Vyatta 目標 NAT 不工作

在超過我們的第一個 VRRP 組中的 IP 限制後，我們遇到了向 vyatta 設備添加新 IP 的問題。工作中列出的所有 IPvrrp-group 1都很好，但我添加的任何IPvrrp-group 2都沒有。

我們可以看到流量進入，但我們想要工作的流量 (443) 永遠不會到達 NAT。但是，ping 流量進來並返回（這應該不起作用）。NAT 位於防火牆之前，但我們已經檢查過它以確保我們沒有遺漏任何東西並且它有 0 次命中。任何想法將不勝感激。

流量從埠 443 進入但不退出

tcpdump: listening on bond1, link-type EN10MB (Ethernet), capture size 65535 bytes
12:07:50.003063 IP (tos 0x0, ttl 52, id 63499, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62111 > 1.1.1.1.443: Flags [S], cksum 0xd629 (correct), seq 237589496, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539048232 ecr 0,sackOK,eol], length 0
12:07:50.709156 IP (tos 0x0, ttl 52, id 37525, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62113 > 1.1.1.1.443: Flags [S], cksum 0x412b (correct), seq 2830126052, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539048881 ecr 0,sackOK,eol], length 0
12:07:57.131533 IP (tos 0x0, ttl 52, id 34718, offset 0, flags [DF], proto TCP (6), length 64)
2.2.2.2.62137 > 1.1.1.1.443: Flags [S], cksum 0xc2c7 (correct), seq 3549136583, win 65535, options [mss 1380,nop,wscale 5,nop,nop,TS val 1539055166 ecr 0,sackOK,eol], length 0

防火牆命中的 NAT 表中沒有任何內容

sh nat destination translations | match 1.1.1.1

sh firewall name out2in rule 100

-----------------------------
Rulesets Information
-----------------------------

IPv4 Firewall "out2in":

Active on traffic to -
zone [inside] from zone [outside]

rule action proto packets bytes
---- ------ ----- ------- -----
100 accept tcp 0 0
condition - saddr 0.0.0.0/0 daddr 10.0.0.100

Ping 有效（但不翻譯）

15:11:31.052571 IP (tos 0x0, ttl 52, id 65344, offset 0, flags [none], proto ICMP (1), length 84)
   2.2.2.2 > 1.1.1.1: ICMP echo request, id 28473, seq 117, length 64
15:11:31.052585 IP (tos 0x0, ttl 64, id 9409, offset 0, flags [none], proto ICMP (1), length 84)
   1.1.1.1 > 2.2.2.2: ICMP echo reply, id 28473, seq 117, length 64
15:11:32.055675 IP (tos 0x0, ttl 52, id 32001, offset 0, flags [none], proto ICMP (1), length 84)
   2.2.2.2 > 1.1.1.1: ICMP echo request, id 28473, seq 118, length 64

NAT

set nat destination rule 100 destination address '1.1.1.1'
set nat destination rule 100 destination port 'https'
set nat destination rule 100 inbound-interface 'bond1'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation address '10.0.0.100'

防火牆

set firewall name out2in rule 100 action 'accept'
set firewall name out2in rule 100 destination address '10.0.0.100'
set firewall name out2in rule 100 destination port '443'
set firewall name out2in rule 100 protocol 'tcp'

VRRP 配置

set interfaces bonding bond1 address '1.1.1.4/28'
set interfaces bonding bond1 hash-policy 'layer3+4'
set interfaces bonding bond1 mode '802.3ad'
set interfaces bonding bond1 vrrp vrrp-group 1 advertise-interval '1'
set interfaces bonding bond1 vrrp vrrp-group 1 preempt 'false'
set interfaces bonding bond1 vrrp vrrp-group 1 priority '253'
set interfaces bonding bond1 vrrp vrrp-group 1 'rfc3768-compatibility'
set interfaces bonding bond1 vrrp vrrp-group 1 sync-group 'vgroup1'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.1.230/28'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.2.80/28'
set interfaces bonding bond1 vrrp vrrp-group 1 virtual-address '1.1.3.172/29'
...
set interfaces bonding bond1 vrrp vrrp-group 2 advertise-interval '1'
set interfaces bonding bond1 vrrp vrrp-group 2 preempt 'false'
set interfaces bonding bond1 vrrp vrrp-group 2 priority '253'
set interfaces bonding bond1 vrrp vrrp-group 2 'rfc3768-compatibility'
set interfaces bonding bond1 vrrp vrrp-group 2 sync-group 'vgroup1'
set interfaces bonding bond1 vrrp vrrp-group 2 virtual-address '1.1.1.1/28'

為 zone-policy 添加了新的子介面

set zone-policy zone outside interface 'bond1'
set zone-policy zone outside interface 'bond1v1'
set zone-policy zone outside interface 'bond1v2'

路由匹配bond1v1中的相似路由

1.1.3.172/28 is directly connected, bond1v1
1.1.1.1/28 is directly connected, bond1v2

好吧，我想通了。問題實際上與我的內部網路 10.0.0.100 似乎無法正常工作有關。

引用自：https://serverfault.com/questions/788333