☰

iptables - 将流量从内部网络转发到外部网络不起作用

tag-icon • tag-icon linux iptables ping
iptables - 将流量从内部网络转发到外部网络不起作用

我正在运行 almalinux 8 并且我的虚拟机连接了 3 个网络接口

`[root@puppetmaster ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:d1:2f:93 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp0s3
       valid_lft 80482sec preferred_lft 80482sec
    inet6 fe80::a00:27ff:fed1:2f93/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:e4:53:8a brd ff:ff:ff:ff:ff:ff
    inet 192.168.128.2/24 brd 192.168.128.255 scope global noprefixroute enp0s8
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fee4:538a/64 scope link
       valid_lft forever preferred_lft forever
4: enp0s9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:c5:47:fa brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.10/24 brd 192.168.1.255 scope global dynamic noprefixroute enp0s9
       valid_lft 69570sec preferred_lft 69570sec
    inet6 fe80::a00:27ff:fec5:47fa/64 scope link
       valid_lft forever preferred_lft forever`

现在我想将所有网络流量转发enp0s8到enp0s9。所以我尝试通过 iptables 来做到这一点。为此我运行了以下命令

[root@puppetmaster ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
[root@puppetmaster ~]# iptables -t nat -A POSTROUTING --out-interface enp0s9 -j MASQUERADE
root@puppetmaster ~]# iptables -A FORWARD --in-interface enp0s8 -j ACCEPT

这是 iptables 的输出

[root@puppetmaster ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@puppetmaster ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

但我还是无法 ping 通

谢谢

我应该能够从内网 ping 通

- - - - 编辑 - - - - - - - - -

我设置了其他虚拟机并添加了默认路由

[root@websrv ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:d1:2f:93 brd ff:ff:ff:ff:ff:ff
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:f0:16:bd brd ff:ff:ff:ff:ff:ff
    inet 192.168.128.10/24 brd 192.168.128.255 scope global noprefixroute enp0s8
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fef0:16bd/64 scope link
       valid_lft forever preferred_lft forever
4: enp0s9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:ca:35:bd brd ff:ff:ff:ff:ff:ff
[root@websrv ~]# ip route
default via 192.168.128.2 dev enp0s8
192.168.128.0/24 dev enp0s8 proto kernel scope link src 192.168.128.10 metric 101

但是，当我尝试 ping 时，它会返回对 dns 请求的响应，但不会响应 icmp 请求

[root@websrv ~]# ping google.com
PING google.com (142.250.192.110) 56(84) bytes of data.
^C
--- google.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2074ms

答案1

我想通了这个问题。在 nat 服务器上，默认路由是来自我在 iptables nat 表中定义的接口的其他接口。我已从列表中删除了该默认路由，并且能够 ping 通服务器。另一种方法是保持路由表不变并更改 iptables 上的接口。这两种方式我都能解决。

相关内容