☰

退出 openvpn 后网络命名空间损坏

tag-icon • tag-icon network-namespaces
退出 openvpn 后网络命名空间损坏

我做了这些：

ip netns add vpn
ip netns exec vpn ip addr add 127.0.0.1/8 dev lo     
ip netns exec vpn ip link set lo up
ip link add vpn0 type veth peer name vpn1
ip link set vpn0 up
ip link set vpn1 netns vpn up     
ip addr add 10.200.200.1/24 dev vpn0
ip netns exec vpn ip addr add 10.200.200.2/24 dev vpn1
ip netns exec vpn ip route add default via 10.200.200.1 dev vpn1
iptables -A INPUT \! -i vpn0 -s 10.200.200.0/24 -j DROP
iptables -t nat -A POSTROUTING -s 10.200.200.0/24 -o wl+ -j MASQUERADE
sysctl -q net.ipv4.ip_forward=1
ip netns exec vpn ping www.google.com

它奏效了。然后我跑了ip netns exec vpn sudo openvpn，退出后，我无法让它再次工作。 ping 不再起作用，甚至连 IP 地址也不起作用。即使运行ip netns delete vpn并重新运行命令也无济于事。

# ip addr show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: wlan0: <BROADCAST,MULTICAST> mtu 1500 qdisc mq state DOWN group default qlen 1000
    link/ether 22:cc:d1:f6:35:2b brd ff:ff:ff:ff:ff:ff
3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether f0:de:f1:f7:2c:4a brd ff:ff:ff:ff:ff:ff
    inet 192.168.0.29/24 brd 192.168.0.255 scope global dynamic eth0
       valid_lft 73102sec preferred_lft 73102sec
8: vpn0@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 1e:5e:d3:e5:db:22 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.200.200.1/24 scope global vpn0
       valid_lft forever preferred_lft forever    

# ip route show
default via 192.168.0.1 dev eth0 proto static metric 100 
10.200.200.0/24 dev vpn0 proto kernel scope link src 10.200.200.1 
192.168.0.0/24 dev eth0 proto kernel scope link src 192.168.0.29 metric 100 

# iptables-save 
# Generated by iptables-save v1.6.1 on Tue Dec 19 12:49:08 2017
*nat
:PREROUTING ACCEPT [117:18442]
:INPUT ACCEPT [83:15245]
:OUTPUT ACCEPT [6361:448220]
:POSTROUTING ACCEPT [6369:448969]
-A POSTROUTING -s 10.200.200.0/24 -o wl+ -j MASQUERADE
COMMIT
# Completed on Tue Dec 19 12:49:08 2017
# Generated by iptables-save v1.6.1 on Tue Dec 19 12:49:08 2017
*filter
:INPUT ACCEPT [417285:494013961]
:FORWARD ACCEPT [100347:95403730]
:OUTPUT ACCEPT [306295:38038441]
-A INPUT -s 10.200.200.0/24 ! -i vpn0 -j DROP
COMMIT
# Completed on Tue Dec 19 12:49:08 2017

# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1

# ip netns exec vpn ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2030ms

答案1

您的MASQUERADE规则仅适用于wlan0未使用的离开流量。您是否需要将类似的规则应用于eth0？

ip netns delete如果保留其他引用，则不会删除命名空间，这会导致 veth 对保留，导致某些命令失败并出现错误。

相关内容