rea*_*nly 5 linux firewall iptables port-forwarding dhcpcd
部署：
VM -- (eth0)RPI(wlan0) -- Router -- ISP
^ ^ ^ ^
DHCP Static DHCP GW
注意：RPI 主机名： gateway
• 目标是使虚拟机可以从网络外部访问。根据教程https://www.youtube.com/watch?v=IAa4tI4JrgI，通过路由器和 RPI 上的端口转发，通过在 RPI 上安装 dhcpcd 和配置 iptables 完成。
• 这是我的interfaces，我已经注释掉了 auto wlan0，以试图解决这个问题（之前，它没有被注释，并且仍然是一样的......）
# interfaces(5) file used by ifup(8) and ifdown(8)
# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'
# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d
#auto wlan0
iface wlan0 inet dhcp
wpa-ssid FunBox-84A8
wpa-psk 7A73FA25C43563523D7ED99A4D
#auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.2.1
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
• 这里是firewall.conf使用的iptables：
# Generated by iptables-save v1.6.0 on Sun Feb 17 20:01:56 2019
*nat
:PREROUTING ACCEPT [86:11520]
:INPUT ACCEPT [64:8940]
:OUTPUT ACCEPT [71:5638]
:POSTROUTING ACCEPT [37:4255]
-A PREROUTING -d 192.168.1.21/32 -p tcp -m tcp --dport 170 -j DNAT --to-destination 192.168.2.83:22
-A PREROUTING -d 192.168.1.21/32 -p tcp -m tcp --dport 171 -j DNAT --to-destination 192.168.2.83:443
-A PREROUTING -d 192.168.1.21/32 -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.2.66:3389
-A POSTROUTING -o wlan0 -j MASQUERADE
COMMIT
# Completed on Sun Feb 17 20:01:56 2019
# Generated by iptables-save v1.6.0 on Sun Feb 17 20:01:56 2019
*filter
:INPUT ACCEPT [3188:209284]
:FORWARD ACCEPT [25:2740]
:OUTPUT ACCEPT [2306:270630]
-A FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -o wlan0 -j ACCEPT
COMMIT
# Completed on Sun Feb 17 20:01:56 2019
# Generated by iptables-save v1.6.0 on Sun Feb 17 20:01:56 2019
*mangle
:PREROUTING ACCEPT [55445:38248798]
:INPUT ACCEPT [3188:209284]
:FORWARD ACCEPT [52257:38039514]
:OUTPUT ACCEPT [2306:270630]
:POSTROUTING ACCEPT [54565:38310208]
COMMIT
# Completed on Sun Feb 17 20:01:56 2019
# Generated by iptables-save v1.6.0 on Sun Feb 17 20:01:56 2019
*raw
:PREROUTING ACCEPT [55445:38248798]
:OUTPUT ACCEPT [2306:270630]
