搞不清楚你client和sever运行在什么环境下。你可不可以详细说一下。（我只知道server是阿里云vps，貌似是在阿里云VPS上通过docker运行的udp2raw server）

jiangtiandao · 2017-09-18T03:51:31Z

server直接在宿主机上运行能看到 client_ready
server 如果是在阿里云VPS上的 docker compose 就不行
https://github.com/jiangtiandao/ss-libev-kcptun-udp2raw

client 一直是 lede-17.01.2-x86_virtual_machine_image_with_udp2raw_pre_installed.zip

wangyu- · 2017-09-18T04:24:10Z

我按下面的步骤运行的：
git clone https://github.com/jiangtiandao/ss-libev-kcptun-udp2raw
cd ss-libev-kcptun-udp2raw
docker-compose up

但是运行不起来，报错：

Step 3/5 : RUN git clone https://github.com/wangyu-/udp2raw-tunnel.git  && cd udp2raw-tunnel && make
 ---> Running in 140d2b02aca4
Cloning into 'udp2raw-tunnel'...
echo "const char *gitversion = \"36d6854a57046650ad62460553a06f358c17d7a2\";" > git_version.h
rm -f udp2raw
g++   -o udp2raw          -I. main.cpp lib/aes.c lib/md5.c encrypt.cpp log.cpp network.cpp common.cpp  -lpthread -std=c++11 -Wall -Wextra -Wno-unused-variable -Wno-unused-parameter -Wno-missing-field-initializer219d2e45b4af: Already exists
 ---> 873e3d1add29
Removing intermediate container 140d2b02aca4
Step 4/5 : FROM debian:stretch
stretch: Pulling from library/debian
Digest: sha256:126052225b62db18c32f03a4462a92fad2ef243c6509371edb82a2298087b12c
Status: Downloaded newer image for debian:stretch
 ---> 72ef1cf971d1
Step 5/5 : COPY --from=builder /udp2raw-tunnel/udp2raw .
 ---> 3a0c2377580b
Removing intermediate container 9aa055381574
Successfully built 3a0c2377580b
Successfully tagged sslibevkcptunudp2raw_udp2raw:latest
WARNING: Image for service udp2raw was built because it did not already exist. To rebuild this image you must use `docker-compose build` or `docker-compose up --build`.
Creating sslibevkcptunudp2raw_kcptun_1 ... 
Creating sslibevkcptunudp2raw_ss_1 ... 
Creating sslibevkcptunudp2raw_udp2raw_1 ... 
Creating sslibevkcptunudp2raw_kcptun_1
Creating sslibevkcptunudp2raw_ss_1
Creating sslibevkcptunudp2raw_kcptun_1 ... error

ERROR: for sslibevkcptunudp2raw_kcptun_1  Cannot start service kcptun: oci runtime error: container_linux.go:262: starting container process caused "exec: \"./server\": stat ./server: no such file or directory"
Creating sslibevkcptunudp2raw_udp2raw_1 ... done

ERROR: for kcptun  Cannot start service kcptun: oci runtime error: container_linux.go:262: starting container process caused "exec: \"./server\": stat ./server: no such file or directory"

ERROR: Encountered errors while bringing up the project.
root@debian9:~/Desktop/ss-libev-kcptun-udp2raw#

wangyu- · 2017-09-18T04:34:59Z

@jiangtiandao 我查了一下docker的网络模式，貌似docker的bridge模式跟虚拟机的不一样，bridge可能不能正常工作。host模式应该可以。

jiangtiandao · 2017-09-18T04:35:21Z

yml 写错了
./server -> server
repo 已经更新

wangyu- · 2017-09-18T04:37:29Z

之前别人在docker上运行，docker环境是vps服务商提供的。

你这种自己搭的环境我之前没遇到过，得探索一下。

wangyu- · 2017-09-18T05:10:37Z

@jiangtiandao

我把你的dockerfile.udp2raw,单独copy了出来，单独build了一个docker image，步骤如下：
docker build -t udp2raw_test .
docker run --net=host udp2raw_test ./udp2raw -s -l 192.168.100.108:10998 -r 127.0.0.1:29900 --raw-mode faketcp -g
iptables -I INPUT -p tcp -m tcp --dport 10998 -j DROP
docker run --net=host udp2raw_test ./udp2raw -s -l 192.168.100.108:10998 -r 127.0.0.1:29900 --raw-mode faketcp

