我正在尝试使用 pfSense 与 Tinc VPN 链接在一起来创建多站点网络。这是我当前的拓扑：
Router A Router B
**************** ****************
* * * *
* 10.0.0.1/16 *--------* 10.1.0.1/16 *
* * * *
**************** ****************
| |
| |
**************** ****************
* * * *
* 10.0.0.11/16 * * 10.1.0.16/16 *
* * * *
**************** ****************
Node 1 My Desktop
我的台式机和两个路由器都可以访问网络上的每台机器，但节点 1 只能访问路由器 A。
路由器 B 目前位于 Verizon 路由器后面，VPN 端口已转发。链接已建立。不过，我怀疑这是否是问题的根源。
我已经三次检查了我的 pfSense 配置，它们彼此完全相同。我真的不确定是什么阻止了节点 1 与网络的其余部分进行通信。我基本上已经打开了所有内容。我为所有接口设置了任意到任意规则，但节点 1 找不到路由。
如果有任何相关性，路由器 A 和节点 1 通过 Vultr 托管在云中。我已启用私有网络，节点 1 正在从路由器 A 上的 DHCP 服务器请求地址。Vultr 确实在 10.XXX 空间中分配了具有相同子网的私有 IP。我的 IP 空间会与他们的冲突吗？Vultr 没有部署网关，他们分配的 IP 完全是静态的。
您可以使用私有网络上的任何 IP。我们默认分配一个 IP，但您可以忽略它并使用其他 IP。
我真的不知道为什么节点 1 无法访问其他子网，我希望有人能帮助我解决这个问题。
10.1.0.16
bkvaluemeal@Formula:~$ ping -c 3 10.1.0.1
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.330 ms
64 bytes from 10.1.0.1: icmp_seq=2 ttl=64 time=0.319 ms
64 bytes from 10.1.0.1: icmp_seq=3 ttl=64 time=0.305 ms
--- 10.1.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1998ms
rtt min/avg/max/mdev = 0.305/0.318/0.330/0.010 ms
bkvaluemeal@Formula:~$ ping -c 3 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=9.82 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=8.86 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=38.0 ms
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 8.864/18.925/38.085/13.553 ms
bkvaluemeal@Formula:~$ ping -c 3 10.0.0.11
PING 10.0.0.11 (10.0.0.11) 56(84) bytes of data.
64 bytes from 10.0.0.11: icmp_seq=1 ttl=62 time=11.5 ms
64 bytes from 10.0.0.11: icmp_seq=2 ttl=62 time=10.5 ms
64 bytes from 10.0.0.11: icmp_seq=3 ttl=62 time=9.37 ms
--- 10.0.0.11 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 9.370/10.482/11.555/0.892 ms
bkvaluemeal@Formula:~$ ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether e0:3f:49:ad:81:03 brd ff:ff:ff:ff:ff:ff
inet 10.1.0.16/16 brd 10.1.255.255 scope global dynamic eno1
valid_lft 6915sec preferred_lft 6915sec
inet6 fe80::20dc:2028:faee:5420/64 scope link
valid_lft forever preferred_lft forever
3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 54:27:1e:55:ae:33 brd ff:ff:ff:ff:ff:ff
inet 192.168.1.163/24 brd 192.168.1.255 scope global dynamic wlp3s0
valid_lft 76214sec preferred_lft 76214sec
inet6 fe80::d9de:6606:5307:968b/64 scope link
valid_lft forever preferred_lft forever
4: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000
link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
valid_lft forever preferred_lft forever
5: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
link/ether 52:54:00:d1:33:dd brd ff:ff:ff:ff:ff:ff
6: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:82:c6:99:06 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 scope global docker0
valid_lft forever preferred_lft forever
10.1.0.1
PING 10.1.0.16 (10.1.0.16): 56 data bytes
64 bytes from 10.1.0.16: icmp_seq=0 ttl=64 time=0.177 ms
64 bytes from 10.1.0.16: icmp_seq=1 ttl=64 time=0.312 ms
64 bytes from 10.1.0.16: icmp_seq=2 ttl=64 time=0.194 ms
--- 10.1.0.16 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 0.177/0.228/0.312/0.060 ms
PING 10.0.0.1 (10.0.0.1): 56 data bytes
64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=8.926 ms
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=8.335 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=8.290 ms
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 8.290/8.517/8.926/0.290 ms
