Re: [gentoo-user-ru] Не ходят пинги в локалке. Кто виноват и что делать???

[Andrew A. Sabitov]

On 04.06.2015 14:55, Alex Efros wrote:
> Hi!
>
> On Thu, Jun 04, 2015 at 01:39:57PM +0600, Andrew A. Sabitov wrote:
>> Коллеги, кто может раскрыть секрет: что, хотя бы в теории, может убивать
>> пакеты _до_ iptables???
> Ядро, разумеется. Там тоже есть фильтры пакетов, например проверки source
> route работают в сложных конфигурациях… странновато. Я предпочитаю их
> отключать и реализовывать защиту от спуфинга ручками в iptables.
>
> При этом в hardened настройки ядра по умолчанию для source route
> изменились недавно (https://bugs.gentoo.org/show_bug.cgi?id=534132),
> поэтому я бы рекомендовал явно прописать в /etc/sysctl.conf:
>      net.ipv4.conf.default.rp_filter = 0
>      net.ipv4.conf.all.rp_filter = 0
> и перегрузиться (или выставить этот 0 ручками в /proc или через sysctl для
> всех интерфейсов плюс к default и all).
>

Уже давно сделал :(

  ~ # sysctl -a | grep rp_fil
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.rp_filter = 0
net.ipv4.conf.eth0/0007.arp_filter = 0
net.ipv4.conf.eth0/0007.rp_filter = 0
net.ipv4.conf.eth0/0008.arp_filter = 0
net.ipv4.conf.eth0/0008.rp_filter = 0
net.ipv4.conf.eth0/0016.arp_filter = 0
net.ipv4.conf.eth0/0016.rp_filter = 0
net.ipv4.conf.eth0/0017.arp_filter = 0
net.ipv4.conf.eth0/0017.rp_filter = 0
net.ipv4.conf.eth0/0018.arp_filter = 0
net.ipv4.conf.eth0/0018.rp_filter = 0
net.ipv4.conf.eth0/0019.arp_filter = 0
net.ipv4.conf.eth0/0019.rp_filter = 0
net.ipv4.conf.eth0/0021.arp_filter = 0
net.ipv4.conf.eth0/0021.rp_filter = 0
net.ipv4.conf.eth0/0032.arp_filter = 0
net.ipv4.conf.eth0/0032.rp_filter = 0
net.ipv4.conf.eth0/0040.arp_filter = 0
net.ipv4.conf.eth0/0040.rp_filter = 0
net.ipv4.conf.eth0/0130.arp_filter = 0
net.ipv4.conf.eth0/0130.rp_filter = 0
net.ipv4.conf.eth0/0131.arp_filter = 0
net.ipv4.conf.eth0/0131.rp_filter = 0
net.ipv4.conf.eth0/0132.arp_filter = 0
net.ipv4.conf.eth0/0132.rp_filter = 0
net.ipv4.conf.eth0/0133.arp_filter = 0
net.ipv4.conf.eth0/0133.rp_filter = 0
net.ipv4.conf.eth0/0134.arp_filter = 0
net.ipv4.conf.eth0/0134.rp_filter = 0
net.ipv4.conf.eth0/0135.arp_filter = 0
net.ipv4.conf.eth0/0135.rp_filter = 0
net.ipv4.conf.eth0/0141.arp_filter = 0
net.ipv4.conf.eth0/0141.rp_filter = 0
net.ipv4.conf.eth0/0144.arp_filter = 0
net.ipv4.conf.eth0/0144.rp_filter = 0
net.ipv4.conf.eth0/0150.arp_filter = 0
net.ipv4.conf.eth0/0150.rp_filter = 0
net.ipv4.conf.eth0/0151.arp_filter = 0
net.ipv4.conf.eth0/0151.rp_filter = 0
net.ipv4.conf.eth0/0152.arp_filter = 0
net.ipv4.conf.eth0/0152.rp_filter = 0
net.ipv4.conf.eth0/0153.arp_filter = 0
net.ipv4.conf.eth0/0153.rp_filter = 0
net.ipv4.conf.eth0/0154.arp_filter = 0
net.ipv4.conf.eth0/0154.rp_filter = 0
net.ipv4.conf.eth0/0155.arp_filter = 0
net.ipv4.conf.eth0/0155.rp_filter = 0
net.ipv4.conf.eth0/0156.arp_filter = 0
net.ipv4.conf.eth0/0156.rp_filter = 0
net.ipv4.conf.eth0/0157.arp_filter = 0
net.ipv4.conf.eth0/0157.rp_filter = 0
net.ipv4.conf.eth0/0158.arp_filter = 0
net.ipv4.conf.eth0/0158.rp_filter = 0
net.ipv4.conf.eth0/0161.arp_filter = 0
net.ipv4.conf.eth0/0161.rp_filter = 0
net.ipv4.conf.eth0/0162.arp_filter = 0
net.ipv4.conf.eth0/0162.rp_filter = 0
net.ipv4.conf.eth0/0181.arp_filter = 0
net.ipv4.conf.eth0/0181.rp_filter = 0
net.ipv4.conf.eth0/0182.arp_filter = 0
net.ipv4.conf.eth0/0182.rp_filter = 0
net.ipv4.conf.eth0/0183.arp_filter = 0
net.ipv4.conf.eth0/0183.rp_filter = 0
net.ipv4.conf.eth0/0184.arp_filter = 0
net.ipv4.conf.eth0/0184.rp_filter = 0
net.ipv4.conf.eth0/0201.arp_filter = 0
net.ipv4.conf.eth0/0201.rp_filter = 0
net.ipv4.conf.eth0/0202.arp_filter = 0
net.ipv4.conf.eth0/0202.rp_filter = 0
net.ipv4.conf.eth0/0203.arp_filter = 0
net.ipv4.conf.eth0/0203.rp_filter = 0
net.ipv4.conf.eth0/0221.arp_filter = 0
net.ipv4.conf.eth0/0221.rp_filter = 0
net.ipv4.conf.eth0/0224.arp_filter = 0
net.ipv4.conf.eth0/0224.rp_filter = 0
net.ipv4.conf.eth1.arp_filter = 0
net.ipv4.conf.eth1.rp_filter = 0
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.rp_filter = 0