Início / server / 问题

Perguntas[linux](server)

Martin Hope
Nicola Mori
Asked: 2025-04-24 19:05:39 +0800 CST
  • 8

Após uma queda de energia e uma falha no UPS, o pool ZFS está em um estado que não consigo entender:

$ zpool status -c serial
  pool: storage
 state: DEGRADED
status: One or more devices could not be used because the label is missing or
        invalid.  Sufficient replicas exist for the pool to continue
        functioning in a degraded state.
action: Replace the device using 'zpool replace'.
   see: https://openzfs.github.io/openzfs-docs/msg/ZFS-8000-4J
  scan: scrub repaired 0B in 1 days 10:40:40 with 0 errors on Wed Apr  2 10:40:42 2025
config:

        NAME                                                  STATE     READ WRITE CKSUM                serial
        storage                                               DEGRADED     0     0     0
          raidz2-0                                            DEGRADED     0     0     0
            8844532865098720143                               FAULTED      0     0     0  was /dev/sda1  ZL2AJ3S10000C1111G0H
            scsi-35000c500cafcbb67                            ONLINE       0     0     0  ZL2AJ3S10000C1111G0H
            scsi-35000c500cafc9a63                            ONLINE       0     0     0  ZL2AKR3F0000C1128SV6
            scsi-35000c500cafcb303                            ONLINE       0     0     0  ZL2AKQVX0000C1143G62
            scsi-35000c500cafcff33                            ONLINE       0     0     0  ZL2AKAG10000C11445AW
            scsi-35000c500cafc392b                            ONLINE       0     0     0  ZL2AKCWB0000C1143ARJ
            wwn-0x5000c500cafa8287                            ONLINE       0     0     0  ZL2AHSSL0000C107BQWN
            scsi-35000c500cafbec03                            ONLINE       0     0     0  ZL2AGE6X0000C1122SME
            7647119559265938125                               FAULTED      0     0     0  was /dev/sdi1  ZL2AGE6X0000C1122SME
            scsi-35000c500cafca18b                            ONLINE       0     0     0  ZL2AKR0B0000C1128RNJ
            scsi-35000c500cafc29c3                            ONLINE       0     0     0  ZL2AGDN30000C1140NTP
            scsi-35000c500cafbe293                            ONLINE       0     0     0  ZL2AKDSM0000C11278YB
          raidz2-1                                            DEGRADED     0     0     0
            scsi-SSEAGATE_ST16000NM002G_ZL2AKBXB0000C1126C6X  ONLINE       0     0     0  ZL2AKBXB0000C1126C6X
            1470086598115969130                               UNAVAIL      0     0     0  was /dev/sdy1          20342A6158FC
            wwn-0x5000c500cae0af8b                            ONLINE       0     0     0  ZL29T97Q0000C107188W
            12722321230162544658                              FAULTED      0     0     0  was /dev/sdl1  ZL2AKDSM0000C11278YB
            scsi-35000c500cafc3be7                            ONLINE       0     0     0  ZL2AJJZF0000C1143AH2
            scsi-35000c500cafc611f                            ONLINE       0     0     0  ZL2AKC6Z0000C11438R8
            scsi-35000c500cafcfb97                            ONLINE       0     0     0  ZL2AHY5R0000C11441Z5
            scsi-35000c500cafc8663                            ONLINE       0     0     0  ZL2AKBNX0000C1128RLR
            scsi-35000c500cafc9fa3                            ONLINE       0     0     0  ZL2AKR0Y0000C1128RN1
            scsi-35000c500cafc96b3                            ONLINE       0     0     0  ZL2AKR6T0000C1128SQP
            scsi-35000c500cafc2f23                            ONLINE       0     0     0  ZL2AK1NP0000C1143FXB
            scsi-35000c500cafc4ccf                            ONLINE       0     0     0  ZL2AKCKG0000C1143ETM
        logs
          nvme-INTEL_SSDPED1K375GA_PHKS01530050375AGN         ONLINE       0     0     0    PHKS01530050375AGN
        cache
          sdu                                                 FAULTED      0     0     0  corrupted data  ZL2AKR6T0000C1128SQP
          sdw                                                 FAULTED      0     0     0  corrupted data  ZL2AK1NP0000C1143FXB

Há muita coisa que não entendo no status acima:

  1. Todos os discos COM DEFEITO têm o mesmo número de série de um dos discos ONLINE
  2. O número de série do disco UNAVAIL é de um dos dois SSDs que uso para cache, não de um dos HDDs usados ​​para o pool
  3. As séries dos dois discos de cache com FALHA são as de dois HDDs de armazenamento

O que poderia ter acontecido para reduzir o pool nesse estado? É recuperável? Pensei em tentar o procedimento descrito aqui, mas não consigo nem entender quais são os discos com defeito. O procedimento simples descrito nesta postagem funcionaria no meu caso? Preciso muito de ajuda com isso, agradeço antecipadamente.

linux
Martin Hope
Artem
Asked: 2025-04-12 19:29:18 +0800 CST
  • 5

Meu servidor IMAP Dovecot usa compressão Deflate para conexão. Como posso desativá-lo para testes? Tentei adicionar

plugin {
  imap_compress_deflate_level = 0
}

para configuração personalizada em /etc/dovecot/conf.d/, mas não funciona.

linux
Martin Hope
LinuxScientist
Asked: 2025-04-04 04:31:01 +0800 CST
  • 7

Eu realmente preciso de ajuda para descobrir como expandir com segurança a partição raiz na minha VM de servidor Linux. Adicionei 50 GB de espaço extra ao disco virtual da VM e consigo visualizar usando o fdisk, mas não tenho certeza de como alocá-lo sem danificar o sistema.

