我有一个问题，我不能弄清楚，我试图访问[RPI]networking服务器，但数据包永远不会到达iptables FILTER链
我会试着解释一下：
GW1具有公共地址，并且从端口8080到192.168.69.14:80执行DNAT
S1是用于LAN的openVPN服务器eth0 ，用于VPN的tap0是桥接的
[RPI]在端口80上运行networking服务器
GW2是[RPI]默认网关，没有公共地址
GW1 <-----------------> S1 <-----Open VPN tunnel------> [RPI] <--Default route--> GW2 (192.168.69.1) (192.168.69.22) (192.168.69.14 - tap0) (192.168.30.1) (192.168.30.2 - wlan0)
现在，一切工作正常如果我从S1 ， GW2到达[RPI]的networking服务器或从GW1做一个ping
但是，如果我尝试通过端口8080上的GW1的公共IP访问networking服务器，数据包将达到[RPI] ，但在iptables消失，正如您在这里可以看到的那样， iptables规则在以下打印：
Apr 27 18:13:51 WeatherStorm kernel: [11383.698445] TRACE: raw:PREROUTING:rule:3 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307) Apr 27 18:13:51 WeatherStorm kernel: [11383.874415] TRACE: raw:PREROUTING:policy:4 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307) Apr 27 18:13:51 WeatherStorm kernel: [11384.051167] TRACE: mangle:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307) Apr 27 18:13:51 WeatherStorm kernel: [11384.227423] TRACE: nat:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=275 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215BF0000000001030307) Apr 27 18:13:52 WeatherStorm kernel: [11384.459821] TRACE: raw:PREROUTING:rule:3 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307) Apr 27 18:13:52 WeatherStorm kernel: [11384.635037] TRACE: raw:PREROUTING:policy:4 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307) Apr 27 18:13:52 WeatherStorm kernel: [11384.811610] TRACE: mangle:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307) Apr 27 18:13:52 WeatherStorm kernel: [11384.988901] TRACE: nat:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=22576 DF PROTO=TCP SPT=33137 DPT=80 SEQ=671043022 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B215FE0000000001030307) Apr 27 18:13:54 WeatherStorm kernel: [11386.698855] TRACE: raw:PREROUTING:rule:3 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307) Apr 27 18:13:54 WeatherStorm kernel: [11386.874488] TRACE: raw:PREROUTING:policy:4 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307) Apr 27 18:13:54 WeatherStorm kernel: [11387.050505] TRACE: mangle:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307) Apr 27 18:13:54 WeatherStorm kernel: [11387.228835] TRACE: nat:PREROUTING:policy:1 IN=tap0 OUT= MAC=82:ed:f9:e6:c2:ea:00:0c:42:f5:XX:XX:XX:XX SRC=37.188.XXX.XXX DST=192.168.69.14 LEN=60 TOS=0x00 PREC=0x00 TTL=50 ID=276 DF PROTO=TCP SPT=33136 DPT=80 SEQ=3502183596 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405360402080A01B218AD0000000001030307)
生的：
[root@WeatherStorm tmp]# iptables -L -nv -t raw Chain PREROUTING (policy ACCEPT 5750 packets, 748K bytes) pkts bytes target prot opt in out source destination 27 1620 TRACE tcp -- * * 37.188.XXX.XXX 0.0.0.0/0 270 15120 TRACE icmp -- * * 0.0.0.0/0 0.0.0.0/0 51 3958 TRACE tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 Chain OUTPUT (policy ACCEPT 4768 packets, 911K bytes) pkts bytes target prot opt in out source destination 8 448 TRACE icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 TRACE tcp -- * * 0.0.0.0/0 37.188.XXX.XXX
割碎：
[root@WeatherStorm tmp]# iptables -L -nv -t mangle Chain PREROUTING (policy ACCEPT 4177 packets, 544K bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 3661 packets, 374K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 3498 packets, 674K bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 3498 packets, 674K bytes) pkts bytes target prot opt in out source destination
