如何在linux机器上启用traceroute

Question

我正在研究传输层中的一些东西，在我运行我们的自定义策略来保护我无法traceroute从 linux 机器上执行的策略之后。

root@keystone-evm:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             10.222.4.212         udp dpt:echo
ACCEPT     udp  --  anywhere             10.222.4.212         udp dpt:isakmp
ACCEPT     udp  --  anywhere             10.222.4.212         udp dpt:radius
ACCEPT     udp  --  anywhere             10.222.4.212         udp dpt:ntp
ACCEPT     icmp --  anywhere             10.222.4.212
ACCEPT     udp  --  anywhere             10.222.4.212         udp dpt:domain
ACCEPT     udp  --  anywhere             10.222.4.212         udp dpt:bootpc
ACCEPT     udp  --  anywhere             10.222.4.212         udp dpt:bootps
ACCEPT     123  --  anywhere             10.222.4.212
DROP       all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere             udp spts:33434:33524 state NEW,RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     udp  --  10.222.4.212         anywhere             udp dpt:echo
ACCEPT     udp  --  10.222.4.212         anywhere             udp dpt:isakmp
ACCEPT     udp  --  10.222.4.212         anywhere             udp dpt:radius
ACCEPT     udp  --  10.222.4.212         anywhere             udp dpt:ntp
ACCEPT     icmp --  10.222.4.212         anywhere
ACCEPT     udp  --  10.222.4.212         anywhere             udp dpt:domain
ACCEPT     udp  --  10.222.4.212         anywhere             udp dpt:bootpc
ACCEPT     udp  --  10.222.4.212         anywhere             udp dpt:bootps
ACCEPT     123  --  10.222.4.212         anywhere
DROP       all  --  anywhere             anywhere
ACCEPT     udp  --  anywhere             anywhere             udp dpts:33434:33524 state NEW
root@keystone-evm:~# traceroute 10.222.4.100
traceroute to 10.222.4.100 (10.222.4.100), 30 hops max, 38 byte packets
 1traceroute: sendto: Operation not permitted

下面给出的是我发出的启用 traceroute 的命令：

• iptables -A OUTPUT -o eth0 -p udp --dport 33434:33524 -m state --state NEW -j ACCEPT
• iptables -A INPUT -p udp --sport 33434:33524 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

Answer 1

从中我们可以看出man 8 traceroute：

• UDP 是 Linux 上的默认跟踪路由机制
• traceroute 期望收到“ICMP 无法访问”消息以响应其查询
• 跟踪从端口 33434 开始，每跳递增 1

同时，微软确认Windows在其实现中使用了“ICMP Echo Requests”。

因此，这是允许主机正确处理入站和执行出站跟踪路由的答案。附加规则以拒绝（不丢弃）UDP 端口 33434-33474 上的流量，并回复回显请求，并允许匹配的出站数据包（如果您限制出站流量）。

# reject (not drop) packets for inbound traceroutes from Linux boxes
iptables -I INPUT -p udp --dport 33434:33474 -j REJECT

# accept ping requests for Windows-style traceroutes
iptables -I INPUT -p ICMP --icmp-type echo-request -j ACCEPT

# allow ping responses for Windows-style traceroutes
iptables -I OUTPUT -p ICMP --icmp-type echo-reply -j ACCEPT

# allow the server to perform its own traceroutes
iptables -I OUTPUT -p udp --dport 33434:33474 -j ACCEPT

为了记录，摘自手册页：

LIST OF AVAILABLE METHODS
       In  general,  a  particular traceroute method may have to be chosen by -M name, but
       most of the methods have their simple cmdline switches (you can see them after  the
       method name, if present).

   default
       The traditional, ancient method of tracerouting. Used by default.

       Probe  packets  are udp datagrams with so-called "unlikely" destination ports.  The
       "unlikely" port of the first probe is 33434, then for each next probe it is  incre-
       mented by one. Since the ports are expected to be unused, the destination host nor-
       mally returns "icmp unreach port" as a final response.  (Nobody knows what  happens
       when some application listens for such ports, though).

       This method is allowed for unprivileged users.

   icmp       -I
       Most usual method for now, which uses icmp echo packets for probes.
       If you can ping(8) the destination host, icmp tracerouting is applicable as well.

   tcp        -T
       Well-known modern method, intended to bypass firewalls.
       Uses the constant destination port (default is 80, http).

Answer 2

感谢您的所有投入。

我想出了一个 shell 脚本来为我完成这项工作。我相信这也有助于其他用户执行任务。请注意本机IP。请相应地进行必要的更改。

#!/bin/sh
echo "Enabling Traceroute..."

#Outbound UDP traffic Policy

iptables -I OUTPUT -o eth0 -p udp --dport 33434:33524 -m state --state NEW -j ACCEPT

iptables -I INPUT -p udp --sport 33434:33524 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#Inbound ICMP traffic Policy


iptables -I INPUT -p icmp --icmp-type 3/3 -d 10.222.4.212 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -I INPUT -p icmp --icmp-type 11  -d 10.222.4.212 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT