Добрый день!

На домашнем маршрутизаторе стоит CentOS 5.x с ядром 3.0.44-1.el5.elrepo, настроен NAT. На маршрутизаторе три подсети: LAN, WLAN и WAN. За маршрутизатором стоит Synology DiskStation DS413j, которая, собственно, создаёт бо'льшую часть трафика.

К сожалению, часть пакетов от DiskStation оказываются на WAN-интерфейсе с локальным IP-адресом:

firewall:~# tcpdump -vvvnnieth0 -c10 src 172.16.254.8
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
13:13:21.000827 IP (tos 0x0, ttl  63, id 5750, offset 0, flags [DF], proto: TCP (6), length: 52) 172.16.254.8.43378 > 195.82.146.121.80: F, cksum 0x9f5a (correct), 2603057241:2603057241(0) ack 2381765229 win 216 <nop,nop,timestamp 216183677 2367642493>
13:13:21.748215 IP (tos 0x0, ttl  63, id 9187, offset 0, flags [DF], proto: TCP (6), length: 40) 172.16.254.8.36402 > 195.82.146.122.80: F, cksum 0x5770 (correct), 3779438242:3779438242(0) ack 3572585472 win 6432
13:13:26.518351 IP (tos 0x0, ttl  63, id 7235, offset 0, flags [DF], proto: TCP (6), length: 40) 172.16.254.8.43521 > 195.82.146.120.80: F, cksum 0xd9af (correct), 2003206:2003206(0) ack 1399467583 win 6432
13:13:26.787903 IP (tos 0x0, ttl  63, id 7236, offset 0, flags [DF], proto: TCP (6), length: 40) 172.16.254.8.43521 > 195.82.146.120.80: F, cksum 0xd9af (correct), 0:0(0) ack 1 win 6432
13:13:27.327884 IP (tos 0x0, ttl  63, id 7237, offset 0, flags [DF], proto: TCP (6), length: 40) 172.16.254.8.43521 > 195.82.146.120.80: F, cksum 0xd9af (correct), 0:0(0) ack 1 win 6432
13:13:28.411000 IP (tos 0x0, ttl  63, id 7238, offset 0, flags [DF], proto: TCP (6), length: 40) 172.16.254.8.43521 > 195.82.146.120.80: F, cksum 0xd9af (correct), 0:0(0) ack 1 win 6432
13:13:30.567867 IP (tos 0x0, ttl  63, id 7239, offset 0, flags [DF], proto: TCP (6), length: 40) 172.16.254.8.43521 > 195.82.146.120.80: F, cksum 0xd9af (correct), 0:0(0) ack 1 win 6432
13:13:34.887867 IP (tos 0x0, ttl  63, id 7240, offset 0, flags [DF], proto: TCP (6), length: 40) 172.16.254.8.43521 > 195.82.146.120.80: F, cksum 0xd9af (correct), 0:0(0) ack 1 win 6432
13:13:37.417925 IP (tos 0x0, ttl  63, id 7988, offset 0, flags [DF], proto: TCP (6), length: 52) 172.16.254.8.47083 > 188.190.120.34.80: F, cksum 0x1741 (correct), 2126666411:2126666411(0) ack 773466477 win 176 <nop,nop,timestamp 216185319 2898141976>
13:13:41.482124 IP (tos 0x0, ttl  63, id 5751, offset 0, flags [DF], proto: TCP (6), length: 52) 172.16.254.8.43378 > 195.82.146.121.80: F, cksum 0x975a (correct), 0:0(0) ack 1 win 216 <nop,nop,timestamp 216185725 2367642493>
10 packets captured
13 packets received by filter
0 packets dropped by kernel

Вот настройки iptables:

firewall:~# iptables-save | sed 's/\[[0-9]\+:[0-9]\+\]/[0:0]/'
# Generated by iptables-save v1.3.5 on Fri Jan  3 13:14:12 2014
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -d 224.0.0.0/240.0.0.0 -p igmp -j TTL --ttl-inc 1
-A PREROUTING -d 224.0.0.0/240.0.0.0 -p udp -j TTL --ttl-inc 1
-A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
COMMIT
# Completed on Fri Jan  3 13:14:12 2014
# Generated by iptables-save v1.3.5 on Fri Jan  3 13:14:12 2014
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:reject-and-log-it - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth1 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -i wlan0 -p udp -m udp --sport 68 --dport 67 -j ACCEPT
-A INPUT -s 172.16.253.0/255.255.255.0 -i wlan0 -j ACCEPT
-A INPUT -s 172.16.254.0/255.255.255.0 -i eth1 -j ACCEPT
-A INPUT -s 172.16.253.0/255.255.255.0 -i eth0 -j reject-and-log-it
-A INPUT -s 172.16.254.0/255.255.255.0 -i eth0 -j reject-and-log-it
-A INPUT -s 224.0.0.0/240.0.0.0 -i eth0 -j ACCEPT
-A INPUT -d 224.0.0.0/240.0.0.0 -i eth0 -j ACCEPT
-A INPUT -d 178.23.228.0/255.255.255.224 -i eth0 -p icmp -j ACCEPT
-A INPUT -d 178.23.228.0/255.255.255.224 -i eth0 -p udp -m ttl --ttl-lt 5 -j ACCEPT
-A INPUT -d 178.23.228.0/255.255.255.224 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p icmp -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m ttl --ttl-lt 5 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 25 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 587 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 993 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 995 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 3128 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 12865 -j ACCEPT
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 12865 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 69 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 137 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 445 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 500 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 1024 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 1024 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 1031 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 1031 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -i eth0 -p udp -m udp --dport 1443 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 1433 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 4899 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 51413 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 51414 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 51414 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 54984 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 54984 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p tcp -m tcp --dport 55570 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -d 178.23.228.6 -i eth0 -p udp -m udp --dport 55570 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -j reject-and-log-it
-A FORWARD -i eth0 -o eth1 -p igmp -j ACCEPT
-A FORWARD -d 224.0.0.0/240.0.0.0 -j ACCEPT
-A FORWARD -s 172.16.253.0/255.255.255.0 -d 172.16.254.0/255.255.255.0 -i wlan0 -o eth1 -j ACCEPT
-A FORWARD -s 172.16.254.0/255.255.255.0 -d 172.16.253.0/255.255.255.0 -i eth1 -o wlan0 -j ACCEPT
-A FORWARD -s 172.16.253.0/255.255.255.0 -i wlan0 -o eth0 -j ACCEPT
-A FORWARD -s 172.16.253.0/255.255.255.0 -i wlan0 -o eth1 -j ACCEPT
-A FORWARD -s 172.16.254.0/255.255.255.0 -i eth1 -o eth0 -j ACCEPT
-A FORWARD -s 172.16.254.0/255.255.255.0 -i eth1 -o eth1 -j ACCEPT
-A FORWARD -d 172.16.253.0/255.255.255.0 -i eth0 -o wlan0 -j ACCEPT
-A FORWARD -d 172.16.253.0/255.255.255.0 -i eth1 -o wlan0 -j ACCEPT
-A FORWARD -d 172.16.254.0/255.255.255.0 -i eth0 -o eth1 -j ACCEPT
-A FORWARD -j reject-and-log-it
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 178.23.228.0/255.255.255.224 -o eth0 -j ACCEPT
-A OUTPUT -d 172.16.253.0/255.255.255.0 -o wlan0 -j ACCEPT
-A OUTPUT -d 172.16.254.0/255.255.255.0 -o eth1 -j ACCEPT
-A OUTPUT -d 224.0.0.0/240.0.0.0 -o eth0 -j ACCEPT
-A OUTPUT -s 224.0.0.0/240.0.0.0 -o eth0 -j ACCEPT
-A OUTPUT -d 224.0.0.0/240.0.0.0 -o wlan0 -j ACCEPT
-A OUTPUT -s 224.0.0.0/240.0.0.0 -o wlan0 -j ACCEPT
-A OUTPUT -d 224.0.0.0/240.0.0.0 -o eth1 -j ACCEPT
-A OUTPUT -s 224.0.0.0/240.0.0.0 -o eth1 -j ACCEPT
-A OUTPUT -j reject-and-log-it
-A reject-and-log-it -j LOG --log-level 7
-A reject-and-log-it -j REJECT --reject-with icmp-port-unreachable
COMMIT
# Completed on Fri Jan  3 13:14:12 2014
# Generated by iptables-save v1.3.5 on Fri Jan  3 13:14:12 2014
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A PREROUTING -d 178.23.228.6 -p tcp -m tcp --dport 2222 -j DNAT --to-destination 172.16.254.8:22
-A PREROUTING -d 178.23.228.6 -p tcp -m tcp --dport 51414 -j DNAT --to-destination 172.16.254.8:51414
-A PREROUTING -d 178.23.228.6 -p udp -m udp --dport 51414 -j DNAT --to-destination 172.16.254.8:51414
-A POSTROUTING -o eth0 -j SNAT --to-source 178.23.228.6
-A POSTROUTING -d 172.16.254.0/255.255.255.0 -o eth1 -j SNAT --to-source 172.16.254.254
-A POSTROUTING -d 172.16.253.0/255.255.255.0 -o wlan0 -j SNAT --to-source 172.16.253.254
COMMIT
# Completed on Fri Jan  3 13:14:12 2014

Попытка добавить что-то вроде

-A PREROUTING -s 172.16.254.0/255.255.255.0 -m state --state INVALID -j DROP

(как сказано тут http://www.opennet.me/openforum/vsluhforumID1/88674.html#12) проблему не решает.

Буду признателен за любую помощь.

С уважением,
Тимофей