Aqui está meu layout de partição atual:

home-srv-01:~ #  lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
sda      8:0    0  100G  0 disk 
├─sda1   8:1    0    8M  0 part 
├─sda2   8:2    0 30.8G  0 part /var
│                               /usr/local
│                               /tmp
│                               /boot/grub2/i386-pc
│                               /boot/grub2/x86_64-efi
│                               /opt
│                               /srv
│                               /.snapshots
│                               /root
│                               /
├─sda3   8:3    0 17.2G  0 part /home
└─sda4   8:4    0    2G  0 part [SWAP]
sr0     11:0    1 15.3G  0 rom  
home-srv-01:~ #

home-srv-01:~ # fdisk -l
GPT PMBR size mismatch (104857599 != 209715199) will be corrected by write.
Disk /dev/sda: 100 GiB, 107374182400 bytes, 209715200 sectors
Disk model: VMware Virtual S
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: gpt
Disk identifier: A1C8759F-D45C-4FB4-A365-1402AD4516B3

Device         Start       End  Sectors  Size Type
/dev/sda1       2048     18431    16384    8M BIOS boot
/dev/sda2      18432  64600063 64581632 30.8G Linux filesystem
/dev/sda3   64600064 100661247 36061184 17.2G Linux filesystem
/dev/sda4  100661248 104857566  4196319    2G Linux swap
home-srv-01:~ #

O objetivo é expandir a partição raiz do Btrfs (sda2) para o novo espaço livre sem perder os dados em /home (sda3 XFS) ou fazer com que o sistema fique ininicializável. Infelizmente, minhas tentativas anteriores resultaram em problemas de inicialização, então estou sendo extremamente cauteloso agora.

Recapitulação das etapas:

  1. Fez backup de todos os dados de /home( /dev/sda3).
  2. Inicializado em um ambiente live CD/USB.
  3. Dados movidos de /homepara um disco externo.
  4. Executei swapoff /dev/sda4e deletei /dev/sda4.
  5. Excluído /dev/sda3(isso cria espaço livre ao lado de /dev/sda2).
  6. Redimensionou o sistema de arquivos Btrfs ao /dev/sda2usar btrfs filesystem resize max /.
  7. Recriou /dev/sda3e restaurou os /homedados do backup.
  8. Recriado /dev/sda4e executado swapon /dev/sda4.
  9. Uma vez concluído, o sistema não inicializa mais.

Agradeço desde já qualquer conselho ou sugestão passo a passo. Eu realmente apreciaria sua orientação.

LX

linux
Martin Hope
MikiBelavista
Asked: 2025-04-02 20:30:08 +0800 CST
  • 5

Estou tentando desabilitar o Jenins neste servidor, porque não precisamos mais dele

ps -feww | grep jenkins

mostra

jenkins     6646    6089  0 08:53 ?        00:00:00 npm start
jenkins     9180    6646 29 08:53 ?        01:19:15 next-server (v14.2.5)
jenkins    15769   12444  0 08:53 ?        00:00:02 /shared/argocd-dex rundex
jumicha      587438  544583  0 13:18 pts/0    00:00:00 grep --color=auto jenkins

Qual deve ser o próximo passo? Como descobrir o que iniciou o Jenkins?

ps -p 9180 -o pid,vsz=MEMORY -o user,group=GROUP -o comm,args=ARGS
    PID MEMORY USER     GROUP    COMMAND         ARGS
   9180 21735356 jenkins 65533   next-server (v1 next-server (v14.2.5)

O que foi que deu início ao next-server?

pstree -pn 9180
next-server (v1(9180)─┬─{next-server (v1}(9189)
                      ├─{next-server (v1}(9190)
                      ├─{next-server (v1}(9191)
                      ├─{next-server (v1}(9192)
                      ├─{next-server (v1}(9193)
                      ├─{next-server (v1}(9214)
                      ├─{next-server (v1}(12061)
                      ├─{next-server (v1}(12062)
                      ├─{next-server (v1}(12063)
                      └─{next-server (v1}(12064)
linux
Martin Hope
Clodoaldo
Asked: 2025-03-24 01:24:01 +0800 CST
  • 5

Existem regras aplicadas ao firewalld por dois serviços, Fail2ban e Wireguard. Sempre que recarrego o serviço de firewall, as regras são perdidas. Como preservá-las entre as recarregamentos?

# firewall-cmd --get-all-rules --direct
ipv4 filter INPUT_direct 0 -p tcp -m multiport --dports ssh -m set --match-set f2b-sshd src -j REJECT --reject-with icmp-port-unreachable
ipv4 filter FORWARD 0 -i wg -o eth0 -j ACCEPT
ipv4 filter FORWARD 1 -i wg -o wg -j ACCEPT
ipv4 nat POSTROUTING 0 -o eth0 -j MASQUERADE

Rocky Linux 9

linux
Martin Hope
Arkaik
Asked: 2025-03-19 17:43:29 +0800 CST
  • 5

Estou tentando há horas configurar corretamente o ssh MFA com a chave pública ou a senha sendo solicitada antes do código OTP no Debian 12.

Atualmente, consigo configurar publickey+MFA e password+MFA, mas não consigo configurar publickey|password+MFA

chave pública+MFA

  • Editar/etc/pam.d/sshd

    • Comentário@include common-auth
    • Adicione auth required pam_google_authenticator.sona linha depois

  • Crie um arquivo /etc/ssh/sshd_config.d/mfa.confcom o seguinte conteúdo

UsePAM yes
ChallengeResponseAuthentication yes
AuthenticationMethods publickey,keyboard-interactive

Com esta configuração consigo logar com publickey+MFA, porém ao usar a senha recebo umaPermission denied (publickey)

senha+MFA

  • Editar/etc/pam.d/sshd

    • Manter@include common-auth
    • Adicione auth required pam_google_authenticator.sona linha depois

  • Crie um arquivo /etc/ssh/sshd_config.d/mfa.confcom o seguinte conteúdo

UsePAM yes
ChallengeResponseAuthentication yes

Com esta configuração consigo logar com password+MFA, porém ao utilizar a publickey auth o código OTP não é pedido

Tentei muitas configurações diferentes e fiz muitas pesquisas, mas não consigo encontrar uma maneira de configurar a autenticação como eu quero.

Por exemplo com

AuthenticationMethods publickey,keyboard-interactive password,keyboard-interactive

Consigo efetuar login corretamente com publickey+MFA, mas quando uso a senha recebo a mensagem "Permissão negada", mesmo usando a senha correta.

Eu até tentei usar um arquivo de configuração pam personalizado como segue

auth    substack                        pam_unix.so
auth    required                        pam_google_authenticator.so
auth    requisite                       pam_deny.so
auth    required                        pam_permit.so

Mas nada que tentei funciona corretamente

Não entendo por que é tão difícil configurá-lo, já que o sshd lida com isso nativamente, mas ao adicionar OTP MFA, ele não pode ser conectado diretamente após a autenticação básica do sshd

Se alguém encontrar uma maneira de obter essa configuração, ficarei feliz em saber.

desde já, obrigado

linux
Martin Hope
darth_alexious
Asked: 2025-03-11 04:45:01 +0800 CST
  • 6

Máquina: Linux Debian 12.8

duas interfaces Ethernet

  • enp2s0 - conectado ao roteador do ISP
  • enp4s0 - conectado ao switch LAN

Enquanto estou em ponte, posso acessar a Internet de qualquer máquina na LAN, no entanto, não consigo acessar a Internet da máquina em ponte.

Se eu derrubar a ponte, a Internet é restaurada na máquina, mas é claro que ela perde sua finalidade porque perde a conexão entre as duas interfaces Ethernet.

  • Não preciso necessariamente de uma ponte, só preciso colocar esse equipamento como um dispositivo de segurança para minha rede e fazer o tráfego passar por ele.
  • Quero que a própria máquina possa se conectar à Internet e qualquer outra máquina na LAN também.
  • Se ajudar, também tenho na mesma máquina uma interface sem fio chamada wlp3s0
  • Também tenho o firewalld instalado (seja habilitado/desabilitado, o resultado é sempre o mesmo)

Obrigado por qualquer ajuda.

editar: segmento /etc/network/interfaces para a ponte:

auto br0
iface br0 inet static
        bridge_ports enp2s0 enp4s0
        address 192.168.22.2
        broadcast 192.168.22.255
        netmask 255.255.255.0
        gateway 192.168.22.1
linux
Martin Hope
verified_tinker
Asked: 2025-03-10 13:43:22 +0800 CST
  • 5

Eu uso o Mullvad VPN na minha máquina host (Fedora 41), que configura uma interface WireGuard, wg0-mullvade quero que o tráfego de e para o namespace blo ignore, com o objetivo final de conectar-me à VPN AnyConnect da minha empresa de dentro ble, depois, fazer RDP no meu computador do escritório, enquanto o resto do meu tráfego de Internet passa pelo Mullvad.

