主页 / user-506262

sunknudsen's questions

Martin Hope
sunknudsen
Asked: 2021-04-20 06:48:26 +0800 CST
  • 2

我使用以下实现了 SSH 连接速率限制。

iptables -N SSH_BRUTE_FORCE_MITIGATION
iptables -A SSH_BRUTE_FORCE_MITIGATION -m recent --name SSH --set
iptables -A SSH_BRUTE_FORCE_MITIGATION -m recent --name SSH --update --seconds 300 --hitcount 10 -m limit --limit 1/second --limit-burst 100 -j LOG --log-prefix "iptables[ssh-brute-force]: "
iptables -A SSH_BRUTE_FORCE_MITIGATION -m recent --name SSH --update --seconds 300 --hitcount 10 -j DROP
iptables -A SSH_BRUTE_FORCE_MITIGATION -j ACCEPT

如何重置速率限制计数器？

编辑：尝试过sudo iptables -Z，但引发以下错误。

$ sudo iptables -Z
[sudo] password for pi:
iptables v1.8.2 (nf_tables):  RULE_REPLACE failed (Invalid argument): rule in chain INPUT
iptables
Martin Hope
sunknudsen
Asked: 2020-08-11 07:35:29 +0800 CST
  • 1

我目前有以下内容：

ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 1 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 2 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 3 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 4 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 128 -j ACCEPT
ip6tables -A INPUT -p ipv6-icmp --icmpv6-type 129 -j ACCEPT

对于 ICMPv6 类型 3，我只想接受代码 0。

对于 ICMPv6 类型 4，我只想接受代码 1 和 2。

这是基于RFC 4890的。

iptables
Martin Hope
sunknudsen
Asked: 2020-08-08 13:14:05 +0800 CST
  • 0

我的理解是 10.0.2.1/32 表示 10.0.2.1 而 10.0.2.1/24 表示 10.0.2.1 到 10.0.2.255。

例如/etc/network/interfaces，/24在配置静态 IP 时使用。

但是 in表示子网/etc/iptables/rules.v4中-d 10.0.2.0/24的任何 IP 255.255.255.0... 等于 10.0.2.0 到 10.0.2.255 对吗？

对不起新手的问题......我很困惑！

networking debian
Martin Hope
sunknudsen
Asked: 2020-06-24 05:17:38 +0800 CST
  • 1

使用终端，我运行以下命令。

ssh [email protected] -i ~/.ssh/admin -N -D 9090

Firefox 配置如下。

火狐袜子 5

许多网站工作得很好，但某些网站失败了，并且在终端上抛出了以下错误。

channel 1: open failed: administratively prohibited: open failed

我的研究指出了tail auth.log在服务器上运行所表明的 DNS 问题。

error: connect_to ipleak.net: unknown host (Temporary failure in name resolution)

我该如何解决这个问题？

debian firefox proxy socks
Martin Hope
sunknudsen
Asked: 2020-05-03 04:39:59 +0800 CST
  • 2

这是我当前的ipsec.conf.

我需要更改什么以确保客户端无限期地重试连接到服务器。

$ cat /etc/ipsec.conf

conn %default
    ike=aes256gcm16-sha384-modp3072!
    esp=aes256gcm16-sha384-modp3072!

conn ikev2
    auto=start
    dpdaction=restart
    closeaction=restart
    keyingtries=%forever
    [email protected]
    leftsourceip=%config
    leftauth=eap-tls
    leftcert=vpn-client.crt
    right=159.203.26.109
    rightid=my-vpn.com
    rightsubnet=0.0.0.0/0
    rightauth=pubkey
ipsec strongswan
Martin Hope
sunknudsen
Asked: 2020-05-03 04:28:32 +0800 CST
  • 0

不久前我写了一个 strongSwan指南，我遵循了。

然后我为 DHCP 安装isc-dhcp-server并配置了 strongSwan。

一切正常，除了客户端无法通过 SSH 连接到 VPN 服务器或 VPN 子网上的其他客户端 ( 10.0.2.0/24)。

我无法弄清楚我错过了什么。我在另一台服务器上执行了完全相同的步骤，客户端可以通过 SSH 连接到 VPN 服务器和其他客户端（相同的配置，但 strongSwan 版本5.5.1vs 5.7.2）。

