我有以下问题：我有一个界面eth0 with IP 172.20.51.61/24
我在同一台机器上配置了 2 个 VLAN：
eth0.120 : 172.20.52.61/24
eth0.200 : 172.20.54.61/24
我还有一个 DELL 交换机，
trunk port 2 and
access ports 6 VLAN 120 and
access port 10 VLAN 200.
这台机器上有一个 DHCP 服务器，因此当我连接两个 VLAN 上的两台笔记本电脑时，我会获得相应的 IP 地址：
PC1 172.20.54.234
PC2 172.20.52.114
问题是我无法从一台 PC1 ping 到 PC2。
那么如何实现从不同子网中的 PC1 或 PC2 进行 ping 操作。
我的iptable规则如下：
Chain INPUT (policy ACCEPT 81 packets, 5386 bytes)
pkts bytes target prot opt in out source destination
178 19945 delegate_input all -- * * 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 delegate_forward all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
626 211K delegate_output all -- * * 0.0.0.0/0 0.0.0.0/0
Chain delegate_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for forwarding */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 zone_lan_forward all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 zone_wan_forward all -- eth1 * 0.0.0.0/0 0.0.0.0/0
0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0
Chain delegate_input (1 references)
pkts bytes target prot opt in out source destination
23 2206 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
155 17739 input_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for input */
74 12353 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
3 180 syn_flood tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02
0 0 zone_lan_input all -- eth0 * 0.0.0.0/0 0.0.0.0/0
0 0 zone_wan_input all -- eth1 * 0.0.0.0/0 0.0.0.0/0
Chain delegate_output (1 references)
pkts bytes target prot opt in out source destination
23 2206 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
603 209K output_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for output */
601 208K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
2 264 zone_lan_output all -- * eth0 0.0.0.0/0 0.0.0.0/0
0 0 zone_wan_output all -- * eth1 0.0.0.0/0 0.0.0.0/0
Chain syn_flood (1 references)
pkts bytes target prot opt in out source destination
3 180 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 25/sec burst 50
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain zone_lan_dest_ACCEPT (2 references)
pkts bytes target prot opt in out source destination
2 264 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0
Chain zone_lan_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for forwarding */
0 0 zone_wan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* forwarding lan -> wan */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port forwards */
0 0 zone_lan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain zone_lan_input (1 references)
pkts bytes target prot opt in out source destination
0 0 input_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for input */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port redirections */
0 0 zone_lan_src_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain zone_lan_output (1 references)
pkts bytes target prot opt in out source destination
2 264 output_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for output */
2 264 zone_lan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain zone_lan_src_ACCEPT (1 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0
Chain zone_wan_dest_ACCEPT (2 references)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * eth1 0.0.0.0/0 0.0.0.0/0
Chain zone_wan_dest_REJECT (1 references)
pkts bytes target prot opt in out source destination
0 0 reject all -- * eth1 0.0.0.0/0 0.0.0.0/0
Chain zone_wan_forward (1 references)
pkts bytes target prot opt in out source destination
0 0 forwarding_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for forwarding */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port forwards */
0 0 zone_wan_dest_REJECT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain zone_wan_input (1 references)
pkts bytes target prot opt in out source destination
0 0 input_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for input */
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68 /* Allow-DHCP-Renew */
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 /* Allow-Ping */
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port redirections */
0 0 zone_wan_src_REJECT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain zone_wan_output (1 references)
pkts bytes target prot opt in out source destination
0 0 output_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for output */
0 0 zone_wan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
Chain zone_wan_src_REJECT (1 references)
pkts bytes target prot opt in out source destination
0 0 reject all -- eth1 * 0.0.0.0/0 0.0.0.0/0
答案1
您需要为笔记本电脑中的其他网络添加 IP 路由。
172.20.51.61如果该机器也是您网络中的默认路由器，则这是最简单的。
在这种情况下，您需要以下内容：
- 确保路由器机器中启用了 IP 路由。
- 添加防火墙规则，以便允许两个 VLAN 网络之间的流量。
- 确保两台客户端机器都以该路由器作为默认网关（客户端机器网络中接口的IP）。
路由器似乎安装了某种防火墙管理软件，您应该检查该配置，而不是直接操作 IPTables。