我有一个带有一个公共 IP 的 VPS，64.x.x.x该 IP 已分配给enp1s0。
我的目标是让 LXC 容器在此 VPS 上运行，与主机和 WAN 的连接Container > lxcbr0 > enp1s0 > WAN
。这意味着流量从我遵循 LXC 中的标准程序路由，该程序创建了一个网桥lxcbr0和一个连接到网桥的 veth 设备。从容器中我可以 ping 主机以及主机的公共 IP。但我无法访问 WAN！据我所知，我在配置中做的所有事情都是正确的，但显然我没有。
主持人：
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether xx:xx:xx:xx:xx:xx brd ff:ff:ff:ff:ff:ff
inet 64.x.x.x/32 brd 64.x.x.250 scope global dynamic enp1s0
valid_lft 84329sec preferred_lft 84329sec
inet6 fe80::9400:1ff:fe0e:33dc/64 scope link
valid_lft forever preferred_lft forever
3: lxcbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 00:16:3e:00:00:00 brd ff:ff:ff:ff:ff:ff
inet 10.0.3.1/24 brd 10.0.3.255 scope global lxcbr0
valid_lft forever preferred_lft forever
inet6 fe80::216:3eff:fe00:0/64 scope link
valid_lft forever preferred_lft forever
4: vethf6wBpH@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master lxcbr0 state UP group default qlen 1000
link/ether fe:1f:bc:2d:41:3c brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::fc1f:bcff:fe2d:413c/64 scope link
valid_lft forever preferred_lft forever
# iptables -L -t nat -v
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
2 124 MASQUERADE all -- any any 10.0.3.0/24 !10.0.3.0/24
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 17.x.x.1 0.0.0.0 UG 0 0 0 enp1s0
10.0.3.0 0.0.0.0 255.255.255.0 U 0 0 0 lxcbr0
17.x.x.1 0.0.0.0 255.255.255.255 UH 0 0 0 enp1s0
# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
# iptables -L FORWARD
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
容器：
# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 4e:53:3c:48:56:ad brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 10.0.3.25/24 brd 10.0.3.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::4c53:3cff:fe48:56ad/64 scope link
valid_lft forever preferred_lft forever
# route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.0.3.1 0.0.0.0 UG 0 0 0 eth0
10.0.3.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
我查看了tcpdump -i lxcbr0 icmp主机。Ping要求但我没看到任何回复.tcpdump -i enp1s0 icmp当我从容器 ping WAN 时没有显示任何活动。
感谢对此的所有想法！