希望您能帮助我解决我的问题。我正在构建一个供个人使用的网络,但发现了一些问题,我没有网络经验。我将使用附图进行解释:
问题: 我无法使用 Wireguard 和基于 Raspberry 的 VPN 路由器访问本地网络上的设备,其中包括本地网络内的服务(摄像头、个人网络服务器、数据库)。
目标:
从远程服务器和客户端访问设备及其服务。我一直在搜索和更改配置,但都不起作用。有时从 10.6.0.1,我可以访问 IP 172.16.0.1,仅此而已。
基础设施描述:
Wireguard 服务器(a)位于 Oracle 实例上,如图所示,它具有以下特点:
公网 IP 158.43.56.3(IP 示例)
通过 ens3 接口的内部 IP 10.0.0.183
通过 wg0 接口的 Wireguard 服务器 IP 10.6.0.1
Wireguard 端口 51820
通过 pivpn 安装 Wireward
在本地网络中,调制解调器提供 192.168.100.XX 网络(wifi 或以太网)
在提供调制解调器的网络中,有一台搭载 Ubuntu 20.04 的 Raspberry Pi 4 (b) 作为有线路由器,具有以下特点:
- 通过 eth0 接口的本地 IP 192.168.100.182
- IP Wireguard 作为对等体 10.6.0.5 通过 wg0 接口
- 接口 eth1(USB 以太网适配器)上的本地子网 IP 172.16.0.1
- 接口 eth1 上的 DHCP 服务器
交换机连接到 eth1 接口
不同的设备(服务器、IP 摄像机、DVR)连接到交换机,DHCP 为它们提供 172.16.0.XX 格式的 IP,范围介于 172.16.0.10 和 172.16.0.200 之间(例如 ba、bb、bc)
连接到 VPN 的其他网络上的设备(例如 10.6.0.3)
我当前的设置如下(正如您所见,我一直在尝试):
Wireguard 服务器:
[Interface]
PrivateKey = yL743NyU0M1z7guWxA9kekW7DAOXzO8EDfkAaG+jSGQ=
Address = 10.6.0.1/24
MTU = 1420
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT;
PostUp = iptables -A FORWARD -o wg0 -j ACCEPT;
PostUp = iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostUp = sysctl -q -w net.ipv4.ip_forward=1
#PostUp = route del -net 172.16.0.0/24 dev wg0
#iptables -t nat -A PREROUTING -d 172.16.0.0/24 -j DNAT --to-destination 10.6.0.1
#PostUp = iptables -t nat -A PREROUTING -d 172.16.0.0/24 -j DNAT --to-destination 10.6.0.1
#PostUp = iptables -t filter -A FORWARD -s 10.6.0.0/24 -d 172.16.0.0/24 -j ACCEPT
#PostUp = iptables -t nat -A POSTROUTING -s 10.6.0.0/24 -d 172.16.0.0/24 -j MASQUERADE
PostDown = sysctl -q -w net.ipv4.ip_forward=0
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT;
PostDown = iptables -D FORWARD -o wg0 -j ACCEPT;
PostDown = iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
##PostUp = iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o ens3 -j TCPMSS --clamp-mss-to-pmtu
##PostUp = iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
##PostUp = iptables -A FORWARD -i ens3 -j ACCEPT
##PostUp = sysctl -q -w net.ipv4.ip_forward=1
##PostDown = sysctl -q -w net.ipv4.ip_forward=0
##PostDown = iptables -D FORWARD -i ens3 -j ACCEPT
##PostDown = iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE
##PostDown = iptables -t mangle -D POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o ens3 -j TCPMSS --clamp-mss-to-pmtu
### begin huawei-device ###
[Peer]
PublicKey = WaP0UPdQWKE0uy3F750cOEeLmLkikdtw0XAw/eGcrFI=
PresharedKey = fMqhe7jxsC9ukEhymPOXCogWMWo82TzIx6Veg+8lslc=
AllowedIPs = 10.6.0.2/24
### end huawei-device ###
### begin mac ###
[Peer]
