我有一个 Proxmox Linux 服务器，它能够向本地网络上的主机发送和接收数据包，但不会处理来自网关的数据包。这会导致互联网流量失败，因此我无法运行 apt 来更新软件包。所有协议似乎都受到影响。
服务器上运行的虚拟机可以正常访问网关。
我的 /etc/network/interfaces 文件包含：
auto lo
iface lo inet loopback
iface enp10s0 inet manual
auto vmbr0
iface vmbr0 inet static
address 10.0.1.200/24
gateway 10.0.1.1
bridge_ports enp10s0
bridge_stp off
bridge_fd 0
auto wlp7s0
iface wlp7s0 inet static
hostapd /etc/hostapd/hostapd.conf
address 10.0.2.1
netmask 255.255.255.0
auto vmbr1
iface vmbr1 inet static
address 10.1.2.1
netmask 255.255.255.0
bridge_ports none
bridge-stp off
bridge-fd 0
post-up echo 1 > /proc/sys/net/ipv4/ip_forward
post-up iptables -t nat -A POSTROUTING -s '10.1.2.0/24' -o wlp7s0 -j MASQUERADE
post-down iptables -t nat -D POSTROUTING -s '10.1.2.0/24' -o wlp7s0 -j MASQUERADE
wlp7s0 和 vmbr1 进行了 NAT，以允许 VM 访问不应访问一般网络/互联网的无线 IOT 设备。
我的路由表：
$ ip route
default via 10.0.1.200 dev vmbr0 metric 100
10.0.1.0/24 dev vmbr0 proto kernel scope link src 10.0.1.200
10.0.2.0/24 dev wlp7s0 proto kernel scope link src 10.0.2.1
10.1.2.0/24 dev vmbr1 proto kernel scope link src 10.1.2.1
经过一番阅读，我尝试更改 rp_filter，但将值从 2 更改为 0 并没有帮助。默认设置（移除 VM 接口）：
$ sysctl -a | grep \\.rp_filter
net.ipv4.conf.all.rp_filter = 2
net.ipv4.conf.default.rp_filter = 0
net.ipv4.conf.enp10s0.rp_filter = 0
net.ipv4.conf.lo.rp_filter = 0
net.ipv4.conf.vmbr0.rp_filter = 0
net.ipv4.conf.vmbr1.rp_filter = 0
net.ipv4.conf.wlp7s0.rp_filter = 0
ip_forward 已设置：
$ cat /proc/sys/net/ipv4/ip_forward
1
我已通过 tcpdump 验证，当我尝试从服务器 ping 到网关或从服务器到网关时，正在从网关接收数据包。此示例使用 ping：
# tcpdump -n -i vmbr0 host 10.0.1.1 and icmp
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on vmbr0, link-type EN10MB (Ethernet), capture size 262144 bytes
22:42:37.136341 IP 10.0.1.200 > 10.0.1.1: ICMP echo request, id 22073, seq 1, length 64
22:42:37.136478 IP 10.0.1.1 > 10.0.1.200: ICMP echo reply, id 22073, seq 1, length 64
22:42:38.142240 IP 10.0.1.200 > 10.0.1.1: ICMP echo request, id 22073, seq 2, length 64
22:42:38.142429 IP 10.0.1.1 > 10.0.1.200: ICMP echo reply, id 22073, seq 2, length 64
ping -v 的输出只是空的：
$ ping -v 10.0.1.1
PING 10.0.1.1 (10.0.1.1) 56(84) bytes of data.
^C
--- 10.0.1.1 ping statistics ---
22 packets transmitted, 0 received, 100% packet loss, time 511ms
ip 表中的唯一条目是 NAT：
# iptables-save -c
# Generated by iptables-save v1.8.2 on Sat Jan 29 22:45:46 2022
*raw
:PREROUTING ACCEPT [1828405583:1847667077335]
:OUTPUT ACCEPT [10762322:981310704]
COMMIT
# Completed on Sat Jan 29 22:45:46 2022
# Generated by iptables-save v1.8.2 on Sat Jan 29 22:45:46 2022
*filter
:INPUT ACCEPT [10597558:1212589593]
:FORWARD ACCEPT [1782904005:1841102268241]
:OUTPUT ACCEPT [10762351:981313827]
COMMIT
# Completed on Sat Jan 29 22:45:46 2022
# Generated by iptables-save v1.8.2 on Sat Jan 29 22:45:46 2022
*nat
:PREROUTING ACCEPT [29808561:4940456833]
:INPUT ACCEPT [2456738:231340403]
:OUTPUT ACCEPT [1168080:75403202]
:POSTROUTING ACCEPT [2829337:181352732]
[190:11400] -A POSTROUTING -s 10.1.2.0/24 -o wlp7s0 -j MASQUERADE
COMMIT
# Completed on Sat Jan 29 22:45:46 2022