网络拓扑

2024-5-31 • tag-icon

我正在尝试使用第 2 层以太网桥建立 OpenVPN 连接来桥接两个 LAN。ARP 响应似乎无法正确生成...

请注意我想创建一个满的二层桥接，这样所有流量（包括广播数据包）都可以中继。我将使用 ebtables 和其他方法来阻止 DHCP 等。

网络拓扑

我们在不同的物理位置有两个 LAN（我们称之为 LAN1 和 LAN2）。每个 LAN 都是消费级互联网连接上的标准住宅网络。

------------     ---------     ----------    ------------------------
* Internet * --> * Modem * --> * Router * -> * Switches and Clients *
------------     ---------     ----------    ------------------------

在每个网络上，我们都构建了一个 Linux 服务器，旨在充当备份文件服务器和 VPN 桥接器。这两个服务器分别称为 Thing1（位于 LAN1 上）和 Thing2（位于 LAN2 上），它们是客户端设备。

LAN1 使用 192.168.110.0/24

路由器 1（ASUS RT-AC68U）作为 DHCP 服务器和互联网网关，地址为 192.168.110.254
各种交换机及客户端电脑、电话、电视等。
Thing1（OpenVPN 服务器）已连接到 192.168.110.250

LAN2 使用 192.168.111.0/24

路由器 2（ASUS RT-AC66U）作为 DHCP 服务器和互联网网关，地址为 192.168.111.254
各种交换机及客户端电脑、电话、电视等。
Thing2（OpenVPN 服务器）已连接到 192.168.111.250

配置

每台 OpenVPN 机器（Thing1 和 Thing2）都已安装并正在运行 OpenVPN。连接已成功创建。

在每台服务器上，我们使用 bridge-start 脚本创建我们的 tap 和 bridge。我在这里修剪了一下...

桥接启动

echo 1 > /proc/sys/net/ipv4/ip_forward
br="br0"
tap="tap0"
eth="enp2s0"

#obtain the Hardware Mac address of the physical ethernet interface
eth_hw_mac=`ifconfig $eth | grep 'HWaddr' | cut -d' ' -f9`

for t in $tap; do
    ip tuntap add dev $t mode tap
done

brctl addbr $br
brctl addif $br $eth

for t in $tap; do
    brctl addif $br $t
done

for t in $tap; do
    ifconfig $t 0.0.0.0 promisc up
done

ifconfig $eth 0.0.0.0 promisc up
ifconfig $br hw ether $eth_hw_mac

dhclient $br

# Load ebtables rules to block DHCP traffic across the bridge.
ebtables -A INPUT -i tap0 -p ipv4 --ip-proto udp --ip-dport 67:68 -j DROP
ebtables -A INPUT -i tap0 -p ipv4 --ip-proto udp --ip-sport 67:68 -j DROP
ebtables -A FORWARD -o tap0 -p ipv4 --ip-proto udp --ip-dport 67:68 -j DROP
ebtables -A FORWARD -o tap0 -p ipv4 --ip-proto udp --ip-sport 67:68 -j DROP

唯一的区别是，在 Thing2 上，tap 接口名为 tap1，而不是 tap0。

Thing1（192.168.110.250）上的相关 ifconfig

br0       Link encap:Ethernet  HWaddr b8:ae:ed:fc:4a:4f
          inet addr:192.168.110.250  Bcast:192.168.110.255  Mask:255.255.255.0
          inet6 addr: fe80::baae:edff:fefc:4a4f/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:560719 errors:0 dropped:0 overruns:0 frame:0
          TX packets:271873 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:120753983 (120.7 MB)  TX bytes:72273308 (72.2 MB)

enp2s0    Link encap:Ethernet  HWaddr b8:ae:ed:fc:4a:4f
          inet6 addr: fe80::baae:edff:fefc:4a4f/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:525244 errors:0 dropped:68 overruns:0 frame:0
          TX packets:548223 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:142488031 (142.4 MB)  TX bytes:129824161 (129.8 MB)

tap0      Link encap:Ethernet  HWaddr c6:5d:10:17:5c:b9
          inet6 addr: fe80::c45d:10ff:fe17:5cb9/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:240521 errors:0 dropped:0 overruns:0 frame:0
          TX packets:238686 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:49398722 (49.3 MB)  TX bytes:47097224 (47.0 MB)

Thing2 上的相关 ifconfig（192.168.111.250）

br0       Link encap:Ethernet  HWaddr f4:4d:30:08:f1:e5
          inet addr:192.168.111.250  Bcast:192.168.111.255  Mask:255.255.255.0
          inet6 addr: fe80::f64d:30ff:fe08:f1e5/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1049729 errors:0 dropped:0 overruns:0 frame:0
          TX packets:757240 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:5142387727 (5.1 GB)  TX bytes:302576425 (302.5 MB)

enp2s0    Link encap:Ethernet  HWaddr f4:4d:30:08:f1:e5
          inet6 addr: fe80::f64d:30ff:fe08:f1e5/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:7254547 errors:0 dropped:389 overruns:0 frame:0
          TX packets:3661240 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:6092825279 (6.0 GB)  TX bytes:1214754910 (1.2 GB)

tap1      Link encap:Ethernet  HWaddr 46:6f:ee:61:de:b2
          inet addr:192.168.110.1  Bcast:192.168.110.255  Mask:255.255.255.0
          inet6 addr: fe80::446f:eeff:fe61:deb2/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:233278 errors:0 dropped:0 overruns:0 frame:0
          TX packets:294344 errors:0 dropped:46711 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:46740438 (46.7 MB)  TX bytes:129353655 (129.3 MB)

