Iptables
PPTP VPN Ubuntu 沒有網路訪問
我已經在核心 5.0x 的 Ubuntu 18.04 機器上設置了 PPTPd 伺服器，能夠從 Win10 機器連接到它，ping 伺服器並 ping 8.8.8.8。所以 DNS 通過 VPN 工作。但是，我無法檢索任何網頁或連接到其他埠。
我已經完成了 modprobe 的事情（nf_nat_pptp 和 nf_conntrack_pptp）。
伺服器的本地地址為 192.168.0.1，客戶端預設接收 192.168.0.100。下面的 iptables 顯示了用於測試的其他一些地址範圍。
我很確定這是一個 iptables 問題，但我沒有通過查看規則列表來跟踪此類問題的經驗。
# sysctl -p net.ipv4.ip_forward = 1 net.netfilter.nf_conntrack_helper = 1# iptables -nvL -t nat --line-number Chain PREROUTING (policy ACCEPT 239K packets, 23M bytes) num pkts bytes target prot opt in out source destination 1 252K 25M PREROUTING_direct all -- * * 0.0.0.0/0 0.0.0.0/0 2 252K 25M PREROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 Chain INPUT (policy ACCEPT 50342 packets, 2729K bytes) num pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 62252 packets, 4500K bytes) num pkts bytes target prot opt in out source destination 1 62476 4516K OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0 Chain POSTROUTING (policy ACCEPT 21854 packets, 1580K bytes) num pkts bytes target prot opt in out source destination 1 40409 2921K MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0 2 70 4886 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0 3 5 325 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0 4 22005 1590K POSTROUTING_direct all -- * * 0.0.0.0/0 0.0.0.0/0 5 22005 1590K POSTROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 6 6 432 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0 7 0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0 8 0 0 MASQUERADE all -- * eth0 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT_direct (1 references) num pkts bytes target prot opt in out source destination Chain POSTROUTING_ZONES (1 references) num pkts bytes target prot opt in out source destination 1 0 0 POST_public all -- * * 0.0.0.0/0 192.168.0.0/24 [goto] 2 22005 1590K POST_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto] Chain POSTROUTING_direct (1 references) num pkts bytes target prot opt in out source destination Chain POST_public (2 references) num pkts bytes target prot opt in out source destination 1 22005 1590K POST_public_pre all -- * * 0.0.0.0/0 0.0.0.0/0 2 22005 1590K POST_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 3 22005 1590K POST_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 4 22005 1590K POST_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 5 22005 1590K POST_public_post all -- * * 0.0.0.0/0 0.0.0.0/0 Chain POST_public_allow (1 references) num pkts bytes target prot opt in out source destination Chain POST_public_deny (1 references) num pkts bytes target prot opt in out source destination Chain POST_public_log (1 references) num pkts bytes target prot opt in out source destination Chain POST_public_post (1 references) num pkts bytes target prot opt in out source destination Chain POST_public_pre (1 references) num pkts bytes target prot opt in out source destination Chain PREROUTING_ZONES (1 references) num pkts bytes target prot opt in out source destination 1 11025 842K PRE_public all -- * * 192.168.0.0/24 0.0.0.0/0 [goto] 2 241K 24M PRE_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain PREROUTING_direct (1 references) num pkts bytes target prot opt in out source destination Chain PRE_public (2 references) num pkts bytes target prot opt in out source destination 1 252K 25M PRE_public_pre all -- * * 0.0.0.0/0 0.0.0.0/0 2 252K 25M PRE_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 3 252K 25M PRE_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 4 252K 25M PRE_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 5 252K 25M PRE_public_post all -- * * 0.0.0.0/0 0.0.0.0/0 Chain PRE_public_allow (1 references) num pkts bytes target prot opt in out source destination Chain PRE_public_deny (1 references) num pkts bytes target prot opt in out source destination Chain PRE_public_log (1 references) num pkts bytes target prot opt in out source destination Chain PRE_public_post (1 references) num pkts bytes target prot opt in out source destination Chain PRE_public_pre (1 references) num pkts bytes target prot opt in out source destination# iptables -nvL --line-number Chain INPUT (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 5673 557K ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 2 5071 511K ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 3 83 4400 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723 state NEW 4 1532 141K ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 5 1 52 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:1723 state NEW 6 1759 163K ACCEPT 47 -- eth0 * 0.0.0.0/0 0.0.0.0/0 7 555K 94M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT 8 21994 1589K ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 9 110K 6423K INPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0 10 72059 4171K INPUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 11 8933 364K DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 12 11808 1026K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited 13 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 14 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 15 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) num pkts bytes target prot opt in out source destination 1 2072 108K TCPMSS tcp -- * * 192.168.0.0/24 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU 2 0 0 TCPMSS tcp -- * * 10.0.0.0/24 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU 3 3739 194K TCPMSS tcp -- * * 192.168.0.0/24 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU 4 0 0 TCPMSS tcp -- * * 192.168.1.0/24 0.0.0.0/0 tcp flags:0x06/0x02 TCPMSS clamp to PMTU 5 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 6 80 5808 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED,DNAT 7 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 8 8862 510K FORWARD_direct all -- * * 0.0.0.0/0 0.0.0.0/0 9 8862 510K FORWARD_IN_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 10 8819 507K FORWARD_OUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 11 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 12 8819 507K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited 13 0 0 TCPMSS tcp -- * * 192.168.0.0/24 0.0.0.0/0 tcp flags:0x17/0x02 TCPMSS set 1356 14 0 0 ACCEPT all -- ppp+ eth0 0.0.0.0/0 0.0.0.0/0 15 0 0 ACCEPT all -- eth0 ppp+ 0.0.0.0/0 