PublicKey = ZCAV6xDLswBuqYWs38JYwvx2fwvmR1uEFRIAD760pxI=
PresharedKey = JdtJFaWUG2ECAfLX05WCyz/rrcs6VWFkVgnvEqnqhHo=
AllowedIPs = 10.6.0.3/32
AllowedIPs = 172.16.0.10/32
PersistentKeepalive = 15
### end mac ###
### begin rasprouter ###
[Peer]
PublicKey = r56sl4HNKHFkz8/r+aGqOHClMuXUt9lGE34gpktP5Q4=
PresharedKey = ukAcmfZUaMuVq53ruIYWmADwDYq0W+0KNjgAQ/ojqH4=
AllowedIPs = 10.6.0.5/32
AllowedIPs = 172.16.0.10/32
PersistentKeepalive = 15
### end rasprouter ###
Raspberry 有线路由器
[Interface]
PrivateKey = SJXlysVGPfvodzG98EbwrZNvuPqo4sATLKaTB3Kqe20=
Address = 10.6.0.5/24
DNS = 1.1.1.1
###PostUp = sysctl -w net.ipv4.ip_forward=1
###PostUp = iptables -A FORWARD -i wg0 -j ACCEPT
###PostUp = iptables -A FORWARD -o wg0 -j ACCEPT
###PostUp = iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
###PostUp = iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE
###PostDown = sysctl -w net.ipv4.ip_forward=0
###PostDown = iptables -D FORWARD -i wg0 -j ACCEPT
###PostDown = iptables -D FORWARD -o wg0 -j ACCEPT
###PostDown = iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
###PostDown = iptables -t nat -D POSTROUTING -o eth1 -j MASQUERADE
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth1 -j MASQUERADE; iptables -A FORWARD -o wg0 -j ACCEPT
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth1 -j MASQUERADE; iptables -D FORWARD -o wg0 -j ACCEPT
[Peer]
PublicKey = mCK/FAHGtXFBNLS5WpHhSPEBvZRwY09HohD1YkNCNSI=
PresharedKey = ukAcmfZUaMuVq53ruIYWmADwDYq0W+0KNjgAQ/ojqH4=
Endpoint = 158.43.56.3:51820
#AllowedIPs = 0.0.0.0/0, ::/1
AllowedIPs = 172.16.0.10/32
AllowedIPs = 10.6.0.0/24
PersistentKeepalive = 25
另一个 LAN 上的附加客户端(图中的 Mac),距离较远
[Interface]
PrivateKey = YH+51/x6MoErmogdOs0UUzIF6W6Oz56t7BhhW9dFvXM=
Address = 10.6.0.3/24
DNS = 1.1.1.1
[Peer]
PublicKey = mCK/FAHGtXFBNLS5WpHhSPEBvZRwY09HohD1YkNCNSI=
PresharedKey = JdtJFaWUG2ECAfLX05WCyz/rrcs6VWFkVgnvEqnqhHo=
Endpoint = 158.43.56.3:51820
### AllowedIPs = 0.0.0.0/0, ::0/0
AllowedIPs = 172.16.0.10/32
AllowedIPs = 10.6.0.0/24
PersistentKeepalive = 25
接下来我分享一下基础设施的现状
从服务器Pastebin 服务器状态
来自 Raspberry 有线路由器Pastebin Raspberry 状态
测试
从 a 到 b 有效
ubuntu@instance-20210915-wireguard:~$ ping 10.6.0.5
PING 10.6.0.5 (10.6.0.5) 56(84) bytes of data.
64 bytes from 10.6.0.5: icmp_seq=1 ttl=64 time=75.1 ms
64 bytes from 10.6.0.5: icmp_seq=2 ttl=64 time=74.8 ms
^C
--- 10.6.0.5 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1001ms
rtt min/avg/max/mdev = 74.772/74.920/75.069/0.148 ms
从 a 到 ba 不起作用
ubuntu@instance-20210915-wireguard:~$ ping 172.16.0.1
PING 172.16.0.1 (172.16.0.1) 56(84) bytes of data.
