主页 / ubuntu / 问题 / 1378968
Accepted
nightwatch
Asked: 2021-12-04 00:34:08 +0800 CST

UFW 取消阻止主机到访客流量

  • 772

我在 Ubuntu 20.04 上，我已启用 UFW 作为 killswitch 以与我的wireguard vpn 一起使用。我当前的规则运行良好，除了我的 ubuntu 主机和我的 debian 10.5 virtualbox 来宾之间的流量被阻止。

如何解锁主机/访客流量？

我目前的 UFW 规则是：

[ 1] 22/tcp                     ALLOW IN    Anywhere                  
[ 2] Anywhere                   ALLOW OUT   Anywhere on wg-client1     (out)
[ 3] 80/tcp                     ALLOW IN    Anywhere                  
[ 4] 443/tcp                    ALLOW IN    Anywhere                  
[ 5] Anywhere on wg-client1     ALLOW IN    Anywhere                  
[ 6] 94.121.83.88               ALLOW OUT   Anywhere                   (out)
[ 7] 21/tcp                     ALLOW IN    Anywhere                  
[ 8] 53                         ALLOW OUT   Anywhere                   (out)
[ 9] 9418/tcp                   ALLOW IN    Anywhere

我以前尝试过以下都失败了（即当我 ping 访客 ip192.168.0.84 时，我得到了ping: sendmsg: Operation not permitted）

[10] 22/tcp                     ALLOW IN    10.10.10.2                
[11] 22/tcp                     ALLOW IN    192.168.0.0/24            
[12] Anywhere                   ALLOW IN    192.168.0.0/24            
[13] 192.168.0.0/24             ALLOW IN    Anywhere                  
[14] 192.168.0.0/24 22          ALLOW IN    Anywhere                  
[15] Anywhere                   ALLOW IN    192.168.0.0/24 22

我还使用伪装将所有流量通过 vpn。我的ifconfig -a输出是：

enp3s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.18  netmask 255.255.255.0  broadcast 192.168.0.255
        ether b4:a9:fc:b0:b0:d1  txqueuelen 1000  (Ethernet)
        RX packets 668474  bytes 477052588 (477.0 MB)
        RX errors 0  dropped 1  overruns 0  frame 0
        TX packets 945227  bytes 553827446 (553.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        loop  txqueuelen 1000  (Local Loopback)
        RX packets 2106  bytes 198789 (198.7 KB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 2106  bytes 198789 (198.7 KB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vboxnet0: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        ether 0a:00:27:00:00:00  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

vboxnet1: flags=4098<BROADCAST,MULTICAST>  mtu 1500
        ether 0a:00:27:00:00:01  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wg-client1: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        inet 10.10.10.2  netmask 255.255.255.255  destination 10.10.10.2
        unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  txqueuelen 1000  (UNSPEC)
        RX packets 565766  bytes 350115976 (350.1 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 451704  bytes 440547648 (440.5 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlp0s10f2: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.0.6  netmask 255.255.255.0  broadcast 192.168.0.255
        ether 34:cf:f6:61:c0:38  txqueuelen 1000  (Ethernet)
        RX packets 433847  bytes 102427035 (102.4 MB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 94319  bytes 29872001 (29.8 MB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

需要注意的是，我的 debian guest 有两个网络接口，一个是静态的 192.168.0.84，一个是动态的，这样我就可以使用多个 wifi 网络。

# The primary network interface
auto enp0s3
iface enp0s3 inet static
        address 192.168.0.84
        netmask 255.255.255.0
        network 192.168.0.0
        broadcast 192.168.0.255
       
#dynamic gateway for Internet access on random networks
auto enp0s8
iface enp0s8 inet dhcp

谢谢

更新 我终于弄清楚了我的系统日志，我注意到了这一点：
[UFW BLOCK] IN= OUT=wlp0s10f2 SRC=192.168.0.255 DST=192.168.0.84 ....

所以当然，我检查了 vbox 管理器，对于我的桥接连接适配器，我只有 2 个选项：wlp0s10f2或enp3s0（以太网）

即使ifocnfig -a显示为网络接口，我在 virtualbox 中wg-client1也没有可用的接口。wg-client1

我使用不同的规则来允许 22/tcp 从wlp0s10f2on 开始wg-client1，但没有成功。

有小费吗？

networking

1 个回答

  1. Best Answer

    有点尴尬，但在开始赏金后不到 5 分钟，我用一个有根据的猜测解决了这个问题：

    sudo ufw allow out on wlp0s10f2 from any to 192.168.0.84

    现在我的全新安装完美运行。我的错误是使用 vpn ip 作为地址。将其更改为 vbox 机器的 IP 地址。让我重回正轨。

    • 0

相关问题