NAT：
[root@WeatherStorm tmp]# iptables -L -nv -t nat Chain PREROUTING (policy ACCEPT 596 packets, 180K bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 80 packets, 9600 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 59 packets, 4443 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 59 packets, 4443 bytes) pkts bytes target prot opt in out source destination
过滤：
[root@WeatherStorm tmp]# iptables -L -nv -t filter Chain INPUT (policy ACCEPT 23788 packets, 2365K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 23777 packets, 5142K bytes) pkts bytes target prot opt in out source destination
任何想法什么/哪里可能是一个问题？ 如果我尝试从GW2访问它看起来像
Apr 27 18:22:02 WeatherStorm kernel: [11873.756818] TRACE: raw:PREROUTING:policy:4 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11873.850894] TRACE: mangle:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11873.945646] TRACE: nat:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11874.039622] TRACE: mangle:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11874.133002] TRACE: filter:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11874.226404] TRACE: nat:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=34259 DF PROTO=TCP SPT=38739 DPT=80 SEQ=3482087833 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F44A0000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11874.319744] TRACE: raw:PREROUTING:policy:4 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11874.413794] TRACE: mangle:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11874.508565] TRACE: nat:PREROUTING:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307) Apr 27 18:22:02 WeatherStorm kernel: [11874.602511] TRACE: mangle:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307) Apr 27 18:22:04 WeatherStorm kernel: [11874.695929] TRACE: filter:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307) Apr 27 18:22:04 WeatherStorm kernel: [11874.789331] TRACE: nat:INPUT:policy:1 IN=wlan0 OUT= MAC=a0:f3:c1:2f:86:6a:00:1c:bf:8e:XX:XX:XX:XX SRC=192.168.30.1 DST=192.168.30.2 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=22857 DF PROTO=TCP SPT=38740 DPT=80 SEQ=3524767168 ACK=0 WINDOW=5840 RES=0x00 SYN URGP=0 OPT (020405B40402080A01B3F4890000000001030307)
。
在S1上使用以下iptables规则解决
iptables -A PREROUTING -t mangle -i br0 -p tcp --dport 80 -d 192.168.69.14 -j MARK --set-mark 1 iptables -A POSTROUTING -t nat --match mark --mark 1 -j SNAT --to-source 192.168.69.1
您的[RPI]路由configuration不正确 – 如果您希望通过GW1从公共Internet地址可达，则默认路由必须指向GW1 ，或者（如果从[RPI]到公用Internet地址的出站连接必须通过GW2 ）需要在[RPI]上configuration策略路由，使得通过GW1属于传入连接的报文通过GW1路由。
（第三种方法是让GW1也把数据包SNAT到192.168.69.1 ，这样它们会从直接连接的IP来到[RPI] ，但是在这种情况下，你将无法确定[RPI]上的实际客户端地址[RPI]处理这些数据包对于HTTP，您可以通过在GW1上安装反向HTTP代理而不是使用NAT，并在HTTP头中传递真实客户端IP来解决此问题。
在你当前的configuration中，来自tap0不是来自直接连接的主机的数据包可能由于在该接口上启用了rp_filter而被丢弃（尽pipe根据ip-sysctl.txt ， rp_filter的默认值是0，许多发行版启用它默认情况下在他们的networkingconfiguration）。 如果您查看netfilter数据包stream程图 ， rp_filter在“路由决策”节点处应用rp_filter ，这与您的观察结果一致（最后一个节点是nat:PREROUTING ，它位于“路由决策”节点之前）。
请注意，只是禁用rp_filter不会帮助你，因为来自[RPI]回复数据包将仅通过GW2发送，即使它们以某种方式到达另一个主机，它也会拒绝它们，因为这些数据包将没有正确的NAT处理由GW1 。 你真的必须确保对通过GW1传来的NAT数据包的回复被发送回GW1 – 没有这个NAT将无法正常工作。