Iptables + Nat

Обсуждение настройки и работы сервисов, резервирования, сетевых настроек и вопросов безопасности ОС.

Модераторы: SLEDopit, Модераторы разделов

Potia
Сообщения: 86

Iptables + Nat

Сообщение Potia »

Вот такая вещь, два интерфейса eth0 - интернет (192.168.0.3 route на 192.168.0.2) и вторая с radius (vpn) 172.16.0.1. Есть клиент, который соединяется по vpn и получает 172.16.0.10. Но в интернет выйти не может.

Вот все логи :

iptables -nL

Код: Выделить всё

Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
Chain FORWARD (policy DROP)
target     prot opt source               destination        
ACCEPT     all  --  172.16.0.0/24        0.0.0.0/0          
ACCEPT     all  --  0.0.0.0/0            172.16.0.0/24      
ACCEPT     all  --  172.16.0.10          0.0.0.0/0          
ACCEPT     all  --  0.0.0.0/0            172.16.0.10        
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destinatio


iptables -t nat -nL

Код: Выделить всё

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination        
ACCEPT     all  --  172.16.0.10          0.0.0.0/0          
ACCEPT     all  --  172.16.0.0/24        0.0.0.0/0          
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination        
SNAT       all  --  172.16.0.0           0.0.0.0/0          to:192.168.0.3
SNAT       all  --  172.16.0.0/24        0.0.0.0/0          to:192.168.0.3
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  


route

Код: Выделить всё

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
172.16.0.10     *               255.255.255.255 UH    0      0        0 ppp0
192.168.0.0     *               255.255.0.0     U     0      0        0 eth1
192.168.0.0     *               255.255.0.0     U     0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
default         192.168.0.2     0.0.0.0         UG    0      0        0 eth0
default         192.168.255.254 0.0.0.0         UG    0      0        0 eth1