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 52:54:00:11:c0:d6 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp1s0
       valid_lft 81301sec preferred_lft 81301sec
    inet6 fec0::e777:52d6:5436:4997/64 scope site dynamic noprefixroute 
       valid_lft 86366sec preferred_lft 14366sec
    inet6 fe80::bc4e:6885:3d23:b51b/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
3: veth-bl-root@if2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 62:fb:a5:45:d4:e3 brd ff:ff:ff:ff:ff:ff link-netns bl
    inet 192.168.11.2/24 scope global veth-bl-root
       valid_lft forever preferred_lft forever
    inet6 fe80::60fb:a5ff:fe45:d4e3/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever
4: vpn0: <NO-CARRIER,POINTOPOINT,MULTICAST,NOARP,UP> mtu 1207 qdisc fq_codel state DOWN group default qlen 500
    link/none 
10: wg0-mullvad: <POINTOPOINT,UP,LOWER_UP> mtu 1380 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none 
    inet 10.136.199.175/32 scope global wg0-mullvad
       valid_lft forever preferred_lft forever

veth-bl-rooté a interface virtual ethernet conectando o namespace raiz ao meu namespace bl. Você pode ignorar vpn0. É a VPN da empresa que mencionei e, por enquanto, só posso usá-la quando o Mullvad estiver desconectado.

Eu segui este tutorial para configurar o namespace e conectá-lo à Internet, o que significa que habilitei o encaminhamento de IP, o encaminhamento de pacotes e o mascaramento de IP. Quando o Mullvad VPN é desconectado, ele funciona, mas quando eu habilito o VPN, as solicitações expiram. Eu acho que é porque o mascaramento de IP não acontece até que os pacotes sejam roteados por enp1s0, e o Mullvad VPN impede isso:

$ ip route get 8.8.8.8 from 192.168.11.2
8.8.8.8 from 192.168.11.2 dev wg0-mullvad table 1836018789 uid 1000 
    cache

Embora na prática wg0-mullvadseja a rota padrão, ela não parece ser definida como tal.

$ ip route
default via 10.0.2.2 dev enp1s0 proto dhcp src 10.0.2.15 metric 100 
10.0.2.0/24 dev enp1s0 proto kernel scope link src 10.0.2.15 metric 100 
10.64.0.1 dev wg0-mullvad proto static 
192.168.11.0/24 dev veth-bl-root proto kernel scope link src 192.168.11.2

$ ip rule list
0:  from all lookup local
32764:  from all lookup main suppress_prefixlength 0
32765:  not from all fwmark 0x6d6f6c65 lookup 1836018789
32766:  from all lookup main
32767:  from all lookup default

$ ip route show table 1836018789
default dev wg0-mullvad proto static

Como ele usa marcação de pacotes e sua própria tabela de roteamento, tentei duas abordagens que usavam cada uma dessas coisas.

Tentativas de correção

Tabela de roteamento separada

Primeiro, tentei criar uma nova tabela de roteamento, onde a única rota era através de enp1s0, e adicionei uma regra especificando que todo o tráfego proveniente do endereço IP do namespace deveria usar essa tabela.

$ ip route show table bl
default via 10.0.2.15 dev enp1s0

$ ip rule
0:  from all lookup local
32763:  from 192.168.11.2/24 lookup bl
32764:  from all lookup main suppress_prefixlength 0
32765:  not from all fwmark 0x6d6f6c65 lookup 1836018789
32766:  from all lookup main
32767:  from all lookup default

Como tinha precedência sobre as regras de Mullvad, eu esperava que funcionasse. De fato, ip route getera promissor:

$ ip route get 8.8.8.8 from 192.168.11.2
8.8.8.8 from 192.168.11.2 dev enp1s0 table bl uid 1000 
    cache

Infelizmente, os pedidos expiraram.

$ sudo ip netns exec bl traceroute -n 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  *^C

$ sudo ip netns exec bl ping -c 3 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.

--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2076ms

O uso ping -I 192.168.11.2 8.8.8.8também não teve sucesso:

$ sudo ping -I 192.168.11.2 8.8.8.8
PING 8.8.8.8 (8.8.8.8) from 192.168.11.2 : 56(84) bytes of data.
From 192.168.11.2 icmp_seq=1 Destination Port Unreachable
ping: sendmsg: Operation not permitted
From 192.168.11.2 icmp_seq=2 Destination Port Unreachable
ping: sendmsg: Operation not permitted
From 192.168.11.2 icmp_seq=3 Destination Port Unreachable
ping: sendmsg: Operation not permitted
^C
--- 8.8.8.8 ping statistics ---
3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2075ms

tcpdump -n -i veth-bl-root icmppegou os pacotes, mas tcpdump -n -i enp1s0 icmpnão encontrou nada. Os pacotes ainda estavam passando wg0-mullvad:

# This is what happened when running `ping -c 3 8.8.8.8`.
$ sudo tcpdump -n -i wg0-mullvad icmp
dropped privs to tcpdump
tcpdump: verbose output suppressed, use -v[v]... for full protocol decode
listening on wg0-mullvad, link-type RAW (Raw IP), snapshot length 262144 bytes
08:55:53.448220 IP 10.136.199.175 > 10.64.0.1: ICMP echo request, id 13627, seq 601, length 50
08:55:53.532425 IP 10.64.0.1 > 10.136.199.175: ICMP echo reply, id 13627, seq 601, length 50
08:55:59.449654 IP 10.136.199.175 > 10.64.0.1: ICMP echo request, id 13627, seq 602, length 50
08:55:59.534057 IP 10.64.0.1 > 10.136.199.175: ICMP echo reply, id 13627, seq 602, length 50
08:56:05.451552 IP 10.136.199.175 > 10.64.0.1: ICMP echo request, id 13627, seq 603, length 50
08:56:05.535728 IP 10.64.0.1 > 10.136.199.175: ICMP echo reply, id 13627, seq 603, length 50
^C
6 packets captured
6 packets received by filter
0 packets dropped by kernel

Aqui está a saída nft list rulesetneste estágio:

table inet firewalld {
    ct helper helper-netbios-ns-udp {
        type "netbios-ns" protocol udp
        l3proto ip
    }

    chain mangle_PREROUTING {
        type filter hook prerouting priority mangle + 10; policy accept;
        jump mangle_PREROUTING_POLICIES
    }

    chain mangle_PREROUTING_POLICIES {
        iifname "enp1s0" jump mangle_PRE_policy_allow-host-ipv6
        iifname "enp1s0" jump mangle_PRE_FedoraWorkstation
        iifname "enp1s0" return
        jump mangle_PRE_policy_allow-host-ipv6
        jump mangle_PRE_FedoraWorkstation
        return
    }

    chain nat_PREROUTING {
        type nat hook prerouting priority dstnat + 10; policy accept;
        jump nat_PREROUTING_POLICIES
    }

    chain nat_PREROUTING_POLICIES {
        iifname "enp1s0" jump nat_PRE_policy_allow-host-ipv6
        iifname "enp1s0" jump nat_PRE_FedoraWorkstation
        iifname "enp1s0" return
        jump nat_PRE_policy_allow-host-ipv6
        jump nat_PRE_FedoraWorkstation
        return
    }

    chain nat_POSTROUTING {
        type nat hook postrouting priority srcnat + 10; policy accept;
        jump nat_POSTROUTING_POLICIES
    }

    chain nat_POSTROUTING_POLICIES {
        iifname "enp1s0" oifname "enp1s0" jump nat_POST_FedoraWorkstation
        iifname "enp1s0" oifname "enp1s0" return
        oifname "enp1s0" jump nat_POST_FedoraWorkstation
        oifname "enp1s0" return
        iifname "enp1s0" jump nat_POST_FedoraWorkstation
        iifname "enp1s0" return
        jump nat_POST_FedoraWorkstation
        return
    }

    chain nat_OUTPUT {
        type nat hook output priority dstnat + 10; policy accept;
        jump nat_OUTPUT_POLICIES
    }

    chain nat_OUTPUT_POLICIES {
        oifname "enp1s0" jump nat_OUT_FedoraWorkstation
        oifname "enp1s0" return
        jump nat_OUT_FedoraWorkstation
        return
    }

    chain filter_PREROUTING {
        type filter hook prerouting priority filter + 10; policy accept;
        icmpv6 type { nd-router-advert, nd-neighbor-solicit } accept
        meta nfproto ipv6 fib saddr . mark . iif oif missing drop
    }

    chain filter_INPUT {
        type filter hook input priority filter + 10; policy accept;
        ct state { established, related } accept
        ct status dnat accept
        iifname "lo" accept
        ct state invalid drop
        jump filter_INPUT_POLICIES
        reject with icmpx admin-prohibited
    }

    chain filter_FORWARD {
        type filter hook forward priority filter + 10; policy accept;
        ct state { established, related } accept
        ct status dnat accept
        iifname "lo" accept
        ct state invalid drop
        ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
        jump filter_FORWARD_POLICIES
        reject with icmpx admin-prohibited
    }

    chain filter_OUTPUT {
        type filter hook output priority filter + 10; policy accept;
        ct state { established, related } accept
        oifname "lo" accept
        ip6 daddr { ::/96, ::ffff:0.0.0.0/96, 2002::/24, 2002:a00::/24, 2002:7f00::/24, 2002:a9fe::/32, 2002:ac10::/28, 2002:c0a8::/32, 2002:e000::/19 } reject with icmpv6 addr-unreachable
        jump filter_OUTPUT_POLICIES
    }

    chain filter_INPUT_POLICIES {
        iifname "enp1s0" jump filter_IN_policy_allow-host-ipv6
        iifname "enp1s0" jump filter_IN_FedoraWorkstation
        iifname "enp1s0" reject with icmpx admin-prohibited
        jump filter_IN_policy_allow-host-ipv6
        jump filter_IN_FedoraWorkstation
        reject with icmpx admin-prohibited
    }

