다음 토폴로지가 있습니다.
위에 나열된 iptables 규칙을 따릅니다.https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
이것이 출력이다iptables -L -v
Chain INPUT (policy ACCEPT 1236 packets, 145K bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 407 packets, 25288 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- any any anywhere anywhere ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- eth0 eth1 192.168.0.0/24 anywhere ctstate NEW
0 0 ACCEPT all -- tun0 eth1 10.8.0.0/24 anywhere ctstate NEW
0 0 ACCEPT all -- tun0 eth0 10.8.0.0/24 192.168.0.0/24 ctstate NEW
Chain OUTPUT (policy ACCEPT 1691 packets, 230K bytes)
pkts bytes target prot opt in out source destination
Chain LOGGING (0 references)
pkts bytes target prot opt in out source destination
이것은의 출력입니다구성된 경우:
eth0 Link encap:Ethernet HWaddr 00:90:e8:45:96:79
inet addr:192.168.0.10 Bcast:192.168.0.255 Mask:255.255.255.0
inet6 addr: fe80::290:e8ff:fe45:9679/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:47251 errors:0 dropped:341 overruns:0 frame:0
TX packets:35463 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6700218 (6.3 MiB) TX bytes:6348389 (6.0 MiB)
eth1 Link encap:Ethernet HWaddr 00:90:e8:45:96:7a
inet addr:213.179.150.110 Bcast:213.179.150.111 Mask:255.255.255.248
inet6 addr: fe80::290:e8ff:fe45:967a/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:431735 errors:0 dropped:1629 overruns:0 frame:0
TX packets:515499 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:55214512 (52.6 MiB) TX bytes:93401691 (89.0 MiB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:124 errors:0 dropped:0 overruns:0 frame:0
TX packets:124 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:12872 (12.5 KiB) TX bytes:12872 (12.5 KiB)
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1 P-t-P:10.8.0.1 Mask:255.255.255.0
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:105 errors:0 dropped:0 overruns:0 frame:0
TX packets:239 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:8100 (7.9 KiB) TX bytes:18522 (18.0 KiB)
경로-n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 213.179.150.105 0.0.0.0 UG 0 0 0 eth1
10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
213.179.150.104 0.0.0.0 255.255.255.248 U 0 0 0 eth1
클라이언트가 실행 중이고 클라이언트의 tun 인터페이스를 ping할 수 있으므로 터널이 설정된 것 같습니다.
PING 10.8.0.2 (10.8.0.2) 56(84) bytes of data.
64 bytes from 10.8.0.2: icmp_req=8 ttl=64 time=704 ms
64 bytes from 10.8.0.2: icmp_req=9 ttl=64 time=824 ms
64 bytes from 10.8.0.2: icmp_req=10 ttl=64 time=704 ms
64 bytes from 10.8.0.2: icmp_req=11 ttl=64 time=723 ms
64 bytes from 10.8.0.2: icmp_req=12 ttl=64 time=725 ms
64 bytes from 10.8.0.2: icmp_req=13 ttl=64 time=665 ms
하지만 eth0(192.168.0.10)에서 "10.8.0.2"를 ping할 수 없습니다.
PING 10.8.0.2 (10.8.0.2) from 192.168.0.10 eth0: 56(84) bytes of data.
From 192.168.0.10 icmp_seq=1 Destination Host Unreachable
From 192.168.0.10 icmp_seq=2 Destination Host Unreachable
From 192.168.0.10 icmp_seq=3 Destination Host Unreachable
내 생각에는 기본 게이트웨이가 eth0과 동일한 서브넷에 있지 않기 때문에 ping이 실패하는 것 같습니다. 하지만 eth0의 트래픽을 tun0으로 전달하면 안 되나요? 내가 여기서 무엇을 놓치고 있는 걸까요?
eth0에서 tun0으로 전달 규칙을 추가해 보았습니다. Chain FORWARD(정책 ACCEPT 0 패킷, 0바이트)
pkts bytes target prot opt in out source destination
0 0 all -- eth0 tun0 anywhere anywhere
그러나 아무 소용이 없습니다!
나는 다음을 언급하는 것을 잊었습니다.
sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
이것은 내 NAT 테이블입니다.
Chain PREROUTING (policy ACCEPT 1 packets, 28 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 1 packets, 28 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any tun0 anywhere 10.8.0.0/24
0 0 MASQUERADE all -- any eth1 10.8.0.0/24 anywhere
0 0 MASQUERADE all -- any tun0 192.168.0.0/24 anywhere