PING 10.0.0.11 (10.0.0.11): 56 data bytes
64 bytes from 10.0.0.11: icmp_seq=0 ttl=63 time=11.052 ms
64 bytes from 10.0.0.11: icmp_seq=1 ttl=63 time=9.573 ms
64 bytes from 10.0.0.11: icmp_seq=2 ttl=63 time=9.913 ms
--- 10.0.0.11 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 9.573/10.179/11.052/0.632 ms
10.0.0.1
PING 10.1.0.16 (10.1.0.16): 56 data bytes
64 bytes from 10.1.0.16: icmp_seq=0 ttl=63 time=8.307 ms
64 bytes from 10.1.0.16: icmp_seq=1 ttl=63 time=9.256 ms
64 bytes from 10.1.0.16: icmp_seq=2 ttl=63 time=9.109 ms
--- 10.1.0.16 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 8.307/8.891/9.256/0.417 ms
PING 10.1.0.1 (10.1.0.1): 56 data bytes
64 bytes from 10.1.0.1: icmp_seq=0 ttl=64 time=8.618 ms
64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=8.579 ms
64 bytes from 10.1.0.1: icmp_seq=2 ttl=64 time=8.702 ms
--- 10.1.0.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 8.579/8.633/8.702/0.051 ms
PING 10.0.0.11 (10.0.0.11): 56 data bytes
64 bytes from 10.0.0.11: icmp_seq=0 ttl=64 time=1.142 ms
64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=2.385 ms
64 bytes from 10.0.0.11: icmp_seq=2 ttl=64 time=2.053 ms
--- 10.0.0.11 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 1.142/1.860/2.385/0.525 ms
10.0.0.11
root@node1:~# ping -c 3 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1 icmp_seq=1 ttl=64 time=1.10 ms
64 bytes from 10.0.0.1 icmp_seq=2 ttl=64 time=1.04 ms
64 bytes from 10.0.0.1 icmp_seq=3 ttl=64 time=0.749 ms
--- 10.0.0.1 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2004ms
rtt min/avg/max/mdev = 0.749/0.968/1.106/0.156 ms
root@node1:~# ping -c 3 10.1.0.1
PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data.
--- 10.1.0.1 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2042ms
root@node1:~# ping -c 3 10.1.0.16
PING 10.1.0.16 (10.1.0.16) 56(84) bytes of data.
--- 10.1.0.16 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2048ms
root@node1:~# ip address
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether XX:XX:XX:XX:XX:XX brd XX:XX:XX:XX:XX:XX
inet 45.77.X.X/23 brd 45.77.X.X scope global ens3
valid_lft forever preferred_lft forever
inet6 2001:19f0:X:X:X:X:X:X/64 scope global mngtmpaddr dynamic
valid_lft 2591544sec preferred_lft 604344sec
inet6 fe80::5400:X:X:X/64 scope link
valid_lft forever preferred_lft forever
3: ens7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 5a:01:01:3c:13:c8 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.11/16 brd 10.0.255.255 scope global ens7
valid_lft forever preferred_lft forever
inet6 fe80::5801:1ff:fe3c:13c8/64 scope link
valid_lft forever preferred_lft forever
4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:65:df:2f:a1 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:65ff:fedf:2fa1/64 scope link
valid_lft forever preferred_lft forever
答案1
“ping 从一边传来，桌面-->节点1但从节点1-->桌面“——如果这个说法准确的话，那么就排除了路由问题的所有可能性。
为了使 ping 从桌面->节点 1 正常工作，您还必须收到从节点 1->桌面返回的回复。这表明 VPN 和路由上的所有设置都正常。
相反，这是防火墙问题。由于来自 Node1 的 ping 在路由器 B 处被丢弃，但路由器 B 可以 ping 桌面，因此防火墙问题可能出在路由器 B 上。路由器 B 允许出站和“相关”连接，但不允许入站连接。
根据您发布的信息，我不得不说这与您所说的“防火墙 LAN 规则”有关。将其更改为 ANY/ANY/ANY/ANY（或其他）以进行测试。防火墙规则含糊不清，所以我无法说出一种或另一种。
编辑：
我们发现节点 1 有两个网络接口。一个位于 IP 为 10.0.0.11 的“专用网络”上，另一个具有公共 IP 地址和默认网关。此外，NAT 规则导致流量通过 VPN 隧道进行 NAT。因此，Desktop 可以成功 PING 节点 1，因为到达节点 1 的流量似乎来自 10.0.0.1。但是当尝试从节点 1 PING 桌面时，节点 1 没有到 10.1.0.0/16 的路由。
一旦我们清理了节点 1 上的路由表并在路由器 A 和 B 上将 NAT 规则设置为自动，一切都会开始按预期工作。