这个 openvz 盒子几周前还运行正常,现在却无法 ping 外界。
我不是网络专家,我认为最初的工作设置将持续更长时间。
另一件奇怪的事情是,该虚拟机的 Web 服务可以从外部访问。
Ping 网络接口:
vz:/# ping 88.191.118.xxx
PING 88.191.118.xxx (88.191.118.xxx) 56(84) bytes of data.
64 bytes from 88.191.118.xxx: icmp_req=1 ttl=64 time=0.048 ms
64 bytes from 88.191.118.xxx: icmp_req=2 ttl=64 time=0.043 ms
--- 88.191.118.xxx ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.043/0.045/0.048/0.007 ms
Ping 谷歌:
vz:/# ping 74.125.230.83
PING 74.125.230.83 (74.125.230.83) 56(84) bytes of data.
--- 74.125.230.83 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3023ms
ifconfig:
vz:/# ifconfig
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:59 errors:0 dropped:0 overruns:0 frame:0
TX packets:59 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:5507 (5.3 KiB) TX bytes:5507 (5.3 KiB)
venet0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:127.0.0.1 P-t-P:127.0.0.1 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
RX packets:89 errors:0 dropped:0 overruns:0 frame:0
TX packets:584 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:20938 (20.4 KiB) TX bytes:395767 (386.4 KiB)
venet0:0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.23.101 P-t-P:192.168.23.101 Bcast:0.0.0.0 Mask:255.255.255.255
UP BROADCAST POINTOPOINT RUNNING NOARP MTU:1500 Metric:1
路线:
vz:/# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.0.2.1 0.0.0.0 255.255.255.255 UH 0 0 0 venet0
0.0.0.0 192.0.2.1 0.0.0.0 UG 0 0 0 venet0
主机上的 iptable:
iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
fail2ban-ssh tcp -- anywhere anywhere multiport dports ssh
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain fail2ban-ssh (1 references)
target prot opt source destination
RETURN all -- anywhere anywhere
答案1
已解决:该盒子2周前重新启动,并且iptables脚本未启动。
当前firewall.sh脚本:
sd-20628:~# more firewall.sh
#!/bin/bash
IPTABLES='/sbin/iptables';
VZ101_WEB="192.168.23.101";
LAN="192.168.23.0/24";
WAN_IFACE="eth0";
WAN_IP="88.191.xxx.xxx";
# Flushing tables
$IPTABLES -F
$IPTABLES -X
$IPTABLES -t nat -F
# Define default policy
$IPTABLES -P INPUT DROP
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT
$IPTABLES -A INPUT -j ACCEPT -d $LAN;
$IPTABLES -A INPUT -j ACCEPT -m state --state ESTABLISHED,RELATED
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 22
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 80
$IPTABLES -A INPUT -j ACCEPT -p tcp --dport 9102
$IPTABLES -A INPUT -j ACCEPT -p icmp
# SSH in VZ access
$IPTABLES -t nat -A PREROUTING -p tcp --dport 22101 -d $WAN_IP -j DNAT --to-destination $VZ101_WEB:22