可以正常运行：

root@debian9:~/Desktop/test# docker run  --net=host udp2raw_test ./udp2raw -s -l 192.168.100.108:10998 -r 127.0.0.1:29900 --raw-mode faketcp  
[2017-09-18 05:05:13][INFO]argc=8 ./udp2raw -s -l 192.168.100.108:10998 -r 127.0.0.1:29900 --raw-mode faketcp 
[2017-09-18 05:05:13][INFO]important variables: log_level=4:INFO raw_mode=faketcp cipher_mode=aes128cbc auth_mode=md5 key=secret key local_ip=192.168.100.108 local_port=10998 remote_ip=127.0.0.1 remote_port=29900 source_ip=0.0.0.0 source_port=0 socket_buf_size=1048576 
[2017-09-18 05:05:13][INFO]const_id:55553768
[2017-09-18 05:05:13][INFO]now listening at 192.168.100.108:10998
[2017-09-18 05:06:31][INFO][192.168.100.1:22487]received syn,sent syn ack back
[2017-09-18 05:06:31][INFO][192.168.100.1:22487]got packet from a new ip
[2017-09-18 05:06:31][INFO][192.168.100.1:22487]created new conn,state: server_handshake1,my_id is faea9230
[2017-09-18 05:06:31][INFO][192.168.100.1:22487]changed state to server_handshake1,my_id is faea9230
[2017-09-18 05:06:31][INFO][192.168.100.1:22487]received handshake oppsite_id:58d98047  my_id:faea9230
[2017-09-18 05:06:31][INFO][192.168.100.1:22487]oppsite const_id:a2b9e22 
[2017-09-18 05:06:31][INFO][192.168.100.1:22487]changed state to server_ready

wangyu- · 2017-09-18T05:12:48Z

@jiangtiandao

至于docker compose，我不熟悉，你自己改一下docker-compose.yml，要点是网络模式要设置成host。

wangyu- · 2017-09-18T05:15:40Z

@jiangtiandao
还有，我得提醒一下，你udp2raw启动命令里remote ip设成了kcptun，这是不行的，必须是ip。

udp2raw_1  | [2017-09-18 05:10:54][INFO]argc=10 ./udp2raw -s -l 0.0.0.0:10998 -r kcptun:29900 -k xxxxxxxxx --raw-mode faketcp

wangyu- · 2017-09-18T05:19:22Z

@jiangtiandao

我把你的dockerfile.udp2raw,单独copy了出来，单独build了一个docker image

在这个基础上，我用netcat做了测试，udp转发也是正常的。

jiangtiandao · 2017-09-18T11:30:36Z

yml加一行
network_mode: 'host' 就可以正常使用了

embeddedsecurity · 2020-03-03T17:55:10Z

yml加一行
network_mode: 'host' 就可以正常使用了

可以把你的docker-compose.yml发出来我看看嘛？

jiangtiandao closed this as completed Sep 18, 2017

wangyu- mentioned this issue Sep 18, 2017

udp2raw如何在Docker 中使用？ #54

Closed

wangyu- added question solved labels Sep 23, 2017

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

faketcp 模式下宿主机防火墙如何设置? #55

faketcp 模式下宿主机防火墙如何设置? #55

jiangtiandao commented Sep 17, 2017 •

edited

Loading

wangyu- commented Sep 17, 2017

jiangtiandao commented Sep 17, 2017 •

edited

Loading

jiangtiandao commented Sep 17, 2017 •

edited

Loading

wangyu- commented Sep 17, 2017 •

edited

Loading

jiangtiandao commented Sep 18, 2017 •

edited

Loading

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017 •

edited

Loading

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

embeddedsecurity commented Mar 3, 2020

faketcp 模式下 宿主机防火墙如何设置? #55

faketcp 模式下 宿主机防火墙如何设置? #55

Comments

jiangtiandao commented Sep 17, 2017 • edited Loading

wangyu- commented Sep 17, 2017

jiangtiandao commented Sep 17, 2017 • edited Loading

jiangtiandao commented Sep 17, 2017 • edited Loading

wangyu- commented Sep 17, 2017 • edited Loading

jiangtiandao commented Sep 18, 2017 • edited Loading

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017 • edited Loading

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

wangyu- commented Sep 18, 2017

jiangtiandao commented Sep 18, 2017

embeddedsecurity commented Mar 3, 2020

faketcp 模式下宿主机防火墙如何设置? #55

faketcp 模式下宿主机防火墙如何设置? #55

jiangtiandao commented Sep 17, 2017 •

edited

Loading

jiangtiandao commented Sep 17, 2017 •

edited

Loading

jiangtiandao commented Sep 17, 2017 •

edited

Loading

wangyu- commented Sep 17, 2017 •

edited

Loading

jiangtiandao commented Sep 18, 2017 •

edited

Loading

jiangtiandao commented Sep 18, 2017 •

edited

Loading