커널이 블랙홀 주소 유형을 알도록하는 것은 당신에게 달려 있다고 생각합니다.
에서 xt_addrtype.h 의 iptables 소스 코드 파일, 당신은 볼 수 있습니다 :
/* rtn_type enum values from rtnetlink.h, but shifted */
enum {
XT_ADDRTYPE_UNSPEC = 1 << 0,
XT_ADDRTYPE_UNICAST = 1 << 1, /* 1 << RTN_UNICAST */
XT_ADDRTYPE_LOCAL = 1 << 2, /* 1 << RTN_LOCAL, etc */
XT_ADDRTYPE_BROADCAST = 1 << 3,
XT_ADDRTYPE_ANYCAST = 1 << 4,
XT_ADDRTYPE_MULTICAST = 1 << 5,
XT_ADDRTYPE_BLACKHOLE = 1 << 6,
XT_ADDRTYPE_UNREACHABLE = 1 << 7,
XT_ADDRTYPE_PROHIBIT = 1 << 8,
XT_ADDRTYPE_THROW = 1 << 9,
XT_ADDRTYPE_NAT = 1 << 10,
XT_ADDRTYPE_XRESOLVE = 1 << 11,
};
그리고에 rtnetlink.h, 당신은 동일한 정의를 볼 수 있습니다 :
enum {
RTN_UNSPEC,
RTN_UNICAST, /* Gateway or direct route */
RTN_LOCAL, /* Accept locally */
RTN_BROADCAST, /* Accept locally as broadcast,
send as broadcast */
RTN_ANYCAST, /* Accept locally as broadcast,
but send as unicast */
RTN_MULTICAST, /* Multicast route */
RTN_BLACKHOLE, /* Drop */
RTN_UNREACHABLE, /* Destination is unreachable */
RTN_PROHIBIT, /* Administratively prohibited */
RTN_THROW, /* Not in this table */
RTN_NAT, /* Translate this address */
RTN_XRESOLVE, /* Use external resolver */
__RTN_MAX
};
iptables커널 tcp 네트워킹 스택에서 동일한 주소 유형 정의를 사용할 수 있습니다 .
그런 다음에서 man ip:
Route types:
unicast - the route entry describes real paths to the destinations covered by the route prefix.
unreachable - these destinations are unreachable. Packets are discarded and the ICMP message host unreachable is generated.
The local senders get an EHOSTUNREACH error.
blackhole - these destinations are unreachable. Packets are discarded silently. The local senders get an EINVAL error.
prohibit - these destinations are unreachable. Packets are discarded and the ICMP message communication administratively
prohibited is generated. The local senders get an EACCES error.
local - the destinations are assigned to this host. The packets are looped back and delivered locally.
broadcast - the destinations are broadcast addresses. The packets are sent as link broadcasts.
throw - a special control route used together with policy rules. If such a route is selected, lookup in this table is termi‐
nated pretending that no route was found. Without policy routing it is equivalent to the absence of the route in the routing
table. The packets are dropped and the ICMP message net unreachable is generated. The local senders get an ENETUNREACH
error.
nat - a special NAT route. Destinations covered by the prefix are considered to be dummy (or external) addresses which
require translation to real (or internal) ones before forwarding. The addresses to translate to are selected with the
attribute Warning: Route NAT is no longer supported in Linux 2.6.
via.
anycast - not implemented the destinations are anycast addresses assigned to this host. They are mainly equivalent to local
with one difference: such addresses are invalid when used as the source address of any packet.
multicast - a special type used for multicast routing. It is not present in normal routing tables.
따라서 ip명령 으로 네트워크에 대한 경로를 정의하고 블랙홀 경로로 표시하면 커널은 이제이 네트워크 주소를 블랙홀 유형으로 만듭니다.
ip route add blackhole X.X.X.X/24
LOCAL가장 확실하지 않습니다127.0.0.0/8. 어려운 방법을 찾았습니다. (... 분명히 로컬 주소는 인터페이스에 할당 된 모든 주소를 나타냅니다.