将工作 ipv6 nat 添加到现有 ipv4 nat

Question

我喜欢将 ipv6 添加到现有的工作 ipv4 nat 中。它是 proxmox 主机，客户端是虚拟机。

我尝试通过在 nat 设备（proxmox 主机）上添加相应的文件来使其工作。文件 /etc/network/interfaces 现在看起来像这样：

source /etc/network/interfaces.d/*

auto lo
iface lo inet loopback
iface lo inet6 loopback

auto eno1
iface eno1 inet static
  address 124.202.254.99
  netmask 255.255.255.192
  gateway 126.202.254.129
  up route add -net 116.202.254.128 netmask 255.255.255.192 gw 116.202.254.129 dev eno1

iface eno1 inet6 static
  address 2a01:4f8:543:4122::12
  netmask 64
  gateway fe80::1

auto vmbr0
iface vmbr0 inet static
        address  192.168.20.1
        netmask  255.255.255.0
        bridge_ports none
        bridge_stp off
        bridge_fd 0
        post-up echo 1 > /proc/sys/net/ipv4/ip_forward
        post-up iptables -t nat -A POSTROUTING -s '192.168.20.0/24' -o eno1 -j MASQUERADE
        post-down iptables -t nat -D POSTROUTING -s '192.168.20.0/24' -o eno1 -j MASQUERADE
        post-up   iptables -t raw -I PREROUTING -i fwbr+ -j CT --zone 1
        post-down iptables -t raw -D PREROUTING -i fwbr+ -j CT --zone 1
        # Port 80 (http)
        post-up   iptables -t nat -A PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination 192.168.20.200
        post-down iptables -t nat -D PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination 192.168.20.200

        # Port 443 (https)
        post-up   iptables -t nat -A PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination 192.168.20.200
        post-down iptables -t nat -D PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination 192.168.20.200


iface vmbr0 inet6 static
        address fcc9::1
        netmask 64
        bridge_ports none
        bridge_stp off
        bridge_fd 0
     # Port 80 (http)  - hex c8 is 200 decimal!
        post-up   ip6tables -t nat -A PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination fcc9::c8
        post-down ip6tables -t nat -D PREROUTING -i eno1 -p tcp --dport 80 -j DNAT --to-destination fcc9::c8

        # Port 443 (https) - hex c8 is 200 decimal!
        post-up   ip6tables -t nat -A PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination fcc9::c8
        post-down ip6tables -t nat -D PREROUTING -i eno1 -p tcp --dport 443 -j DNAT --to-destination fcc9::c8

客户端的 /etc/network/interfaces 是：

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens18
iface ens18 inet static
    address 192.168.20.200/24
    gateway 192.168.20.1
    # dns-* options are implemented by the resolvconf package, if installed
    # put nameservers in /etc/resolv.conf

iface ens18 inet6 static
    address fcc9::c8
    netmask 64
    gateway fcc9::1

在 proxmox 主机上，我跑了sysctl -w net.ipv6.conf.all.forwarding=1

我可以从 proxmox 主机 ping6 到互联网上具有 ipv6 的每台主机。我还可以从客户端 ping 到fcc9::1，也可以 ping 到2a01:4f8:543:4122::12，但无法google.com从客户端 ping 通。地址解析正确。