iptables - 内部ネットワークから外部ネットワークへのトラフィック転送は機能しません。

私はalmalinux 8を実行しており、私の仮想マシンは3つのネットワークインターフェイスに接続されています。

`[root@puppetmaster ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:d1:2f:93 brd ff:ff:ff:ff:ff:ff
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic noprefixroute enp0s3
       valid_lft 80482sec preferred_lft 80482sec
    inet6 fe80::a00:27ff:fed1:2f93/64 scope link noprefixroute
       valid_lft forever preferred_lft forever
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:e4:53:8a brd ff:ff:ff:ff:ff:ff
    inet 192.168.128.2/24 brd 192.168.128.255 scope global noprefixroute enp0s8
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fee4:538a/64 scope link
       valid_lft forever preferred_lft forever
4: enp0s9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:c5:47:fa brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.10/24 brd 192.168.1.255 scope global dynamic noprefixroute enp0s9
       valid_lft 69570sec preferred_lft 69570sec
    inet6 fe80::a00:27ff:fec5:47fa/64 scope link
       valid_lft forever preferred_lft forever`

今、すべてのネットワークトラフィックenp0s8をenp0s9。だからiptablesで試してみました。これを行うには、次のコマンドを実行しました。

[root@puppetmaster ~]# sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 1
[root@puppetmaster ~]# iptables -t nat -A POSTROUTING --out-interface enp0s9 -j MASQUERADE
root@puppetmaster ~]# iptables -A FORWARD --in-interface enp0s8 -j ACCEPT

これはiptablesの出力です。

[root@puppetmaster ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination
MASQUERADE  all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@puppetmaster ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
ACCEPT     icmp --  anywhere             anywhere
ACCEPT     all  --  anywhere             anywhere
ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

しかし、まだpingできません。

ありがとう

イントラネットでpingを送信できる必要があります。

- - - - 編集する - - - - - - - - - -

別のVMを設定し、デフォルトパスを追加しました。

[root@websrv ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:d1:2f:93 brd ff:ff:ff:ff:ff:ff
3: enp0s8: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:f0:16:bd brd ff:ff:ff:ff:ff:ff
    inet 192.168.128.10/24 brd 192.168.128.255 scope global noprefixroute enp0s8
       valid_lft forever preferred_lft forever
    inet6 fe80::a00:27ff:fef0:16bd/64 scope link
       valid_lft forever preferred_lft forever
4: enp0s9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:ca:35:bd brd ff:ff:ff:ff:ff:ff
[root@websrv ~]# ip route
default via 192.168.128.2 dev enp0s8
192.168.128.0/24 dev enp0s8 proto kernel scope link src 192.168.128.10 metric 101

ただし、pingを試みるとdnsリクエストへのレスポンスは返されますが、icmpリクエストへのレスポンスは返されません。

[root@websrv ~]# ping google.com
PING google.com (142.250.192.110) 56(84) bytes of data.
^C
--- google.com ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2074ms