COMMIT
# Completed on Sun Feb 17 20:01:56 2019
• iptables -L：
pi@gateway:/etc$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
• 这是dhcpcd.conf：
# A sample configuration for dhcpcd.
# See dhcpcd.conf(5) for details.
# Allow users of this group to interact with dhcpcd via the control socket.
#controlgroup wheel
# Inform the DHCP server of our hostname for DDNS.
hostname
# Use the hardware address of the interface for the Client ID.
clientid
# or
# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
# Some non-RFC compliant DHCP servers do not reply with this set.
# In this case, comment out duid and enable clientid above.
#duid
# Persist interface configuration when dhcpcd exits.
persistent
# Rapid commit support.
# Safe to enable by default because it requires the equivalent option set
# on the server to actually work.
option rapid_commit
# A list of options to request from the DHCP server.
option domain_name_servers, domain_name, domain_search, host_name
option classless_static_routes
# Most distributions have NTP support.
option ntp_servers
# Respect the network MTU. This is applied to DHCP routes.
option interface_mtu
# A ServerID is required by RFC2131.
require dhcp_server_identifier
# Generate Stable Private IPv6 Addresses instead of hardware based ones
slaac private
# Example static IP configuration:
#interface eth0
#static ip_address=192.168.0.10/24
#static ip6_address=fd51:42f8:caae:d92e::ff/64
#static routers=192.168.0.1
#static domain_name_servers=192.168.0.1 8.8.8.8 fd51:42f8:caae:d92e::1
# It is possible to fall back to a static IP if DHCP fails:
# define static profile
#profile static_eth0
#static ip_address=192.168.1.23/24
#static routers=192.168.1.1
#static domain_name_servers=192.168.1.1
# fallback to static profile on eth0
#interface eth0
#fallback static_eth0
denyinterfaces eth0
host Accountant {
hardware ethernet 10:60:4b:68:03:21;
fixed-address 192.168.2.83;
}
host Accountant1 {
hardware ethernet 00:0c:29:35:95:ed;
fixed-address 192.168.2.66;
}
host Accountant3 {
hardware ethernet 30:85:A9:1B:C4:8B;
fixed-address 192.168.2.70;
}
• 我无法弄清楚的错误消息：
root@gateway:/home/pi# systemctl restart dhcpcd
Warning: dhcpcd.service changed on disk. Run 'systemctl daemon-reload' to reload units.
Job for dhcpcd.service failed because the control process exited with error code.
See "systemctl status dhcpcd.service" and "journalctl -xe" for details.
root@gateway:/home/pi# systemctl status dhcpcd
? dhcpcd.service - dhcpcd on all interfaces
Loaded: loaded (/lib/systemd/system/dhcpcd.service; enabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/dhcpcd.service.d
??wait.conf
Active: failed (Result: exit-code) since Sun 2019-02-17 20:36:42 GMT; 6s ago
Process: 775 ExecStart=/usr/lib/dhcpcd5/dhcpcd -q -w (code=exited, status=6)
Feb 17 20:36:42 gateway systemd[1]: Starting dhcpcd on all interfaces...
Feb 17 20:36:42 gateway dhcpcd[775]: Not running dhcpcd because /etc/network/interfaces
Feb 17 20:36:42 gateway dhcpcd[775]: defines some interfaces that will use a
Feb 17 20:36:42 gateway dhcpcd[775]: DHCP client or static address
Feb 17 20:36:42 gateway systemd[1]: dhcpcd.service: Control process exited, code=exited status=6
Feb 17 20:36:42 gateway systemd[1]: Failed to start dhcpcd on all interfaces.
Feb 17 20:36:42 gateway systemd[1]: dhcpcd.service: Unit entered failed state.
Feb 17 20:36:42 gateway systemd[1]: dhcpcd.service: Failed with result 'exit-code'.
Warning: dhcpcd.service changed on disk. Run 'systemctl daemon-reload' to reload units.
root@gateway:/home/pi#
root@gateway:/home/pi# systemctl daemon-reload
root@gateway:/home/pi# systemctl status dhcpcd
? dhcpcd.service - dhcpcd on all interfaces
Loaded: loaded (/lib/systemd/system/dhcpcd.service; enabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/dhcpcd.service.d
??wait.conf
Active: failed (Result: exit-code) since Sun 2019-02-17 20:36:42 GMT; 1min 23s ago
Feb 17 20:36:42 gateway systemd[1]: Starting dhcpcd on all interfaces...
Feb 17 20:36:42 gateway dhcpcd[775]: Not running dhcpcd because /etc/network/interfaces
Feb 17 20:36:42 gateway dhcpcd[775]: defines some interfaces that will use a
Feb 17 20:36:42 gateway dhcpcd[775]: DHCP client or static address
Feb 17 20:36:42 gateway systemd[1]: dhcpcd.service: Control process exited, code=exited status=6
Feb 17 20:36:42 gateway systemd[1]: Failed to start dhcpcd on all interfaces.
Feb 17 20:36:42 gateway systemd[1]: dhcpcd.service: Unit entered failed state.
