在我的木偶客户半定期运行期间，我看到数据包被丢弃。 我不明白是什么原因造成的。 我应该提到Puppet通过puppetlabs / firewall模块来pipe理防火墙规则。 但规则似乎没有改变。 通过这种说法，傀儡debugging并不显示规则被删除，然后被添加，数据包计数从傀儡代理运行之前继续，并且在傀儡代理运行期间查看规则在运行期间没有显示任何规则改变。
Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 /* 000 accept all icmp */ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 001 accept all to lo interface */ ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 002 accept related established rules */ state RELATED,ESTABLISHED ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport ports 22 /* 100 allow ssh access */ ACCEPT tcp -- 172.xx.xx.xx 0.0.0.0/0 multiport ports 5666 /* 101 allow nrpe access from 172.xx.xx.xx */ ACCEPT tcp -- 69.xx.xx.xx 0.0.0.0/0 multiport ports 5666 /* 101 allow nrpe access from 69.xx.xx.xx */ ACCEPT tcp -- 192.168.116.0/24 192.168.116.0/24 multiport ports 3306 /* 300 allow MySQL BackNet */ LOG tcp -- 0.0.0.0/0 0.0.0.0/0 /* 301 log all other BackNet requests */ LOG flags 0 level 6 prefix "[IPTABLES INPUT] dropped " DROP tcp -- 0.0.0.0/0 0.0.0.0/0 /* 302 drop all other BackNet requests */ LOG tcp -- 0.0.0.0/0 0.0.0.0/0 /* 998 log all other requests */ LOG flags 0 level 6 prefix "[IPTABLES INPUT] dropped " DROP tcp -- 0.0.0.0/0 0.0.0.0/0 /* 999 drop all other requests */ Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 /* 002 accept related established rules OUT */ state RELATED,ESTABLISHED ACCEPT tcp -- 172.31.100.0/23 172.31.100.0/23 multiport ports 389,636 /* 351 allow LDAPNet OUT */ ACCEPT tcp -- 192.168.116.0/24 192.168.116.0/24 multiport ports 3306 /* 351 allow MySQL BackNet OUT */ LOG tcp -- 0.0.0.0/0 0.0.0.0/0 /* 352 drop all other BackNet requests OUT */ LOG flags 0 level 6 prefix "[IPTABLES OUTPUT] dropped " LOG tcp -- 0.0.0.0/0 0.0.0.0/0 /* 352 drop all other LDAPNet requests OUT */ LOG flags 0 level 6 prefix "[IPTABLES OUTPUT] dropped " DROP tcp -- 0.0.0.0/0 0.0.0.0/0 /* 353 drop all other BackNet requests OUT */ DROP tcp -- 0.0.0.0/0 0.0.0.0/0 /* 353 drop all other LDAPNet requests OUT */ 而且我看到傀儡大师在傀儡客户端丢包。 logging为：
Aug 13 14:22:19 int-vs-repo kernel: [91935.669812] [IPTABLES INPUT] dropped IN=eth0 OUT= MAC=00:50:56:bc:0c:4c:00:e0:b6:00:44:f6:08:00 SRC=PuppetMasterIP DST=Local_IP LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=48739 DF PROTO=TCP SPT=8140 DPT=40069 WINDOW=749 RES=0x00 ACK URGP=0 Aug 13 14:22:19 int-vs-repo kernel: [91935.670108] [IPTABLES INPUT] dropped IN=eth0 OUT= MAC=00:50:56:bc:0c:4c:00:e0:b6:00:44:f6:08:00 SRC=PuppetMasterIP DST=Local_IP LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=48740 DF PROTO=TCP SPT=8140 DPT=40069 WINDOW=749 RES=0x00 ACK URGP=0 Aug 13 14:22:19 int-vs-repo kernel: [91935.670134] [IPTABLES INPUT] dropped IN=eth0 OUT= MAC=00:50:56:bc:0c:4c:00:e0:b6:00:44:f6:08:00 SRC=PuppetMasterIP DST=Local_IP LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=48741 DF PROTO=TCP SPT=8140 DPT=40069 WINDOW=749 RES=0x00 ACK URGP=0 Aug 13 14:22:19 int-vs-repo kernel: [91935.670409] [IPTABLES INPUT] dropped IN=eth0 OUT= MAC=00:50:56:bc:0c:4c:00:e0:b6:00:44:f6:08:00 SRC=PuppetMasterIP DST=Local_IP LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=48742 DF PROTO=TCP SPT=8140 DPT=40069 WINDOW=749 RES=0x00 ACK URGP=0
我并不过分担心这些特定的数据包，但是计划移动更多的机器来集中控制iptables规则，并担心这是一个不容忽视的问题的指标。 看起来好像所有这样丢弃的数据包都是ACK，并且它们的ID增加了一个，也就是说，在我看来，连接在中间丢失，并且ESTABLISHED，RELATED规则应该允许这些数据包。
Aug 14 21:52:19 int-vs-repo kernel: [205448.464080] [IPTABLES INPUT 998] dropped IN=eth0 OUT= MAC=00:50:56:bc:0c:4c:00:e0:b6:00:44:f6:08:00 SRC=PuppetMasterIP DST=PuppetClientIP LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=40139 DF PROTO=TCP SPT=8140 DPT=52532 WINDOW=726 RES=0x00 ACK URGP=0 Aug 14 21:52:19 int-vs-repo kernel: [205448.464110] [IPTABLES INPUT 998] dropped IN=eth0 OUT= MAC=00:50:56:bc:0c:4c:00:e0:b6:00:44:f6:08:00 SRC=PuppetMasterIP DST=PuppetAgentIP LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=40140 DF PROTO=TCP SPT=8140 DPT=52532 WINDOW=726 RES=0x00 ACK URGP=0