![Linux 桥 (brctl) 不传递流量](https://linux22.com/image/161569/Linux%20%E6%A1%A5%20(brctl)%20%E4%B8%8D%E4%BC%A0%E9%80%92%E6%B5%81%E9%87%8F.png)
我创建了以下配置:
/* Created a Linux bridge and brought it up */
brctl addbr AnaBr4
ifconfig AnaBr4 up
/* Created a tuntap interface and brought it up */
ip tuntap add name Xr1 mode tap
ifconfig Xr1 up
/* Added the tuntap intf to Bridge */
brctl addif AnaBr4 Xr1
我将 Xr1 连接到我的一个虚拟路由器。现在我使用 VMM 实例化 Ubuntu 服务器并将一张网卡连接到 AnaBr4。所以拓扑如下:
Router(intf1)------(Xr1)(Anabr4)(vnet1)-----(Ens4)Ubuntu
我为 Ens4 分配了 10.1.1.1/24 fr intf1 和 10.1.1.2/24。
我发现 ARP 解析工作正常,但看不到 Ping 流量(或任何其他流量)。
尝试了 TCPDUMP,发现我在 brctl 上收到了 Ping 流量,但没有转发出去。
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vnet1, link-type EN10MB (Ethernet), capture size 262144 bytes
08:35:30.530193 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 986, length 64
08:35:31.558092 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 987, length 64
08:35:32.578175 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 988, length 64
08:35:33.602173 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 989, length 64
showmac 看起来没问题,如下所示:
root@kvmserver:~# brctl showmacs AnaBr4
port no mac addr is local? ageing timer
1 52:46:f8:b8:27:88 no 16.73 /*Router Intf1 MAC */
2 52:54:00:d8:8e:f8 no 0.32 /* Ubuntu MAC */
1 aa:0b:51:de:18:7d yes 0.00
1 aa:0b:51:de:18:7d yes 0.00
2 fe:54:00:d8:8e:f8 yes 0.00
2 fe:54:00:d8:8e:f8 yes 0.00
root@kvmserver:~#
相同的配置工作了近 8 个月,昨天我重新加载了 KVM 服务器,之后相同的配置不起作用。
任何帮助深表感谢。
您好,请找到下面的 iptables 输出:
root@kvmserver:~# iptables -vnL
Chain INPUT (policy ACCEPT 822K packets, 12G bytes)
pkts bytes target prot opt in out source destination
101 7429 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
26 8358 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
0 0 ACCEPT udp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
0 0 ACCEPT tcp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
0 0 ACCEPT udp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
0 0 ACCEPT tcp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
Chain FORWARD (policy DROP 3538 packets, 506K bytes)
pkts bytes target prot opt in out source destination
43713 56M ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED
14808 813K ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0
6 1948 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0
0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 ACCEPT all -- virbr1 virbr1 0.0.0.0/0 0.0.0.0/0
0 0 REJECT all -- * virbr1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
0 0 REJECT all -- virbr1 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
3538 506K DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
3538 506K DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 815K packets, 12G bytes)
pkts bytes target prot opt in out source destination
26 8592 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68
0 0 ACCEPT udp -- * virbr1 0.0.0.0/0 0.0.0.0/0 udp dpt:68
Chain DOCKER (1 references)
pkts bytes target prot opt in out source destination
Chain DOCKER-ISOLATION-STAGE-1 (1 references)
pkts bytes target prot opt in out source destination
0 0 DOCKER-ISOLATION-STAGE-2 all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
3538 506K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-ISOLATION-STAGE-2 (1 references)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
Chain DOCKER-USER (1 references)
pkts bytes target prot opt in out source destination
3538 506K RETURN all -- * * 0.0.0.0/0 0.0.0.0/0
root@kvmserver:~#
大家好,
我想我发现了问题。将以下内容添加到 /etc/sysctl.conf 文件修复了该问题:
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0
答案1
感谢您的所有帮助。通过将以下内容添加到 /etc/sysctl.conf 文件来修复此问题
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0