内部网络上的 VirtualBox VM 路由器访问

Question 1

在 U1 上，您需要为内部专用网络设置 NAT，或者将其打开并只转发数据包。如果选择第二种方式，您需要在物理 LAN 上要连接到虚拟 LAN 的任何机器上设置适当的路由。

如果要设置 NAT，则必须启用数据包转发并设置一些iptables规则。这是我使用的脚本 -

#!/bin/bash
# a very simple set of iptables commands 
# to allow forwarding between ethernet
# devices


# which device is the one that connects to The World (or at least your
# non virtual LAN - this would be a Bridged or NAT (not NAT Network) type
# in VirtualBox
WAN_DEVICE="enp0s3"

# which device is the one that connects to Internal Only or Host Only network?
LAN_DEVICE="enp0s8"


# enable forwarding
 echo 1 > /proc/sys/net/ipv4/ip_forward

# where is iptables located?
iptables=`which iptables`

# flush all existing rules
$iptables -F

# this is for NAT
# enable masquerading
$iptables -t nat -A POSTROUTING -o $WAN_DEVICE -j MASQUERADE

# don't forward packets from off-lan to lan if
# they are a brand new connection being formed
$iptables -A FORWARD -i $WAN_DEVICE -o $LAN_DEVICE -m state --state NEW -j REJECT

# if the packets come from off-lan but they are
# related to a connection that was established from
# within the lan, go ahead and forward them
$iptables -A FORWARD -i $WAN_DEVICE -o $LAN_DEVICE -m state --state RELATED,ESTABLISHED -j ACCEPT

# whatever traffic comes from the lan to go to
# the world allow thru
$iptables -A FORWARD -i $LAN_DEVICE -o $WAN_DEVICE -j ACCEPT

运行此命令后，你的 iptables 应该如下所示

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere             state NEW reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

直接打开它有点过头了，但您可以简单地更改上面的规则以接受所有连接并在两个接口上转发输入/输出。这样做，您还将删除 NAT/Masquerade 命令，但您需要在要从物理 LAN 连接到虚拟 LAN 的任何机器上设置路由。只需注释掉其他$iptables调用（flush 调用除外）并复制最后一行，并将设备引用反转，这样可以将脚本简化为 -

#!/bin/bash
# a very simple set of iptables commands 
# to allow forwarding between ethernet
# devices


# which device is the one that connects to The World (or at least your
# non virtual LAN - this would be a Bridged or NAT (not NAT Network) type
# in VirtualBox
WAN_DEVICE="enp0s3"

# which device is the one that connects to Internal Only network?
LAN_DEVICE="enp0s8"


# enable forwarding
 echo 1 > /proc/sys/net/ipv4/ip_forward

# where is iptables located?
iptables=`which iptables`

# flush all existing rules
$iptables -F

# whatever traffic comes from the lan to go to
# the world allow thru
$iptables -A FORWARD -i $LAN_DEVICE -o $WAN_DEVICE -j ACCEPT

# whatever traffic comes from the world to go to
# the lan allow thru
$iptables -A FORWARD -i $WAN_DEVICE -o $LAN_DEVICE -j ACCEPT

使用这个之后，你的 iptables 应该看起来像

# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Answer

在 U1 上，您需要为内部专用网络设置 NAT，或者将其打开并只转发数据包。如果选择第二种方式，您需要在物理 LAN 上要连接到虚拟 LAN 的任何机器上设置适当的路由。