我有以下情况：
路由看起来像这样：
Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 172.28.183.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 172.28.171.0 0.0.0.0 255.255.255.0 U 0 0 0 eth2 172.28.173.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1 78.46.78.0 172.28.171.1 255.255.255.0 UG 0 0 0 eth2 169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 eth0 0.0.0.0 172.28.183.1 0.0.0.0 UG 100 0 0 eth0 正如你所看到的，有78.46.78.0/24的特殊路由 – 这个stream量应该通过二级networkingeth2。
哪个工作。 我可以做任何types的TCP连接到机器在78.46.78.0/24。
但是，当我试图让他们，我得到了奇怪的结果：
root@blob:~# mtr --report --report-cycles=5 78.46.78.198 HOST: blob Loss% Snt Last Avg Best Wrst StDev 1. 172.28.171.1 0.0% 5 0.6 0.6 0.5 0.6 0.0 2. ??? 100.0 5 0.0 0.0 0.0 0.0 0.0
在tcpdump输出中，我看到超出了生存时间的回复：
10:16:28.158888 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 59520, length 44 10:16:28.159363 IP 172.28.171.1 > 172.28.171.2: ICMP time exceeded in-transit, length 72 10:16:28.259153 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 59776, length 44 10:16:28.359546 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 60032, length 44 10:16:28.408129 IP 10.9.208.1 > 172.28.171.2: ICMP time exceeded in-transit, length 36 10:16:28.428193 IP 10.9.208.2 > 172.28.171.2: ICMP time exceeded in-transit, length 36 10:16:28.459953 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 60288, length 44 10:16:28.560260 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 60544, length 44 10:16:28.618138 IP 10.9.213.6 > 172.28.171.2: ICMP time exceeded in-transit, length 36 10:16:28.660678 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 60800, length 44 10:16:28.708130 IP 10.9.212.253 > 172.28.171.2: ICMP time exceeded in-transit, length 36 10:16:28.730193 IP 213.158.195.13 > 172.28.171.2: ICMP time exceeded in-transit, length 36 10:16:28.761086 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 61056, length 44 10:16:28.861380 IP 172.28.171.2 > 78.46.78.198: ICMP echo request, id 2092, seq 61312, length 44 10:16:28.938167 IP 213.248.89.153 > 172.28.171.2: ICMP time exceeded in-transit, length 36
但是，与mtr我strace我看到这些ICMP答复不交付给mtr！
我认为原因可能是icmp响应的源ip来自“错误的接口” – 即ICMP响应来自（例如）10.9.212.253（某些中间路由器），但是这个ip应该通过eth0路由，而它涉及eth2。
这是合理的理由吗？ 我能做些什么来使mtr工作到我的“特殊”networking？
iptables设置使用：
iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -i eth1 -j ACCEPT iptables -A INPUT -p icmp -j ACCEPT iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A FORWARD -i eth1 -j ACCEPT iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE iptables -t nat -A POSTROUTING -o eth2 -j MASQUERADE iptables -A INPUT -j LOG --log-prefix 'IPTABLES: ' iptables -A FORWARD -j LOG --log-prefix 'IPTABLES: '
但是我没有看到任何与kern.log相关的icmp相关软件包。
感谢RafałRamocki – 解决scheme很简单 – 您必须closureseth2接口上的rp_filter-ing：
echo 0 > /proc/sys/net/ipv4/conf/eth2/rp_filter
从内核文档：
rp_filter --------- Integer value determines if a source validation should be made. 1 means yes, 0 means no. Disabled by default, but local/broadcast address spoofing is always on. If you set this to 1 on a router that is the only connection for a network to the net, it will prevent spoofing attacks against your internal networks (external addresses can still be spoofed), without the need for additional firewall rules.
虽然很好的防止欺骗攻击（至less有一些），它绝对会杀死一些function，如果你有更多的互联网连接。