Início / unix / Perguntas / 418908
Accepted
Pink Panther
Asked: 2018-01-23 09:17:28 +0800 CST

problemas ao definir regras de encaminhamento adequadas em `iptables` com endereço IP personalizado para compartilhamento de rede

  • 772

Estou tendo problemas para configurar uma ponte para meu raspberry pi.

Minha configuração é:
Eu tenho um laptop rodando a estação de trabalho fedora 27 que está conectada à internet por wifi. Eu tenho um Raspberry Pi Zero W que está conectado ao meu laptop via usb(e apenas usb, sem energia externa, sem ethernet, nada).
Eu atualizei a imagem stretch lite para o meu pi e instalei P4wnP1a partir daqui: https://github.com/mame82/P4wnP1
Antes de instalar P4wnP1meu pi tinha um endereço aleatório 169.254.xxx.xxx, é por isso que mudei o ip da minha interface usb ethernet para um adequado sub-rede para ssho pi. Depois de um tempo, descobri a configuração certa para colocar meu pi online e baixar o git para clonar o repositório.

Depois que executei install.she reiniciei o pi, o pi tinha um endereço IP estático 172.16.0.1. E tentei a mesma coisa para colocá-lo online, mudei o ip da minha interface, ssh para pi, configurei o gateway para minha máquina fedora.
Mas não consigo obter o pi online.

Provavelmente devo mencionar aqui que habilitei "compartilhar conexão com outros computadores" network managere também tentei muitas coisas com iptableso , mas não consigo fazê-lo funcionar.

Passei os últimos 3 dias tentando descobrir, mas não tive sucesso.

aqui está o meu ifconfig no meu fedora:

$ ifconfig
enp0s20f0u6i1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.16.0.2  netmask 255.255.0.0  broadcast 172.16.255.255
        inet6 fe80::f7f7:80c:8a15:5771  prefixlen 64  scopeid 0x20<link>
        ether ee:98:9b:bc:37:ab  txqueuelen 1000  (Ethernet)
        RX packets 2687  bytes 186674 (182.2 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1648  bytes 176862 (172.7 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

enp0s31f6: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        ether c8:5b:76:6b:e4:90  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device interrupt 16  memory 0xf1200000-f1220000  

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 1982  bytes 177290 (173.1 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 1982  bytes 177290 (173.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.122.1  netmask 255.255.255.0  broadcast 192.168.122.255
        ether 52:54:00:08:e4:d3  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp4s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.2.106  netmask 255.255.255.0  broadcast 192.168.2.255
        inet6 fe80::ebcf:d3b1:5a74:185e  prefixlen 64  scopeid 0x20<link>
        ether e4:a7:a0:99:2e:8d  txqueuelen 1000  (Ethernet)
        RX packets 135496  bytes 72791497 (69.4 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 51579  bytes 21450089 (20.4 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

aqui a enp0s20f06i3interface é aquela conectada ao pi. Antes de alterar seu endereço IP, ele tinha um 10.46.0.1endereço, que também é o mesmo endereço após a reinicialização.

aqui route -ndo meu pi

pi@MAME82-P4WNP1:~ $ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.16.0.2      0.0.0.0         UG    0      0        0 usb0
172.16.0.0      0.0.0.0         255.255.255.252 U     0      0        0 usb0
172.24.0.0      0.0.0.0         255.255.255.0   U     0      0        0 wlan0

e o ifconfig do meu pi

pi@MAME82-P4WNP1:~ $ ifconfig
lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

usb0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.16.0.1  netmask 255.255.255.252  broadcast 172.16.0.3
        inet6 fe80::cc4b:62ff:fe84:7df0  prefixlen 64  scopeid 0x20<link>
        ether ce:4b:62:84:7d:f0  txqueuelen 1000  (Ethernet)
        RX packets 1959  bytes 182340 (178.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 3197  bytes 269463 (263.1 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.24.0.1  netmask 255.255.255.0  broadcast 172.24.0.255
        inet6 fe80::ba27:ebff:fe5e:ceb7  prefixlen 64  scopeid 0x20<link>
        ether b8:27:eb:5e:ce:b7  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 14  bytes 1404 (1.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

e aqui route -nno meu fedora

$ route -n                 
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.2.1     0.0.0.0         UG    600    0        0 wlp4s0
172.16.0.0      0.0.0.0         255.255.0.0     U     0      0        0 enp0s20f0u6i1
192.168.2.0     0.0.0.0         255.255.255.0   U     600    0        0 wlp4s0
192.168.122.0   0.0.0.0         255.255.255.0   U     0      0        0 virbr0

resolv.confno meu pi

pi@MAME82-P4WNP1:~ $ cat /etc/resolv.conf
# Generated by resolvconf
nameserver 10.46.0.1
nameserver 8.8.8.8
nameserver 8.8.4.4

e /etc/network/interfacesno meu pi

pi@MAME82-P4WNP1:~ $ cat /etc/network/interfaces
# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d


dns-nameservers 8.8.8.8 8.8.4.4

auto usb0

iface usb0 inet manual

auto usb1

iface usb1 inet manual

finalmente iptablesestou no meu fedora, onde acho que o problema é:

$ sudo iptables -L                                                          
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:domain
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootps
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:bootps
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
INPUT_direct  all  --  anywhere             anywhere            
INPUT_ZONES_SOURCE  all  --  anywhere             anywhere            
INPUT_ZONES  all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             10.42.0.0/24         state RELATED,ESTABLISHED
ACCEPT     all  --  10.42.0.0/24         anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             192.168.122.0/24     ctstate RELATED,ESTABLISHED
ACCEPT     all  --  192.168.122.0/24     anywhere            
ACCEPT     all  --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
REJECT     all  --  anywhere             anywhere             reject-with icmp-port-unreachable
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
FORWARD_direct  all  --  anywhere             anywhere            
FORWARD_IN_ZONES_SOURCE  all  --  anywhere             anywhere            
FORWARD_IN_ZONES  all  --  anywhere             anywhere            
FORWARD_OUT_ZONES_SOURCE  all  --  anywhere             anywhere            
FORWARD_OUT_ZONES  all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere             ctstate INVALID
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:bootpc
OUTPUT_direct  all  --  anywhere             anywhere            

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination         
FWDI_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 
FWDI_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 
FWDI_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination         
FWDO_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 
FWDO_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 
FWDO_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_direct (1 references)
target     prot opt source               destination         

Chain FWDI_FedoraWorkstation (3 references)
target     prot opt source               destination         
FWDI_FedoraWorkstation_log  all  --  anywhere             anywhere            
FWDI_FedoraWorkstation_deny  all  --  anywhere             anywhere            
FWDI_FedoraWorkstation_allow  all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            

Chain FWDI_FedoraWorkstation_allow (1 references)
target     prot opt source               destination         

Chain FWDI_FedoraWorkstation_deny (1 references)
target     prot opt source               destination         

Chain FWDI_FedoraWorkstation_log (1 references)
target     prot opt source               destination         

Chain FWDO_FedoraWorkstation (3 references)
target     prot opt source               destination         
FWDO_FedoraWorkstation_log  all  --  anywhere             anywhere            
FWDO_FedoraWorkstation_deny  all  --  anywhere             anywhere            
FWDO_FedoraWorkstation_allow  all  --  anywhere             anywhere            

Chain FWDO_FedoraWorkstation_allow (1 references)
target     prot opt source               destination         

Chain FWDO_FedoraWorkstation_deny (1 references)
target     prot opt source               destination         

Chain FWDO_FedoraWorkstation_log (1 references)
target     prot opt source               destination         

Chain INPUT_ZONES (1 references)
target     prot opt source               destination         
IN_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 
IN_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 
IN_FedoraWorkstation  all  --  anywhere             anywhere            [goto] 

Chain INPUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain INPUT_direct (1 references)
target     prot opt source               destination         

Chain IN_FedoraWorkstation (3 references)
target     prot opt source               destination         
IN_FedoraWorkstation_log  all  --  anywhere             anywhere            
IN_FedoraWorkstation_deny  all  --  anywhere             anywhere            
IN_FedoraWorkstation_allow  all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            

Chain IN_FedoraWorkstation_allow (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:netbios-ns ctstate NEW
ACCEPT     udp  --  anywhere             anywhere             udp dpt:netbios-dgm ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh ctstate NEW
ACCEPT     udp  --  anywhere             224.0.0.251          udp dpt:mdns ctstate NEW
ACCEPT     udp  --  anywhere             anywhere             udp dpts:blackjack:65535 ctstate NEW
ACCEPT     tcp  --  anywhere             anywhere             tcp dpts:blackjack:65535 ctstate NEW

Chain IN_FedoraWorkstation_deny (1 references)
target     prot opt source               destination         

Chain IN_FedoraWorkstation_log (1 references)
target     prot opt source               destination         

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

Acho que preciso apenas adicionar as entradas adequadas, mas não consegui descobrir, pesquisei em muitos fóruns.
existe uma maneira de alterar as 10.46.0.0/24entradas para a 172.16.0.0/24rede?
porque minha interface tinha esse ip antes e se eu pudesse apenas trocar o ip nas regras eu estaria feito, certo?

Eu tentei sudo iptables -t nat -A POSTROUTING -o wlp4s0 -j MASQUERADEe também tentei definir as regras sozinho, porém não consigo definir minhas FORWARDregras de acordo.

networking ssh

1 respostas

  1. Best Answer

    Resumo:

    O Pi precisa do Fedora para encaminhar o tráfego para a Internet.

    pi

    1 placa de rede (da qual nos importamos) chamada:

    usb0 -- conectado ao Fedora.

    Fedora:

    Conectado à Internet.

    2 placas de rede (das quais nos importamos) nomeadas:

    wlp4s0 -- internet wi-fi

    enp0s20f0u6i1 -- conectado ao pi.