вод вывод команды sysctl -a | grep ipv4

Код: Выделить всё

net.ipv4.ip_conntrack_udp_timeouts = 30180
net.ipv4.ip_conntrack_tcp_timeouts = 180043200012060120120106030120
net.ipv4.ip_conntrack_max = 8184
net.ipv4.conf.ppp0.arp_filter = 0
net.ipv4.conf.ppp0.tag = 0
net.ipv4.conf.ppp0.log_martians = 0
net.ipv4.conf.ppp0.bootp_relay = 0
net.ipv4.conf.ppp0.medium_id = 0
net.ipv4.conf.ppp0.proxy_arp = 0
net.ipv4.conf.ppp0.accept_source_route = 1
net.ipv4.conf.ppp0.send_redirects = 1
net.ipv4.conf.ppp0.rp_filter = 1
net.ipv4.conf.ppp0.shared_media = 1
net.ipv4.conf.ppp0.secure_redirects = 1
net.ipv4.conf.ppp0.accept_redirects = 1
net.ipv4.conf.ppp0.mc_forwarding = 0
net.ipv4.conf.ppp0.forwarding = 1
net.ipv4.conf.eth0.arp_filter = 0
net.ipv4.conf.eth0.tag = 0
net.ipv4.conf.eth0.log_martians = 0
net.ipv4.conf.eth0.bootp_relay = 0
net.ipv4.conf.eth0.medium_id = 0
net.ipv4.conf.eth0.proxy_arp = 0
net.ipv4.conf.eth0.accept_source_route = 1
net.ipv4.conf.eth0.send_redirects = 1
net.ipv4.conf.eth0.rp_filter = 1
net.ipv4.conf.eth0.shared_media = 1
net.ipv4.conf.eth0.secure_redirects = 1
net.ipv4.conf.eth0.accept_redirects = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth1.arp_filter = 0
net.ipv4.conf.eth1.tag = 0
net.ipv4.conf.eth1.log_martians = 0
net.ipv4.conf.eth1.bootp_relay = 0
net.ipv4.conf.eth1.medium_id = 0
net.ipv4.conf.eth1.proxy_arp = 0
net.ipv4.conf.eth1.accept_source_route = 1
net.ipv4.conf.eth1.send_redirects = 1
net.ipv4.conf.eth1.rp_filter = 1
net.ipv4.conf.eth1.shared_media = 1
net.ipv4.conf.eth1.secure_redirects = 1
net.ipv4.conf.eth1.accept_redirects = 1
net.ipv4.conf.eth1.mc_forwarding = 0
net.ipv4.conf.eth1.forwarding = 1
net.ipv4.conf.lo.arp_filter = 0
net.ipv4.conf.lo.tag = 0
net.ipv4.conf.lo.log_martians = 0
net.ipv4.conf.lo.bootp_relay = 0
net.ipv4.conf.lo.medium_id = 0
net.ipv4.conf.lo.proxy_arp = 0
net.ipv4.conf.lo.accept_source_route = 1
net.ipv4.conf.lo.send_redirects = 1
net.ipv4.conf.lo.rp_filter = 1
net.ipv4.conf.lo.shared_media = 1
net.ipv4.conf.lo.secure_redirects = 1
net.ipv4.conf.lo.accept_redirects = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.default.arp_filter = 0
net.ipv4.conf.default.tag = 0
net.ipv4.conf.default.log_martians = 0
net.ipv4.conf.default.bootp_relay = 0
net.ipv4.conf.default.medium_id = 0
net.ipv4.conf.default.proxy_arp = 0
net.ipv4.conf.default.accept_source_route = 1
net.ipv4.conf.default.send_redirects = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.shared_media = 1
net.ipv4.conf.default.secure_redirects = 1
net.ipv4.conf.default.accept_redirects = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.all.arp_filter = 0
net.ipv4.conf.all.tag = 0
net.ipv4.conf.all.log_martians = 0
net.ipv4.conf.all.bootp_relay = 0
net.ipv4.conf.all.medium_id = 0
net.ipv4.conf.all.proxy_arp = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.send_redirects = 1
net.ipv4.conf.all.rp_filter = 0
net.ipv4.conf.all.shared_media = 1
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.all.forwarding = 1
net.ipv4.neigh.ppp0.locktime = 512
net.ipv4.neigh.ppp0.proxy_delay = 409
net.ipv4.neigh.ppp0.anycast_delay = 512
net.ipv4.neigh.ppp0.proxy_qlen = 64
net.ipv4.neigh.ppp0.unres_qlen = 3
net.ipv4.neigh.ppp0.gc_stale_time = 60
net.ipv4.neigh.ppp0.delay_first_probe_time = 5
net.ipv4.neigh.ppp0.base_reachable_time = 30
net.ipv4.neigh.ppp0.retrans_time = 512
net.ipv4.neigh.ppp0.app_solicit = 0
net.ipv4.neigh.ppp0.ucast_solicit = 3
net.ipv4.neigh.ppp0.mcast_solicit = 3
net.ipv4.neigh.eth0.locktime = 512
net.ipv4.neigh.eth0.proxy_delay = 409
net.ipv4.neigh.eth0.anycast_delay = 512
net.ipv4.neigh.eth0.proxy_qlen = 64
net.ipv4.neigh.eth0.unres_qlen = 3
net.ipv4.neigh.eth0.gc_stale_time = 60
net.ipv4.neigh.eth0.delay_first_probe_time = 5
net.ipv4.neigh.eth0.base_reachable_time = 30
net.ipv4.neigh.eth0.retrans_time = 512
net.ipv4.neigh.eth0.app_solicit = 0