Feb 17 20:36:42 gateway systemd[1]: dhcpcd.service: Failed with result 'exit-code'.
root@gateway:/home/pi#
•gateway版本：
pi@gateway:/etc$ cat os-release
PRETTY_NAME="Raspbian GNU/Linux 9 (stretch)"
NAME="Raspbian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
ID=raspbian
ID_LIKE=debian
问题：
1）错误信息Not running dhcpcd because /etc/network/interfaces defines some interfaces that will use a DHCP client or static address是什么意思？如何修复它，根据我上面的配置？
2）为什么主机没有根据我的 dhcpcd.conf 分配 IP 地址，除了主机Accountant，它总是获得相同的 IP，这是我想要的，即使注释掉绑定...？如何修复它，以便能够将多个主机 MAC 与 IP 绑定？
3）这个符号是什么意思：
#auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.2.1
netmask 255.255.255.0
network 192.168.2.0
broadcast 192.168.2.255
interfacesLinux中文件的符号规则是什么？
问题 1.) 抱歉，您似乎误解了一些事情。
dhcpcd是一个 DHCP客户端守护进程，通常由 NetworkManager 或 启动ifupdown，而不是直接由 启动systemd。它将负责为您的wlan0.
如果您愿意，可以使用dhcpcd开始方式systemd，但这需要禁用/etc/network/interfaces发行版的所有正常网络接口配置逻辑（即必须为空的非注释行），并在必要时用您自己的自定义脚本替换它。仅限特殊用途；如果你不能绝对确定你应该这样做，那么你就不应该这样做。
dhcpcd永远不会为任何其他主机提供 IP 地址。您添加的这一部分dhcpcd.conf看起来像是属于 ISC DHCP服务器守护程序的配置文件dhcpd（是的，这只是一个字母的差异）：
host Accountant {
hardware ethernet 10:60:4b:68:03:21;
fixed-address 192.168.2.83;
}
host Accountant1 {
hardware ethernet 00:0c:29:35:95:ed;
fixed-address 192.168.2.66;
}
host Accountant3 {
hardware ethernet 30:85:A9:1B:C4:8B;
fixed-address 192.168.2.70;
}
但是，如果您正在遵循您提到的 YouTube 教程，您甚至可能还没有dhcpd安装，因为dnsmasq应该完成这项工作。
据我所知，等效语法dnsmasq.conf是：
dhcp-host=10:60:4b:68:03:21,192.168.2.83,Accountant
dhcp-host=00:0c:29:35:95:ed,192.168.2.66,Accountant1
dhcp-host=30:85:A9:1B:C4:8B,192.168.2.70,Accountant3
免责声明：我实际上没有使用过dnsmasq，所以这是基于快速谷歌搜索其手册页。
问题 2.) 在您提到的教程中，dnsmasq应该充当eth0. 你没有说任何事情，所以我不知道它是否正在运行。如果不是，始终获得相同 IP 的一个客户端可能只是退回到先前收到的尚未过期的旧 DHCP 租约。是的，如果网络似乎没有可用的工作 DHCP 服务器，DHCP 客户端可能会永久存储 DHCP 租约并继续使用它。
问题3.)：/etc/network/interfaces是一个经典的Debian/Ubuntu风格的网络接口配置文件。用于man interfaces查看它的文档，或查看此处。
在 Debian、*Ubuntu、Raspbian 等中，NetworkManager 将有一个可以读取 /etc/network/interfaces但不会写入的插件。
如果使用 NetworkManager 配置工具（例如nmcli、nmtui）或您选择的桌面环境中基于 GUI 的 NetworkManager 配置工具，则配置将保存到/etc/NetworkManager/system-connections/目录中的文件中。
如果未安装 NetworkManager，该/etc/network/interfaces文件将由ifupdown包使用，其中包括命令ifup和ifdown. 该软件包还包括一个系统启动脚本，该ifup -a脚本将在启动时运行，从而auto <interface name>启用/etc/network/interfaces. 还有一个 udev 规则，ifup <interface name>如果新网络接口的驱动程序自动加载并/etc/network/interfaces有一条allow-hotplug <interface name>线，该规则将运行。
| 归档时间： |
|
| 查看次数： |
10020 次 |
| 最近记录： |