Linux服务器忽略网关中的数据包
Linux服务器忽略网关中的数据包
提问于 2022-01-29 14:56:19
我有一个Proxmox服务器，它能够向本地网络上的主机发送和接收数据包，但不会从网关处理数据包。这会导致互联网流量失败，所以我无法运行易于更新的软件包。所有协议似乎都受到影响。
运行在服务器上的VMs可以很好地访问网关。
My /etc/network/interfaces文件包含：
auto lo
iface lo inet loopback
iface enp10s0 inet manual
auto vmbr0
iface vmbr0 inet static
address 10.0.1.200/24
gateway 10.0.1.1
bridge_ports enp10s0
bridge_stp off
bridge_fd 0
auto wlp7s0
iface wlp7s0 inet static
hostapd /etc/hostapd/hostapd.conf
address 10.0.2.1
netmask 255.255.255.0
auto vmbr1
iface vmbr1 inet static
address 10.1.2.1
netmask 255.255.255.0
bridge_ports none
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.1.2.0/24' -o wlp7s0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.1.2.0/24' -o wlp7s0 -j MASQUERADEwlp7s0和vmbr1允许VM访问不应该访问普通网络/internet的无线IOT设备。
我的航路表：
$ ip route
default via 10.0.1.200 dev vmbr0 metric 100
10.0.1.0/24 dev vmbr0 proto kernel scope link src 10.0.1.200
10.0.2.0/24 dev wlp7s0 proto kernel scope link src 10.0.2.1
10.1.2.0/24 dev vmbr1 proto kernel scope link src 10.1.2.1阅读了一段时间后，我尝试更改rp_filter，但将值从2更改为0无助于此。默认设置(删除VM接口)：
$ sysctl -a | grep \\.rp_filter
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.enp10s0.rp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.vmbr0.rp_filter = 0
net.ipv4.conf.vmbr1.rp_filter = 0
net.ipv4.conf.wlp7s0.rp_filter = 0设置了ip_forward：
$ cat /proc/sys/net/ipv4/ip_forward
1我已经通过tcpdump验证，当我尝试从服务器到网关，或者从服务器到网关时，数据包是从网关接收的。此示例使用ping：
# tcpdump -n -i vmbr0 host 10.0.1.1 and icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vmbr0, link-type EN10MB (Ethernet), capture size 262144 bytes
22:42:37.136341 IP 10.0.1.200 > 10.0.1.1: ICMP echo request, id 22073, seq 1, length 64
22:42:37.136478 IP 10.0.1.1 > 10.0.1.200: ICMP echo reply, id 22073, seq 1, length 64
22:42:38.142240 IP 10.0.1.200 > 10.0.1.1: ICMP echo request, id 22073, seq 2, length 64
22:42:38.142429 IP 10.0.1.1 > 10.0.1.200: ICMP echo reply, id 22073, seq 2, length 64ping -v的输出是空的：
$ ping -v 10.0.1.1
PING 10.0.1.1 (10.0.1.1) 56(84) bytes of data.
^C
--- 10.0.1.1 ping statistics ---
22 packets transmitted, 0 received, 100% packet loss, time 511msip表中唯一的条目是NAT：
# iptables-save -c
# Generated by iptables-save v1.8.2 on Sat Jan 29 22:45:46 2022
*raw
:PREROUTING ACCEPT [1828405583:1847667077335]
:OUTPUT ACCEPT [10762322:981310704]
COMMIT
# Completed on Sat Jan 29 22:45:46 2022
# Generated by iptables-save v1.8.2 on Sat Jan 29 22:45:46 2022
*filter
:INPUT ACCEPT [10597558:1212589593]
:FORWARD ACCEPT [1782904005:1841102268241]
:OUTPUT ACCEPT [10762351:981313827]
COMMIT
# Completed on Sat Jan 29 22:45:46 2022
# Generated by iptables-save v1.8.2 on Sat Jan 29 22:45:46 2022
*nat
:PREROUTING ACCEPT [29808561:4940456833]
:INPUT ACCEPT [2456738:231340403]
:OUTPUT ACCEPT [1168080:75403202]
:POSTROUTING ACCEPT [2829337:181352732]
[190:11400] -A POSTROUTING -s 10.1.2.0/24 -o wlp7s0 -j MASQUERADE
COMMIT
# Completed on Sat Jan 29 22:45:46 2022回答 1
Server Fault用户
回答已采纳
发布于 2022-01-30 02:25:20
感谢尼基塔·基普里亚诺夫( Nikita Kipriyanov )为我指明了正确的方向，我解决了这个问题。
跑步时
tcpdump -en host 10.0.1.1我注意到ping响应出现在系统上不存在的接口上：
# tcpdump -en host 10.0.1.1
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp10s0, link-type EN10MB (Ethernet), capture size 262144 bytes
10:01:49.233889 24:4b:fe:4a:11:96 > 02:29:9a:f3:0a:00, ethertype IPv4 (0x0800), length 98: 10.0.1.200 > 10.0.1.1: ICMP echo request, id 5544, seq 1, length 64
10:01:49.234053 02:29:9a:f3:0a:00 > 00:26:18:e2:68:f9, ethertype IPv4 (0x0800), length 98: 10.0.1.1 > 10.0.1.200: ICMP echo reply, id 5544, seq 1, length 64这意味着系统在tcpdump下看到具有正确IP地址的传入数据包，但正确地忽略它们，以便基于MAC地址进行处理。
我检查了网关路由器上的配置，并注意到它有一个固定的ARP条目，地址很糟糕(可能是旧配置)。更改网关设置为enp10s0's MAC地址解决了问题。
页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://serverfault.com/questions/1091568
复制相关文章
相似问题
腾讯云开发者
