我正在运行一个 OpenWRT 路由器，它通过 OpenVPN 建立 VPN 连接并通过 VPN 路由所有流量。OpenWRT 路由器位于另一个路由器后面，后者建立互联网连接。一切正常，但现在我想访问私有网络中的其他设备，但未连接到 OpenWRT 路由器。
网络配置如下：
- 一个互联网路由器，建立与互联网的连接并提供 192.168.178.0/24 的网络。它的 IP 地址是 192.168.178.1。
- 运行 OpenWRT 的 VPN 路由器通过 LAN 电缆与互联网路由器连接。它提供 192.168.1.0/24 的网络。它的 IP 地址是 192.168.1.1。它与互联网上的服务器建立 VPN 连接，并通过 VPN 路由来自其私有网络 (192.168.1.0/24) 的所有流量。
目标：
- 连接到 VPN 路由器的设备应能访问 Internet 路由器网络中的设备。例如，通过 LAN 连接到 IP 地址为 192.168.178.2 的 Internet 路由器的网络打印机应能从连接到 IP 地址为 192.168.1.2 的 VPN 路由器的设备使用。
我使用 UCI（统一配置接口）配置了 OpenWRT 路由器。配置如下：
/etc/config/网络
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config globals 'globals'
option ula_prefix 'fd6a:fb7c:0d05::/48'
config interface 'lan'
option ifname 'eth0.1'
option type 'bridge'
option proto 'static'
option ipaddr '192.168.1.1'
option netmask '255.255.255.0'
option ip6assign '60'
option macaddr 'f8:1a:67:5a:a6:22'
config interface 'wan'
option ifname 'eth0.2'
option macaddr 'f8:1a:67:5a:a6:25'
option netmask '255.255.255.0'
option proto 'dhcp'
option type 'bridge'
config interface 'wan6'
option ifname '@wan'
option proto 'dhcpv6'
config interface 'IPredator'
option ifname 'tun1337'
option proto 'none'
config switch
option name 'switch0'
option reset '1'
option enable_vlan '1'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0t 2 3 4 5'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '0t 1'
/etc/config/防火墙
config defaults
option syn_flood 1
option input ACCEPT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
list network 'lan'
option input ACCEPT
option output ACCEPT
option forward REJECT
config zone
option name wan
list network 'wan'
list network 'wan6'
option input ACCEPT
option output ACCEPT
option forward REJECT
config zone
option name ipr
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
list network 'IPredator'
config forwarding
option src lan
option dest ipr
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option src_ip fe80::/10
option src_port 547
option dest_ip fe80::/10
option dest_port 546
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
list icmp_type router-advertisement
list icmp_type neighbour-advertisement
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type echo-reply
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
# include a file with users custom iptables rules
config include
option path /etc/firewall.user
**如果配置 -a**
root@OpenWrt:~# ifconfig -a
br-lan Link encap:Ethernet HWaddr F8:1A:67:5A:A6:22
inet addr:192.168.1.1 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::fa1a:67ff:fe5a:a622/64 Scope:Link
inet6 addr: fd6a:fb7c:d05::1/60 Scope:Global
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:93532 errors:0 dropped:0 overruns:0 frame:0
TX packets:115912 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:56145012 (53.5 MiB) TX bytes:123691502 (117.9 MiB)
br-wan Link encap:Ethernet HWaddr F8:1A:67:5A:A6:25
inet addr:192.168.178.20 Bcast:192.168.178.255 Mask:255.255.255.0
inet6 addr: fe80::fa1a:67ff:fe5a:a625/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:115908 errors:0 dropped:0 overruns:0 frame:0
TX packets:92434 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:130982133 (124.9 MiB) TX bytes:16794507 (16.0 MiB)
eth0 Link encap:Ethernet HWaddr 00:04:9F:EF:01:01
inet6 addr: fe80::204:9fff:feef:101/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:205419 errors:0 dropped:0 overruns:0 frame:0
TX packets:203843 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:192549225 (183.6 MiB) TX bytes:137710000 (131.3 MiB)
Base address:0x4000
eth0.1 Link encap:Ethernet HWaddr 00:04:9F:EF:01:01
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:89286 errors:0 dropped:0 overruns:0 frame:0
TX packets:111404 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:55392304 (52.8 MiB) TX bytes:120099623 (114.5 MiB)
eth0.2 Link encap:Ethernet HWaddr 00:04:9F:EF:01:01
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:115908 errors:0 dropped:0 overruns:0 frame:0
TX packets:92434 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:130982133 (124.9 MiB) TX bytes:16794507 (16.0 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:12 errors:0 dropped:0 overruns:0 frame:0
TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:2232 (2.1 KiB) TX bytes:2232 (2.1 KiB)
tun1337 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:46.246.43.203 P-t-P:46.246.43.203 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:114743 errors:0 dropped:0 overruns:0 frame:0
TX packets:91993 errors:0 dropped:351 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:121822466 (116.1 MiB) TX bytes:55995093 (53.4 MiB)