Thing1（192.168.110.250）上的 OpenVPN server.conf 的相关行

port 1194
proto udp
dev tap0
topology subnet
ifconfig-pool-persist ipp.txt
server-bridge 192.168.110.250 255.255.255.0 192.168.110.1 192.168.110.10
client-to-client
keepalive 10 120
persist-key
persist-tun

Thing1 上的路由表

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         router.asus.com 0.0.0.0         UG    0      0        0 br0
192.168.110.0   *               255.255.255.0   U     0      0        0 br0
192.168.111.0   192.168.111.250 255.255.255.0   UG    0      0        0 tap0
192.168.111.250 *               255.255.255.255 UH    0      0        0 tap0

Thing2 上的路由表

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         router.asus.com 0.0.0.0         UG    0      0        0 br0
192.168.110.0   192.168.110.250 255.255.255.0   UG    0      0        0 tap1
192.168.110.250 *               255.255.255.255 UH    0      0        0 tap1
192.168.111.0   *               255.255.255.0   U     0      0        0 br0

问题

我尝试从 .110.250 ping .111.250，但 ARP 解析始终未发生......

ping 192.168.111.250

PING 192.168.111.250 (192.168.111.250) 56(84) bytes of data.
From 192.168.110.250 icmp_seq=1 Destination Host Unreachable
From 192.168.110.250 icmp_seq=2 Destination Host Unreachable
From 192.168.110.250 icmp_seq=3 Destination Host Unreachable

在 ping 操作正在进行的同时，对 .110.250 的 tap 进行 tcpdump...

tcpdump -i tap0 -en | grep "ARP"

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:43:08.283935 c6:5d:10:17:5c:b9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.111.250 tell 192.168.110.250, length 28
15:43:08.300129 46:6f:ee:61:de:b2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.110.250 tell 192.168.110.1, length 28
15:43:08.300181 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28
15:43:09.300441 46:6f:ee:61:de:b2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.110.250 tell 192.168.110.1, length 28
15:43:09.300493 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28
15:43:10.302120 46:6f:ee:61:de:b2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.110.250 tell 192.168.110.1, length 28
15:43:10.302170 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28
15:43:11.300760 46:6f:ee:61:de:b2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.110.250 tell 192.168.110.1, length 28
15:43:11.300810 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28
15:43:12.300762 46:6f:ee:61:de:b2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.110.250 tell 192.168.110.1, length 28
15:43:12.300815 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28

每次 ping 尝试都会重复此序列。

同时，在 .111.250 的 tap1 上（其 IP 为 192.168.110.1）...

tcpdump -i tap1 -en | grep "ARP"

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on tap1, link-type EN10MB (Ethernet), capture size 262144 bytes
15:49:47.315913 c6:5d:10:17:5c:b9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.111.250 tell 192.168.110.250, length 28
15:49:47.813360 46:6f:ee:61:de:b2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.110.250 tell 192.168.110.1, length 28
15:49:47.830572 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28
15:49:48.314726 c6:5d:10:17:5c:b9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.111.250 tell 192.168.110.250, length 28
15:49:48.812622 46:6f:ee:61:de:b2 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.110.250 tell 192.168.110.1, length 28
15:49:48.832273 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28

如果我们看一下 .111.250 的 br0（实际上有 192.168.111.250）...

tcpdump -i br0 -en | grep "ARP"

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:53:49.969025 c6:5d:10:17:5c:b9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.111.250 tell 192.168.110.250, length 28
15:53:50.341753 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28
15:53:50.968877 c6:5d:10:17:5c:b9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.111.250 tell 192.168.110.250, length 28
15:53:51.341336 b8:ae:ed:fc:4a:4f > 46:6f:ee:61:de:b2, ethertype ARP (0x0806), length 42: Reply 192.168.110.250 is-at b8:ae:ed:fc:4a:4f, length 28

但是在物理以太网适配器上......

tcpdump -i enp2s0 -en | grep "ARP"

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp2s0, link-type EN10MB (Ethernet), capture size 262144 bytes
15:56:13.344685 c6:5d:10:17:5c:b9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.111.250 tell 192.168.110.250, length 28
15:56:14.344167 c6:5d:10:17:5c:b9 > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.168.111.250 tell 192.168.110.250, length 28

据我所知，Thing2 的 br0（地址为 192.168.111.250）应该发送类似的回复......

f4:4d:30:08:f1:e5 > c6:5d:10:17:5c:b9, ethertype ARP (0x0806), length 42: Reply 192.168.111.250 is-at f4:4d:30:08:f1:e5, length 28

我不知道这是否能修复所有问题，或者我是否遗漏了一些非常明显的东西。如果您认为任何建议可以引导我朝着正确的方向前进，请随时提出。

答案1

问题在于您尝试桥接两个不同的 IP 子网，但无法正常工作。一个 IP 子网由单个广播域组成，现在您尝试在单个广播域中设置两个不同的 IP 子网（通过 VPN 桥接）。

在 ping 过程中发生的情况是，您192.168.111.250向发送 ARP 请求192.168.110.250，但后者不会应答，因为该请求来自其子网之外的 IP 地址192.168.110.0/24。

br0您的配置中的另一个问题是，您为作为桥接设备的设备以及tapX作为桥接一部分的设备定义了 IP 地址。

您应该只为桥接设备分配一个 IP 地址。

如果您确实想要完整的 L2 网络解决方案，则需要重新设计您的网络概念，以便在网桥上使用单个 IP 子网。

网络拓扑

配置

桥接启动

Thing1（192.168.110.250）上的相关 ifconfig

Thing2 上的相关 ifconfig（192.168.111.250）

Thing1（192.168.110.250）上的 OpenVPN server.conf 的相关行

Thing1 上的路由表

Thing2 上的路由表

问题

答案1

相关内容