    chain filter_FORWARD_POLICIES {
        iifname "enp1s0" oifname "enp1s0" jump filter_FWD_FedoraWorkstation
        iifname "enp1s0" oifname "enp1s0" reject with icmpx admin-prohibited
        iifname "enp1s0" jump filter_FWD_FedoraWorkstation
        iifname "enp1s0" reject with icmpx admin-prohibited
        oifname "enp1s0" jump filter_FWD_FedoraWorkstation
        oifname "enp1s0" reject with icmpx admin-prohibited
        jump filter_FWD_FedoraWorkstation
        reject with icmpx admin-prohibited
    }

    chain filter_OUTPUT_POLICIES {
        oifname "enp1s0" jump filter_OUT_FedoraWorkstation
        oifname "enp1s0" return
        jump filter_OUT_FedoraWorkstation
        return
    }

    chain filter_IN_FedoraWorkstation {
        jump filter_IN_FedoraWorkstation_pre
        jump filter_IN_FedoraWorkstation_log
        jump filter_IN_FedoraWorkstation_deny
        jump filter_IN_FedoraWorkstation_allow
        jump filter_IN_FedoraWorkstation_post
        meta l4proto { icmp, ipv6-icmp } accept
    }

    chain filter_IN_FedoraWorkstation_pre {
    }

    chain filter_IN_FedoraWorkstation_log {
    }

    chain filter_IN_FedoraWorkstation_deny {
    }

    chain filter_IN_FedoraWorkstation_allow {
        ip6 daddr fe80::/64 udp dport 546 accept
        tcp dport 22 accept
        udp dport 137 ct helper set "helper-netbios-ns-udp"
        udp dport 137 accept
        udp dport 138 accept
        ip daddr 224.0.0.251 udp dport 5353 accept
        ip6 daddr ff02::fb udp dport 5353 accept
        udp dport 1025-65535 accept
        tcp dport 1025-65535 accept
    }

    chain filter_IN_FedoraWorkstation_post {
    }

    chain filter_OUT_FedoraWorkstation {
        jump filter_OUT_FedoraWorkstation_pre
        jump filter_OUT_FedoraWorkstation_log
        jump filter_OUT_FedoraWorkstation_deny
        jump filter_OUT_FedoraWorkstation_allow
        jump filter_OUT_FedoraWorkstation_post
    }

    chain filter_OUT_FedoraWorkstation_pre {
    }

    chain filter_OUT_FedoraWorkstation_log {
    }

    chain filter_OUT_FedoraWorkstation_deny {
    }

    chain filter_OUT_FedoraWorkstation_allow {
    }

    chain filter_OUT_FedoraWorkstation_post {
    }

    chain nat_OUT_FedoraWorkstation {
        jump nat_OUT_FedoraWorkstation_pre
        jump nat_OUT_FedoraWorkstation_log
        jump nat_OUT_FedoraWorkstation_deny
        jump nat_OUT_FedoraWorkstation_allow
        jump nat_OUT_FedoraWorkstation_post
    }

    chain nat_OUT_FedoraWorkstation_pre {
    }

    chain nat_OUT_FedoraWorkstation_log {
    }

    chain nat_OUT_FedoraWorkstation_deny {
    }

    chain nat_OUT_FedoraWorkstation_allow {
    }

    chain nat_OUT_FedoraWorkstation_post {
    }

    chain nat_POST_FedoraWorkstation {
        jump nat_POST_FedoraWorkstation_pre
        jump nat_POST_FedoraWorkstation_log
        jump nat_POST_FedoraWorkstation_deny
        jump nat_POST_FedoraWorkstation_allow
        jump nat_POST_FedoraWorkstation_post
    }

    chain nat_POST_FedoraWorkstation_pre {
    }

    chain nat_POST_FedoraWorkstation_log {
    }

    chain nat_POST_FedoraWorkstation_deny {
    }

    chain nat_POST_FedoraWorkstation_allow {
    }

    chain nat_POST_FedoraWorkstation_post {
    }

    chain filter_FWD_FedoraWorkstation {
        jump filter_FWD_FedoraWorkstation_pre
        jump filter_FWD_FedoraWorkstation_log
        jump filter_FWD_FedoraWorkstation_deny
        jump filter_FWD_FedoraWorkstation_allow
        jump filter_FWD_FedoraWorkstation_post
    }

    chain filter_FWD_FedoraWorkstation_pre {
    }

    chain filter_FWD_FedoraWorkstation_log {
    }

    chain filter_FWD_FedoraWorkstation_deny {
    }

    chain filter_FWD_FedoraWorkstation_allow {
        oifname "enp1s0" accept
    }

    chain filter_FWD_FedoraWorkstation_post {
    }

    chain nat_PRE_FedoraWorkstation {
        jump nat_PRE_FedoraWorkstation_pre
        jump nat_PRE_FedoraWorkstation_log
        jump nat_PRE_FedoraWorkstation_deny
        jump nat_PRE_FedoraWorkstation_allow
        jump nat_PRE_FedoraWorkstation_post
    }