wlan0 Link encap:Ethernet HWaddr F8:1A:67:5A:A6:24
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:122 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:22643 (22.1 KiB)
wlan1 Link encap:Ethernet HWaddr F8:1A:67:5A:A6:23
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:4244 errors:0 dropped:0 overruns:0 frame:0
TX packets:4750 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:812112 (793.0 KiB) TX bytes:3727774 (3.5 MiB)
路线
root@OpenWrt:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default anon-43-1.vpn.i 128.0.0.0 UG 0 0 0 tun1337
default 192.168.178.1 0.0.0.0 UG 0 0 0 br-wan
46.246.43.0 * 255.255.255.0 U 0 0 0 tun1337
46.246.43.130 192.168.178.1 255.255.255.255 UGH 0 0 0 br-wan
128.0.0.0 anon-43-1.vpn.i 128.0.0.0 UG 0 0 0 tun1337
192.168.1.0 * 255.255.255.0 U 0 0 0 br-lan
192.168.178.0 * 255.255.255.0 U 0 0 0 br-wan
iptables -L
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
403 172K delegate_input all -- any any anywhere anywhere
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
358 169K delegate_forward all -- any any anywhere anywhere
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
317 84722 delegate_output all -- any any anywhere anywhere
Chain delegate_forward (1 references)
pkts bytes target prot opt in out source destination
358 169K forwarding_rule all -- any any anywhere anywhere /* user chain for forwarding */
340 167K ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
18 2048 zone_lan_forward all -- br-lan any anywhere anywhere
0 0 zone_wan_forward all -- br-wan any anywhere anywhere
0 0 zone_ipr_forward all -- tun1337 any anywhere anywhere
0 0 reject all -- any any anywhere anywhere
Chain delegate_input (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- lo any anywhere anywhere
403 172K input_rule all -- any any anywhere anywhere /* user chain for input */
145 13909 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
5 268 syn_flood tcp -- any any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN
11 766 zone_lan_input all -- br-lan any anywhere anywhere
243 157K zone_wan_input all -- br-wan any anywhere anywhere
4 208 zone_ipr_input all -- tun1337 any anywhere anywhere
Chain delegate_output (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any lo anywhere anywhere
317 84722 output_rule all -- any any anywhere anywhere /* user chain for output */
129 27577 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 zone_lan_output all -- any br-lan anywhere anywhere
186 56993 zone_wan_output all -- any br-wan anywhere anywhere
2 152 zone_ipr_output all -- any tun1337 anywhere anywhere
Chain forwarding_ipr_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_rule (1 references)
pkts bytes target prot opt in out source destination
Chain forwarding_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_ipr_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_rule (1 references)
pkts bytes target prot opt in out source destination
Chain input_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_ipr_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_lan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_rule (1 references)
pkts bytes target prot opt in out source destination
Chain output_wan_rule (1 references)
pkts bytes target prot opt in out source destination
Chain reject (4 references)
pkts bytes target prot opt in out source destination
4 208 REJECT tcp -- any any anywhere anywhere reject-with tcp-reset
0 0 REJECT all -- any any anywhere anywhere reject-with icmp-port-unreachable
Chain syn_flood (1 references)
pkts bytes target prot opt in out source destination
5 268 RETURN tcp -- any any anywhere anywhere tcp flags:FIN,SYN,RST,ACK/SYN limit: avg 25/sec burst 50
0 0 DROP all -- any any anywhere anywhere
Chain zone_ipr_dest_ACCEPT (2 references)
pkts bytes target prot opt in out source destination
20 2200 ACCEPT all -- any tun1337 anywhere anywhere
Chain zone_ipr_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_ipr_rule all -- any any anywhere anywhere /* user chain for forwarding */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port forwards */
0 0 zone_ipr_src_REJECT all -- any any anywhere anywhere
Chain zone_ipr_input (1 references)
pkts bytes target prot opt in out source destination
4 208 input_ipr_rule all -- any any anywhere anywhere /* user chain for input */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port redirections */
4 208 zone_ipr_src_REJECT all -- any any anywhere anywhere
Chain zone_ipr_output (1 references)
pkts bytes target prot opt in out source destination
2 152 output_ipr_rule all -- any any anywhere anywhere /* user chain for output */
