![将工作 ipv6 nat 添加到现有 ipv4 nat](https://linux22.com/image/215404/%E5%B0%86%E5%B7%A5%E4%BD%9C%20ipv6%20nat%20%E6%B7%BB%E5%8A%A0%E5%88%B0%E7%8E%B0%E6%9C%89%20ipv4%20nat.png)
我喜欢将 ipv6 添加到现有的工作 ipv4 nat 中。它是 proxmox 主机,客户端是虚拟机。
我尝试通过在 nat 设备(proxmox 主机)上添加相应的文件来使其工作。文件 /etc/network/interfaces 现在看起来像这样:
source /etc/network/interfaces.d/*
auto lo
iface lo inet loopback
iface lo inet6 loopback
auto eno1
iface eno1 inet static
address 124.202.254.99
netmask 255.255.255.192
gateway 126.202.254.129
up route add -net 116.202.254.128 netmask 255.255.255.192 gw 116.202.254.129 dev eno1
iface eno1 inet6 static
address 2a01:4f8:543:4122::12
netmask 64
gateway fe80::1
auto vmbr0
iface vmbr0 inet static
address 192.168.20.1
netmask 255.255.255.0
bridge_ports none
bridge_stp off
bridge_fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '192.168.20.0/24' -o eno1 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '192.168.20.0/24' -o eno1 -j MASQUERADE
post-up iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
# Port 80 (http)
post-up iptables -t nat -A PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination 192.168.20.200
post-down iptables -t nat -D PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination 192.168.20.200
# Port 443 (https)
post-up iptables -t nat -A PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination 192.168.20.200
post-down iptables -t nat -D PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination 192.168.20.200
iface vmbr0 inet6 static
address fcc9::1
netmask 64
bridge_ports none
bridge_stp off
bridge_fd 0
# Port 80 (http) - hex c8 is 200 decimal!
post-up ip6tables -t nat -A PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination fcc9::c8
post-down ip6tables -t nat -D PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination fcc9::c8
# Port 443 (https) - hex c8 is 200 decimal!
post-up ip6tables -t nat -A PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination fcc9::c8
post-down ip6tables -t nat -D PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination fcc9::c8
客户端的 /etc/network/interfaces 是:
source /etc/network/interfaces.d/*
# The loopback network interface
auto lo
iface lo inet loopback
# The primary network interface
allow-hotplug ens18
iface ens18 inet static
address 192.168.20.200/24
gateway 192.168.20.1
# dns-* options are implemented by the resolvconf package, if installed
# put nameservers in /etc/resolv.conf
iface ens18 inet6 static
address fcc9::c8
netmask 64
gateway fcc9::1
在 proxmox 主机上,我跑了sysctl -w net.ipv6.conf.all.forwarding=1
我可以从 proxmox 主机 ping6 到互联网上具有 ipv6 的每台主机。我还可以从客户端 ping 到fcc9::1
,也可以 ping 到2a01:4f8:543:4122::12
,但无法google.com
从客户端 ping 通。地址解析正确。