$ ipsec --version

Linux strongSwan U5.7.2/K4.19.0-8-amd64

$ cat /etc/ipsec.conf

config setup
  charondebug="ike 1, knl 1, cfg 0"
  uniqueids=never

conn ikev2
  auto=add
  compress=no
  type=tunnel
  keyexchange=ikev2
  fragmentation=yes
  forceencaps=yes
  ike=aes256gcm16-sha384-modp3072!
  esp=aes256gcm16-sha384-modp3072!
  dpdaction=clear
  dpddelay=300s
  rekey=no
  left=%any
  leftid=my-vpn.com
  leftcert=vpn-server.crt
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  right=%any
  rightid=%any
  rightauth=eap-tls
  rightdns=1.1.1.1,1.0.0.1
  rightsourceip=%dhcp
  rightsendcert=never
  eap_identity=%identity

$ cat /etc/strongswan.conf

libtls {
  suites = TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
}
charon {
  plugins {
    dhcp {
      force_server_address = yes
      identity_lease = yes
      interface = ens3
      load = yes
      server = 10.0.2.255
    }
  }
}

$ cat /etc/network/interfaces

# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
allow-hotplug ens3
iface ens3 inet static
    # Redacted

# The VPN DHCP network interface
auto ens3:1
iface ens3:1 inet static
    address 10.0.2.1
    netmask 255.255.255.0

$ cat /etc/dhcp/dhcpd.conf

default-lease-time 600;
max-lease-time 7200;
ddns-update-style none;
subnet 10.0.2.0 netmask 255.255.255.0 {
  range 10.0.2.10 10.0.2.254;
}

$ iptables-save

# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*mangle
:PREROUTING ACCEPT [33047:26369989]
:INPUT ACCEPT [15485:16310786]
:FORWARD ACCEPT [16291:10015891]
:OUTPUT ACCEPT [13361:11160535]
:POSTROUTING ACCEPT [29612:21159798]
-A FORWARD -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
-A FORWARD -p tcp -m policy --dir out --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT
# Completed on Sat May  2 08:16:30 2020
# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*nat
:PREROUTING ACCEPT [1644:68855]
:INPUT ACCEPT [58:4901]
:POSTROUTING ACCEPT [124:8399]
:OUTPUT ACCEPT [138:9996]
-A POSTROUTING -s 10.0.2.0/24 -o ens3 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.0.2.0/24 -o ens3 -j MASQUERADE
COMMIT
# Completed on Sat May  2 08:16:30 2020
# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*filter
:INPUT DROP [82:5220]
:FORWARD DROP [32:18146]
:OUTPUT DROP [17:1198]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A INPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 50 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -m connlimit --connlimit-above 50 --connlimit-mask 32 --connlimit-saddr -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p udp -m udp --sport 67:68 --dport 67:68 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 123 -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
COMMIT
# Completed on Sat May  2 08:16:30 2020
# Generated by xtables-save v1.8.2 on Sat May  2 08:16:30 2020
*raw
:PREROUTING ACCEPT [33047:26369989]
:OUTPUT ACCEPT [13361:11160535]
COMMIT
# Completed on Sat May  2 08:16:30 2020

$ sysctl -p

net.ipv4.ip_forward = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
networking iptables ipsec strongswan
Martin Hope
sunknudsen
Asked: 2020-04-25 12:00:05 +0800 CST
  • 1

该错误发生在 LVM/LUKS Debian VPS 上。

我删除了swap卷并root使用以下方法增加了卷：

swapoff /dev/group/swap
lvremove group/swap
lvresize -rl +100%FREE /dev/group/root

现在，当我启动时，我收到以下错误消息：

Failed to find logical volume "group/swap"

一切正常，但我想修复导致此错误的任何原因。

lvm luks
Martin Hope
sunknudsen
Asked: 2020-04-16 03:20:36 +0800 CST
  • 0

我正在尝试按照我为拉伸编写的指南在 Debian buster 上设置一个 stronSwan 服务器。

与服务器的连接工作正常，但客户端无法访问互联网。

我错过了什么？

猫 /etc/ipsec.conf

config setup
  charondebug="ike 1, knl 1, cfg 0"
  uniqueids=never

conn ikev2
  auto=add
  compress=no
  type=tunnel
  keyexchange=ikev2
  fragmentation=yes
  forceencaps=yes
  ike=aes256gcm16-sha384-modp3072!
  esp=aes256gcm16-sha384-modp3072!
  dpdaction=clear
  dpddelay=300s
  rekey=no
  left=%any
  leftid=example.net
  leftcert=server.crt
  leftsendcert=always
  leftsubnet=0.0.0.0/0
  right=%any
  rightid=%any
  rightauth=eap-tls
  rightdns=1.1.1.1,1.0.0.1
  rightsourceip=10.0.2.0/24
  rightsendcert=never
  eap_identity=%identity