0.0.0.0/0 16 0 0 ACCEPT all -- ppp+ * 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 603K packets, 125M bytes) num pkts bytes target prot opt in out source destination 1 8423 599K ACCEPT 47 -- * eth0 0.0.0.0/0 0.0.0.0/0 2 43988 3795K ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0 3 627K 136M OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0 4 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 5 0 0 ACCEPT 47 -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD_IN_ZONES (1 references) num pkts bytes target prot opt in out source destination 1 8862 510K FWDI_public all -- * * 192.168.0.0/24 0.0.0.0/0 [goto] 2 0 0 FWDI_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain FORWARD_OUT_ZONES (1 references) num pkts bytes target prot opt in out source destination 1 0 0 FWDO_public all -- * * 0.0.0.0/0 192.168.0.0/24 [goto] 2 8819 507K FWDO_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto] Chain FORWARD_direct (1 references) num pkts bytes target prot opt in out source destination Chain FWDI_public (2 references) num pkts bytes target prot opt in out source destination 1 8862 510K FWDI_public_pre all -- * * 0.0.0.0/0 0.0.0.0/0 2 8862 510K FWDI_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 3 8862 510K FWDI_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 4 8862 510K FWDI_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 5 8862 510K FWDI_public_post all -- * * 0.0.0.0/0 0.0.0.0/0 6 43 3348 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 Chain FWDI_public_allow (1 references) num pkts bytes target prot opt in out source destination Chain FWDI_public_deny (1 references) num pkts bytes target prot opt in out source destination Chain FWDI_public_log (1 references) num pkts bytes target prot opt in out source destination Chain FWDI_public_post (1 references) num pkts bytes target prot opt in out source destination Chain FWDI_public_pre (1 references) num pkts bytes target prot opt in out source destination Chain FWDO_public (2 references) num pkts bytes target prot opt in out source destination 1 8819 507K FWDO_public_pre all -- * * 0.0.0.0/0 0.0.0.0/0 2 8819 507K FWDO_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 3 8819 507K FWDO_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 4 8819 507K FWDO_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 5 8819 507K FWDO_public_post all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FWDO_public_allow (1 references) num pkts bytes target prot opt in out source destination Chain FWDO_public_deny (1 references) num pkts bytes target prot opt in out source destination Chain FWDO_public_log (1 references) num pkts bytes target prot opt in out source destination Chain FWDO_public_post (1 references) num pkts bytes target prot opt in out source destination Chain FWDO_public_pre (1 references) num pkts bytes target prot opt in out source destination Chain INPUT_ZONES (1 references) num pkts bytes target prot opt in out source destination 1 1214 114K IN_public all -- * * 192.168.0.0/24 0.0.0.0/0 [goto] 2 70845 4058K IN_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain INPUT_direct (1 references) num pkts bytes target prot opt in out source destination 1 37532 2252K REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 25,465,587,143,993,110,995 match-set f2b-postfix-sasl src reject-with icmp-port-unreachable 2 1 60 REJECT tcp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 22 match-set f2b-sshd src reject-with icmp-port-unreachable Chain IN_public (2 references) num pkts bytes target prot opt in out source destination 1 72059 4171K IN_public_pre all -- * * 0.0.0.0/0 0.0.0.0/0 2 72059 4171K IN_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 3 72059 4171K IN_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 4 72059 4171K IN_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 5 20855 1397K IN_public_post all -- * * 0.0.0.0/0 0.0.0.0/0 6 114 6638 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 Chain IN_public_allow (1 references) num pkts bytes target prot opt in out source destination 1 2000 84664 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ctstate NEW,UNTRACKED 2 21 868 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 ctstate NEW,UNTRACKED 3 27 1460 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:993 ctstate NEW,UNTRACKED 4 12 496 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:465 ctstate NEW,UNTRACKED 5 676 36856 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW,UNTRACKED 6 11957 717K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:25 ctstate NEW,UNTRACKED 7 186 10756 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:110 ctstate NEW,UNTRACKED 8 4329 238K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ctstate NEW,UNTRACKED 9 25 1368 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:995 ctstate NEW,UNTRACKED 10 21 1088 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:143 ctstate NEW,UNTRACKED 11 3 120 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20 ctstate NEW,UNTRACKED 12 114 5008 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:10000:10100 ctstate NEW,UNTRACKED 13 26 1376 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20000 ctstate NEW,UNTRACKED 14 31 2022 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 ctstate NEW,UNTRACKED 15 7 288 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 ctstate NEW,UNTRACKED 16 31049 1629K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpts:1025:65535 ctstate NEW,UNTRACKED 17 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:2222 ctstate NEW,UNTRACKED 18 720 43028 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:587 ctstate NEW,UNTRACKED Chain IN_public_deny (1 references) num pkts bytes target prot opt in out source destination Chain IN_public_log (1 references) num pkts bytes target prot opt in out source destination Chain IN_public_post (1 references) num pkts bytes target prot opt in out source destination Chain IN_public_pre (1 references) num pkts bytes target prot opt in out source destination Chain OUTPUT_direct (1 references) num pkts bytes target prot opt in out source destination
iptables 規則肯定有問題。我看到很多重疊。例如，仔細看看
POSTROUTING鏈。規則 #1、2 和 3 是相同的。此外，規則#6、7 和 8 是相同的。請記住，規則是從上到下處理的。如果你再仔細看看
POSTROUTING_ZONES鏈。規則 #1 沒有命中 (0 pkts)。這意味著流量被早期的規則阻止。我建議您進行規則清理，並重新添加規則以確保您不會重複。