我想在 XEN 上安装 OpenVPN domU。Dom0 和 domU 正在运行 Debian Squeeze,所有 domU 都在 NAT 私有网络 10.0.0.1/24 上。我的 VPN-Gate 位于 10.0.0.1 上并正在运行。我如何才能使其在 dom0 公共 IP 下可访问?
我尝试使用 iptables 转发端口,但没有成功。
这是我所做的:
~ # iptables -L -n -v
Chain INPUT (policy ACCEPT 1397 packets, 118K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 930 packets, 133K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED PHYSDEV match --physdev-out vif5.0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vif5.0 udp spt:68 dpt:67
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED PHYSDEV match --physdev-out vif5.0
0 0 ACCEPT all -- * * 10.0.0.1 0.0.0.0/0 PHYSDEV match --physdev-in vif5.0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED PHYSDEV match --physdev-out vif3.0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vif3.0 udp spt:68 dpt:67
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED PHYSDEV match --physdev-out vif3.0
0 0 ACCEPT all -- * * 10.0.0.5 0.0.0.0/0 PHYSDEV match --physdev-in vif3.0
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED PHYSDEV match --physdev-out vif2.0
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 PHYSDEV match --physdev-in vif2.0 udp spt:68 dpt:67
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED PHYSDEV match --physdev-out vif2.0
0 0 ACCEPT all -- * * 10.0.0.2 0.0.0.0/0 PHYSDEV match --physdev-in vif2.0
147 8236 ACCEPT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80
13 546 ACCEPT udp -- eth0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194
Chain OUTPUT (policy ACCEPT 1000 packets, 99240 bytes)
pkts bytes target prot opt in out source destination
~ # iptables -L -t nat -n -v
Chain PREROUTING (policy ACCEPT 324 packets, 23925 bytes)
pkts bytes target prot opt in out source destination
139 7824 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:10.0.0.5:80
1 42 DNAT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1194 to:10.0.0.1:1194
Chain POSTROUTING (policy ACCEPT 92 packets, 5030 bytes)
pkts bytes target prot opt in out source destination
863 64983 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 180 packets, 13953 bytes)
pkts bytes target prot opt in out source destination
答案1
我设法让它工作了。错误不是在包转发中,而是在 IP 路由中。我需要确保 VPN 客户端知道在哪里可以找到 10.0.0.0/24 网络。这可以通过使用 OpenVPN 的 来完成push-route
。