具有以下拓扑：
hostA(virbr0: 192.168.122.1) -- TAP 接口 -- (eth0: 192.168.122.85) gw (eth1: 192.168.3.51) --- (LAN: 192.168.3.0/24)
gw：QEMU VM Guest，充当其他 QEMU VM Guest 的网关，通过eth1接口与其连接。gw使用 接口通过 Linux TAP 接口连接到 QEMU 主机eth0。 TAB 接口动态分配 IP eth0。
hostA: QEMU 虚拟机主机
root@hostA:~$ ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.16.254.134 netmask 255.255.255.0 broadcast 172.16.254.255
inet6 fe80::20c:29ff:fe25:1670 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:25:16:70 txqueuelen 1000 (Ethernet)
RX packets 18116 bytes 1361094 (1.3 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 14579 bytes 5334119 (5.3 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
gns3tap0-0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::50bd:d3ff:fe1a:e55 prefixlen 64 scopeid 0x20<link>
ether 52:bd:d3:1a:0e:55 txqueuelen 1000 (Ethernet)
RX packets 353 bytes 28543 (28.5 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 3348 bytes 183399 (183.3 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 662311 bytes 99203163 (99.2 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 662311 bytes 99203163 (99.2 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 52:54:00:62:0a:c5 txqueuelen 1000 (Ethernet)
RX packets 353 bytes 23601 (23.6 KB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 379 bytes 28629 (28.6 KB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
gw:~# ifconfig
eth0 Link encap:Ethernet HWaddr 0C:FE:27:0C:E4:00
inet addr:192.168.122.85 Bcast:192.168.122.255 Mask:255.255.255.0
inet6 addr: fe80::efe:27ff:fe0c:e400/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:379 errors:3150 dropped:0 overruns:0 frame:3150
TX packets:353 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:31851 (31.1 KiB) TX bytes:28543 (27.8 KiB)
eth1 Link encap:Ethernet HWaddr 0C:FE:27:0C:E4:01
inet addr:192.168.3.51 Bcast:0.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::efe:27ff:fe0c:e401/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:302 errors:0 dropped:0 overruns:0 frame:0
TX packets:300 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:25796 (25.1 KiB) TX bytes:24782 (24.2 KiB)
gw:~# netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.122.1 0.0.0.0 UG 0 0 0 eth0
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth1
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
目标是从主机 A 到内部 LAN 的虚拟机 192.168.3.0/24 具有可达性
以下路由配置正在运行：
root@hostA:~$ sudo route add -net 192.168.3.0 netmask 255.255.255.0 gw 192.168.122.85
root@hostA:~$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 172.16.254.2 0.0.0.0 UG 0 0 0 eth0
172.16.254.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
192.168.3.0 192.168.122.85 255.255.255.0 UG 0 0 0 virbr0
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr0
root@hostA:~$ ping 192.168.3.102
PING 192.168.3.102 (192.168.3.102) 56(84) bytes of data.
64 bytes from 192.168.3.102: icmp_seq=1 ttl=63 time=3.07 ms
^C
--- 192.168.3.102 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 3.071/3.071/3.071/0.000 ms
root@hostA:~$ ping 192.168.3.103
PING 192.168.3.103 (192.168.3.103) 56(84) bytes of data.
64 bytes from 192.168.3.103: icmp_seq=1 ttl=63 time=3.03 ms
64 bytes from 192.168.3.103: icmp_seq=2 ttl=63 time=2.99 ms
^C
--- 192.168.3.103 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 2.997/3.014/3.032/0.057 ms
然而，由于Linux TAP是动态分配IP的eth0，所以需要有路由，不会使用下一个路由器的IP地址作为下一跳，而是使用退出接口的本地IP，类似至以下内容：
root@hostA:~$ route add -net 192.168.0.0 netmask 255.255.0.0 gw 192.168.122.1 dev virbr0
root@hostA:~$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 172.16.254.2 0.0.0.0 UG 0 0 0 eth0
172.16.254.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
192.168.0.0 192.168.122.1 255.255.0.0 UG 0 0 0 virbr0
192.168.122.0 0.0.0.0 255.255.255.0 U 0 0 0 virbr
root@hostA:~$ ping -c 1 192.168.122.85
PING 192.168.122.85 (192.168.122.85) 56(84) bytes of data.