net.ipv4.neigh.eth0.ucast_solicit = 3
net.ipv4.neigh.eth0.mcast_solicit = 3
net.ipv4.neigh.eth1.locktime = 512
net.ipv4.neigh.eth1.proxy_delay = 409
net.ipv4.neigh.eth1.anycast_delay = 512
net.ipv4.neigh.eth1.proxy_qlen = 64
net.ipv4.neigh.eth1.unres_qlen = 3
net.ipv4.neigh.eth1.gc_stale_time = 60
net.ipv4.neigh.eth1.delay_first_probe_time = 5
net.ipv4.neigh.eth1.base_reachable_time = 30
net.ipv4.neigh.eth1.retrans_time = 512
net.ipv4.neigh.eth1.app_solicit = 0
net.ipv4.neigh.eth1.ucast_solicit = 3
net.ipv4.neigh.eth1.mcast_solicit = 3
net.ipv4.neigh.lo.locktime = 512
net.ipv4.neigh.lo.proxy_delay = 409
net.ipv4.neigh.lo.anycast_delay = 512
net.ipv4.neigh.lo.proxy_qlen = 64
net.ipv4.neigh.lo.unres_qlen = 3
net.ipv4.neigh.lo.gc_stale_time = 60
net.ipv4.neigh.lo.delay_first_probe_time = 5
net.ipv4.neigh.lo.base_reachable_time = 30
net.ipv4.neigh.lo.retrans_time = 512
net.ipv4.neigh.lo.app_solicit = 0
net.ipv4.neigh.lo.ucast_solicit = 3
net.ipv4.neigh.lo.mcast_solicit = 3
net.ipv4.neigh.default.gc_thresh3 = 1024
net.ipv4.neigh.default.gc_thresh2 = 512
net.ipv4.neigh.default.gc_thresh1 = 128
net.ipv4.neigh.default.gc_interval = 30
net.ipv4.neigh.default.locktime = 512
net.ipv4.neigh.default.proxy_delay = 409
net.ipv4.neigh.default.anycast_delay = 512
net.ipv4.neigh.default.proxy_qlen = 64
net.ipv4.neigh.default.unres_qlen = 3
net.ipv4.neigh.default.gc_stale_time = 60
net.ipv4.neigh.default.delay_first_probe_time = 5
net.ipv4.neigh.default.base_reachable_time = 30
net.ipv4.neigh.default.retrans_time = 512
net.ipv4.neigh.default.app_solicit = 0
net.ipv4.neigh.default.ucast_solicit = 3
net.ipv4.neigh.default.mcast_solicit = 3
net.ipv4.tcp_tw_reuse = 0
net.ipv4.icmp_ratemask = 6168
net.ipv4.icmp_ratelimit = 512
net.ipv4.tcp_adv_win_scale = 2
net.ipv4.tcp_app_win = 31
net.ipv4.tcp_rmem = 409687380174760
net.ipv4.tcp_wmem = 409616384131072
net.ipv4.tcp_mem = 235522406424576
net.ipv4.tcp_dsack = 1
net.ipv4.tcp_ecn = 0
net.ipv4.tcp_reordering = 3
net.ipv4.tcp_fack = 1
net.ipv4.tcp_orphan_retries = 0
net.ipv4.inet_peer_gc_maxtime = 120
net.ipv4.inet_peer_gc_mintime = 10
net.ipv4.inet_peer_maxttl = 600
net.ipv4.inet_peer_minttl = 120
net.ipv4.inet_peer_threshold = 65664
net.ipv4.igmp_max_memberships = 20
net.ipv4.route.min_adv_mss = 256
net.ipv4.route.min_pmtu = 552
net.ipv4.route.mtu_expires = 600
net.ipv4.route.gc_elasticity = 8
net.ipv4.route.error_burst = 2560
net.ipv4.route.error_cost = 512
net.ipv4.route.redirect_silence = 10240
net.ipv4.route.redirect_number = 9
net.ipv4.route.redirect_load = 10
net.ipv4.route.gc_interval = 60
net.ipv4.route.gc_timeout = 300
net.ipv4.route.gc_min_interval = 5
net.ipv4.route.max_size = 8192
net.ipv4.route.gc_thresh = 512
net.ipv4.route.max_delay = 10
net.ipv4.route.min_delay = 2
net.ipv4.icmp_ignore_bogus_error_responses = 0
net.ipv4.icmp_echo_ignore_broadcasts = 0
net.ipv4.icmp_echo_ignore_all = 0
net.ipv4.ip_local_port_range = 10244999
net.ipv4.tcp_max_syn_backlog = 256
net.ipv4.tcp_rfc1337 = 0
net.ipv4.tcp_stdurg = 0
net.ipv4.tcp_abort_on_overflow = 0
net.ipv4.tcp_tw_recycle = 0
net.ipv4.tcp_syncookies = 0
net.ipv4.tcp_fin_timeout = 60
net.ipv4.tcp_retries2 = 15
net.ipv4.tcp_retries1 = 3
net.ipv4.tcp_keepalive_intvl = 75
net.ipv4.tcp_keepalive_probes = 9
net.ipv4.tcp_keepalive_time = 7200
net.ipv4.ipfrag_time = 30
net.ipv4.ip_dynaddr = 0
net.ipv4.ipfrag_low_thresh = 196608
net.ipv4.ipfrag_high_thresh = 262144
net.ipv4.tcp_max_tw_buckets = 16384
net.ipv4.tcp_max_orphans = 8192
net.ipv4.tcp_synack_retries = 5
net.ipv4.tcp_syn_retries = 5
net.ipv4.ip_nonlocal_bind = 0
net.ipv4.ip_no_pmtu_disc = 0
net.ipv4.ip_autoconfig = 0
net.ipv4.ip_default_ttl = 64
net.ipv4.ip_forward = 1
net.ipv4.tcp_retrans_collapse = 1
net.ipv4.tcp_sack = 1
net.ipv4.tcp_window_scaling = 1
net.ipv4.tcp_timestamps = 1


В чем может быть проблема?
Спасибо сказали: