Eu tenho tráfego LAN (10.20.1.0/24) e WLAN (172.16.20.0/24) chegando em ens32 e destinado a 10.21.0.1 via OpenVPN tun0 em um sistema Debian 9. iptables está encaminhando da LAN, mas não da WLAN.
Usando uma regra TRACE em iptables , recebo o seguinte via LAN:
May 14 15:03:07 vpnsrv kernel: [2357925.893248] TRACE: raw:PREROUTING:policy:2 IN=ens32 OUT= MAC=... SRC=10.20.1.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=57269 DPT=22 SEQ=3284245311 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E55489B0000000004020000)
May 14 15:03:07 vpnsrv kernel: [2357925.893288] TRACE: nat:PREROUTING:policy:2 IN=ens32 OUT= MAC=... SRC=10.20.1.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=57269 DPT=22 SEQ=3284245311 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E55489B0000000004020000)
May 14 15:03:07 vpnsrv kernel: [2357925.893317] TRACE: filter:FORWARD:rule:1 IN=ens32 OUT=tun0 MAC=... SRC=10.20.1.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=TCP SPT=57269 DPT=22 SEQ=3284245311 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E55489B0000000004020000)
May 14 15:03:07 vpnsrv kernel: [2357925.893347] TRACE: filter:ufw-before-logging-forward:return:1 IN=ens32 OUT=tun0 MAC=... SRC=10.20.1.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=TCP SPT=57269 DPT=22 SEQ=3284245311 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E55489B0000000004020000)
May 14 15:03:07 vpnsrv kernel: [2357925.893365] TRACE: filter:FORWARD:rule:2 IN=ens32 OUT=tun0 MAC=... SRC=10.20.1.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=TCP SPT=57269 DPT=22 SEQ=3284245311 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E55489B0000000004020000)
May 14 15:03:07 vpnsrv kernel: [2357925.893388] TRACE: filter:ufw-before-forward:rule:8 IN=ens32 OUT=tun0 MAC=... SRC=10.20.1.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=TCP SPT=57269 DPT=22 SEQ=3284245311 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E55489B0000000004020000)
May 14 15:03:07 vpnsrv kernel: [2357925.893404] TRACE: nat:POSTROUTING:policy:3 IN= OUT=tun0 SRC=10.20.1.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=62 ID=0 DF PROTO=TCP SPT=57269 DPT=22 SEQ=3284245311 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E55489B0000000004020000)
mas apenas a primeira parte via WLAN:
May 14 15:08:44 vpnsrv kernel: [2358263.328390] TRACE: raw:PREROUTING:policy:2 IN=ens32 OUT= MAC=... SRC=172.16.20.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=57342 DPT=22 SEQ=3290971808 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E5A69C30000000004020000)
May 14 15:08:44 vpnsrv kernel: [2358263.328430] TRACE: nat:PREROUTING:policy:2 IN=ens32 OUT= MAC=... SRC=172.16.20.12 DST=10.21.0.1 LEN=64 TOS=0x00 PREC=0x00 TTL=63 ID=0 DF PROTO=TCP SPT=57342 DPT=22 SEQ=3290971808 ACK=0 WINDOW=65535 RES=0x00 CWR ECE SYN URGP=0 OPT (020405B4010303050101080A0E5A69C30000000004020000)
Regras de filtro relevantes são:
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A ufw-before-forward -i ens32 -o tun0 -j ACCEPT
Por que o tráfego da WLAN não é encaminhado?
Você usa o roteamento de políticas? Se assim for - mostrando regras e tabelas de roteamento podem ser relevantes aqui. Além disso, por favor, mostre a entrada da sua tabela de roteamento para a rede 172.16.20.0/24, já que você pode estar acessando o rp_filter se isto não estiver configurado corretamente