请告知我哪里做错了：
我有一台新的 4 端口迷你电脑，我想将其用作我不断增长的网络的路由器（带有防火墙、NAT、DNS 等常用服务）。主要原因是利用 iptables 中的 ipset，其次是为了获得更好的性能。我有两个数字交换机插入 eth0 和 eth1，而互联网电缆插入 eth2。
我提供了以下配置文件设置和结果。从我的台式计算机，我可以通过 ssh 进入新的网关盒，然后从那里可以 ping WAN 地址，但不能 ping 本地网络地址。我暂时将 iptables 设置为相当宽松，以确保这不是问题所在（至少我是这么认为的）。我假设基于 syslog 的 dhcp 存在问题，但我不知道具体是什么问题或如何修复它。
非常感谢您抽出时间来提供帮助！
/etc/dhcp/dhcpd.conf 列表（为简洁起见删除了注释行）：
ddns-update-style none;
option domain-name "ptj.lan";
option domain-name-servers 208.67.222.222, 8.8.8.8;
default-lease-time 600;
max-lease-time 7200;
authoritative;
log-facility local7;
subnet 192.168.10.0 netmask 255.255.255.0 {
range 192.168.10.101 192.168.10.254;
option routers 192.168.10.60;
option domain-name-servers 208.67.222.222, 208.67.220.220;
host tractorshed {
hardware ethernet AC:CC:8E:0F:96:EC;
fixed-address 192.168.10.22;
}
host screenporch {
hardware ethernet AC:CC:8E:10:61:74;
fixed-address 192.168.10.23;
}
host carport {
hardware ethernet AC:CC:8E:10:61:6B;
fixed-address 192.168.10.21;
}
host brotherprinter {
hardware ethernet 00:1B:A9:15:65:70;
fixed-address 192.168.10.10;
}
host nuc {
hardware ethernet B8:AE:ED:7B:73:30;
fixed-address 192.168.10.32;
}
host ptj-vision {
hardware ethernet 4C:72:B9:21:0C:E4;
fixed-address 192.168.10.31;
}
}
/etc/default/isc-dhcp-server 列表：
DHCPD_CONF=/etc/dhcp/dhcpd.conf
DHCPD_PID=/var/run/dhcpd.pid
INTERFACES="eth0 eth2 eth3"
# I know eth1 is labelled "4" on back of box so I'll use 4 for connection to a digital switch with address 192.168.10.60 so I can reach it
和 /etc/network/interfaces 列表：
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
auto eth2
iface eth2 inet dhcp
auto eth3
iface eth3 inet dhcp
# and the static address interface (marked "4" on the box) which I'll use on LAN side for access to this machine:
auto eth1
iface eth1 inet static
address 192.168.10.60
netmask 255.255.255.0
broadcast 192.168.10.255
#stuff to rebuild ipset and iptable on reboot:
pre-up ipset restore < /home/boss/BadIPLists/genblacklist.bak
pre-up ipset restore < /home/boss/BadIPLists/sshblacklist.bak
pre-up iptables-restore < /home/boss/iptables.rules
最后，来自 syslog 的一个示例：
Jan 8 14:59:54 debFirewall dhclient: No DHCPOFFERS received.
Jan 8 14:59:54 debFirewall dhclient: No working leases in persistent database - sleeping.
Jan 8 15:04:43 debFirewall dhclient: DHCPDISCOVER on eth3 to 255.255.255.255 port 67 interval 7
Jan 8 15:04:50 debFirewall dhclient: DHCPDISCOVER on eth3 to 255.255.255.255 port 67 interval 15
Jan 8 15:05:05 debFirewall dhclient: DHCPDISCOVER on eth3 to 255.255.255.255 port 67 interval 16
Jan 8 15:05:21 debFirewall dhclient: DHCPDISCOVER on eth3 to 255.255.255.255 port 67 interval 13
Jan 8 15:05:34 debFirewall dhclient: DHCPDISCOVER on eth3 to 255.255.255.255 port 67 interval 10
Jan 8 15:05:44 debFirewall dhclient: No DHCPOFFERS received.
Jan 8 15:05:44 debFirewall dhclient: No working leases in persistent database - sleeping.
Jan 8 15:06:21 debFirewall kernel: [ 8422.877907] igb 0000:02:00.0 eth1: igb: eth1 NIC Link is Down
Jan 8 15:06:25 debFirewall kernel: [ 8427.224580] igb 0000:04:00.0 eth3: igb: eth3 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
Jan 8 15:07:17 debFirewall dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 5
Jan 8 15:07:22 debFirewall dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 13
Jan 8 15:07:35 debFirewall dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
Jan 8 15:07:42 debFirewall dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 11
Jan 8 15:07:53 debFirewall dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 7
Jan 8 15:08:00 debFirewall dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 18
Jan 8 15:08:10 debFirewall kernel: [ 8532.140374] igb 0000:04:00.0 eth3: igb: eth3 NIC Link is Down
Jan 8 15:08:18 debFirewall dhclient: No DHCPOFFERS received.
Jan 8 15:08:18 debFirewall dhclient: No working leases in persistent database - sleeping.
Jan 8 15:08:19 debFirewall kernel: [ 8540.932948] igb 0000:02:00.0 eth1: igb: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX/TX
答案1
好的，我了解到，即使设备位于同一网络（如 192.168.10.0），两个 NIC 的连接显然也无法相互通信。有一些潜在的解决方案，但对我来说最好的是将它们桥接起来（eth0 eth1 和 eth3），如下所述： https://wiki.debian.org/NetworkConfiguration
此外，我还必须在 /etc/dhcp/dhcpd.conf（选项路由器）中输入网关地址，以便 dhcp 客户端知道将数据包发送到何处。/etc/network/interfaces 中给出的静态地址也需要网关列表。
现在一切都运行正常，我的 iptables/ipset 配置正在阻止数千个 ip 地址攻击媒介。