^C
--- 172.16.0.1 ping statistics ---
4 packets transmitted, 0 received, 100% packet loss, time 3075ms
从 a 到 c 的作品
ubuntu@instance-20210915-wireguard:~$ ping 10.6.0.3
PING 10.6.0.3 (10.6.0.3) 56(84) bytes of data.
64 bytes from 10.6.0.3: icmp_seq=1 ttl=64 time=78.5 ms
64 bytes from 10.6.0.3: icmp_seq=2 ttl=64 time=119 ms
64 bytes from 10.6.0.3: icmp_seq=3 ttl=64 time=77.9 ms
^C
--- 10.6.0.3 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 77.888/91.816/119.047/19.256 ms
从 b 到 a 的作品
ubuntu@ubuntu:~$ ping 10.6.0.1
PING 10.6.0.1 (10.6.0.1) 56(84) bytes of data.
64 bytes from 10.6.0.1: icmp_seq=1 ttl=64 time=74.3 ms
64 bytes from 10.6.0.1: icmp_seq=2 ttl=64 time=74.5 ms
^C
--- 10.6.0.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 74.334/74.396/74.459/0.062 ms
从 c 到 a 作品
user@MacBook-Pro-user Downloads % ping 10.6.0.1
PING 10.6.0.1 (10.6.0.1): 56 data bytes
64 bytes from 10.6.0.1: icmp_seq=0 ttl=64 time=80.921 ms
64 bytes from 10.6.0.1: icmp_seq=1 ttl=64 time=78.086 ms
64 bytes from 10.6.0.1: icmp_seq=2 ttl=64 time=91.625 ms
^C
--- 10.6.0.1 ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 78.086/83.544/91.625/5.830 ms
从 b 到 c 不起作用
ubuntu@ubuntu:~$ ping 10.6.0.3
PING 10.6.0.3 (10.6.0.3) 56(84) bytes of data.
From 10.6.0.1 icmp_seq=1 Destination Host Prohibited
From 10.6.0.1 icmp_seq=2 Destination Host Prohibited
^C
--- 10.6.0.3 ping statistics ---
2 packets transmitted, 0 received, +2 errors, 100% packet loss, time 1002ms
从 c 到 b 不起作用
user@MacBook-Pro-user Downloads % ping 10.6.0.5
PING 10.6.0.5 (10.6.0.5): 56 data bytes
92 bytes from 10.6.0.1: Dest Unreachable, Bad Code: 10
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 5400 25f3 0 0000 3f 01 41a3 10.6.0.3 10.6.0.5
Request timeout for icmp_seq 0
92 bytes from 10.6.0.1: Dest Unreachable, Bad Code: 10
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 5400 a5cc 0 0000 3f 01 c1c9 10.6.0.3 10.6.0.5
Request timeout for icmp_seq 1
^C
--- 10.6.0.5 ping statistics ---
3 packets transmitted, 0 packets received, 100.0% packet loss
从 b 到 ba 有效!!
ubuntu@ubuntu:~$ ping 172.16.0.10
PING 172.16.0.10 (172.16.0.10) 56(84) bytes of data.
64 bytes from 172.16.0.10: icmp_seq=1 ttl=64 time=74.6 ms
64 bytes from 172.16.0.10: icmp_seq=2 ttl=64 time=74.5 ms
^C
--- 172.16.0.10 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1002ms
rtt min/avg/max/mdev = 74.455/74.541/74.627/0.086 ms
嗯,目标是至少能够从 IP 10.6.0.1 到达 172.16.0.XX。
使用 OpenVPN 我可以毫无问题地定义基础设施,但带宽很糟糕。
我很不擅长处理网络基础设施,抱歉。
下一步是什么?
使用 Nginx 来使用服务并部署 Apache Airflow 以处理我在局域网中生成的信息。
提前致谢
编辑:我之前发过错误的网站