☰

Linux 桥 (brctl) 不传递流量

tag-icon • tag-icon linux ping bridge
Linux 桥 (brctl) 不传递流量

我创建了以下配置：

/* Created a Linux bridge and brought it up */
brctl addbr AnaBr4
ifconfig AnaBr4 up

/* Created a tuntap interface and brought it up */
ip tuntap add name Xr1 mode tap
ifconfig Xr1 up

/* Added the tuntap intf to Bridge */
brctl addif AnaBr4 Xr1

我将 Xr1 连接到我的一个虚拟路由器。现在我使用 VMM 实例化 Ubuntu 服务器并将一张网卡连接到 AnaBr4。所以拓扑如下：

Router(intf1)------(Xr1)(Anabr4)(vnet1)-----(Ens4)Ubuntu

我为 Ens4 分配了 10.1.1.1/24 fr intf1 和 10.1.1.2/24。

我发现 ARP 解析工作正常，但看不到 Ping 流量（或任何其他流量）。

尝试了 TCPDUMP，发现我在 brctl 上收到了 Ping 流量，但没有转发出去。

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vnet1, link-type EN10MB (Ethernet), capture size 262144 bytes
08:35:30.530193 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 986, length 64
08:35:31.558092 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 987, length 64
08:35:32.578175 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 988, length 64
08:35:33.602173 IP 10.1.1.2 > 10.1.1.1: ICMP echo request, id 9159, seq 989, length 64

showmac 看起来没问题，如下所示：

root@kvmserver:~# brctl showmacs AnaBr4
port no mac addr        is local?   ageing timer
  1 52:46:f8:b8:27:88   no        16.73 /*Router Intf1 MAC */
  2 52:54:00:d8:8e:f8   no         0.32 /* Ubuntu MAC */
  1 aa:0b:51:de:18:7d   yes        0.00
  1 aa:0b:51:de:18:7d   yes        0.00
  2 fe:54:00:d8:8e:f8   yes        0.00
  2 fe:54:00:d8:8e:f8   yes        0.00
root@kvmserver:~#

相同的配置工作了近 8 个月，昨天我重新加载了 KVM 服务器，之后相同的配置不起作用。

任何帮助深表感谢。

您好，请找到下面的 iptables 输出：

root@kvmserver:~# iptables -vnL
Chain INPUT (policy ACCEPT 822K packets, 12G bytes)
 pkts bytes target     prot opt in     out     source               destination
  101  7429 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
   26  8358 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    0     0 ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67

Chain FORWARD (policy DROP 3538 packets, 506K bytes)
 pkts bytes target     prot opt in     out     source               destination
43713   56M ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     ctstate RELATED,ESTABLISHED
14808  813K ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0
    6  1948 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 ACCEPT     all  --  virbr1 virbr1  0.0.0.0/0            0.0.0.0/0
    0     0 REJECT     all  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr1 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
 3538  506K DOCKER-USER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 3538  506K DOCKER-ISOLATION-STAGE-1  all  --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 DOCKER     all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     all  --  docker0 docker0  0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 815K packets, 12G bytes)
 pkts bytes target     prot opt in     out     source               destination
   26  8592 ACCEPT     udp  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            udp dpt:68
    0     0 ACCEPT     udp  --  *      virbr1  0.0.0.0/0            0.0.0.0/0            udp dpt:68

Chain DOCKER (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DOCKER-ISOLATION-STAGE-2  all  --  docker0 !docker0  0.0.0.0/0            0.0.0.0/0
 3538  506K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-ISOLATION-STAGE-2 (1 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       all  --  *      docker0  0.0.0.0/0            0.0.0.0/0
    0     0 RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination
 3538  506K RETURN     all  --  *      *       0.0.0.0/0            0.0.0.0/0
root@kvmserver:~#

大家好，

我想我发现了问题。将以下内容添加到 /etc/sysctl.conf 文件修复了该问题：

net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

答案1

感谢您的所有帮助。通过将以下内容添加到 /etc/sysctl.conf 文件来修复此问题

net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

相关内容