![Debian 防火墙不会将流量从接口 x 转发到 tun0](https://linux22.com/image/793046/Debian%20%E9%98%B2%E7%81%AB%E5%A2%99%E4%B8%8D%E4%BC%9A%E5%B0%86%E6%B5%81%E9%87%8F%E4%BB%8E%E6%8E%A5%E5%8F%A3%20x%20%E8%BD%AC%E5%8F%91%E5%88%B0%20tun0.png)
我想要一个 debian 系统作为具有 openvpn 流量的路由器,其中接口 x 上的所有流量都应转发到 openvpn 接口 y。
下面的图片展示了我的网络设置,大致可以正常工作: 网络设置Iptables 规则(活动):
#!/bin/bash
iptables -F
iptables -X
iptables -t nat -F
iptables -t nat -X
iptables -t mangle -F
iptables -t mangle -X
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
#iptables -A INPUT -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A INPUT -o ens19 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A INPUT -i tun0 -o ens19 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -t nat -A PREROUTING -i ens19 -j ACCEPT
#iptables -A FORWARD -j ACCEPT
iptables -A FORWARD -i ens19 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o ens19 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -i tun0 -m state --state New,RELATED,ESTABLISHED -j ACCEPT
#iptables -A FORWARD -i ens19 -j ACCEPT
#iptables -t nat -s 192.168.1.0/24 -A POSTROUTING -o tun0 -j MASQUERADE
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
#iptables -t nat -A POSTROUTING -j MASQUERADE
iptables-save | sudo tee /etc/iptables/rules.v4
exit
转发规则:cat /etc/sysctl.conf | grep -v '#'
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv4.conf.all.forwarding = 1
设置处于活动状态,但没有转发流量。
检查过
ping web.de -I ens18 # (Network interface with route to "normal" router.) -> Working
ping web.de -I ens19 # (Network interface with firewall-rule forwarding to tun0.) -> Not working, but getting ip information of "web.de"
ping web.de -I tun0 # (Network interface by openvpn.) -> Working
我的猜测:NAT 有效,但不能将 ens19 转发到 tun0。
我在这里和其他网站上找到并阅读了许多论坛,人们在那里讨论同样的想法。它们似乎对我不起作用。奇怪 :(
iptables-save
*filter
:INPUT ACCEPT [40976:12561334]
:FORWARD ACCEPT [32894:54259570]
:OUTPUT ACCEPT [32983:2879147]
-A INPUT -i tun0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ens19 -o tun0 -j ACCEPT
-A FORWARD -i tun0 -o ens19 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Tue Jan 9 ...
# Generated by iptables-save v1.8.7 on Tue Jan 9 ...
*nat
:PREROUTING ACCEPT [63033:10635529]
:INPUT ACCEPT [6276:710107]
:OUTPUT ACCEPT [1569:103282]
:POSTROUTING ACCEPT [1156:77777]
-A POSTROUTING -o tun0 -j MASQUERADE
COMMIT
我缺少什么才能让流量转发 ens19 -> tun0 正常工作?任何帮助都非常好。谢谢
ip link; ip -4 -br addr; ip route; ip rule