2 152 zone_ipr_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_ipr_src_REJECT (2 references)
pkts bytes target prot opt in out source destination
4 208 reject all -- tun1337 any anywhere anywhere
Chain zone_lan_dest_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any br-lan anywhere anywhere
Chain zone_lan_forward (1 references)
pkts bytes target prot opt in out source destination
pkts bytes target prot opt in out source destination
18 2048 forwarding_lan_rule all -- any any anywhere anywhere /* user chain for forwarding */
18 2048 zone_ipr_dest_ACCEPT all -- any any anywhere anywhere /* forwarding lan -> ipr */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port forwards */
0 0 zone_lan_src_REJECT all -- any any anywhere anywhere
Chain zone_lan_input (1 references)
pkts bytes target prot opt in out source destination
11 766 input_lan_rule all -- any any anywhere anywhere /* user chain for input */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port redirections */
11 766 zone_lan_src_ACCEPT all -- any any anywhere anywhere
Chain zone_lan_output (1 references)
pkts bytes target prot opt in out source destination
0 0 output_lan_rule all -- any any anywhere anywhere /* user chain for output */
0 0 zone_lan_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_lan_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
11 766 ACCEPT all -- br-lan any anywhere anywhere
Chain zone_lan_src_REJECT (1 references)
pkts bytes target prot opt in out source destination
0 0 reject all -- br-lan any anywhere anywhere
Chain zone_wan_dest_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
186 56993 ACCEPT all -- any br-wan anywhere anywhere
Chain zone_wan_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_wan_rule all -- any any anywhere anywhere /* user chain for forwarding */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port forwards */
0 0 zone_wan_src_REJECT all -- any any anywhere anywhere
Chain zone_wan_input (1 references)
pkts bytes target prot opt in out source destination
243 157K input_wan_rule all -- any any anywhere anywhere /* user chain for input */
0 0 ACCEPT udp -- any any anywhere anywhere udp dpt:bootpc /* Allow-DHCP-Renew */
0 0 ACCEPT icmp -- any any anywhere anywhere icmp echo-request /* Allow-Ping */
0 0 ACCEPT all -- any any anywhere anywhere ctstate DNAT /* Accept port redirections */
243 157K zone_wan_src_ACCEPT all -- any any anywhere anywhere
Chain zone_wan_output (1 references)
pkts bytes target prot opt in out source destination
186 56993 output_wan_rule all -- any any anywhere anywhere /* user chain for output */
186 56993 zone_wan_dest_ACCEPT all -- any any anywhere anywhere
Chain zone_wan_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
243 157K ACCEPT all -- br-wan any anywhere anywhere
Chain zone_wan_src_REJECT (1 references)
pkts bytes target prot opt in out source destination
0 0 reject all -- br-wan any anywhere anywhere
我不太熟悉网络配置。因此我非常感谢您的帮助。
答案1
首先，虽然我不熟悉 UCI，但OpenWrt 维基通知我它可以使用外部文件来容纳手动 iptables 规则。您已经定义了一个：'/etc/firewall.user'，因此您在评论中提到的解决方案可能仍然可行。
您的路由允许顺利到达 192.168.178.0/24 子网，假设您的路由器使用的接口实际上是“br-wan”，而您只是没有将最后一个字符复制到问题中。这似乎是防火墙问题。
输出iptables -L显示了一些奇怪的内容。允许从 LAN 到 VPN 的流量的规则是：
Chain FORWARD (policy DROP)
delegate_forward all -- anywhere anywhere
Chain delegate_forward (1 references)
zone_lan_forward all -- anywhere anywhere
Chain zone_lan_forward (1 references)
zone_ipr_dest_ACCEPT all -- anywhere anywhere /* forwarding lan -> ipr */
Chain zone_ipr_dest_ACCEPT (2 references)
ACCEPT all -- anywhere anywhere
需要使用“--verbose”标志才能确定，但根据这些链的注释和名称，似乎这些规则仅适用于转发到“tun1337”接口的流量。您的 iptables 没有适用于“br-wan”的等效规则。转发到互联网路由器子网的流量最终会被拒绝。
要在不手动添加规则的情况下执行此操作，请将以下行附加到“/etc/config/firewall”：
config forwarding
option src lan
option dest wan
OpenWrt 路由器后面的流量现在应该到达 192.168.178.0/24 子网，但不会有任何响应；互联网路由器后面的机器不知道如何路由目的地在 192.168.1.0/24 范围内的数据包。解决这个问题最简单的方法是让 OpenWrt 路由器执行 NAT。使用 iptables：
iptables -t nat -A POSTROUTING -i br-lan -i br-wan -j MASQUERADE
option masq 1我的有根据的猜测是，通过在“/etc/config/firewall”中的 wan 区域配置中插入行，将自动创建类似的规则。
使用 NAT 有一些缺点。以这种方式转发的所有流量在互联网路由器后面的机器看来都以 192.168.178.20 为源。此外，您需要设置端口转发以从 OpenWrt 路由器的 WAN 端发起连接。
避免 NAT 将需要进一步更改防火墙和互联网路由器上的路由表。您需要添加路由“192.168.1.0/24 via 192.168.178.20”。如果路由器不允许手动配置路由表，则必须将它们分别添加到 192.168.178.0/24 子网上的机器。此外，还必须将以下几行附加到 OpenWrt 路由器上的“/etc/config/firewall”：
config forwarding
option src wan
option dest lan
答案2
您需要做的就是将以下路由添加到 OpenWRT 路由表，
ip ro add 192.168.78.0/24 via 192.168.78.1 dev your_WAN_interface
其中 your_WAN_interface 代表 OpenWRT 路由器的 WAN 接口 NIC。您还将看到以下 iptables 规则：
iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -d 192.168.78.0/24 -j MASQUERADE