iptables-保存

# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*filter
:INPUT DROP [87:4831]
:FORWARD DROP [0:0]
:OUTPUT DROP [9:720]
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Apr 15 15:26:32 2020
# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*nat
:PREROUTING ACCEPT [1800:60571]
:INPUT ACCEPT [12:768]
:POSTROUTING ACCEPT [24:1586]
:OUTPUT ACCEPT [15:1122]
-A POSTROUTING -s 10.0.2.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
-A POSTROUTING -s 10.0.2.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Wed Apr 15 15:26:32 2020
# Generated by xtables-save v1.8.2 on Wed Apr 15 15:26:32 2020
*mangle
:PREROUTING ACCEPT [2413:113771]
:INPUT ACCEPT [701:58267]
:FORWARD ACCEPT [22:1424]
:OUTPUT ACCEPT [432:58684]
:POSTROUTING ACCEPT [445:59388]
-A FORWARD -s 10.0.2.0/24 -o eth0 -p tcp -m policy --dir in --pol ipsec -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
COMMIT
# Completed on Wed Apr 15 15:26:32 2020

sysctl -p

net.ipv4.ip_forward = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
strongswan
Martin Hope
sunknudsen
Asked: 2019-08-07 13:47:35 +0800 CST
  • 1

假设我有两台主机，a.example.com并且b.example.com只希望启用proxy_protocol负载a.example.com均衡器后面的主机（b.example.com用于直接运行状况检查）。尝试了以下设置，但出现错误。

a.example.com

server {
    listen 80 proxy_protocol;
    listen 443 proxy_protocol ssl;

    server_name a.example.com;

    location / {
        proxy_pass http://localhost:8443;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_protocol_addr;
        proxy_cache_bypass $http_upgrade;
    }

    ssl_certificate /etc/letsencrypt/live/a.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/a.example.com/privkey.pem;
}

b.example.com

server {
    listen 80;

    server_name b.example.com;

    location /healthcheck {
        proxy_pass http://localhost:8443;
        access_log off;
    }
}

错误

2019/08/06 17:40:50 [error] 10488#10488: *12 broken header: "GET /healthcheck HTTP/1.1
Host: b.example.com
Connection: keep-alive
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

" while reading PROXY protocol, client: 1.2.3.4, server: 0.0.0.0:80
nginx
Martin Hope
sunknudsen
Asked: 2019-06-26 16:07:57 +0800 CST
  • 1

目前，我使用以下配置。我应该切换到rekey=yes，如果是，为什么？我希望强制执行完美前向保密 (PFS)。欢迎提出其他安全建议。

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=never

conn ikev2
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256gcm16-sha384-modp3072!
    esp=aes256gcm16-sha384-modp3072!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=my-vpn.com
    leftcert=vpn-server.crt
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-tls
    rightdns=1.1.1.1,1.0.0.1
    rightsourceip=%dhcp
    rightsendcert=never
    eap_identity=%identity
strongswan
Martin Hope
sunknudsen
Asked: 2019-06-06 08:52:07 +0800 CST
  • 1

我rightsourceip=%dhcp在服务器上使用，所以两个客户端不能有相同的leftid.

在使用之前rightsourceip=%dhcp，我使用uniqueids=never并10.0.2.0/24允许多个客户端使用相同的leftid，但这似乎不起作用rightsourceip=%dhcp（我做错了什么吗？）。

看起来受监督（始终在线）的 iOS VPN 客户端建立了两个关联，一个通过 LTE，一个通过 Wi-Fi……这会中断与 VPN 服务器的连接。猜猜服务器不知道必须将数据包发送到哪个关联......并且一旦 Wi-Fi 启动，iOS 可能不会在两个接口上进行监听。

