Networking
子網 B 可以擊中 A，但反之則不行
我正在嘗試使用與 Tinc VPN 連結的 pfsense 創建一個多站點網路。這是我目前的拓撲：
Router A Router B **************** **************** * * * * * 10.0.0.1/16 *--------* 10.1.0.1/16 * * * * * **************** **************** | | | | **************** **************** * * * * * 10.0.0.11/16 * * 10.1.0.16/16 * * * * * **************** **************** Node 1 My Desktop我的桌面和兩個路由器都可以訪問網路上的每台機器，但節點 1 只能訪問路由器 A。
路由器 B 目前位於 Verizon 的路由器後面，並轉發了 VPN 埠。連結已建立。雖然，我懷疑這將是這裡問題的根源。
我已經三次檢查了我的 pfsense 配置，它們彼此相同。我真的不確定是什麼阻止了節點 1 與網路的其餘部分通信。我基本上已經打開了一切。我對所有介面都有任何規則，但節點 1 找不到路由。
如果有任何相關性，路由器 A 和節點 1 通過 Vultr 託管在雲中。我啟用了專用網路，節點 1 正在從路由器 A 上的 DHCP 伺服器請求地址。Vultr 確實在 10.XXX 空間中分配了具有相同子網的專用 IP。我的 IP 空間會不會和他們的衝突？Vultr 不部署網關，它們分配的 IP 完全是靜態的。
您可以在專用網路上使用您喜歡的任何 IP。我們預設分配一個 IP，但您可以忽略它並根據需要使用其他 IP。
我真的不知道為什麼節點 1 無法訪問另一個子網，我希望有人能夠幫助我解決這個問題。
10.1.0.16
bkvaluemeal@Formula:~$ ping -c 3 10.1.0.1 PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data. 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=0.330 ms 64 bytes from 10.1.0.1: icmp_seq=2 ttl=64 time=0.319 ms 64 bytes from 10.1.0.1: icmp_seq=3 ttl=64 time=0.305 ms --- 10.1.0.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 1998ms rtt min/avg/max/mdev = 0.305/0.318/0.330/0.010 ms bkvaluemeal@Formula:~$ ping -c 3 10.0.0.1 PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. 64 bytes from 10.0.0.1: icmp_seq=1 ttl=63 time=9.82 ms 64 bytes from 10.0.0.1: icmp_seq=2 ttl=63 time=8.86 ms 64 bytes from 10.0.0.1: icmp_seq=3 ttl=63 time=38.0 ms --- 10.0.0.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 8.864/18.925/38.085/13.553 ms bkvaluemeal@Formula:~$ ping -c 3 10.0.0.11 PING 10.0.0.11 (10.0.0.11) 56(84) bytes of data. 64 bytes from 10.0.0.11: icmp_seq=1 ttl=62 time=11.5 ms 64 bytes from 10.0.0.11: icmp_seq=2 ttl=62 time=10.5 ms 64 bytes from 10.0.0.11: icmp_seq=3 ttl=62 time=9.37 ms --- 10.0.0.11 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 9.370/10.482/11.555/0.892 ms bkvaluemeal@Formula:~$ ip address 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever 2: eno1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether e0:3f:49:ad:81:03 brd ff:ff:ff:ff:ff:ff inet 10.1.0.16/16 brd 10.1.255.255 scope global dynamic eno1 valid_lft 6915sec preferred_lft 6915sec inet6 fe80::20dc:2028:faee:5420/64 scope link valid_lft forever preferred_lft forever 3: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 54:27:1e:55:ae:33 brd ff:ff:ff:ff:ff:ff inet 192.168.1.163/24 brd 192.168.1.255 scope global dynamic wlp3s0 valid_lft 76214sec preferred_lft 76214sec inet6 fe80::d9de:6606:5307:968b/64 scope link valid_lft forever preferred_lft forever 4: virbr0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default qlen 1000 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0 valid_lft forever preferred_lft forever 5: virbr0-nic: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000 link/ether 52:54:00:d1:33:dd brd ff:ff:ff:ff:ff:ff 6: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default link/ether 02:42:82:c6:99:06 brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 scope global docker0 valid_lft forever preferred_lft forever10.1.0.1
PING 10.1.0.16 (10.1.0.16): 56 data bytes 64 bytes from 10.1.0.16: icmp_seq=0 ttl=64 time=0.177 ms 64 bytes from 10.1.0.16: icmp_seq=1 ttl=64 time=0.312 ms 64 bytes from 10.1.0.16: icmp_seq=2 ttl=64 time=0.194 ms --- 10.1.0.16 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.177/0.228/0.312/0.060 ms PING 10.0.0.1 (10.0.0.1): 56 data bytes 64 bytes from 10.0.0.1: icmp_seq=0 ttl=64 time=8.926 ms 64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=8.335 ms 64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=8.290 ms --- 10.0.0.1 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 8.290/8.517/8.926/0.290 ms PING 10.0.0.11 (10.0.0.11): 56 data bytes 64 bytes from 10.0.0.11: icmp_seq=0 ttl=63 time=11.052 ms 64 bytes from 10.0.0.11: icmp_seq=1 ttl=63 time=9.573 ms 64 bytes from 10.0.0.11: icmp_seq=2 ttl=63 time=9.913 ms --- 10.0.0.11 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 9.573/10.179/11.052/0.632 ms10.0.0.1
