主页 / user-1062267

Matija Sirk's questions

Martin Hope
Matija Sirk
Asked: 2023-11-24 18:01:17 +0800 CST
  • 6

设置

在带有 Debian Bookworm 的主机服务器上，我通过 cockpit (kvm)创建了两个 VM（pserver 192.168.122.227 和pagent-1 192.168.122.126）。他们都运行 Debian Bullseye。我正在使用默认网络。

此时一切正常，我可以从其中任何一个访问网络。

由于我只有一个 IPv4 地址而无法使用网桥，因此我想将 80 和 443 端口从主机转发到pserver。所以我/etc/libvirt/hooks/qemu在主机上创建了：

#!/bin/bash

# Source: https://wiki.libvirt.org/Networking.html#Forwarding_Incoming_Connections

if [ "${1}" = "pserver" ]; then

   GUEST_IP=192.168.122.227

   if [ "${2}" = "stopped" ] || [ "${2}" = "reconnect" ]; then
    /sbin/iptables -D FORWARD -o virbr0 -p tcp -d $GUEST_IP --dport 80 -j ACCEPT
    /sbin/iptables -t nat -D PREROUTING -p tcp --dport 80 -j DNAT --to $GUEST_IP:80
    /sbin/iptables -D FORWARD -o virbr0 -p tcp -d $GUEST_IP --dport 443 -j ACCEPT
    /sbin/iptables -t nat -D PREROUTING -p tcp --dport 443 -j DNAT --to $GUEST_IP:443
   fi
   if [ "${2}" = "start" ] || [ "${2}" = "reconnect" ]; then
    /sbin/iptables -I FORWARD -o virbr0 -p tcp -d $GUEST_IP --dport 80 -j ACCEPT
    /sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 -j DNAT --to $GUEST_IP:80
    /sbin/iptables -I FORWARD -o virbr0 -p tcp -d $GUEST_IP --dport 443 -j ACCEPT
    /sbin/iptables -t nat -I PREROUTING -p tcp --dport 443 -j DNAT --to $GUEST_IP:443
   fi
fi

我的问题

进行此更改后，从主机到两个虚拟机的 SSH 都可以工作，但在pserver和pagent-1sudo apt update上都失败，因为它无法访问. 在主机上一切正常。deb.debian.org

在pserver上：

sudo apt update
Err:1 http://deb.debian.org/debian bullseye InRelease
  Cannot initiate the connection to debian.map.fastlydns.net:80 (2a04:4e42:8e::644). - connect (101: Network is unreachable) Could not connect to debian.map.fastlydns.net:80 (146.75.122.132), connection timed out Cannot initiate the connection to deb.debian.org:80 (2a04:4e42:8e::644). - connect (101: Network is unreachable)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
All packages are up to date.
W: Failed to fetch http://deb.debian.org/debian/dists/bullseye/InRelease  Cannot initiate the connection to debian.map.fastlydns.net:80 (2a04:4e42:8e::644). - connect (101: Network is unreachable) Could not connect to debian.map.fastlydns.net:80 (146.75.122.132), connection timed out Cannot initiate the connection to deb.debian.org:80 (2a04:4e42:8e::644). - connect (101: Network is unreachable)
W: Some index files failed to download. They have been ignored, or old ones used instead.

我可以 ping 通它，但无法 ping 通它：

ping deb.debian.org
PING debian.map.fastlydns.net (146.75.122.132) 56(84) bytes of data.
64 bytes from 146.75.122.132 (146.75.122.132): icmp_seq=1 ttl=59 time=5.33 ms
64 bytes from 146.75.122.132 (146.75.122.132): icmp_seq=2 ttl=59 time=5.37 ms

wget http://deb.debian.org/debian/
--2023-11-24 10:52:59--  http://deb.debian.org/debian/
Resolving deb.debian.org (deb.debian.org)... 146.75.122.132, 2a04:4e42:8e::644
Connecting to deb.debian.org (deb.debian.org)|146.75.122.132|:80...

然后它就卡住了。

我是否不小心将 iptables 规则设置得太宽泛或者覆盖了某些 iptables 规则？

networking