![具有粘性转发/路由的 iptables](https://linux22.com/image/643864/%E5%85%B7%E6%9C%89%E7%B2%98%E6%80%A7%E8%BD%AC%E5%8F%91%2F%E8%B7%AF%E7%94%B1%E7%9A%84%20iptables.png)
我的 iptables 卡住了。我在 IPTables 后面有一个 DNS 服务器,位于 NAT 的 OpenVPN 管道下方。使用 tcpdump 我看到 DNS 数据包到达外部路由器,但 DNS 请求实际沿着管道到达 DNS 服务器之前需要 4 或 5 次 DNS 查询尝试。服务器刚刚更新,问题仍然存在。是什么原因导致这种“路由卡住”?我该如何摆脱它?
iptables-保存:
# Generated by iptables-save v1.4.21 on Wed Oct 15 18:53:53 2014
*security
:INPUT ACCEPT [6661499:1780706800]
:FORWARD ACCEPT [1395363:1087119696]
:OUTPUT ACCEPT [9054598:4470085569]
COMMIT
# Completed on Wed Oct 15 18:53:53 2014
# Generated by iptables-save v1.4.21 on Wed Oct 15 18:53:53 2014
*raw
:PREROUTING ACCEPT [8279921:2932266784]
:OUTPUT ACCEPT [9054600:4470085953]
COMMIT
# Completed on Wed Oct 15 18:53:53 2014
# Generated by iptables-save v1.4.21 on Wed Oct 15 18:53:53 2014
*nat
:PREROUTING ACCEPT [608923:62822718]
:INPUT ACCEPT [21598:1030929]
:OUTPUT ACCEPT [1936482:102286294]
:POSTROUTING ACCEPT [1846412:66372854]
-A PREROUTING -d 198.74.49.126/32 -i eth0 -p tcp -m multiport --dports 21,25,80,10000 -j DNAT --to-destination 10.8.0.14
-A PREROUTING -d 198.74.49.126/32 -i eth0 -p udp -m udp --dport 53 -j DNAT --to-destination 10.8.0.22
-A PREROUTING -d 198.74.49.126/32 -i eth0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 10.8.0.22
-A PREROUTING -d 198.74.49.126/32 -i eth0 -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.8.0.26
-A POSTROUTING -o eth0 -j SNAT --to-source 198.74.49.126
COMMIT
# Completed on Wed Oct 15 18:53:53 2014
# Generated by iptables-save v1.4.21 on Wed Oct 15 18:53:53 2014
*mangle
:PREROUTING ACCEPT [8279921:2932266784]
:INPUT ACCEPT [6884197:1845120939]
:FORWARD ACCEPT [1395724:1087145845]
:OUTPUT ACCEPT [9054603:4470086441]
:POSTROUTING ACCEPT [10545150:5593566425]
COMMIT
# Completed on Wed Oct 15 18:53:53 2014
# Generated by iptables-save v1.4.21 on Wed Oct 15 18:53:53 2014
*filter
:INPUT DROP [216663:64020937]
:FORWARD DROP [355:25909]
:OUTPUT ACCEPT [9054603:4470086441]
:PRELUDE - [0:0]
-A INPUT -j PRELUDE
-A INPUT -p tcp -m tcp --dport 2222 -j ACCEPT
-A INPUT -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -s 218.1.21.162/32 -m comment --comment "ignore this spammer(?)" -j DROP
-A INPUT -p tcp -m multiport --dports 80,21,25,53,8080,10000 -j ACCEPT
-A INPUT -p udp -m multiport --dports 53,1194,2222,3333,4444,5555,6666,7777 -j ACCEPT
-A FORWARD -j PRELUDE
-A FORWARD -i tun+ -o tun+ -j ACCEPT
-A FORWARD -i tun+ -o eth0 -j ACCEPT
-A FORWARD -d 10.8.0.14/32 -i eth0 -o tun+ -p tcp -m multiport --dports 21,25,53,80 -m comment --comment "allow tcp to server" -j ACCEPT
-A FORWARD -d 10.8.0.22/32 -i eth0 -o tun+ -p udp -m udp --dport 53 -m comment --comment "allow udp to dns server" -j ACCEPT
-A FORWARD -d 10.8.0.22/32 -i eth0 -o tun+ -p tcp -m tcp --dport 53 -m comment --comment "allow tcp to dns server" -j ACCEPT
-A FORWARD -d 10.8.0.26/32 -i eth0 -o tun+ -p tcp -m tcp --dport 8080 -m comment --comment "allow tcp to dns server" -j ACCEPT
-A PRELUDE -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A PRELUDE -m conntrack --ctstate INVALID -j DROP
-A PRELUDE -i lo -j ACCEPT
-A PRELUDE -p icmp -j ACCEPT
COMMIT
# Completed on Wed Oct 15 18:53:53 2014
openvpn.conf:
local 198.74.50.169
port 1194
;proto tcp
proto udp
;dev tap
dev tun
;dev-node MyTap
ca /usr/share/openvpn/easy-rsa/keys/ca.crt
cert /usr/share/openvpn/easy-rsa/keys/server.crt
key /usr/share/openvpn/easy-rsa/keys/server.key # This file should be kept secret
dh /usr/share/openvpn/easy-rsa/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 10.8.1.0 255.255.255.0
client-config-dir /etc/openvpn/ccd
push "dhcp-option DNS 66.228.35.79"
push "dhcp-option DNS 10.8.0.22"
;push "dhcp-option WINS 10.8.0.1"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 5
;mute 20
答案1
确保 named.conf 中的受信任 IP 反映您的前端路由器。