PING 10.1.0.16 (10.1.0.16): 56 data bytes 64 bytes from 10.1.0.16: icmp_seq=0 ttl=63 time=8.307 ms 64 bytes from 10.1.0.16: icmp_seq=1 ttl=63 time=9.256 ms 64 bytes from 10.1.0.16: icmp_seq=2 ttl=63 time=9.109 ms --- 10.1.0.16 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 8.307/8.891/9.256/0.417 ms PING 10.1.0.1 (10.1.0.1): 56 data bytes 64 bytes from 10.1.0.1: icmp_seq=0 ttl=64 time=8.618 ms 64 bytes from 10.1.0.1: icmp_seq=1 ttl=64 time=8.579 ms 64 bytes from 10.1.0.1: icmp_seq=2 ttl=64 time=8.702 ms --- 10.1.0.1 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 8.579/8.633/8.702/0.051 ms PING 10.0.0.11 (10.0.0.11): 56 data bytes 64 bytes from 10.0.0.11: icmp_seq=0 ttl=64 time=1.142 ms 64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=2.385 ms 64 bytes from 10.0.0.11: icmp_seq=2 ttl=64 time=2.053 ms --- 10.0.0.11 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 1.142/1.860/2.385/0.525 ms10.0.0.11
root@node1:~# ping -c 3 10.0.0.1 PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data. 64 bytes from 10.0.0.1 icmp_seq=1 ttl=64 time=1.10 ms 64 bytes from 10.0.0.1 icmp_seq=2 ttl=64 time=1.04 ms 64 bytes from 10.0.0.1 icmp_seq=3 ttl=64 time=0.749 ms --- 10.0.0.1 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 0.749/0.968/1.106/0.156 ms root@node1:~# ping -c 3 10.1.0.1 PING 10.1.0.1 (10.1.0.1) 56(84) bytes of data. --- 10.1.0.1 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2042ms root@node1:~# ping -c 3 10.1.0.16 PING 10.1.0.16 (10.1.0.16) 56(84) bytes of data. --- 10.1.0.16 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2048ms root@node1:~# ip address 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether XX:XX:XX:XX:XX:XX brd XX:XX:XX:XX:XX:XX inet 45.77.X.X/23 brd 45.77.X.X scope global ens3 valid_lft forever preferred_lft forever inet6 2001:19f0:X:X:X:X:X:X/64 scope global mngtmpaddr dynamic valid_lft 2591544sec preferred_lft 604344sec inet6 fe80::5400:X:X:X/64 scope link valid_lft forever preferred_lft forever 3: ens7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 link/ether 5a:01:01:3c:13:c8 brd ff:ff:ff:ff:ff:ff inet 10.0.0.11/16 brd 10.0.255.255 scope global ens7 valid_lft forever preferred_lft forever inet6 fe80::5801:1ff:fe3c:13c8/64 scope link valid_lft forever preferred_lft forever 4: docker0: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc noqueue state DOWN group default link/ether 02:42:65:df:2f:a1 brd ff:ff:ff:ff:ff:ff inet 172.17.0.1/16 scope global docker0 valid_lft forever preferred_lft forever inet6 fe80::42:65ff:fedf:2fa1/64 scope link valid_lft forever preferred_lft forever
“ping 來自一側，桌面 –> 節點 1，但不是從節點 1 啟動時 –> 桌面” - 如果準確，此語句消除了路由問題的所有可能性。
為了使 ping 從 Desktop->Node1 工作，您還必須收到來自 Node1->Desktop 的回复。這表明 VPN 和路由上的一切設置都很好。
相反，這是一個防火牆問題。因為來自 Node1 的 ping 在路由器 B 處被丟棄，但路由器 B 可以 ping 桌面，那麼防火牆問題可能出在路由器 B 上。路由器 B 允許出站和“相關”連接，但不允許入站連接。
根據您發布的資訊，我不得不說這與您所說的“防火牆 LAN 規則”有關。將其更改為 ANY/ANY/ANY/ANY（或其他）以進行測試。防火牆規則是模棱兩可的，所以我不能說一種或另一種。
編輯：
我們發現節點 1 有兩個網路介面。一個在“專用網路”上，IP 為 10.0.0.11，另一個在公共 IP 地址和預設網關上。此外，NAT 規則導致流量通過 VPN 隧道進行 NAT。因此，Desktop 可以成功 PING 節點 1，因為到達節點 1 的流量似乎來自 10.0.0.1。但是當嘗試從節點 1 ping 桌面時，節點 1 沒有到 10.1.0.0/16 的路由。
一旦我們清理了 Node1 上的路由表並將路由器 A 和 B 上的 NAT 規則設置為自動，一切都開始按預期工作。