vlans和iptable (debian)

Question

我正在努力使我的VLAN和iptables正确地工作。

enp2s0f0 =广域网

enp2s0f1.4 =管理网络

我试图尝试的是，允许Admin网络连接到连接到VLAN的任何设备，而其他VLAN只能在其VLAN内连接。

下面是我现在的页表：

# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*filter
:INPUT ACCEPT [145:12267]
:FORWARD ACCEPT [570:105932]
:OUTPUT ACCEPT [730:148524]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0f0 -p tcp -m conntrack --ctstate NEW -m tcp -m multiport --dports 20,21,22,80,443,139,445,8181,4343,8883,60000:65535 -j ACCEPT
-A INPUT -i enp2s0f0 -p udp -m conntrack --ctstate NEW -m udp -m multiport --dports 123,137,138,5353,5678,1194 -j ACCEPT
-A INPUT -i enp2s0f0 -j DROP
-A FORWARD -i enp2s0f1.2 -o enp2s0f1.3 -j DROP
-A FORWARD -i enp2s0f1.2 -o enp2s0f1.4 -j DROP
-A FORWARD -i enp2s0f1.3 -o enp2s0f1.2 -j DROP
-A FORWARD -i enp2s0f1.3 -o enp2s0f1.4 -j DROP
COMMIT
# Completed on Wed Jun 19 11:00:52 2019
# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*raw
:PREROUTING ACCEPT [1367:271510]
:OUTPUT ACCEPT [736:149313]
-A PREROUTING -p tcp -m tcp --dport 21 -j CT --helper ftp
COMMIT

# Completed on Wed Jun 19 11:00:52 2019
# Generated by iptables-save v1.6.0 on Wed Jun 19 11:00:52 2019
*nat
:PREROUTING ACCEPT [56:3871]
:INPUT ACCEPT [40:2935]
:OUTPUT ACCEPT [45:14318]
:POSTROUTING ACCEPT [52:14303]
-A POSTROUTING -o enp2s0f0 -j MASQUERADE
COMMIT
# Completed on Wed Jun 19 11:00:52 2019

下面是我的网络接口

# Include additional interface stanzas.
source-directory interfaces.d

# The loopback network interface
auto lo
iface lo inet loopback
pre-up iptables-restore < /etc/iptables.rules

# enp2s0f0 network interface
allow-hotplug enp2s0f0
iface enp2s0f0 inet dhcp

# server connections
# enp2s0f1 network interface
allow-hotplug enp2s0f1
iface enp2s0f1 inet static
    address 10.0.0.1
    netmask 255.255.255.0
    network 10.0.0.0
    broadcoast 10.0.0.255
    up vconfig add enp2s0f1 2
    up vconfig add enp2s0f1 3
    up vconfig add enp2s0f1 4

# guest network
# enp2s0f1.2 network interface
auto enp2s0f1.2
iface enp2s0f1.2 inet static
    address 10.0.10.1
    netmask 255.255.255.0
    network 10.0.10.0
    broadcast 10.0.10.255

# home network
# enp2s0f1.3 network interface
auto  enp2s0f1.3
iface enp2s0f1.3 inet static
    address 10.0.20.1
    netmask 255.255.255.0
    network 10.0.20.0
    broadcast 10.0.20.255

# business network
# enp2s0f1.4 network interface
auto enp2s0f1.4
iface enp2s0f1.4 inet static
    address 10.0.30.1
    netmask 255.255.255.0
    network 10.0.30.0
    broadcast 10.0.30.255

我还运行了一个通过托管交换机连接到enp2s0f1的DNS服务器。我已经通过dhcp设置自动设置了DNS服务器ip。所有的vlans都需要能够与连接到交换机的任何东西进行通信。

我试过了iptables -P FORWARD DROP，但是这样就不能访问任何与交换机相关的东西了。

Answer 1

1. 您不需要up vconfig...文件的enp2s0f1部分中的interfaces语句。Vlan接口将自动生成相应的接口。
2. 为了获得更好的控制，请使用ACCEPT/DROP all而不是DROP/ACCEPT all。
3. 在您的例子中，规则如下：

# allow replies and port forwarding
iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED,DNAT -j ACCEPT

# allow access to WAN and to DNS from all interfaces (if your debian host is gateway)
iptables -A FORWARD -i enp2s0f1+ -o enp4s0f0 -j ACCEPT
iptables -A FORWARD -i enp2s0f1+ -o enp4s0f1 -j ACCEPT

# allow access to admin vlan from all vlans
iptables -A FORWARD -o enp2s0f1.4 -j ACCEPT
iptables -A FORWARD -i enp2s0f1.4 -j ACCEPT

# log and drop other connections
iptables -A FORWARD -m conntrack --ctstate NEW,INVALID,UNTRACKED -j NFLOG
# you can just set FORWARD policy to DROP
iptables -A FORWARD -j DROP

1. 若要检查规则计数器并使用tcpdump，请执行疑难解答。