Arch Linux，傳入的遠端連接被丟棄

我在（最新的）Arch Linux 伺服器上遇到了問題。我已經能夠用 netcat 重現它。

如果我開始在我的伺服器上收聽：

ncat -l -p 2000 -k

進而

telnet (my local ip) 2000

從本地機器上，我可以看到雙向連接。

但是，如果我從遠端電腦上 telnet，則連接已建立，但我在伺服器端鍵入的任何內容都不會出現在遠端端。如果我在遠端端輸入一些東西，一旦按下 Enter，第一行就會出現在伺服器端，但隨後連接會以Connection closed by foreign host..

我能夠確認此問題與我的路由器無關：將同一埠轉發到另一台 Debian 機器一切正常。這會阻止 nginx 和其他伺服器工作。

我目前沒有任何 iptables 規則：

$ iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

貓：

# ncat -l -p 2000 -k -v             
Ncat: Version 7.92 ( https://nmap.org/ncat )
Ncat: Listening on :::2000
Ncat: Listening on 0.0.0.0:2000


Ncat: Connection from (remote public ip).
Ncat: Connection from (remote public ip):60990.

本地機器上的 tcpdump：

# tcpdump -nnvvS port 2000
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
13:09:46.847867 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 60)
   (server local ip).2000 > (remote public ip).60990: Flags [S.], cksum 0x5399 (incorrect -> 0x8744), seq 1434025023, ack 276028935, win 65160, options [mss 1460,sackOK,TS val 422478433 ecr 3525397188,nop,wscale 7], length 0
13:09:46.870265 IP (tos 0x0, ttl 64, id 14989, offset 0, flags [DF], proto TCP (6), length 53)
   (server local ip).2000 > (remote public ip).60990: Flags [P.], cksum 0x5392 (incorrect -> 0xa864), seq 1434025024:1434025025, ack 276028935, win 510, options [nop,nop,TS val 422478455 ecr 3525397212], length 1
13:09:49.931230 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
   (server local ip).2000 > (remote public ip).60990: Flags [R], cksum 0x94ad (correct), seq 1434025024, win 0, length 0

遠端機器上的 tcpdump：

# tcpdump -nnvvS port 2000
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
13:09:46.835291 IP (tos 0x10, ttl 64, id 59780, offset 0, flags [DF], proto TCP (6), length 60)
   (remote public ip).60990 > (server public ip).2000: Flags [S], cksum 0xff3a (incorrect -> 0x4c94), seq 276028934, win 64240, options [mss 1460,sackOK,TS val 3525397188 ecr 0,nop,wscale 7], length 0
13:09:46.858924 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 60)
   (server public ip).2000 > (remote public ip).60990: Flags [S.], cksum 0xdbaa (correct), seq 1434025023, ack 276028935, win 65160, options [mss 1452,sackOK,TS val 422478433 ecr 3525397188,nop,wscale 7], length 0
13:09:46.858957 IP (tos 0x10, ttl 64, id 59781, offset 0, flags [DF], proto TCP (6), length 52)
   (remote public ip).60990 > (server public ip).2000: Flags [.], cksum 0xff32 (incorrect -> 0x06ea), seq 276028935, ack 1434025024, win 502, options [nop,nop,TS val 3525397212 ecr 422478433], length 0
13:09:49.920045 IP (tos 0x10, ttl 64, id 59782, offset 0, flags [DF], proto TCP (6), length 58)
   (remote public ip).60990 > (server public ip).2000: Flags [P.], cksum 0xff38 (incorrect -> 0x0603), seq 276028935:276028941, ack 1434025024, win 502, options [nop,nop,TS val 3525400273 ecr 422478433], length 6
13:09:49.941752 IP (tos 0x0, ttl 48, id 0, offset 0, flags [DF], proto TCP (6), length 40)
   (server public ip).2000 > (remote public ip).60990: Flags [R], cksum 0xe90b (correct), seq 1434025024, win 0, length 0

當您的 tcpdump 顯示 server_local_ip 和 server_public_ip - 您的伺服器上有多個 IP 地址嗎？這可能是路由的問題，如果是，您應該配置策略路由。

引用自：https://serverfault.com/questions/1090053