Eu tenho um servidor doméstico que também funciona como roteador (gateway). Possui 2 interfaces, uma para internet ( enp4s0 ) e outra ( enp4s1 ) para a rede local. Todos os dispositivos da rede local usam internet de enp4s0 (configuração via masquerading e dnsmasq ) e funciona bem, mas não consigo pingar nenhum dispositivo dentro da LAN do gateway, o único dispositivo em que posso fazer ping de dispositivos na LAN é gateway. Além disso, há o encaminhamento de porta, que funciona bem (eu posso acessar dispositivos na LAN que as portas foram encaminhadas, mas apenas do host remoto). O que estou fazendo errado?
Aqui está minha configuração:
smt-server ~ # iptables-save
*nat
:PREROUTING ACCEPT [3059:171583]
:INPUT ACCEPT [2567:132938]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DOCKER - [0:0]
-A OUTPUT -d X.X.X.X/32 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.0.1
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -o enp4s0 -j MASQUERADE
COMMIT
*mangle
:PREROUTING ACCEPT [372724122:553710820064]
:INPUT ACCEPT [365684276:547976820091]
:FORWARD ACCEPT [7037750:5732930849]
:OUTPUT ACCEPT [193052833:10399179735]
:POSTROUTING ACCEPT [200090538:16132105927]
COMMIT
*filter
:INPUT ACCEPT [2775:188343]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2604:109020]
:DOCKER - [0:0]
-A FORWARD -i enp4s1 -o enp4s0 -j ACCEPT
-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -d 192.168.0.0/24 -o enp4s1 -j ACCEPT
COMMIT
smt-server ~ # ip ro list
default via X.X.X.X dev enp4s0 metric 204
169.254.0.0/16 dev enp4s1 proto kernel scope link src 169.254.151.102 metric 205
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown
X.X.X.X/24 dev enp4s0 proto kernel scope link src X.X.X.X metric 204
192.168.0.0/24 dev enp4s1 proto kernel scope link src 192.168.0.1
smt-server ~ # ip link list
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp4s2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
link/ether 00:80:48:28:1e:57 brd ff:ff:ff:ff:ff:ff
3: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN mode DEFAULT group default qlen 1000
link/ether 50:e5:49:e4:43:4d brd ff:ff:ff:ff:ff:ff
4: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether 00:13:d3:9a:af:33 brd ff:ff:ff:ff:ff:ff
5: enp4s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether e8:cc:18:e8:c6:90 brd ff:ff:ff:ff:ff:ff
6: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN mode DEFAULT group default
link/sit 0.0.0.0 brd 0.0.0.0
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN mode DEFAULT group default
link/ether 02:42:16:6c:f2:cf brd ff:ff:ff:ff:ff:ff
smt-server ~ # ip add list
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: enp4s2: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
link/ether 00:80:48:28:1e:57 brd ff:ff:ff:ff:ff:ff
inet6 fe80::91f4:69a4:2375:9e71/64 scope link tentative
valid_lft forever preferred_lft forever
3: enp3s0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
link/ether 50:e5:49:e4:43:4d brd ff:ff:ff:ff:ff:ff
inet6 fe80::59e:56ea:7de3:cd5e/64 scope link tentative
valid_lft forever preferred_lft forever
4: enp4s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:13:d3:9a:af:33 brd ff:ff:ff:ff:ff:ff
inet X.X.X.X/24 brd X.X.X.X scope global enp4s0
valid_lft forever preferred_lft forever
inet6 fe80::5c50:880a:b7ba:7b38/64 scope link
valid_lft forever preferred_lft forever
5: enp4s1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether e8:cc:18:e8:c6:90 brd ff:ff:ff:ff:ff:ff
inet 192.168.0.1/24 scope global enp4s1
valid_lft forever preferred_lft forever
inet 169.254.151.102/16 brd 169.254.255.255 scope global enp4s1
valid_lft forever preferred_lft forever
inet6 fe80::f987:2ed0:61ed:ddaf/64 scope link
valid_lft forever preferred_lft forever
6: sit0@NONE: <NOARP> mtu 1480 qdisc noop state DOWN group default
link/sit 0.0.0.0 brd 0.0.0.0
7: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default
link/ether 02:42:16:6c:f2:cf brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::ee83:8058:deee:dd8c/64 scope link
valid_lft forever preferred_lft forever
smt-server ~ # sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.all.rp_filter = 1
smt-server ~ # cat /etc/dnsmasq.conf
interface=enp4s1
dhcp-range=192.168.0.100,192.168.0.250,72h
smt-server ~ # netstat -rna
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 X.X.X.X 0.0.0.0 UG 0 0 0 enp4s0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 enp4s1
172.17.0.0 0.0.0.0 255.255.0.0 U 0 0 0 docker0
X.X.X.X 0.0.0.0 255.255.255.0 U 0 0 0 enp4s0
192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 enp4s1
Para evitar perguntas "Você é estúpido? Você está realmente tentando acessar dispositivos por trás do NAT?" - Não, estou tentando acessar o dispositivo que pode ser acessado via DMZ.
Além disso, tenho mais 3 portas ethernet vazias no servidor e gostaria de saber se é possível conectar todas elas em uma LAN? (Isso não é tão importante, mas de qualquer forma seria muito bom usar esse recurso)
UPD: aqui está o script com o qual eu configuro minha LAN:
#!/bin/bash
source="enp4s0"
targets="enp4s1"
sysctl -w net.ipv4.ip_forward=1 &> /dev/null
sysctl -p &> /dev/null
iptables -t nat -F POSTROUTING
iptables -F FORWARD
for iface in $targets; do
ip addr add 192.168.0.1/24 dev $iface &> /dev/null
iptables -A FORWARD -i $iface -o $source -j ACCEPT &> /dev/null
done
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT &> /dev/null
iptables -t nat -F POSTROUTING &> /dev/null
iptables -t nat -A POSTROUTING -o $source -j MASQUERADE &> /dev/null
Por favor, verifique se a máscara de rede e a transmissão estão configuradas corretamente nos clientes - deve corresponder aos parâmetros no gw. Outra sugestão - se você estiver usando o switch gerenciado na LAN - verifique se algo como vlan privado não está habilitado.