V2EX › LGA1150 的所有回复 › 第 37 页 / 共 93 页

看来是 DHCPv6，不过你依然可以试试 relay
编辑 /etc/config/dhcp
config dhcp 'lan'
option interface 'lan'
option start '100'
option limit '150'
option leasetime '12h'
option ra 'relay'
option ndp 'relay'

config dhcp 'wan'
option interface 'wan'
option ignore '1'

config dhcp 'wan6'
option interface 'wan'
option ra 'relay'
option ndp 'relay'
option master '1'
其他部分别动
取消原有的 NAT6 设置，重启

2018-05-26 14:49:55 +08:00

回复了 MEISTING 创建的主题 › 宽带症候群 › ipv6 nat 后会对 pt 上传有影响吗

@MEISTING 接口掩码是不是 /64

2018-05-26 13:56:19 +08:00

回复了 MEISTING 创建的主题 › 宽带症候群 › ipv6 nat 后会对 pt 上传有影响吗

@237176253 如果是 SLAAC 给 /64 中的一个的话，可以 odhcpd relay

2018-05-26 01:54:09 +08:00

回复了 Menci 创建的主题 › 宽带症候群 › 国内 Ping 和 HTTP(S) 能通， SSH 接受指纹后卡住，怎么回事

@snsd The IT Crowd

2018-05-25 17:30:47 +08:00

回复了 Menci 创建的主题 › 宽带症候群 › 国内 Ping 和 HTTP(S) 能通， SSH 接受指纹后卡住，怎么回事

结论：
https://i.imgur.com/Yj6dB3W.gif

2018-05-24 01:05:40 +08:00

回复了 mario85 创建的主题 › 宽带症候群 › 电信宽带流量劫持广告复现过程

我似乎抓到劫持包了
似乎所有的劫持包都有一个变量"_atn_obj_"
于是用 iptables 关键字匹配：
iptables -A forwarding_rule -i pppoe-wan -p tcp --sport 80 -m string --string "_atn_obj_" --algo bm -j LOG
同时后台开着 tcpdump
直到内核日志中出现一条：
[54945.458949] IN=pppoe-wan OUT=ct MAC= SRC=119.23.80.130 DST=10.2.1.2 LEN=894 TOS=0x00 PREC=0x00 TTL=56 ID=9997 DF PROTO=TCP SPT=80 DPT=45021 WINDOW=256 RES=0x00 ACK PSH URGP=0

然后我过滤抓包结果：
00:35:20.051969 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [S], seq 296045250, win 64240, options [mss 1432,sackOK,TS val 3110253 ecr 0,nop,wscale 8], length 0
00:35:20.060124 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [S.], seq 4085280, ack 296045251, win 14600, options [mss 1444,nop,nop,sackOK,nop,wscale 7], length 0
00:35:20.071531 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], ack 1, win 251, length 0
00:35:20.073405 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [P.], seq 1:1530, ack 1, win 251, length 1529: HTTP: GET /static/image/mobile/styletouch.css HTTP/1.1
00:35:20.081913 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [.], ack 1433, win 137, length 0
00:35:20.082025 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [.], ack 1530, win 137, length 0
00:35:20.094693 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 1:245, ack 1530, win 137, length 244: HTTP: HTTP/1.1 304 Not Modified
00:35:20.106128 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], ack 245, win 256, length 0
00:35:20.110373 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], seq 1530:2962, ack 245, win 256, length 1432: HTTP: GET /static/assets/js/amazeui.min.js HTTP/1.1
00:35:20.110765 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [P.], seq 2962:3040, ack 245, win 256, length 78: HTTP
00:35:20.129094 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:1099, ack 2962, win 256, length 854: HTTP: HTTP/1.1 200 OK
00:35:20.129715 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [.], ack 3040, win 159, length 0
00:35:20.143467 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:490, ack 3040, win 159, length 245: HTTP: HTTP/1.1 304 Not Modified
00:35:20.150041 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [F.], seq 3040, ack 1099, win 262, length 0
00:35:20.154660 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], ack 1099, win 262, options [nop,nop,sack 1 {245:490}], length 0
00:35:20.361116 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [F.], seq 3040, ack 1099, win 262, length 0
00:35:20.361483 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:490, ack 3040, win 159, length 245: HTTP: HTTP/1.1 304 Not Modified
00:35:20.394913 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], ack 1099, win 262, options [nop,nop,sack 1 {245:490}], length 0
00:35:20.582203 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [F.], seq 3040, ack 1099, win 262, length 0
00:35:20.799507 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:490, ack 3040, win 159, length 245: HTTP: HTTP/1.1 304 Not Modified
00:35:20.817570 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], ack 1099, win 262, options [nop,nop,sack 1 {245:490}], length 0
00:35:21.021165 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [F.], seq 3040, ack 1099, win 262, length 0
00:35:21.675574 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:490, ack 3040, win 159, length 245: HTTP: HTTP/1.1 304 Not Modified
00:35:21.715799 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], ack 1099, win 262, options [nop,nop,sack 1 {245:490}], length 0
00:35:21.904377 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [F.], seq 3040, ack 1099, win 262, length 0
00:35:23.427507 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:490, ack 3040, win 159, length 245: HTTP: HTTP/1.1 304 Not Modified
00:35:23.454270 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [.], ack 1099, win 262, options [nop,nop,sack 1 {245:490}], length 0
00:35:26.931735 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:490, ack 3040, win 159, length 245: HTTP: HTTP/1.1 304 Not Modified
00:35:27.118104 IP 10.2.1.2.45021 > 119.23.80.130.80: Flags [R], seq 296048290, win 0, length 0

可以看到
00:35:20.129094 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:1099, ack 2962, win 256, length 854: HTTP: HTTP/1.1 200 OK
这个就是返回的 200 劫持，而真正的服务器返回的是
00:35:20.143467 IP 119.23.80.130.80 > 10.2.1.2.45021: Flags [P.], seq 245:490, ack 3040, win 159, length 245: HTTP: HTTP/1.1 304 Not Modified

根据关键字、TCP FLAGS 和 TTL 匹配包并 DROP 掉
iptables -A forwarding_rule -i pppoe-wan -p tcp --sport 80 -m ttl --ttl-eq 55 --tcp-flags ALL PSH,ACK -m string --string "_atn_obj_" --algo bm -j DROP

存放广告内容的服务器 IP 有 183.59.53.187 183.59.53.188 183.59.53.224 ，po 主的是 183.59.53.197 ，看来可以放心地把整段 IP 屏蔽了

2018-05-23 18:49:23 +08:00

回复了 razios 创建的主题 › 宽带症候群 › 请教局域网内 ftp 传输文件速度为何不快？

路由器 LAN 口百兆？

2018-05-23 14:57:54 +08:00

回复了 c3824363 创建的主题 › 宽带症候群 › 为什么定点搞 TCP 呢，是不是只丢 syn 包开销小

我套了一层 IP-in-IP …

2018-05-17 18:52:36 +08:00

回复了 hzqim 创建的主题 › 问与答 › 选择困难：一个带 WIFI 的千 M 交换机。对，就是普通路由器。

WR1200JS

2018-05-16 22:19:40 +08:00

回复了 remnet 创建的主题 › DNS › 1.1.1.1 号称最快的 DNS

@aceralon SYSU?

1 ... 33 34 35 36 37 38 39 40 41 42 ... 93

❮

❯