linux – libvirt的客人无法到达外面的世界

Linux 前端之家
前端之家收集整理的这篇文章主要介绍了linux – libvirt的客人无法到达外面的世界，前端之家小编觉得挺不错的，现在分享给大家，也给大家做个参考。
我的服务器通过eth0(50.131.xxx.xxx)连接到公共互联网.
同一台服务器通过eth1连接到LAN(192.168.138.1/24上为192.168.138.1)
在同一台服务器上,我运行了libvirt,它创建了另一个子网192.168.122.0/24.目前唯一的客人是192.168.122.10.

我正试图在服务器上设置路由,而且我被卡住了.

从我在局域网上的笔记本电脑(192.168.138.18),我可以进入客户,服务器和公共互联网.但是,我只能部分地做相反的事情：从我的客人,我可以ssh到服务器,但我不能ssh到笔记本电脑,或到达公共互联网.

这是服务器上的Ubuntu 12.04 LTS,以及来宾的13.04.

在客人：

guest> traceroute serverfault.com
 1  192.168.122.1 (192.168.122.1)  0.644 ms  0.577 ms  0.564 ms
 2  * * *

(等等)

这里有一些数据可以帮助比我更有知识的人.

guest> ip r
default via 192.168.122.1 dev eth0 
192.168.122.0/24 dev eth0  proto kernel  scope link  src 192.168.122.10 

server> cat /proc/sys/net/ipv4/ip_forward 
1

server> ifconfig
eth0      Link encap:Ethernet  HWaddr 6c:f0:49:0e:09:b2  
      inet addr:50.131.xxx.xxx  Bcast:255.255.255.255  Mask:255.255.252.0
      UP BROADCAST RUNNING MULTICAST  MTU:576  Metric:1
      RX packets:670219 errors:0 dropped:0 overruns:0 frame:0
      TX packets:532895 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:271653035 (271.6 MB)  TX bytes:70403086 (70.4 MB)
      Interrupt:41 

eth1      Link encap:Ethernet  HWaddr 00:c0:49:fa:1f:da  
      inet addr:192.168.138.1  Bcast:192.168.138.255  Mask:255.255.255.0
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:539044 errors:0 dropped:0 overruns:0 frame:0
      TX packets:563204 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:1000 
      RX bytes:72237497 (72.2 MB)  TX bytes:272391132 (272.3 MB)
      Interrupt:19 Base address:0x2000 

lo        Link encap:Local Loopback  
      inet addr:127.0.0.1  Mask:255.0.0.0
      UP LOOPBACK RUNNING  MTU:16436  Metric:1
      RX packets:14143 errors:0 dropped:0 overruns:0 frame:0
      TX packets:14143 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:8000728 (8.0 MB)  TX bytes:8000728 (8.0 MB)

virbr0    Link encap:Ethernet  HWaddr 52:54:00:9e:51:10  
      inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:1655 errors:0 dropped:0 overruns:0 frame:0
      TX packets:2067 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:0 
      RX bytes:188811 (188.8 KB)  TX bytes:242584 (242.5 KB)

vnet0     Link encap:Ethernet  HWaddr fe:54:00:cf:1f:41  
      UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
      RX packets:1655 errors:0 dropped:0 overruns:0 frame:0
      TX packets:4105 errors:0 dropped:0 overruns:0 carrier:0
      collisions:0 txqueuelen:500 
      RX bytes:211981 (211.9 KB)  TX bytes:348362 (348.3 KB)

server> brctl show
bridge name bridge id          STP enabled  interfaces
virbr0      8000.5254009e5110  yes          virbr0-nic
                                            vnet0

server> ip route
default via 50.131.xxx.1 dev eth0  metric 100 
50.131.xxx.0/22 dev eth0  proto kernel  scope link  src 50.131.xxx.xxx 
192.168.122.0/24 dev virbr0  proto kernel  scope link  src 192.168.122.1 
192.168.138.0/24 dev eth1  proto kernel  scope link  src 192.168.138.1 

server> virsh net-list
Name                 State      Autostart
-----------------------------------------
default              active     yes       

server> virsh net-edit default
<network>
 <name>default</name>
 <uuid>ddc855bf-8794-f4de-f1f9-7480edf9f419</uuid>
 <forward mode='route'/>
 <bridge name='virbr0' stp='on' delay='20' />
 <mac address='52:54:00:9E:51:10'/>
 <ip address='192.168.122.1' netmask='255.255.255.0'>
  <dhcp>
   <range start='192.168.122.100' end='192.168.122.254' />
   <host mac='52:54:00:cf:1f:41' name='guest.example.com' ip='192.168.122.10' />
  </dhcp>
 </ip>
</network>

server> tail /etc/sysctl.conf
...
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
net.bridge.bridge-nf-call-arptables = 0

我也跑了ufw.它说：

server> ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming),allow (outgoing)
New profiles: skip


To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere
53/tcp                     ALLOW       192.168.138.0/24
53/udp                     ALLOW       192.168.138.0/24
21                         ALLOW       192.168.138.0/24
192.168.138.0/24           ALLOW       192.168.138.0/24
192.168.122.0/24           ALLOW       192.168.138.0/24
192.168.138.0/24           ALLOW       192.168.122.0/24
192.168.122.0/24           ALLOW       192.168.122.0/24

