我已经安装了centos 6.5。
我已经安装了一个主机虚拟机管理程序，libvirt（kvm-qemu）通过 virt-manager 进行管理，我还安装了两个虚拟机（带有 kvm），每个虚拟机都是 centos 6.5。例如分别为 centos65_1 和 centos65_2。
第一个centos65_1使用默认虚拟网络（NAT）
name: default
device: virbr0
state: active
autoboot: yes
ipv4 configuration
net: 192.168.122.0/24
dhcp:
start: 192.168.122.2
end: 192.168.122.254
forward: NAT
第二个 centos65_2 使用我创建的另一个虚拟网络（路由网络）
name: routed_network
device: virbr1
state: active
autoboot: yes
ipv4 configuration
net: 192.168.100.0/24
dhcp:
start: 192.168.100.128
end: 192.168.100.254
forward: Routed
主持人：
当两个虚拟机都在运行时
[root@isis jvr]# ifconfig
Auto_eth0 Link encap:Ethernet HWaddr 20:CF:30:AE:65:47
inet addr:192.168.1.15 Bcast:192.168.1.255 Mask:255.255.255.0
inet6 addr: fe80::22cf:30ff:feae:6547/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:35 errors:0 dropped:0 overruns:0 frame:0
TX packets:35 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:19218 (18.7 KiB) TX bytes:2888 (2.8 KiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:4958 errors:0 dropped:0 overruns:0 frame:0
TX packets:4958 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1546831 (1.4 MiB) TX bytes:1546831 (1.4 MiB)
virbr0 Link encap:Ethernet HWaddr 52:54:00:96:45:DE
inet addr:192.168.122.1 Bcast:192.168.122.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:31 errors:0 dropped:0 overruns:0 frame:0
TX packets:16 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1886 (1.8 KiB) TX bytes:1344 (1.3 KiB)
virbr1 Link encap:Ethernet HWaddr 52:54:00:2C:02:F9
inet addr:192.168.100.1 Bcast:192.168.100.255 Mask:255.255.255.0
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:29 errors:0 dropped:0 overruns:0 frame:0
TX packets:14 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:1774 (1.7 KiB) TX bytes:1204 (1.1 KiB)
vnet0 Link encap:Ethernet HWaddr FE:54:00:77:ED:C8
inet6 addr: fe80::fc54:ff:fe77:edc8/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:31 errors:0 dropped:0 overruns:0 frame:0
TX packets:194 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:2320 (2.2 KiB) TX bytes:10756 (10.5 KiB)
vnet1 Link encap:Ethernet HWaddr FE:54:00:A2:8D:8B
inet6 addr: fe80::fc54:ff:fea2:8d8b/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:29 errors:0 dropped:0 overruns:0 frame:0
TX packets:148 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:500
RX bytes:2180 (2.1 KiB) TX bytes:8328 (8.1 KiB)
[root@isis jvr]# iptables -v -n -L --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
2 0 0 ACCEPT tcp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
3 0 0 ACCEPT udp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
4 0 0 ACCEPT tcp -- virbr1 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
5 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53
6 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53
7 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67
8 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67
9 4997 1566K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
10 4 336 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
11 4 240 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
12 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
13 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:5900
14 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:5903
15 10 572 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 6 504 ACCEPT all -- * virbr1 0.0.0.0/0 192.168.100.0/24
2 6 504 ACCEPT all -- virbr1 * 192.168.100.0/24 0.0.0.0/0
3 0 0 ACCEPT all -- virbr1 virbr1 0.0.0.0/0 0.0.0.0/0
4 0 0 REJECT all -- * virbr1 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
5 0 0 REJECT all -- virbr1 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
6 0 0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 state RELATED,ESTABLISHED
7 0 0 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0
8 0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0
9 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
10 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
11 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 5015 packets, 1551K bytes)
num pkts bytes target prot opt in out source destination
[root@isis jvr]# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
192.168.100.0 * 255.255.255.0 U 0 0 0 virbr1
192.168.1.0 * 255.255.255.0 U 1 0 0 Auto_eth0
192.168.122.0 * 255.255.255.0 U 0 0 0 virbr0
default 192.168.1.1 0.0.0.0 UG 0 0 0 Auto_eth0
[root@isis jvr]# brctl show
bridge name bridge id STP enabled interfaces
virbr0 8000.5254009645de yes virbr0-nic
vnet0
virbr1 8000.5254002c02f9 yes virbr1-nic
vnet1
ping 客户端 (vms) 正常。
客户端（虚拟机）
centos65_1
它有静态 IP
nano /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
TYPE=Ethernet
UUID=2b991cfa-4c3f-4619-8073-806710299fef
ONBOOT=yes
NM_CONTROLLED=yes
BOOTPROTO=none
IPADDR=192.168.122.5
PREFIX=24
GATEWAY=192.168.122.1
DNS1=192.168.122.1
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
NAME="System eth0"
HWADDR=52:54:00:77:ed:c8
NETMASK=255.255.255.0
USERCTL=no
在 centos65_1 上，ping 第二个虚拟机 192.168.100.130，ping 192.168.1.15 和 192.168.122.1 都可以。ping 192.168.1.1 可以，ping google.com 也可以
NAT 模式有效。
centos65_2
它有静态 IP
nano /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
HWADDR=52:54:00:a2:8d:8b
TYPE=Ethernet
UUID=d61375fb-6e4f-4f43-8015-9f7a218e1b39
ONBOOT=yes
NM_CONTROLLED=yes
BOOTPROTO=none
DNS1=192.168.100.1
IPV6INIT=no
USERCTL=no
IPADDR=192.168.100.130
NETMASK=255.255.255.0
GATEWAY=192.168.100.1
在 centos65_2 上 ping 第二个虚拟机 192.168.122.5，并且 ping 到 192.168.1.15 和 192.168.100.1 都可以。
ping 192.168.1.1 不起作用 ping google.com 不起作用 路由模式不起作用
我怎么就不能去外面的世界呢？
这个想法是让安装了 virt-manager 的 centos 主机成为虚拟机的路由器+防火墙。我以为新的虚拟网络 (routed_network) 已经完成了所有网络工作。
我需要做什么才能使路由网络正常工作？我是虚拟网络的新手。
我不会在我的本地网络中使用 DMZ，我希望在我的本地网络和服务器上使用相同的网络配置。
谢谢。问候。
答案1
IP 转发是否已启用？检查sysctl net.ipv4.ip_forward。如果没有，则使用以下命令启用它sysctl -w net.ipv4.ip_forward=1（要使该更改永久生效，请添加net.ipv4.ip_forward = 1到 /etc/sysctl.conf。