如何在不同子网上的2个VLAN之间路由stream量

我有以下问题：我有一个接口eth0 with IP 172.20.51.61/24

我在同一台机器上configuration了2个VLAN：

 eth0.120 : 172.20.52.61/24 eth0.200 : 172.20.54.61/24

我也有一个DELL开关

 trunk port 2 and access ports 6 VLAN 120 and access port 10 VLAN 200.

这台机器上有一个DHCP服务器，所以当我在两个VLAN上连接两台笔记本电脑时，我会得到相应的IP地址：

 PC1 172.20.54.234 PC2 172.20.52.114

问题是我无法从一台PC1 ping到PC2。

那么如何在不同的子网上启用PC1或PC2的pingfunction。

我的iptable规则如下：

 Chain INPUT (policy ACCEPT 81 packets, 5386 bytes) pkts bytes target prot opt in out source destination 178 19945 delegate_input all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 delegate_forward all -- * * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 626 211K delegate_output all -- * * 0.0.0.0/0 0.0.0.0/0 Chain delegate_forward (1 references) pkts bytes target prot opt in out source destination 0 0 forwarding_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for forwarding */ 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 zone_lan_forward all -- eth0 * 0.0.0.0/0 0.0.0.0/0 0 0 zone_wan_forward all -- eth1 * 0.0.0.0/0 0.0.0.0/0 0 0 reject all -- * * 0.0.0.0/0 0.0.0.0/0 Chain delegate_input (1 references) pkts bytes target prot opt in out source destination 23 2206 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 155 17739 input_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for input */ 74 12353 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 3 180 syn_flood tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 0 0 zone_lan_input all -- eth0 * 0.0.0.0/0 0.0.0.0/0 0 0 zone_wan_input all -- eth1 * 0.0.0.0/0 0.0.0.0/0 Chain delegate_output (1 references) pkts bytes target prot opt in out source destination 23 2206 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0 603 209K output_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for output */ 601 208K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 2 264 zone_lan_output all -- * eth0 0.0.0.0/0 0.0.0.0/0 0 0 zone_wan_output all -- * eth1 0.0.0.0/0 0.0.0.0/0 Chain syn_flood (1 references) pkts bytes target prot opt in out source destination 3 180 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 limit: avg 25/sec burst 50 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 Chain zone_lan_dest_ACCEPT (2 references) pkts bytes target prot opt in out source destination 2 264 ACCEPT all -- * eth0 0.0.0.0/0 0.0.0.0/0 Chain zone_lan_forward (1 references) pkts bytes target prot opt in out source destination 0 0 forwarding_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for forwarding */ 0 0 zone_wan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 /* forwarding lan -> wan */ 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port forwards */ 0 0 zone_lan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain zone_lan_input (1 references) pkts bytes target prot opt in out source destination 0 0 input_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for input */ 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port redirections */ 0 0 zone_lan_src_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain zone_lan_output (1 references) pkts bytes target prot opt in out source destination 2 264 output_lan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for output */ 2 264 zone_lan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain zone_lan_src_ACCEPT (1 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- eth0 * 0.0.0.0/0 0.0.0.0/0 Chain zone_wan_dest_ACCEPT (2 references) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * eth1 0.0.0.0/0 0.0.0.0/0 Chain zone_wan_dest_REJECT (1 references) pkts bytes target prot opt in out source destination 0 0 reject all -- * eth1 0.0.0.0/0 0.0.0.0/0 Chain zone_wan_forward (1 references) pkts bytes target prot opt in out source destination 0 0 forwarding_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for forwarding */ 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port forwards */ 0 0 zone_wan_dest_REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain zone_wan_input (1 references) pkts bytes target prot opt in out source destination 0 0 input_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for input */ 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:68 /* Allow-DHCP-Renew */ 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 icmptype 8 /* Allow-Ping */ 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate DNAT /* Accept port redirections */ 0 0 zone_wan_src_REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain zone_wan_output (1 references) pkts bytes target prot opt in out source destination 0 0 output_wan_rule all -- * * 0.0.0.0/0 0.0.0.0/0 /* user chain for output */ 0 0 zone_wan_dest_ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 Chain zone_wan_src_REJECT (1 references) pkts bytes target prot opt in out source destination 0 0 reject all -- eth1 * 0.0.0.0/0 0.0.0.0/0

您需要为笔记本电脑中的其他networking添加IP路由。

如果172.20.51.61机器也是networking中的默认路由器，这是最简单的。

在这种情况下，你需要以下的东西：

确保在路由器机器中启用IP路由。
添加防火墙规则，以便允许两个VLANnetworking之间的通信。
确保两台客户机都有该路由器作为默认网关（客户机networking中接口的IP地址）。

路由器似乎已经安装了某种防火墙pipe理软件，您应该检查该configuration，而不是直接IPTables操纵。