我怎样才能解决这个问题？还有，什么rekeying disabled意思？

Security Associations (5 up, 0 connecting):
       ikev2[7]: ESTABLISHED 65 seconds ago, 159.203.26.109[my-vpn.com]...207.46.13.62[[email protected]]
       ikev2[7]: IKEv2 SPIs: 0a53e7fec5e65e2b_i 2d03da3fce35f91c_r*, rekeying disabled
       ikev2[7]: IKE proposal: AES_GCM_16_256/PRF_HMAC_SHA2_384/MODP_3072
       ikev2{7}:  INSTALLED, TUNNEL, reqid 5, ESP in UDP SPIs: c468b92b_i 00006960_o
       ikev2{7}:  AES_GCM_16_256, 8795 bytes_i (22 pkts, 0s ago), 4983 bytes_o (19 pkts, 41s ago), rekeying disabled
       ikev2{7}:   0.0.0.0/0 === 10.0.2.13/32
       ikev2[6]: ESTABLISHED 65 seconds ago, 159.203.26.109[my-vpn.com]...157.55.39.61[[email protected]]
       ikev2[6]: IKEv2 SPIs: e2a7434252a49075_i fe57e34b97ba086e_r*, rekeying disabled
       ikev2[6]: IKE proposal: AES_GCM_16_256/PRF_HMAC_SHA2_384/MODP_3072
       ikev2{6}:  INSTALLED, TUNNEL, reqid 5, ESP in UDP SPIs: cdc9dd9c_i 0ec723e6_o
       ikev2{6}:  AES_GCM_16_256, 8170 bytes_i (122 pkts, 0s ago), 0 bytes_o, rekeying disabled
       ikev2{6}:   0.0.0.0/0 === 10.0.2.13/32
ios
Martin Hope
sunknudsen
Asked: 2019-06-04 16:53:14 +0800 CST
  • 6

如果服务器关闭，我希望客户端无限期地尝试重新连接，所以当它回来时，客户端只是重新连接。

客户ipsec.conf

conn %default
    ike=aes256gcm16-sha384-modp3072!
    esp=aes256gcm16-sha384-modp3072!

conn ikev2
    auto=start
    [email protected]
    leftsourceip=%config
    leftauth=eap-tls
    leftcert=vpn-client.crt
    right=my-vpn.com
    rightid=my-vpn.com
    rightsubnet=0.0.0.0/0
    rightauth=pubkey
strongswan
Martin Hope
sunknudsen
Asked: 2019-05-24 10:34:33 +0800 CST
  • 1

服务器ipsec.conf

config setup
    charondebug="ike 1, knl 1, cfg 0"
    uniqueids=never

conn ikev2
    auto=add
    compress=no
    type=tunnel
    keyexchange=ikev2
    fragmentation=yes
    forceencaps=yes
    ike=aes256gcm16-sha384-modp3072!
    esp=aes256gcm16-sha384-modp3072!
    dpdaction=clear
    dpddelay=300s
    rekey=no
    left=%any
    leftid=my-vpn.com
    leftcert=vpn-server.crt
    leftsendcert=always
    leftsubnet=0.0.0.0/0
    right=%any
    rightid=%any
    rightauth=eap-tls
    rightdns=1.1.1.1,1.0.0.1
    rightsourceip=10.0.2.0/24
    rightsendcert=never
    eap_identity=%identity

服务器iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 443 -m conntrack --ctstate NEW -m limit --limit 60/sec --limit-burst 20 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m udp --dport 500 -j ACCEPT
-A INPUT -p udp -m udp --dport 4500 -j ACCEPT
-A FORWARD -s 10.0.2.0/24 -m policy --dir in --pol ipsec --proto esp -j ACCEPT
-A FORWARD -d 10.0.2.0/24 -m policy --dir out --pol ipsec --proto esp -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

客户ipsec.conf

conn ikev2
    auto=start
    [email protected]
    leftsourceip=%config
    leftauth=eap-tls
    leftcert=vpn-client.crt
    right=my-vpn.com
    rightid=my-vpn.com
    rightauth=pubkey

客户iptables -S

-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 80 -m state --state NEW -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 443 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 500 -m state --state NEW -j ACCEPT
-A OUTPUT -p udp -m udp --dport 4500 -m state --state NEW -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

连接已建立，但当我运行时curl https://checkip.amazonaws.com，返回的 IP 是客户端公共 IP 与服务器公共 IP（预期）。如何通过 VPN 路由所有流量？

此外，无法从服务器 SSH 到客户端。为什么？

谢谢！

strongswan
Martin Hope
sunknudsen
Asked: 2019-05-16 06:25:45 +0800 CST
  • -1

我在服务器上使用以下规则：

sudo iptables -A INPUT -p udp --dport  500 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 4500 -j ACCEPT
sudo iptables -A FORWARD --match policy --pol ipsec --dir in  --proto esp -s 10.0.2.0/24 -j ACCEPT
sudo iptables -A FORWARD --match policy --pol ipsec --dir out --proto esp -d 10.0.2.0/24 -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 10.0.2.0/24 -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
sudo iptables -t nat -A POSTROUTING -s 10.0.2.0/24 -o eth0 -j MASQUERADE
sudo iptables -t mangle -A FORWARD --match policy --pol ipsec --dir in -s 10.0.2.0/24 -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360

客户端的等价物是什么？

strongswan