通过 VPN 上行链路路由 - 数据包不穿过隧道

Question

我想通过家庭服务器和远程服务器之间的 VPN 隧道在家庭 LAN 和远程 LAN 之间进行路由。这是设置：

                       _________________                                   _____________                                    __________________
              ________|                 |______                  _________|             |________                __________|                  |
             |        |                 |      |                |         |             |        |              |          |                  |
Remote-LAN---| enp1s0 |  remote-server  | tun1 |---VPN-Tunnel---| uplink0 | home server | enp2s0 |---Home-LAN---| Ethernet | Windows Notebook |
             |________|                 |______|                |_________|             |________|              |__________|                  |
                      |_________________|                                 |_____________|                                  |__________________|

远程服务器

接口

enp1s0: 192.168.178.10/24
tun1: 10.11.0.2/24

路线

default via 192.168.178.1 dev enp1s0 proto static
10.11.0.0/24 dev tun1 proto kernel scope link src 10.11.0.2
172.23.56.0/24 via 10.11.0.1 dev tun1
192.168.178.0/24 dev enp1s0 proto kernel scope link src 192.168.178.10

路由已启用

# cat /etc/sysctl.d/30-ipforward.conf
net.ipv4.ip_forward=1

防火墙

-A ufw-user-input -i tun1 -j ACCEPT

家庭服务器

接口

enp2s0: 172.23.56.2/24
uplink0: 10.11.0.1/24

路线

default via 172.23.56.254 dev enp2s0 proto static
10.11.0.0/24 dev uplink0 proto kernel scope link src 10.11.0.1
172.23.56.0/24 dev enp2s0 proto kernel scope link src 172.23.56.2
192.168.178.0/24 via 10.11.0.2 dev uplink0

已启用路由

$ cat /etc/sysctl.d/routing.conf
net.ipv4.ip_forward = 1

防火墙

table inet filter {
        chain input {
                type filter hook input priority 0; policy accept;
                ct state { established, related } accept
                ct state invalid drop
                iifname "lo" accept
                ip protocol icmp accept
                ip6 nexthdr ipv6-icmp accept
                iifname "enp2s0" tcp dport ssh accept
                tcp dport { http, https } accept
                udp dport { openvpn, 1195 } accept
                iifname "game0" jump game-vpn
                reject
        }

        chain game-vpn {
                tcp dport 25565 accept
        }

        chain forward {
                type filter hook forward priority 0; policy accept;
                ip saddr 172.23.56.0/24 ip daddr 192.168.178.0/24 accept
                ip saddr 192.168.178.0/24 ip daddr 172.23.56.0/24 accept
                drop
        }

        chain output {
                type filter hook output priority 0; policy accept;
        }
}

笔记本电脑（Win 10）

界面

Ethernet: 172.23.56.20

路线

192.168.178.0    255.255.255.0      172.23.56.2     172.23.56.20     51

不幸的是，当我从笔记本电脑 ping 到远程 LAN 时

ping 192.168.178.10

我得到了超时。 echo 请求似乎被转发并到达家庭服务器的 VPN 接口：

$ sudo tcpdump -i uplink0 "host 172.23.56.20"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on uplink0, link-type RAW (Raw IP), capture size 262144 bytes
21:03:56.651706 IP gamebook.fritz.box > 192.168.178.10: ICMP echo request, id 1, seq 265, length 40
21:04:01.284635 IP gamebook.fritz.box > 192.168.178.10: ICMP echo request, id 1, seq 266, length 40
21:04:06.289546 IP gamebook.fritz.box > 192.168.178.10: ICMP echo request, id 1, seq 267, length 40

但它们无法到达远程 VPN 接口：

tcpdump -i tun1 "host 172.23.56.20"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tun1, link-type RAW (Raw IP), capture size 262144 bytes
<a whole lotta nothing>

我缺少什么？我不想使用 NAT，只想使用普通的旧 IPv4 路由。