☰

在 Raspberry Pi 上使用 WireGuard - NAT 问题

tag-icon • tag-icon iptables raspberry-pi vpn nat
在 Raspberry Pi 上使用 WireGuard - NAT 问题

我尝试在带有 Pi-OS 的 Raspberry Pi 3B 上运行 WireGuard，但 NAT 不起作用。

当我启动 WireGuard 时，我得到了这个：

root@raspberrypi:/home/pi# wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.10.10.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a tun.wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
root@raspberrypi:/home/pi#

iptables 看起来如下：

root@raspberrypi:/home/pi# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere                

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@raspberrypi:/home/pi#

但我无法从 wg0 10.10.10.2 连接到 192.168.188.0/24 网络。你有什么想法？

我能够连接到 10.10.10.1/32 IP，但无法 ping 通 192.168.188.0/24 中的任何设备

数据包转发

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

# Uncomment the next line to enable packet forwarding for IPv6
#  Enabling this option disables Stateless Address Autoconfiguration
#  based on Router Advertisements for this host
net.ipv6.conf.all.forwarding=1

以及请求的 NAT

root@raspberrypi:/home/pi# iptables -t nat -vnL
Chain PREROUTING (policy ACCEPT 49 packets, 14332 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 49 packets, 14332 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 490 packets, 32962 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 427 packets, 28720 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   63  4242 MASQUERADE  all  --  *      eth0    0.0.0.0/0            0.0.0.0/0           
root@raspberrypi:/home/pi#

输出ip路由

root@raspberrypi:/home/pi# ip route
default via 192.168.188.1 dev eth0 src 192.168.188.45 metric 202 
default via 192.168.188.1 dev wlan0 src 192.168.188.20 metric 303 
192.168.188.0/24 dev eth0 proto kernel scope link src 192.168.188.45 metric 202 
192.168.188.0/24 dev wlan0 proto kernel scope link src 192.168.188.20 metric 303

输出工作负载：

root@raspberrypi:/home/pi# wg
interface: wg0
  public key: Deleted
  private key: (hidden)
  listening port: 51820
  fwmark: 0xca6c

peer:deleted
  preshared key: (hidden)
  endpoint: 80.142.204.XXX:62046
  allowed ips: 0.0.0.0/0, ::/0
  transfer: 25.44 KiB received, 3.63 MiB sent

罗艾玛更新：2019 年 12 月 24 日

root@raspberrypi:/home/pi# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_update_priority = 1
net.ipv4.ip_forward_use_pmtu = 0

root@raspberrypi:/home/pi# sysctl -a | grep net.ipv6.conf.all.forwarding
net.ipv6.conf.all.forwarding = 1

相关内容