    Para tornar a vida mais simples, recomendo parar com os nomes de interface de rede previsíveis. Queremos usar nomes nic e não queremos que eles mudem conosco.

    Etapa 1: Pare os nomes de interface de rede previsíveis do systemd adicionando "net.ifnames=0" à linha de comando do kernel.

    sudo vi /etc/default/grub

    GRUB_CMDLINE_LINUX="net.ifnames=0"

    Agora atualize o grub:

    sudo grub-mkconfig -o /boot/grub/grub.cfg

    Nota:

    Eu vi onde o valor "biosdevname=0" foi adicionado à linha de comando do kernal além de net.ifnames=0. Minha configuração não exigia isso.

    Passo 2:

    Atribua um novo nome usando as regras do udev criando um novo arquivo de regras

    sudo vi /etc/udev/rules.d/10-myCustom-net.rules

    SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="08:00:27:f3:79:59", KERNEL=="eth*", NAME="test0"

    DEVE alterar a ATTR{address}=="08:00:27:f3:79:59"linha para o seu endereço MAC.

    Mude NAME="test0"para o nome que deseja dar ao nic.

    Nota:

    Removido ATTR{dev_id}=="0x0" and ATTR{type}=="1"do meu modelo Ubuntu 14.

    Alguns dizem para remover KERNEL=="eth*"ou toda a linha é ignorada. Não foi o que aconteceu no meu setup.

    Se você 'perder' o endereço MAC como eu fiz porque reiniciei antes desta etapa, não aparece com ifconfig, vá encontrá-lo em /sys/class/net/assignedName/address.

    BTW: este sistema o renomeou eth0,cat /sys/class/net/eth0/address

    Etapa 3:

    Atribua um endereço ao novo nome de interface

    sudo vi /etc/network/interfaces

    auto test0
iface test0 inet static
    address 192.168.2.202 --  use your address
    netmask 255.255.255.0 --  use your address
and what other entries your system requires.

    Passo 4:

    reiniciar (é apenas mais fácil para a maioria de nós)

    Agora isso nos dá um nome estático para o nosso nic.

    Você só adicionará regras iptable ao Fedora, então isso não é necessário no Pi.

    Suposições:

    Tanto o Fedora quanto o Pi têm tabelas de roteamento padrão e nenhuma regra de iptable.

    Nota:

    Queremos manter nosso endereço IP privado privado e não público.

    RFC1918 name    IP address range    largest CIDR block (subnet mask)
24-bit block    10.0.0.0 – 10.255.255.255   10.0.0.0/8 (255.0.0.0)
20-bit block    172.16.0.0 – 172.31.255.255 172.16.0.0/12 (255.240.0.0)
16-bit block    192.168.0.0 – 192.168.255.255   192.168.0.0/16 (255.255.0.0)

    Pi:

    Atribuir endereço IP a usb0

    sudo vi /etc/network/interfaces

    auto usb0
iface usb0 inet static
    address 172.16.0.1
    netmask 255.240.0.0
add any other values needed.

    Fedora:

    Ativar encaminhamento ipv4

    sudo vi /etc/sysctl.conf

    net.ipv4.ip_forward=1

    Atribua o endereço IP para test0 (lembre-se de que alteramos o nome do nic acima)

    sudo vi /etc/network/interfaces

    # This connects to the Pi
auto test0
iface test0 inet static
    address 172.16.0.2
    netmask 255.240.0.0
add any other values needed.

# This is the internet connection
auto wlp4s0
iface wlp4s0 inet static
    address 192.168.2.106
    netmask 255.255.255.255
add any other values needed like
    gateway a.b.c.d
    dns-nameservers 8.8.8.8 8.8.4.4

    If wlp4s0 address assigned by DHCP it would look more like this

    This is the internet connection

    auto wlp4s0
iface wlp4s0 inet dhcp

    Set the iptable rules to forward the packets from test0 to wlp4s0 AND wrap the packets with a local subnet addressed... wrapper. Entering rules at the command line.

    # this rule will forward all traffic from nic test0 to nic wlp4s0
sudo iptables -A FORWARD -i test0 -o wlp4s0 -j ACCEPT
# this rule will continue to forward any existing connections from test0 to wlp4so
sudo iptables -A FORWARD -i test0 -o wlp4s0 -m state --state ESTABLISHED,RELATED -j ACCEPT

# this rule will wrap the packet with a local address so they do not get lost in transit.
sudo iptables -t nat -A POSTROUTING -j MASQUERADE

    note:

    No firewall rules are enabled. This is a bare minimum to get it working. Add other rules to secure your system.

    Make the iptable rules persistent across reboots.

    On Ubuntu16 the package name is iptables-persistent. Fedora may be different.

    sudo apt-get install iptables-persistent

    Save the current iptable rules

    iptables-save > /etc/iptables/rules.v4

    Reboot fedora.

    Verify:

    ip addresses.

    iptable rules

    • 1

relate perguntas