![自定义路由表伪装不起作用](https://linux22.com/image/793204/%E8%87%AA%E5%AE%9A%E4%B9%89%E8%B7%AF%E7%94%B1%E8%A1%A8%E4%BC%AA%E8%A3%85%E4%B8%8D%E8%B5%B7%E4%BD%9C%E7%94%A8.png)
在 Ubuntu 22.04 服务器中,自定义路由表的伪装/NAT 不起作用(对于 VPN 客户端)。但是,当我不将流量路由到自定义表(并让其保留在主表中)时,它可以工作。
FORWARD 链的默认策略设置为 ACCEPT。
编辑: 当前配置:
# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
# iptables -t filter -L FORWARD
Chain FORWARD (policy ACCEPT)
# iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere
VPN子网是10.250.51.0/24。
# ip rule add from 10.250.51.0/24 lookup table main
# ip rule
0: from all lookup local
32754: from 10.250.51.0/24 lookup main
32766: from all lookup main
32767: from all lookup default
它工作正常。
但是当我更改为以下内容时:
# ip rule del 10.250.51.0/24 lookup table main
# ip rule add from 10.250.51.0/24 lookup table 1000
# ip route add default via eth0 table 1000
# ip rule
0: from all lookup local
32761: from 10.250.51.0/24 lookup 1000
32766: from all lookup main
32767: from all lookup default
# ip route show table 1000
default dev eth0 scope link
这是行不通的。