    chain nat_PRE_FedoraWorkstation_pre {
    }

    chain nat_PRE_FedoraWorkstation_log {
    }

    chain nat_PRE_FedoraWorkstation_deny {
    }

    chain nat_PRE_FedoraWorkstation_allow {
    }

    chain nat_PRE_FedoraWorkstation_post {
    }

    chain mangle_PRE_FedoraWorkstation {
        jump mangle_PRE_FedoraWorkstation_pre
        jump mangle_PRE_FedoraWorkstation_log
        jump mangle_PRE_FedoraWorkstation_deny
        jump mangle_PRE_FedoraWorkstation_allow
        jump mangle_PRE_FedoraWorkstation_post
    }

    chain mangle_PRE_FedoraWorkstation_pre {
    }

    chain mangle_PRE_FedoraWorkstation_log {
    }

    chain mangle_PRE_FedoraWorkstation_deny {
    }

    chain mangle_PRE_FedoraWorkstation_allow {
    }

    chain mangle_PRE_FedoraWorkstation_post {
    }

    chain filter_IN_policy_allow-host-ipv6 {
        jump filter_IN_policy_allow-host-ipv6_pre
        jump filter_IN_policy_allow-host-ipv6_log
        jump filter_IN_policy_allow-host-ipv6_deny
        jump filter_IN_policy_allow-host-ipv6_allow
        jump filter_IN_policy_allow-host-ipv6_post
    }

    chain filter_IN_policy_allow-host-ipv6_pre {
    }

    chain filter_IN_policy_allow-host-ipv6_log {
    }

    chain filter_IN_policy_allow-host-ipv6_deny {
    }

    chain filter_IN_policy_allow-host-ipv6_allow {
        icmpv6 type nd-neighbor-advert accept
        icmpv6 type nd-neighbor-solicit accept
        icmpv6 type nd-router-advert accept
        icmpv6 type nd-redirect accept
    }

    chain filter_IN_policy_allow-host-ipv6_post {
    }

    chain nat_PRE_policy_allow-host-ipv6 {
        jump nat_PRE_policy_allow-host-ipv6_pre
        jump nat_PRE_policy_allow-host-ipv6_log
        jump nat_PRE_policy_allow-host-ipv6_deny
        jump nat_PRE_policy_allow-host-ipv6_allow
        jump nat_PRE_policy_allow-host-ipv6_post
    }

    chain nat_PRE_policy_allow-host-ipv6_pre {
    }

    chain nat_PRE_policy_allow-host-ipv6_log {
    }

    chain nat_PRE_policy_allow-host-ipv6_deny {
    }

    chain nat_PRE_policy_allow-host-ipv6_allow {
    }

    chain nat_PRE_policy_allow-host-ipv6_post {
    }

    chain mangle_PRE_policy_allow-host-ipv6 {
        jump mangle_PRE_policy_allow-host-ipv6_pre
        jump mangle_PRE_policy_allow-host-ipv6_log
        jump mangle_PRE_policy_allow-host-ipv6_deny
        jump mangle_PRE_policy_allow-host-ipv6_allow
        jump mangle_PRE_policy_allow-host-ipv6_post
    }

    chain mangle_PRE_policy_allow-host-ipv6_pre {
    }

    chain mangle_PRE_policy_allow-host-ipv6_log {
    }

    chain mangle_PRE_policy_allow-host-ipv6_deny {
    }

    chain mangle_PRE_policy_allow-host-ipv6_allow {
    }

    chain mangle_PRE_policy_allow-host-ipv6_post {
    }
}
table ip filter {
    chain FORWARD {
        type filter hook forward priority filter; policy accept;
        iifname "veth-bl-root" oifname "enp1s0" counter packets 3 bytes 252 accept
        iifname "enp1s0" oifname "veth-bl-root" counter packets 3 bytes 252 accept
    }
}
# Warning: table ip nat is managed by iptables-nft, do not touch!
table ip nat {
    chain POSTROUTING {
        type nat hook postrouting priority srcnat; policy accept;
        ip saddr 192.168.11.0/24 oifname "enp1s0" counter packets 1 bytes 84 masquerade
    }
}
table inet mullvad {
    chain prerouting {
        type filter hook prerouting priority -199; policy accept;
        iif != "wg0-mullvad" ct mark 0x00000f41 meta mark set 0x6d6f6c65
        ip saddr 193.138.218.220 udp sport 16734 meta mark set 0x6d6f6c65
    }