对我来说,这听起来像是非常明显的事情,但是,对我来说,似乎……

– 添加：
即使我禁用了ufw,行为也是一样的.但这是iptables-save的输出：

# Generated by iptables-save v1.4.12 on Mon Jul 29 08:57:10 2013
*mangle
:PREROUTING ACCEPT [4511095:1341076448]
:INPUT ACCEPT [79374:20510726]
:FORWARD ACCEPT [4428917:1318506209]
:OUTPUT ACCEPT [72504:23698077]
:POSTROUTING ACCEPT [4501421:1342204286]
-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill
COMMIT
# Completed on Mon Jul 29 08:57:10 2013
# Generated by iptables-save v1.4.12 on Mon Jul 29 08:57:10 2013
*nat
:PREROUTING ACCEPT [33012:2764507]
:INPUT ACCEPT [16436:1476129]
:OUTPUT ACCEPT [10423:864202]
:POSTROUTING ACCEPT [10487:868042]
-A POSTROUTING -s 192.168.138.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.138.0/24 -o eth0 -j MASQUERADE
COMMIT
# Completed on Mon Jul 29 08:57:10 2013
# Generated by iptables-save v1.4.12 on Mon Jul 29 08:57:10 2013
*filter
:INPUT DROP [1335:71456]
:FORWARD ACCEPT [3360867:988924571]
:OUTPUT ACCEPT [18:936]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
-A INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT
-A INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A FORWARD -d 192.168.122.0/24 -o virbr0 -j ACCEPT
-A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT
-A FORWARD -i virbr0 -o virbr0 -j ACCEPT
-A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m state --state INVALID -j ufw-logging-deny
-A ufw-before-input -m state --state INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 4 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m state --state RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m state --state INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j ACCEPT
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-output -p tcp -m state --state NEW -j ACCEPT
-A ufw-track-output -p udp -m state --state NEW -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -m comment --comment "\'dapp_OpenSSH\'" -j ACCEPT
-A ufw-user-input -s 192.168.138.0/24 -p tcp -m tcp --dport 53 -j ACCEPT
-A ufw-user-input -s 192.168.138.0/24 -p udp -m udp --dport 53 -j ACCEPT
-A ufw-user-input -s 192.168.138.0/24 -p tcp -m tcp --dport 21 -j ACCEPT
-A ufw-user-input -s 192.168.138.0/24 -p udp -m udp --dport 21 -j ACCEPT
-A ufw-user-input -s 192.168.138.0/24 -d 192.168.138.0/24 -j ACCEPT
-A ufw-user-input -s 192.168.138.0/24 -d 192.168.122.0/24 -j ACCEPT
-A ufw-user-input -s 192.168.122.0/24 -d 192.168.138.0/24 -j ACCEPT
-A ufw-user-input -s 192.168.122.0/24 -d 192.168.122.0/24 -j ACCEPT
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT
COMMIT
# Completed on Mon Jul 29 08:57:10 2013

解决方法

您是否静态设置了来宾机的IP地址？

确保它具有正确的默认路由.

请提供来自客人的ip r或netstat -ra的输出.

你可以从访客那里ping你本地网络上的主机(192.168.138.1)吗？
然后尝试远离客人一步.一个容易记住的主机是谷歌8.8.8.8.

由于可能存在NAT问题,因此只有NAT 192.168.138.0网络.

在UFW看到两条线.

-A POSTROUTING -s 192.168.138.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.138.0/24 -o eth0 -j MASQUERADE

猜你在找的Linux相关文章

文件查找---find
文件查找（find） 1 find 简单的说，就是实时查找指定的内容或条件。特点：最新、最快、最...
非交互式添加分区
非交互式添加分区 方法一 添加/deb/sdb 下的分区，其实位置为1到1000M，第二个分区位置为1...
编译安装httpd
编译安装httpd 1 去官网下载源码包 为避免非法软件，一定要去官网下载http://www.apache.o...
磁盘分区-gdisk用法
gdisk用法 gdisk - InteractiveGUIDpartitiontable (GPT) manipulator GPTfdisk (akagdisk...
Linux常用快捷按键
1 一定用快捷键 这里简单的说下几个常用的快捷按键。 1.1 移动光标快捷键 Crtl + a 光...
文件的压缩与解压
文件的压缩与解压 常用命令和参数 1 gzip -c 将压缩或解压的结果输出至标准输出 -d 解压缩...
合并 CentOS 6.8 的两个ISO镜像
合并 CentOS 6.8 的两个ISO镜像 1、创建相关目录： 说明： /mnt/dvd1和/mnt/dvd2 用于挂载...
常用的文件查看命令
常用的文件查看命令 1 cat 常用参数 -n 显示行号 -E 显示行尾结束符 $ -b 显示非空行编号 ...
挂载mount
mount 1 挂载mount 基本概念 挂载：将额外文件系统与根文件系统现存的目录建立起关联关系，...
部署DNS服务
DNS，全称Domain Name System，即域名解析系统 。 DNS功能 主机名到IP地址的映射有两种方式...
LinuxWindowsCentOSUbuntuNginxWebServiceScalaMemcacheApacheRedisDockerBashAzureTomcatLNMPShell数据结构服务器运维网络安全
xebugnodemondocker-copydcoselasticsearcwindows-contdocker-windodocker-awsamazon-cloudenvoyproxyhashicorp-vaswisscomdevkafka-pythonzscalerphoton-osdocker-swarmkamongoogle-cloudconcoursewso2-ampersistent-vapi-managerprocess-manamanjarojenkins-workhypriotremoteapikeystonejsbitcoindbitcoin-test