用于网桥的iptables设置，重定向dns通信量

Question

我试图将网桥上的dns流量转发到本地dns服务器，但它没有工作。作为一种思维练习，我决定阻止所有的交通，这也是行不通的。这是我的设置：

#/etc/network/interfaces
auto lo
iface lo inet loopback

iface eth0 inet manual
iface eth1 inet manual

#allow-hotplug br0
auto br0
iface br0 inet static
bridge_ports eth0 eth1
address 192.168.1.2
netmask 255.255.255.0
gateway 192.168.1.1

sudo iptables -L的结果( MAC地址用于eth0和eth1)：

Chain INPUT (policy DROP)
target     prot opt source               destination         
DROP       udp  --  anywhere             anywhere             udp dpt:domain
DROP       tcp  --  anywhere             anywhere             tcp dpt:domain
DROP       all  --  anywhere             anywhere             MAC 10:6A:FD:32:07:7F
DROP       all  --  anywhere             anywhere             MAC B7:23:EC:30:BE:B7

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere      

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            
DROP       all  --  anywhere             anywhere 

ifconfig的结果：

br0       Link encap:Ethernet  HWaddr 10:6A:FD:32:07:7F 
          inet addr:192.168.1.2  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: 2602:30a:c038:f980::3ec/128 Scope:Global
          inet6 addr: fe80::129a:ddff:fe41:907d/64 Scope:Link
          inet6 addr: 2602:30a:c038:f980:6806:dd7b:14eb:a2b0/64 Scope:Global
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:558 errors:0 dropped:0 overruns:0 frame:0
          TX packets:83 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:39900 (38.9 KiB)  TX bytes:11753 (11.4 KiB)

eth0      Link encap:Ethernet  HWaddr B7:23:EC:30:BE:B7
          inet addr:169.254.199.229  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:60265 errors:0 dropped:0 overruns:0 frame:0
          TX packets:53413 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:52083764 (49.6 MiB)  TX bytes:12746138 (12.1 MiB)

eth1      Link encap:Ethernet  HWaddr 10:6A:FD:32:07:7F 
          inet addr:169.254.166.137  Bcast:169.254.255.255  Mask:255.255.0.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:52904 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:11527039 (10.9 MiB)  TX bytes:53215987 (50.7 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:200 errors:0 dropped:0 overruns:0 frame:0
          TX packets:200 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:14428 (14.0 KiB)  TX bytes:14428 (14.0 KiB)  

这只是我不确定eth0和eth1是否接收随机ip地址的部分。

连接设置：

Router -> (eth0)Server(eth1) -> Switch -> devices

服务器是我尝试丢弃所有数据包的地方。但是，连接到eth1的设备能够发送和接收所有通信量。我的实际目标是将所有DNS流量转发给本地DNS服务器。

Answer 1

过桥的流量不一定通过网络过滤器。检查net.bridge.bridge-nf-call-iptables sysctl的值；如果它是0，那么这就是问题所在--将其设置为1，一切都将恢复正常。

在内核3.18或更高版本上，为了使上述sysctl可用，您可能需要加载br_netfilter模块。