☰

vlan 和 iptables (debian)

tag-icon • tag-icon linux debian iptables router
vlan 和 iptables (debian)

我正在尝试使我的 VLAN 和 iptables 正常运行。

enp2s0f0 = WAN

enp2s0f1.4 = 管理网络

我想要尝试的是允许管理网络连接到任何与 VLAN 相连的设备，而其他 VLAN 只能在其 VLAN 内连接。

以下是我当前的 iptables：

# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*filter
:INPUT ACCEPT [145:12267]
:FORWARD ACCEPT [570:105932]
:OUTPUT ACCEPT [730:148524]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0f0 -p tcp -m conntrack --ctstate NEW -m tcp -m multiport --dports 20,21,22,80,443,139,445,8181,4343,8883,60000:65535 -j ACCEPT
-A INPUT -i enp2s0f0 -p udp -m conntrack --ctstate NEW -m udp -m multiport --dports 123,137,138,5353,5678,1194 -j ACCEPT
-A INPUT -i enp2s0f0 -j DROP
-A FORWARD -i enp2s0f1.2 -o enp2s0f1.3 -j DROP
-A FORWARD -i enp2s0f1.2 -o enp2s0f1.4 -j DROP
-A FORWARD -i enp2s0f1.3 -o enp2s0f1.2 -j DROP
-A FORWARD -i enp2s0f1.3 -o enp2s0f1.4 -j DROP
COMMIT
# Completed on Wed Jun 19 11:00:52 2019
# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*raw
:PREROUTING ACCEPT [1367:271510]
:OUTPUT ACCEPT [736:149313]
-A PREROUTING -p tcp -m tcp --dport 21 -j CT --helper ftp
COMMIT

# Completed on Wed Jun 19 11:00:52 2019
# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*nat
:PREROUTING ACCEPT [56:3871]
:INPUT ACCEPT [40:2935]
:OUTPUT ACCEPT [45:14318]
:POSTROUTING ACCEPT [52:14303]
-A POSTROUTING -o enp2s0f0 -j MASQUERADE
COMMIT
# Completed on Wed Jun 19 11:00:52 2019

以下是我的网络接口

# Include additional interface stanzas.
source-directory interfaces.d

# The loopback network interface
auto lo
iface lo inet loopback
pre-up iptables-restore < /etc/iptables.rules

# enp2s0f0 network interface
allow-hotplug enp2s0f0
iface enp2s0f0 inet dhcp

# server connections
# enp2s0f1 network interface
allow-hotplug enp2s0f1
iface enp2s0f1 inet static
    address 10.0.0.1
    netmask 255.255.255.0
    network 10.0.0.0
    broadcoast 10.0.0.255
    up vconfig add enp2s0f1 2
    up vconfig add enp2s0f1 3
    up vconfig add enp2s0f1 4

# guest network
# enp2s0f1.2 network interface
auto enp2s0f1.2
iface enp2s0f1.2 inet static
    address 10.0.10.1
    netmask 255.255.255.0
    network 10.0.10.0
    broadcast 10.0.10.255

# home network
# enp2s0f1.3 network interface
auto  enp2s0f1.3
iface enp2s0f1.3 inet static
    address 10.0.20.1
    netmask 255.255.255.0
    network 10.0.20.0
    broadcast 10.0.20.255

# business network
# enp2s0f1.4 network interface
auto enp2s0f1.4
iface enp2s0f1.4 inet static
    address 10.0.30.1
    netmask 255.255.255.0
    network 10.0.30.0
    broadcast 10.0.30.255

我还运行一个通过托管交换机连接到 enp2s0f1 的 DNS 服务器。我让 dnsmasq 通过 dhcp 设置自动设置 DNS 服务器 ip。所有 vlan 都需要能够与连接到交换机的任何设备进行通信。

我尝试过iptables -P FORWARD DROP但是这会导致对连接到交换机的任何内容的访问全部中断。

答案1

  1. 您不需要在文件的up vconfig...该部分中添加语句。Vlan 接口将在启动相应接口时自动创建。enp2s0f1interfaces

  2. 为了更好地控制，请ACCEPT/DROP all改用DROP/ ACCEPT all。

  3. 在你的情况下规则将如下所示：

# allow replies and port forwarding
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED,DNAT -j ACCEPT

# allow access to WAN and to DNS from all interfaces (if your debian host is gateway)
iptables -A FORWARD -i enp2s0f1+ -o enp4s0f0 -j ACCEPT
iptables -A FORWARD -i enp2s0f1+ -o enp4s0f1 -j ACCEPT

# allow access to admin vlan from all vlans
iptables -A FORWARD -o enp2s0f1.4 -j ACCEPT
iptables -A FORWARD -i enp2s0f1.4 -j ACCEPT

# log and drop other connections
iptables -A FORWARD -m conntrack --ctstate NEW,INVALID,UNTRACKED -j NFLOG
# you can just set FORWARD policy to DROP
iptables -A FORWARD -j DROP
  1. 要排除故障，请检查规则计数器并使用tcpdump。

相关内容