☰

无法通过非默认网关 ping 通网关

tag-icon • tag-icon linux iptables routing networking iproute2
无法通过非默认网关 ping 通网关

我有以下网络接口配置，

  • eth0：192.168.78.1/24
  • eth1：192.168.254.76/24（网关 192.168.254.1）
  • eth2：192.168.253.131/24（网关 192.168.253.1）

两个网关都可以访问互联网。

在这种情况下ping -I eth1 4.2.2.2不起作用。以下是命令的输出：

$ ip route show
192.168.78.0/24 dev eth0  proto kernel  scope link  src 192.168.78.1 
192.168.253.0/24 dev eth2  proto kernel  scope link  src 192.168.253.131 
192.168.254.0/24 dev eth1  proto kernel  scope link  src 192.168.254.65 
169.254.0.0/16 dev eth0  scope link  metric 1002 
169.254.0.0/16 dev eth1  scope link  metric 1003 
169.254.0.0/16 dev eth2  scope link  metric 1004 
default via 192.168.253.1 dev eth2 

$ cat /etc/iproute2/rt_tables
255 local
254 main
253 default
0   unspec
1    eth1
2    eth2

$ ip rule ls
0:  from all lookup local 
32765:  from 192.168.254.65 lookup eth1 
32766:  from all lookup main 
32767:  from all lookup default 


$ ip route show table eth1
default via 192.168.254.1 dev eth1

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 100
    link/ether 00:0b:ab:65:10:97 brd ff:ff:ff:ff:ff:ff
    inet 192.168.78.1/24 brd 192.168.78.255 scope global eth0
    inet6 fe80::20b:abff:fe65:1097/64 scope link
       valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 100
    link/ether 00:0b:ab:65:10:98 brd ff:ff:ff:ff:ff:ff
    inet 192.168.254.65/24 brd 192.168.254.255 scope global eth1
    inet6 fe80::20b:abff:fe65:1098/64 scope link
       valid_lft forever preferred_lft forever
4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 100
    link/ether 00:0b:ab:65:10:99 brd ff:ff:ff:ff:ff:ff
    inet 192.168.253.131/24 brd 192.168.253.255 scope global eth2
    inet6 fe80::20b:abff:fe65:1099/64 scope link
       valid_lft forever preferred_lft forever
5: eth3: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether 00:0b:ab:65:10:9a brd ff:ff:ff:ff:ff:ff
6: eth4: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether 00:0b:ab:65:10:9b brd ff:ff:ff:ff:ff:ff
7: eth5: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN qlen 1000
    link/ether 00:0b:ab:65:10:9c brd ff:ff:ff:ff:ff:ff
8: sit0: <NOARP> mtu 1480 qdisc noop state DOWN
    link/sit 0.0.0.0 brd 0.0.0.0

所有rp_filter值均设置为 0。

注意：traceroute -i eth1 4.2.2.2工作正常，但如果不是默认路由，则通过接口 eth1 进行 ping 操作会失败。

如果需要更多设置或者您有任何指示，请告诉我。

答案1

据我所知，它不应该像你想象的那样工作。除非你为具体目标 IP 添加静态路由或使用策略路由，否则数据包将通过默认网关。因此，请尝试添加一些策略路由规则：

echo  300 eth2_gate >> /etc/iproute2/rt_tables
ip route add default via 192.168.254.1 table eth2_gate
ip rule add from 192.168.253.131 table eth2_gate

之后ping -I应该就可以了。希望它能有所帮助。

我也很困惑为什么这个traceroute -s工作会起作用。

答案2

也许与有关rp_filter。请参阅此回复：https://superuser.com/a/1504004/162485

相关内容