在超出第一个 VRRP 组中的 IP 限制后，我们在向 vyatta 设备添加新 IP 时遇到了问题。列出的所有 IP 都可以vrrp-group 1正常工作，但我添加的任何 IP 都vrrp-group 2不能正常工作。
我们可以看到流量进来，但我们想要工作的流量（443）从未到达 NAT。但是，ping 流量进来并返回（这应该不起作用）。NAT 位于防火墙之前，但我们已经检查过以确保我们没有遗漏任何东西，并且它有 0 次命中。任何想法都将不胜感激。
流量从端口 443 进入，但没有出去
tcpdump: listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
12:07:50.003063 IP (tos 0x0, ttl 52, id 63499, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62111 > 1.1.1.1.443: Flags [S], cksum 0xd629 (correct), seq 237589496, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539048232 ecr 0,sackOK,eol], length 0
12:07:50.709156 IP (tos 0x0, ttl 52, id 37525, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62113 > 1.1.1.1.443: Flags [S], cksum 0x412b (correct), seq 2830126052, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539048881 ecr 0,sackOK,eol], length 0
12:07:57.131533 IP (tos 0x0, ttl 52, id 34718, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62137 > 1.1.1.1.443: Flags [S], cksum 0xc2c7 (correct), seq 3549136583, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539055166 ecr 0,sackOK,eol], length 0
防火墙的 NAT 表中没有任何内容
sh nat destination translations | match 1.1.1.1
sh firewall name out2in rule 100
-----------------------------
Rulesets Information
-----------------------------
IPv4 Firewall "out2in":
Active on traffic to -
zone [inside] from zone [outside]
rule action proto packets bytes
---- ------ ----- ------- -----
100 accept tcp 0 0
condition - saddr 0.0.0.0/0 daddr 10.0.0.100
Ping 可以工作（但不能翻译）
15:11:31.052571 IP (tos 0x0, ttl 52, id 65344, offset 0, flags [none], proto ICMP (1), length 84)
2.2.2.2 > 1.1.1.1: ICMP echo request, id 28473, seq 117, length 64
15:11:31.052585 IP (tos 0x0, ttl 64, id 9409, offset 0, flags [none], proto ICMP (1), length 84)
1.1.1.1 > 2.2.2.2: ICMP echo reply, id 28473, seq 117, length 64
15:11:32.055675 IP (tos 0x0, ttl 52, id 32001, offset 0, flags [none], proto ICMP (1), length 84)
2.2.2.2 > 1.1.1.1: ICMP echo request, id 28473, seq 118, length 64
NAT
set nat destination rule 100 destination address '1.1.1.1'
set nat destination rule 100 destination port 'https'
set nat destination rule 100 inbound-interface 'bond1'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation address '10.0.0.100'
防火墙
set firewall name out2in rule 100 action 'accept'
set firewall name out2in rule 100 destination address '10.0.0.100'
set firewall name out2in rule 100 destination port '443'
set firewall name out2in rule 100 protocol 'tcp'
VRRP 配置
set interfaces bonding bond1 address '1.1.1.4/28'
set interfaces bonding bond1 hash-policy 'layer3+4'
set interfaces bonding bond1 mode '802.3ad'
set interfaces bonding bond1 vrrp vrrp-group 1 advertise-interval '1'
set interfaces bonding bond1 vrrp vrrp-group 1 preempt 'false'
set interfaces bonding bond1 vrrp vrrp-group 1 priority '253'
set interfaces bonding bond1 vrrp vrrp-group 1 'rfc3768-compatibility'
set interfaces bonding bond1 vrrp vrrp-group 1 sync-group 'vgroup1'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.1.230/28'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.2.80/28'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.3.172/29'
...
set interfaces bonding bond1 vrrp vrrp-group 2 advertise-interval '1'
set interfaces bonding bond1 vrrp vrrp-group 2 preempt 'false'
set interfaces bonding bond1 vrrp vrrp-group 2 priority '253'
set interfaces bonding bond1 vrrp vrrp-group 2 'rfc3768-compatibility'
set interfaces bonding bond1 vrrp vrrp-group 2 sync-group 'vgroup1'
set interfaces bonding bond1 vrrp vrrp-group 2 virtual-address '1.1.1.1/28'
向区域策略添加了新的子接口
set zone-policy zone outside interface 'bond1'
set zone-policy zone outside interface 'bond1v1'
set zone-policy zone outside interface 'bond1v2'
路由与 bond1v1 中的类似路由匹配
1.1.3.172/28 is directly connected, bond1v1
1.1.1.1/28 is directly connected, bond1v2
答案1
好吧，我找到了答案。问题实际上出在我的内部网络 10.0.0.100 上，它似乎无法正常工作。