☰

Solaris11 和复杂网络：无路由

tag-icon • tag-icon networking virtualbox dns routing solaris
Solaris11 和复杂网络：无路由

我有一台装有 solaris11.4 的服务器，两个网卡，我用它来测试、学习等。我有一个网络，经典的 192.168.0.0/24，但对于虚拟机，我想使用另一个网络 10.2.0.0/24，因此我遵循此程序

a）首先我要创建一个带有 net1 和 net0 的桥，否则 net1 将开始“断开连接”

dladm create-bridge -l net0 -l net1 bridge1

b)然后我为 net1 配置 ipv4 addr

ipadm create-ip net1
ipadm create-addr -T static -a 10.2.0.1 net1

ipadm 和 dladm 没有报告错误

c）然后我在 solaris11 服务器上运行 isc-dhcp 和 isc-dns 一切正常，经过测试，我可以解析外部主机名和 dhcp 分配地址

d)我已经安装了 VirtualBox，桥接网络指向 net1 的机器

e）我已经使用 nat 配置了防火墙

#Vars
ext_if="net0"
int_if="net1"
virt_if="vnic0"
ext_net="192.168.0.0/24"
int_net="10.2.0.0/24"
webports="{443, 80}"

##  make IP reassembly work
set reassemble yes no-df

## ignore loopback traffic
set skip on lo0

# block everything unless told otherwise
# and send TCP-RST/ICMP unreachable
# for every packet which gets blocked
block return in log all
pass out all

# accept incoming SSH connections
pass in proto tcp to any port 2122

# accept dhcp connections
pass in proto udp to any port 67:69
pass in proto tcp to any port 67:69

# accept dns connections
pass in proto udp to any port 53
pass in proto tcp to any port 53

# accept webeservers SSH connections
pass in proto tcp to $ext_if port 8888:8889
pass in proto tcp to $ext_if port $webports

# accept icmp
pass in proto icmp all

## allow all connections initiated from this system,
## including DHCP requests
pass out

#nat
pass out on net0 from $int_net  to any nat-to (net0)

f)使用 routeadm 我已启用路由和 ip 转发。

现在“结果”

我可以从 192.168.0.0/24 ping 10.2.0.0/24 正常 我可以从 10.2.0.0/24 虚拟机 ping 192.168.0.0/24 正常 我可以从 10.2.0.0/24 虚拟机 ping 外部地址（google.de 等） 正常 我无法从虚拟机使用任何协议连接！！ 不正常 当然，我已经使用 netstat -rn 检查了路由，并显示 10.2.0.1 默认（正确）。但 telnet、links、yum 和任何类型的连接都失败！只有 ping 和 dns 解析有效（原文如此！）要检查什么？

答案1

找到解决方案：防火墙限制过多。我使用这个 /etc/firewall/pf.conf，运行良好，没有问题。

# Vars
ext_if="net0"
int_if="net1"
ext_net="192.168.0.0/24"
int_net="10.2.0.0/24"
webports="{443, 80}"

##  make IP reassembly work
set reassemble yes no-df

## ignore loopback traffic
set skip on lo0

# block everything unless told otherwise
# and send TCP-RST/ICMP unreachable
# for every packet which gets blocked
block return in log all
pass out all

# Pass
pass in on $int_if proto tcp from $ext_net to any keep state
pass in on $int_if proto udp from $ext_net to any keep state
pass in on $int_if proto tcp from $int_net to any keep state
pass in on $int_if proto udp from $int_net to any keep state

# accept incoming SSH connections
pass in proto tcp from any to $ext_if port 22

# accept dhcp connections
pass in proto udp to any port 67:69
pass in proto tcp to any port 67:69

# accept dns connections
pass in proto udp to any port 53
pass in proto tcp to any port 53

# accept webeservers connections
pass in proto tcp to $ext_if port $webports

# accept icmp
pass in proto icmp all

## allow all connections initiated from this system,
## including DHCP requests
pass out

#nat
pass out on net0 from $int_net to any nat-to (net0)

相关内容