День добрый!
Принесли сервер с ALT Linux Кентавр 6
Задача настроить на нем NAT. С ALT Linux столкнулся впервые, но вроде ничего сложного, настроил, но не работает MASQUERADE на внешнем интерфейсе.
Итак, в сервере 2 сетевые, одна внутрь (192.168.1.0/24), другая наружу:
bash-3.2# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000
link/ether f0:7d:68:c1:f5:ab brd ff:ff:ff:ff:ff:ff
inet 192.168.1.20/24 brd 192.168.1.255 scope global eth0
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 20:cf:30:35:59:c4 brd ff:ff:ff:ff:ff:ff
inet 46.187.XXX.XXX/21 brd 46.187.7.255 scope global eth1
bash-3.2# ip route show
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.20
46.187.0.0/21 dev eth1 proto kernel scope link src 46.187.XXX.XXX
default via 46.187.YYY.YYY dev eth1
Включил IP Forwarding:
bash-3.2# cat /etc/net/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_timestamps = 0
bash-3.2# cat /proc/sys/net/ipv4/ip_forward
1
Настроил правила FW:
bash-3.2# iptables -L -v
Chain INPUT (policy ACCEPT 3313 packets, 2312K bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -f any any anywhere anywhere
243 31521 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
12 956 ACCEPT icmp -- any any anywhere anywhere
1191 85077 ACCEPT tcp -- eth0 any anywhere anywhere tcp dpt:ssh
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -f any any anywhere anywhere
0 0 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
743 47404 ACCEPT all -- any any 192.168.1.0/24 anywhere
Chain OUTPUT (policy ACCEPT 3678 packets, 624K bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -f any any anywhere anywhere
243 31521 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED
218 27242 ACCEPT icmp -- any any anywhere anywhere
bash-3.2# iptables -t nat -L -v
Chain PREROUTING (policy ACCEPT 1 packets, 76 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 2 packets, 2394 bytes)
pkts bytes target prot opt in out source destination
1 893 MASQUERADE all -- any eth1 anywhere anywhere
Chain OUTPUT (policy ACCEPT 4 packets, 3363 bytes)
pkts bytes target prot opt in out source destination
Проверяю ping с 192.168.1.194, не проходит (с самого сервера все работает), смотрим tcpdump на интерфейсах сервера:
# Интерфейс локальной сети
bash-3.2# tcpdump -i eth0 dst host 8.8.8.8
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
13:47:38.860237 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 661, length 40
13:47:43.631561 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 662, length 40
13:47:48.632015 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 663, length 40
13:47:53.632488 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 664, length 40
# Интерфейс Internet
bash-3.2# tcpdump -i eth1 dst host 8.8.8.8
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
13:48:20.925918 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 665, length 40
13:48:25.633501 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 666, length 40
13:48:30.633976 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 667, length 40
13:48:35.634342 IP 192.168.1.194 > google-public-dns-a.google.com: ICMP echo request, id 1, seq 668, length 40
Что не так и где что подкрутить?
