Administrace komentářů

Dobrý deň vám prajem.

Mám CentOS 6.5 router, ktorý cez eth0 je pripojený na internet a na eth1 má dve vlan-y. Všetko funguje ako má, teda počítače z obidvoch sieti sa dostanú na server, takisto aj na internet. Takisto keď som na serveri "vidím" všetky pc v obidvoch vlan-ach. Jediný problém mám s komunikáciou pc naprieč vlan. Čiže potrebujem napríklad aby pc vo vlan12 "videli" na tlačiareň, ktorá je vo vlan11. A to sa mi nedarí. V sysctl.conf samozrejme mám "net.ipv4.ip_forward = 1".

Konfigurácia je nasledovná:

ip route show

192.168.254.2 dev tun0  proto kernel  scope link  src 192.168.254.1 
1.2.3.248/29 dev eth0  proto kernel  scope link  src 1.2.3.249 
192.168.12.0/24 dev eth1.12  proto kernel  scope link  src 192.168.12.254 
192.168.11.0/24 dev eth1.11  proto kernel  scope link  src 192.168.11.254 
192.168.254.0/24 via 192.168.254.2 dev tun0 
169.254.0.0/16 dev eth1.12  scope link 
default via 1.2.3.254 dev eth0

ifcfg-eth0

DEVICE=eth0
TYPE=Ethernet
BOOTPROTO=static
IPADDR=1.2.3.249
NETMASK=255.255.255.248
NETWORK=1.2.3.248
BROADCAST=1.2.3.255
ONBOOT=yes

ifcfg-eth1

DEVICE=eth1
TYPE=Ethernet
BOOTPROTO=none
ONBOOT=yes

ifcfg-eth1.11

DEVICE=eth1.11
TYPE=Ethernet
BOOTPROTO=static
IPADDR=192.168.11.254
NETMASK=255.255.255.0
NETWORK=192.168.11.0
BROADCAST=192.168.11.255
ONBOOT=yes
VLAN=yes

ifcfg-eth1.12

DEVICE=eth1.12
TYPE=Ethernet
BOOTPROTO=static
IPADDR=192.168.12.254
NETMASK=255.255.255.0
NETWORK=192.168.12.0
BROADCAST=192.168.12.255
ONBOOT=yes
VLAN=yes

Absolútne základný výcuc z firewall-a

LO_IP="127.0.0.1"
LO_NETMASK="127.0.0.0/24"

ETH0_IP="1.2.3.249"
ETH0_NETMASK="1.2.3.248/29"

ETH1_11_IP="192.168.11.254"
ETH1_11_NETMASK="192.168.11.0/24"

ETH1_12_IP="192.168.12.254"
ETH1_12_NETMASK="192.168.12.0/24"

TUN0_IP="192.168.254.1"
TUN0_NETMASK="192.168.254.0/24"

/sbin/iptables --policy FORWARD DROP
/sbin/iptables --table filter --append FORWARD --match state --state ESTABLISHED,RELATED --jump ACCEPT
/sbin/iptables --table filter --append FORWARD --match state --state INVALID --jump DROP

/sbin/iptables --policy INPUT DROP
/sbin/iptables --table filter --append INPUT --match state --state ESTABLISHED,RELATED --jump ACCEPT
/sbin/iptables --table filter --append INPUT --match state --state INVALID --jump DROP

/sbin/iptables --policy OUTPUT DROP
/sbin/iptables --table filter --append OUTPUT --match state --state ESTABLISHED,RELATED --jump ACCEPT
/sbin/iptables --table filter --append OUTPUT --match state --state INVALID --jump DROP

echo -n "Create Rules for Chain: FORWARD ................................................................................ "
/sbin/iptables --table filter --append FORWARD --match state --state NEW --in-interface eth1.11 --source ${ETH1_11_NETMASK} --jump ACCEPT
/sbin/iptables --table filter --append FORWARD --match state --state NEW --in-interface eth1.12 --source ${ETH1_12_NETMASK} --jump ACCEPT
/sbin/iptables --table filter --append FORWARD --match state --state NEW --in-interface tun0 --source ${TUN0_NETMASK} --jump ACCEPT
echo "Done."

echo -n "Create Rules for Chain: INPUT .................................................................................. "
/sbin/iptables --table filter --append INPUT --match state --state NEW --in-interface lo --jump ACCEPT
/sbin/iptables --table filter --append INPUT --match state --state NEW --protocol TCP --match multiport --destination-port 22 --jump ACCEPT

/sbin/iptables --table filter --append INPUT --match limit --limit 1/second --limit-burst 5 --protocol ICMP --icmp-type 0 --jump ACCEPT
/sbin/iptables --table filter --append INPUT --match limit --limit 1/second --limit-burst 5 --protocol ICMP --icmp-type 3 --jump ACCEPT
/sbin/iptables --table filter --append INPUT --match limit --limit 1/second --limit-burst 5 --protocol ICMP --icmp-type 8 --jump ACCEPT
/sbin/iptables --table filter --append INPUT --match limit --limit 1/second --limit-burst 5 --protocol ICMP --icmp-type 11 --jump ACCEPT
echo "Done."

echo -n "Create Rules for Chain: OUTPUT ................................................................................. "
/sbin/iptables --table filter --append OUTPUT --match state --state NEW --jump ACCEPT
echo "Done."

echo -n "Create Rules for Chain: POSTROUTING ............................................................................ "
/sbin/iptables --table nat --append POSTROUTING --out-interface eth0 --source ${ETH1_11_NETMASK} --jump SNAT --to-source ${ETH0_IP}
/sbin/iptables --table nat --append POSTROUTING --out-interface eth0 --source ${ETH1_12_NETMASK} --jump SNAT --to-source ${ETH0_IP}
/sbin/iptables --table nat --append POSTROUTING --out-interface eth0 --source ${TUN0_NETMASK} --jump SNAT --to-source ${ETH0_IP}
echo "Done."

Za akúkoľvek radu vám budem veľmi vďačný.