☰

IP 路由不工作

tag-icon • tag-icon iptables routing gentoo bridge
IP 路由不工作

我为我的虚拟机配置了网桥。 VM 可以 ping 通主机，但无法 ping 通互联网上的任何内容。我的配置：

# ip route
default via 192.168.1.100 dev wlp3s0 
192.168.1.0/24 dev wlp3s0  proto kernel  scope link  src 192.168.1.106  metric 600 
192.168.10.0/24 dev br0  proto kernel  scope link  src 192.168.10.1

桥

# brctl show br0
bridge name     bridge id               STP enabled     interfaces
br0             8000.7a19fd532c51       no              tap0

IF配置

# ifconfig
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.10.1  netmask 255.255.255.0  broadcast 192.168.10.255
        inet6 fe80::7819:fdff:fe53:2c51  prefixlen 64  scopeid 0x20<link>
        ether 7a:19:fd:53:2c:51  txqueuelen 1000  (Ethernet)
        RX packets 1206  bytes 110944 (108.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 296  bytes 28842 (28.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
enp2s0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether 44:a8:42:ea:5e:fb  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 0  (Local Loopback)
        RX packets 1348  bytes 249670 (243.8 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1348  bytes 249670 (243.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
tap0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether fe:3f:76:37:c2:8a  txqueuelen 500 (Ethernet)
        RX packets 547  bytes 57652 (56.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 229  bytes 21306 (20.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
wlp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.1.106  netmask 255.255.255.0  broadcast 192.168.1.255
        inet6 fe80::5ee0:c5ff:fe04:ec  prefixlen 64  scopeid 0x20<link>
        ether 5c:e0:c5:04:00:ec  txqueuelen 1000  (Ethernet)
        RX packets 5061  bytes 3500576 (3.3 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 4400  bytes 684177 (668.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

IP表

# Generated by iptables-save v1.4.21 on Wed Jan 20 03:24:28 2016
*nat
:PREROUTING ACCEPT [6064:511451]
:INPUT ACCEPT [12:3105]
:OUTPUT ACCEPT [2082:136342]
:POSTROUTING ACCEPT [771:53334]
-A POSTROUTING -o wlp3s0 -j MASQUERADE
COMMIT
# Completed on Wed Jan 20 03:24:28 2016
# Generated by iptables-save v1.4.21 on Wed Jan 20 03:24:28 2016
*mangle
:PREROUTING ACCEPT [25489:10605237]
:INPUT ACCEPT [18617:10028011]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [19284:2260048]
:POSTROUTING ACCEPT [19284:2260048]
COMMIT
# Completed on Wed Jan 20 04:20:44 2016
# Generated by iptables-save v1.4.21 on Wed Jan 20 04:20:44 2016
*filter
:INPUT ACCEPT [28:3026]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [22:1683]
-A FORWARD -i br0 -o wlp3s0 -j ACCEPT
-A FORWARD -i wlp3s0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Jan 20 04:20:44 2016

IP转发：

# cat /proc/sys/net/ipv4/ip_forward
1

br0 上的 TCPDUMP

# tcpdump -i br0
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on br0, link-type EN10MB (Ethernet), capture size 262144 bytes
03:28:56.847387 IP wordpress.dev > google.pl: ICMP echo request, id 1630, seq 2616, length 64
03:28:57.855523 IP wordpress.dev > google.pl: ICMP echo request, id 1630, seq 2617, length 64

wlp3s0 上的 TCPDUMP - 没有来自 br0 的数据包

更新

我通过启用 systemct enable systemd-networkd 和 systemct enable iptables 来创建我的桥。当我“手动”创建桥梁时，一切正常。

/etc/systemd/network/LocalBridge.netdev

[NetDev]
Name=br0
Kind=bridge

/etc/systemd/network/LocalBridge.network

[Match]
Name=br0

[Network]
Address=192.168.10.1/24

/etc/systemd/system/iptables.service.d/10iptables.conf

[Service]
Environment="IPTABLES_INIT=/var/lib/iptables/init-IPv4.rules"
Environment="IP6TABLES_INIT=/var/lib/iptables/init-IPv6.rules"
Environment="COUNTERS=yes"

/var/lib/iptables/init-IPv4.rules 与上面的“IP TABLES”部分相同。未使用 /var/lib/iptables/init-IPv6.rules

有什么想法吗？或者如何使用 systemd 在系统启动时正确配置初始桥？

答案1

您的过滤表在 FORWARD 中缺少一些重要的行。

-A FORWARD -i wlp3s0 -o br0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i br0 -o wlp3s0 -j ACCEPT

仅仅因为您在内核中打开了网桥和 IP 转发，并不意味着流量会神奇地四处移动并进行 NAT。 iptables 需要知道如何处理流量。

我会先添加这些行，然后如果您仍然遇到问题，请进一步排除故障。

答案2

我认为 systemd-networkd 只是在启动时创建接口的东西，但它看起来不仅仅是这样。它有自己的路由解决方案，不应该与我管理无线网络所需的 NetworkManager 一起使用。 Systemd-networkd 专为静态连接到网络的服务器或计算机而设计。

现在我决定不使用 systemd-networkd。我更好的解决方案是在 NetworkManager 中创建桥以自动创建。

问题解决了。

相关内容