    chain output {
        type filter hook output priority filter; policy drop;
        oif "lo" accept
        ct mark 0x00000f41 accept
        udp sport 68 ip daddr 255.255.255.255 udp dport 67 accept
        ip6 saddr fe80::/10 udp sport 546 ip6 daddr ff02::1:2 udp dport 547 accept
        ip6 saddr fe80::/10 udp sport 546 ip6 daddr ff05::1:3 udp dport 547 accept
        ip6 daddr ff02::2 icmpv6 type nd-router-solicit icmpv6 code no-route accept
        ip6 daddr ff02::1:ff00:0/104 icmpv6 type nd-neighbor-solicit icmpv6 code no-route accept
        ip6 daddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code no-route accept
        ip6 daddr fe80::/10 icmpv6 type nd-neighbor-advert icmpv6 code no-route accept
        ip daddr 193.138.218.220 udp dport 16734 meta mark 0x6d6f6c65 accept
        oif "wg0-mullvad" udp dport 53 ip daddr 10.64.0.1 accept
        oif "wg0-mullvad" tcp dport 53 ip daddr 10.64.0.1 accept
        udp dport 53 reject
        tcp dport 53 reject with tcp reset
        oif "wg0-mullvad" accept
        reject
    }

    chain input {
        type filter hook input priority filter; policy drop;
        iif "lo" accept
        ct mark 0x00000f41 accept
        udp sport 67 udp dport 68 accept
        ip6 saddr fe80::/10 udp sport 547 ip6 daddr fe80::/10 udp dport 546 accept
        ip6 saddr fe80::/10 icmpv6 type nd-router-advert icmpv6 code no-route accept
        ip6 saddr fe80::/10 icmpv6 type nd-redirect icmpv6 code no-route accept
        ip6 saddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code no-route accept
        icmpv6 type nd-neighbor-advert icmpv6 code no-route accept
        ip saddr 193.138.218.220 udp sport 16734 ct state established accept
        iif "wg0-mullvad" accept
    }

    chain forward {
        type filter hook forward priority filter; policy drop;
        ct mark 0x00000f41 accept
        udp sport 68 ip daddr 255.255.255.255 udp dport 67 accept
        udp sport 67 udp dport 68 accept
        ip6 saddr fe80::/10 udp sport 546 ip6 daddr ff02::1:2 udp dport 547 accept
        ip6 saddr fe80::/10 udp sport 546 ip6 daddr ff05::1:3 udp dport 547 accept
        ip6 saddr fe80::/10 udp sport 547 ip6 daddr fe80::/10 udp dport 546 accept
        ip6 daddr ff02::2 icmpv6 type nd-router-solicit icmpv6 code no-route accept
        ip6 saddr fe80::/10 icmpv6 type nd-router-advert icmpv6 code no-route accept
        ip6 saddr fe80::/10 icmpv6 type nd-redirect icmpv6 code no-route accept
        ip6 daddr ff02::1:ff00:0/104 icmpv6 type nd-neighbor-solicit icmpv6 code no-route accept
        ip6 daddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code no-route accept
        ip6 saddr fe80::/10 icmpv6 type nd-neighbor-solicit icmpv6 code no-route accept
        ip6 daddr fe80::/10 icmpv6 type nd-neighbor-advert icmpv6 code no-route accept
        icmpv6 type nd-neighbor-advert icmpv6 code no-route accept
        oif "wg0-mullvad" udp dport 53 ip daddr 10.64.0.1 accept
        oif "wg0-mullvad" tcp dport 53 ip daddr 10.64.0.1 accept
        udp dport 53 reject
        tcp dport 53 reject with tcp reset
        oif "wg0-mullvad" accept
        iif "wg0-mullvad" ct state established accept
        reject
    }

    chain mangle {
        type route hook output priority mangle; policy accept;
        oif "wg0-mullvad" udp dport 53 ip daddr 10.64.0.1 accept
        oif "wg0-mullvad" tcp dport 53 ip daddr 10.64.0.1 accept
        meta cgroup 5087041 ct mark set 0x00000f41 meta mark set 0x6d6f6c65
    }

    chain nat {
        type nat hook postrouting priority srcnat; policy accept;
        oif "wg0-mullvad" ct mark 0x00000f41 drop
        oif != "lo" ct mark 0x00000f41 masquerade
    }
}

Marcar pacotes debl

Como Mullvad parece ignorar pacotes marcados com 0x6d6f6c65, tentei adicionar uma regra que carimbasse essa marca em pacotes vindos de bl.

$ sudo nft add rule inet mullvad prerouting ip saddr 192.168.11.2 meta mark set 0x6d6f6c65
$ sudo nft list ruleset | grep mullvad
table inet mullvad {
    chain prerouting {
        type filter hook prerouting priority -199; policy accept;
        iif != "wg0-mullvad" ct mark 0x00000f41 meta mark set 0x6d6f6c65
        ip saddr 170.62.100.66 udp sport 10501 meta mark set 0x6d6f6c65
        ip saddr 192.168.11.2 meta mark set 0x6d6f6c65
    }
    ...
}

Mas isso não fez nada.

$ ip route get 8.8.8.8 from 192.168.11.2
8.8.8.8 from 192.168.11.2 dev wg0-mullvad table 1836018789 uid 1000 
    cache 

$ sudo ip netns exec bl traceroute -n 8.8.8.8
traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 60 byte packets
 1  * * *
 2  * * *
 3  * * *
 4  * * *
 5  * * *
 6  *^C

Cometi algum erro ou toda a minha abordagem é falha?

linux