☰

本地主机上没有 ping 响应

tag-icon • tag-icon networking
本地主机上没有 ping 响应

我正在尝试 ping 通过 ssh 连接的远程机器上的环回，但是我没有收到任何答复。

$ ping localhost
PING localhost (127.0.0.1) 56(84) bytes of data.
^C
--- localhost ping statistics ---
5 packets transmitted, 0 received, 100% packet loss, time 100ms

接下来，我运行了一些诊断程序来查看出了什么问题，但在我外行的眼睛看来一切都很正常。

$ cat /etc/hosts
# Your system has configured 'manage_etc_hosts' as True.
# As a result, if you wish for changes to this file to persist
# then you will need to either
# a.) make changes to the master file in /etc/cloud/templates/hosts.debian.tmpl
# b.) change or remove the value of 'manage_etc_hosts' in
#     /etc/cloud/cloud.cfg or cloud-config from user-data
#
127.0.1.1 <name_of_device>
127.0.0.1 localhost

# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts

$ ifconfig lo
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 52  bytes 4188 (4.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 52  bytes 4188 (4.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

$ sysctl net.ipv4.icmp_echo_ignore_all
net.ipv4.icmp_echo_ignore_all = 0

$ cat /etc/resolv.conf 
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 67.207.67.2
nameserver 67.207.67.3

$ sudo iptables -L 
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

$ uname -a
Linux <name_of_device> 4.19.0-10-cloud-amd64 #1 SMP Debian 4.19.132-1 (2020-07-24) x86_64 GNU/Linux

$ cat /etc/nftables.conf 
# /usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0;

        # Always allow SSH access
        tcp dport 22 accept

        ct state established,related log prefix "DROPPING PACKET: " drop

        ip saddr 192.0.2.192/27 accept
        ip saddr 192.0.2.96/27 accept
        ip saddr 192.0.2.0/24 drop

        ip saddr 198.51.100.69/32 accept
        ip saddr 198.51.100.42/32 log prefix "DROPPING PACKET: " drop
        ip saddr 198.51.100.32/28 accept
        ip saddr 199.51.100.0/24 tcp dport { 80, 443 } accept
        ip saddr 199.51.100.0/24 drop

        ip saddr 203.0.113.0/24 tcp dport { 22, 443, 5432 } log prefix "INVALID TRAFFIC NETWORK: " drop
        ip saddr 203.0.113.0/24 tcp dport 80 accept
    }
}

此外，这台机器无法 ping 通互联网上的任何东西。

$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
^C
--- 8.8.8.8 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 55ms

并且从外部也无法 ping 通它。

$ ping 138.68.93.123
PING 138.68.93.123 (138.68.93.123) 56(84) bytes of data.
64 bytes from 138.68.93.123: icmp_seq=1 ttl=52 time=7.75 ms
^C
--- 138.68.93.123 ping statistics ---
5 packets transmitted, 1 received, 80% packet loss, time 4050ms
rtt min/avg/max/mdev = 7.746/7.746/7.746/0.000 ms

到现在为止我已经没有主意了。任何帮助都将不胜感激！

答案1

原因就在这里 - 规则 ct state [...] 丢弃所有传入数据包，即使它们与对本地主机接口的 ping 相关。您应该重新考虑该规则... 您至少应该允许环回接口上的流量...

相关内容