主页 / user-457324

Alexis's questions

Martin Hope
Alexis
Asked: 2021-11-15 07:06:39 +0800 CST
  • 1

故事

我有一个 VPN 线保护虚拟接口wg0（可以是其他任何东西）和一个物理接口eth0。我想将数据包从 VPN 路由到我的 LAN，或从一个接口路由到另一个接口。

几乎所有的博客、文章、教程都建议使用MASQUERADE或Source NAT仅使用：iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

而且，IP masquerade只是一个SNAT（Source NAT），它不会改变源端口。

问题

  • 我认为我应该使用NAPT/PAT是不是错了？
  • 为了完整起见，如何使用 iptables 和/或 nftables 添加 NAPT/PAT 规则？

想法

wg0由主机生成并从（或任何其他虚拟/物理接口）转发的数据包之间可能存在（源端口）冲突。恕我直言，必须使用 NAPT 来避免这些冲突。

RFC 2663，网络地址端口转换 (NAPT)

nat
Martin Hope
Alexis
Asked: 2019-05-11 01:34:12 +0800 CST
  • 2

我安装了仅配置 EAP-TLS 的 Radius 服务器。我有一个client.p12应该包含根 CA 和客户端证书的文件。

  1. 我添加了p12密钥

  2. 我配置了 SSID，但在 freeradius 的调试消息中，似乎 freeradius 无法验证我的密钥/证书。

error 20 at 0 depth lookup: unable to get local issuer certificate
(25) eap_tls: ERROR: Program returned code (2) and output 'error /tmp/radiusd/radiusd.client.XXK1l6r6: verification failed'
tls: Certificate CN (testuser@****.com) fails external verification!
(25) eap_tls: >>> send TLS 1.2  [length 0002] 
(25) eap_tls: ERROR: TLS Alert write:fatal:internal error
tls: TLS_accept: Error in error
(25) eap_tls: ERROR: Failed in __FUNCTION__ (SSL_read): error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
(25) eap_tls: ERROR: System call (I/O) error (-1)
(25) eap_tls: ERROR: TLS receive handshake failed during operation
(25) eap_tls: ERROR: [eaptls process] = fail
(25) eap: ERROR: Failed continuing EAP TLS (13) session.  EAP sub-module failed
(25) eap: Sending EAP Failure (code 4) ID 7 length 4
(25) eap: Failed in EAP select
(25)     [eap] = invalid
(25)   } # authenticate = invalid
(25) Failed to authenticate the user
(25) Using Post-Auth-Type Reject
(25) # Executing group from file /etc/freeradius/3.0/sites-enabled/***network
(25)   Post-Auth-Type REJECT {
(25) attr_filter.access_reject: EXPAND %{User-Name}
(25) attr_filter.access_reject:    --> testuser@@****..com
(25) attr_filter.access_reject: Matched entry DEFAULT at line 11
(25)     [attr_filter.access_reject] = updated
(25)   } # Post-Auth-Type REJECT = updated
(25) Delaying response for 1.000000 seconds
Waking up in 0.6 seconds.
Waking up in 0.3 seconds.
(25) Sending delayed response
(25) Sent Access-Reject Id 25 from 172.17.0.2:1812 to 172.17.0.1:33331 length 44
(25)   EAP-Message = 0x04070004
(25)   Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.8 seconds.
(20) Cleaning up request packet ID 20 with timestamp +1661
(21) Cleaning up request packet ID 21 with timestamp +1661
(22) Cleaning up request packet ID 22 with timestamp +1661
(23) Cleaning up request packet ID 23 with timestamp +1661
(24) Cleaning up request packet ID 24 with timestamp +1661
(25) Cleaning up request packet ID 25 with timestamp +1661
Ready to process requests

问题：如何在 CLI 中使用我的 p12 密钥测试我的 freeradius 服务器，而无需从 Windows 设置所有内容？

openssl