64 bytes from 192.168.122.85: icmp_seq=1 ttl=64 time=0.585 ms
--- 192.168.122.85 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.585/0.585/0.585/0.000 ms
root@hostA:~$ ping -c 1 192.168.3.51
PING 192.168.3.51 (192.168.3.51) 56(84) bytes of data.
64 bytes from 192.168.3.51: icmp_seq=1 ttl=64 time=0.956 ms
--- 192.168.3.51 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.956/0.956/0.956/0.000 ms
root@hostA:~$ ping -c 1 192.168.3.102
PING 192.168.3.102 (192.168.3.102) 56(84) bytes of data.
From 192.168.122.1 icmp_seq=1 Destination Host Unreachable
--- 192.168.3.102 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
root@hostA:~$ ping -c 1 192.168.3.103
PING 192.168.3.103 (192.168.3.103) 56(84) bytes of data.
From 192.168.122.1 icmp_seq=1 Destination Host Unreachable
--- 192.168.3.103 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
如图所示，使用上述路由配置时，能够hostA到达该eth1接口，但无法到达内部 LAN (192.168.3.0/24) 中的任何其他虚拟机。但是，内部 LAN 主机本身能够到达 hostA。
这是iptables配置：
root@hostA:~$ sudo iptables -nvL FORWARD
Chain FORWARD (policy ACCEPT 21 packets, 1624 bytes)
pkts bytes target prot opt in out source destination
197 15616 DOCKER-USER all -- * * 0.0.0.0/0 0.0.0.0/0
197 15616 DOCKER-ISOLATION-STAGE-1 all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- * docker0 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 DOCKER all -- * docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 !docker0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- docker0 docker0 0.0.0.0/0 0.0.0.0/0
88 7346 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED
88 6646 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0
0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0
gw:~# iptables -nvL FORWARD
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth1 eth0 192.168.122.0/24 0.0.0.0/0 ctstate NEW
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
gw:~# sysctl -a | grep ipv4.ip_forward
net.ipv4.ip_forward = 1
dns:~# ifconfig
eth0 Link encap:Ethernet HWaddr 0C:FE:27:0C:76:00
inet addr:192.168.3.103 Bcast:0.0.0.0 Mask:255.255.255.0
inet6 addr: fe80::efe:27ff:fe0c:7600/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:18638 errors:0 dropped:0 overruns:0 frame:0
TX packets:18634 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:1543312 (1.4 MiB) TX bytes:1705846 (1.6 MiB)
dns:~# netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.3.51 0.0.0.0 UG 0 0 0 eth0
192.168.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
问题：
配置中是否缺少某些内容？
有没有办法配置工作路由条目，将使用退出接口的本地IP作为下一跳IP？
答案1
有两个或三个独立的问题。
动态网关IP
为此使用路由协议就有点过分了（除非您已经出于其他原因使用路由协议）。我会尝试将 gw/eth0 的配置更改为静态。如果这是不可能的，那么您可以创建一个用户，gw在hostA该用户上获得sudo设置到该网络的路由的权限。每次gw获得新的 IP 时，它都可以通过 SSH 连接hostA并运行该命令（可能通过ForcedCommand）。
GW 上的路由
路由未在 上配置（正确）gw。您必须通过net.ipv4.ip_forward = 0( )启用它man sysctl并允许防火墙中的相应连接，请参阅iptables -nvL FORWARD。
192.168.3.0 中虚拟机上的路由
连接到的虚拟机gw/eth1必须gw配置为默认网关。如果情况并非如此，则gw必须SNAT对该网络执行 ( iptables)。