![如何修改 OSX 上的路由表以分割流量](https://linux22.com/image/1480581/%E5%A6%82%E4%BD%95%E4%BF%AE%E6%94%B9%20OSX%20%E4%B8%8A%E7%9A%84%E8%B7%AF%E7%94%B1%E8%A1%A8%E4%BB%A5%E5%88%86%E5%89%B2%E6%B5%81%E9%87%8F.png)
我怎样才能在 OSX 上分割流量,以便只有某些子网被路由到以太网接口,而其余的被路由到 Wifi?
我已经使用这个脚本一年半多了,但今天它停止工作了。它所做的就是删除默认网关并将所需的网关(即 en2 = wifi)设置为默认网关,并为每个子网添加记录,告诉它通过所需的“隧道”接口(即 en0 = 以太网)进行路由。
#! /usr/bin/env zsh
if (( EUID != 0 )); then
echo "Please, run this command with sudo" >&2
exit 1
fi
if [ "$#" -ne "2" ]; then
echo "Usage: $0 tunnel_interface default_interface" >&2
exit 1
fi
TUNNEL_INTERFACE=$1
DEFAULT_INTERFACE=$2
GATEWAY=$(netstat -nrf inet | grep default | grep $DEFAULT_INTERFACE | awk '{print $2}')
if [ "$GATEWAY" = "" ]; then
read "GATEWAY?Enter gateway IP address: "
fi
echo "Resetting routes with gateway => $GATEWAY"
echo
route -n delete default -ifscope $DEFAULT_INTERFACE 1>/dev/null
route -n delete -net default -interface $TUNNEL_INTERFACE 1>/dev/null
route -n add -net default $GATEWAY 1>/dev/null
for subnet in 10.89 10.153 10.162 10.168 172.24.0.0/13
do
route -n add -net $subnet -interface $TUNNEL_INTERFACE 1>/dev/null 2>&1
done
echo "google.cz -> $(route get google.cz | grep interface | sed 's/^ *//')"
echo "r5d00 -> $(route get r5d00 | grep interface | sed 's/^ *//')"
我像这样运行这个脚本
$ sudo tunnel-ips.sh no en0 en2
Password:
Resetting routes with gateway => 172.20.10.1
google.cz -> interface: en2
r5d00 -> interface: en0
我通过 Wifi 连接到我的 iPhone 个人热点,它为我分配了 IP 172.20.10.4 和掩码 255.255.255.240。r5d00 服务器的 IP 设置为 172.24.146.155,与 172.24.0.0/13 匹配。
我的路由表如下所示:$ netstat -rn 路由表
Internet:
Destination Gateway Flags Refs Use Netif Expire
default 172.20.10.1 UGSc 3 0 en2
10.89/16 link#4 UCSc 1 0 en0
10.153/16 link#4 UCSc 1 0 en0
10.162/21 link#4 UCS 6 0 en0
10.162/16 link#4 UCSc 1 0 en0
10.162.0.1/32 link#4 UCS 2 0 en0
10.162.0.1 0:0:c:9f:f0:1 UHLWIi 2 4 en0 1167
10.162.0.241 0:20:4a:e6:5c:2c UHLWIi 1 0 en0 1149
10.162.0.242 0:20:4a:54:87:a0 UHLWIi 1 0 en0 1079
10.162.0.243 0:20:4a:d7:d8:3e UHLWIi 1 0 en0 1132
10.162.1.22 0:1e:b:ed:21:b8 UHLWIi 1 18 en0 1136
10.162.7.241/32 link#4 UCS 1 0 en0
10.167/16 link#4 UCSc 1 0 en0
10.168/16 link#4 UCSc 1 0 en0
10.255/16 link#4 UCSc 1 0 en0
127 127.0.0.1 UCS 1 0 lo0
127.0.0.1 127.0.0.1 UH 5 2329 lo0
169.254 link#4 UCS 1 0 en0
169.254 link#5 UCSI 1 0 en2
172.20.10/28 link#5 UCS 1 0 en2
172.20.10.1/32 link#5 UCS 2 0 en2
172.20.10.1 36:e2:fd:74:7b:64 UHLWIir 5 11 en2 1067
172.20.10.4/32 link#5 UCS 1 0 en2
172.24/13 link#4 UCSc 7 0 en0
255.255.255.255/32 link#4 UCS 1 0 en0
255.255.255.255/32 link#5 UCSI 1 0 en2
Internet6:
Destination Gateway Flags Netif Expire
::1 ::1 UHL lo0
fe80::%lo0/64 fe80::1%lo0 UcI lo0
fe80::1%lo0 link#1 UHLI lo0
fe80::%awdl0/64 link#7 UCI awdl0
fe80::a4a8:81ff:fe02:a44d%awdl0 a6:a8:81:2:a4:4d UHLI lo0
fe80::%utun0/64 fe80::db39:e7b8:6234:7841%utun0 UcI utun0
fe80::db39:e7b8:6234:7841%utun0 link#9 UHLI lo0
ff01::%lo0/32 ::1 UmCI lo0
ff01::%awdl0/32 link#7 UmCI awdl0
ff01::%utun0/32 fe80::db39:e7b8:6234:7841%utun0 UmCI utun0
ff02::%lo0/32 ::1 UmCI lo0
ff02::%awdl0/32 link#7 UmCI awdl0
ff02::%utun0/32 fe80::db39:e7b8:6234:7841%utun0 UmCI utun0
当我 ping r5d00 时,它显示“没有到主机的路由”
$ ping r5d00
PING r5d00.cezdata.corp (172.24.146.155): 56 data bytes
Request timeout for icmp_seq 0
Request timeout for icmp_seq 1
Request timeout for icmp_seq 2
Request timeout for icmp_seq 3
ping: sendto: No route to host
Request timeout for icmp_seq 4
ping: sendto: Host is down
Request timeout for icmp_seq 5
ping: sendto: Host is down
Request timeout for icmp_seq 6
ping: sendto: Host is down
Request timeout for icmp_seq 7
ping: sendto: Host is down
Request timeout for icmp_seq 8
ping: sendto: Host is down
Request timeout for icmp_seq 9
ping: sendto: Host is down
Request timeout for icmp_seq 10
我下载了 Wireshark 并记录了流量,但 ICMP 数据包无处可寻(当我禁用 Wifi 并重置路由表时,它确实被记录下来并且 ping 成功)。似乎 IP 与路由表记录不匹配,但当我通过 route get 检查它时,它说它是通过 en0 路由的(这是正确的)。
$ route get r5d00
route to: r5d00
destination: r5d00
interface: en0
flags: <UP,HOST,REJECT,DONE,LLINFO,WASCLONED,IFSCOPE,IFREF>
recvpipe sendpipe ssthresh rtt,msec rttvar hopcount mtu expire
0 0 0 0 0 0 1500 -138
就像我说的,昨天还可以用,今天就不行了。我没有下载任何更新或任何东西。据我所知,这是我的 Mac 的问题,而不是内部网络的问题,因为其他人都没有遇到问题。
答案1
这条ping: sendto: No route to host
消息一开始就暗示测试过程中发生了一些变化。根据路由表,172.24.0.0/13 直接通过 Link#4 连接,这意味着到达该主机不需要路由,甚至不需要生成该消息。
随后,除了第一个之外,其他消息都反映了路由表。这ping: sendto: Host is down
表明主机位于直接连接的网络上,并且主机或其代理尚未回复 ARP 请求。
重复测试时尝试route monitor
在另一个窗口中运行,并观察控制台是否有任何界面转换或其他网络变化。