![iptables 端口转发无法与 libvirtd VM 配合使用](https://linux22.com/image/750489/iptables%20%E7%AB%AF%E5%8F%A3%E8%BD%AC%E5%8F%91%E6%97%A0%E6%B3%95%E4%B8%8E%20libvirtd%20VM%20%E9%85%8D%E5%90%88%E4%BD%BF%E7%94%A8.png)
由于某种原因,我无法从外部世界连接到虚拟机内的服务器,但我绝对可以从虚拟机管理程序连接到我的服务器。服务器应用程序在端口 27500 和 27015 上运行。我对 iptables 不太熟悉,所以可能是我做了一些明显的错误。这是我的 iptables-save:
[root@FW-H01 ~]# iptables-save
# Generated by iptables-save v1.8.4 on Fri Apr 3 21:34:51 2020
*mangle
:PREROUTING ACCEPT [10974504:113682765318]
:INPUT ACCEPT [9998403:109052061915]
:FORWARD ACCEPT [963508:4628352252]
:OUTPUT ACCEPT [11423761:2389165771]
:POSTROUTING ACCEPT [12387067:7017507319]
:LIBVIRT_PRT - [0:0]
-A POSTROUTING -j LIBVIRT_PRT
-A LIBVIRT_PRT -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Fri Apr 3 21:34:51 2020
# Generated by iptables-save v1.8.4 on Fri Apr 3 21:34:51 2020
*nat
:PREROUTING ACCEPT [7429:1219873]
:INPUT ACCEPT [1302:77639]
:OUTPUT ACCEPT [321:22443]
:POSTROUTING ACCEPT [321:22443]
:LIBVIRT_PRT - [0:0]
-A PREROUTING -d 116.202.163.214/32 -p tcp -m tcp --dport 27500 -j DNAT --to-destination 192.168.122.233:27500
-A PREROUTING -d 116.202.163.214/32 -p tcp -m tcp --dport 27015 -j DNAT --to-destination 192.168.122.233:27015
-A PREROUTING -d 116.202.163.214/32 -p udp -m udp --dport 27015 -j DNAT --to-destination 192.168.122.233:27015
-A PREROUTING -d 116.202.163.214/32 -p udp -m udp --dport 27500 -j DNAT --to-destination 192.168.122.233:27500
-A POSTROUTING -j LIBVIRT_PRT
-A POSTROUTING -s 192.168.122.233/32 -p tcp -m tcp --sport 27500 -j SNAT --to-source 116.202.163.214
-A POSTROUTING -s 192.168.122.233/32 -p tcp -m tcp --sport 27015 -j SNAT --to-source 116.202.163.214
-A POSTROUTING -s 192.168.122.233/32 -p udp -m udp --sport 27015 -j SNAT --to-source 116.202.163.214
-A POSTROUTING -s 192.168.122.233/32 -p udp -m udp --sport 27500 -j SNAT --to-source 116.202.163.214
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535
-A LIBVIRT_PRT -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
COMMIT
# Completed on Fri Apr 3 21:34:51 2020
# Generated by iptables-save v1.8.4 on Fri Apr 3 21:34:51 2020
*filter
:INPUT ACCEPT [173397:141627735]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [164473:257858146]
:LIBVIRT_FWI - [0:0]
:LIBVIRT_FWO - [0:0]
:LIBVIRT_FWX - [0:0]
:LIBVIRT_INP - [0:0]
:LIBVIRT_OUT - [0:0]
-A INPUT -j LIBVIRT_INP
-A FORWARD -j LIBVIRT_FWX
-A FORWARD -j LIBVIRT_FWI
-A FORWARD -j LIBVIRT_FWO
-A FORWARD -d 192.168.122.233/32 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 27500 -j ACCEPT
-A FORWARD -d 192.168.122.233/32 -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport 27015 -j ACCEPT
-A FORWARD -d 192.168.122.233/32 -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp --dport 27015 -j ACCEPT
-A FORWARD -d 192.168.122.233/32 -p udp -m state --state NEW,RELATED,ESTABLISHED -m udp --dport 27500 -j ACCEPT
-A OUTPUT -j LIBVIRT_OUT
-A LIBVIRT_FWI -d 192.168.122.0/24 -o virbr0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWO -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT
-A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT
COMMIT
# Completed on Fri Apr 3 21:34:51 2020
有人能看出哪里不对劲吗?请注意,大多数规则都是由 libvirtd 生成的,我不确定它和我的规则之间是否存在任何不正常的交互,或者如果我使用 libvirtd NAT 设置,我是否应该以完全不同的方式执行此操作。如果我需要添加其他信息,请告诉我。任何想法都非常欢迎,我已经花了几个小时试图解决这个问题,提前谢谢!
答案1
这里的问题来自于以下链:
-A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable
它们被添加libvirtd根据libvirt中的网络配置,如果转发模式设置为nat
。
一种可能的解决方案是将模式更改为open
。但是,请小心,因为您必须通过以下命令手动添加转发规则:
virsh net-edit default
并设置如下内容:
<network>
<name>default</name>
<uuid>......</uuid>
<forward mode='open'/>
[...]
</network>