我的 archlinux 出了点网络问题,求大佬帮忙看看

V2EX = way to explore

V2EX 是一个关于分享和探索的地方

现在注册

已注册用户请登录

Distributions

› Ubuntu

› Fedora

› CentOS

中文资源站

› 网易开源镜像站

这是一个创建于 111 天前的主题，其中的信息可能已经有所发展或是发生改变。

root@k8s-node01:~# curl 192.168.22.136:8080
curl: (7) Failed to connect to 192.168.22.136 port 8080: No route to host
root@k8s-node01:~# ping 192.168.22.136
PING 192.168.22.136 (192.168.22.136) 56(84) bytes of data.
64 bytes from 192.168.22.136: icmp_seq=1 ttl=60 time=34.5 ms
64 bytes from 192.168.22.136: icmp_seq=2 ttl=60 time=34.1 ms

192.168.22.136 是我的 archlinux,我能 ping 通,为啥 curl 会报错 no route to host 呢?

这个是 archlinux 的 route 表

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.22.1    0.0.0.0         UG    100    0        0 enp3s0
10.0.0.0        192.168.22.1    255.0.0.0       UG    100    0        0 enp3s0
172.16.6.0      0.0.0.0         255.255.255.0   U     0      0        0 vmnet8
192.168.22.0    0.0.0.0         255.255.255.0   U     100    0        0 enp3s0
192.168.61.0    0.0.0.0         255.255.255.0   U     0      0        0 vmnet1
192.168.192.0   0.0.0.0         255.255.255.0   U     0      0        0 ztjlh3ajee

iptables 信息,已经关了防火墙了

$ sudo iptables -nL                         
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

9 条回复 • 2024-08-15 15:34:48 +08:00

churchmice

111 天前

你看看你有没有设置代理

falser101

111 天前

@churchmice 看本地还是那里?

RobinHuuu

111 天前 via iPhone

ip rule show

falser101

111 天前

@RobinHuuu $ ip rule show
0: from all lookup local
32765: from all fwmark 0x40/0xc0 lookup 100
32766: from all lookup main
32767: from all lookup default

RobinHuuu

111 天前 via iPhone

看看 mangle 和 nat 表，iptables 。另外，没有使用 nftable 吧

falser101

111 天前

@RobinHuuu 之前用了 nftable,我装 waydroid 卸载了,装的 iptables

$ sudo iptables -t mangle -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
TP_PRE 0 -- 0.0.0.0/0 0.0.0.0/0

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
TP_OUT 0 -- 0.0.0.0/0 0.0.0.0/0

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
CHECKSUM 17 -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68 CHECKSUM fill

Chain TP_MARK (1 references)
target prot opt source destination
MARK 6 -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 MARK or 0x40
MARK 17 -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW MARK or 0x40
CONNMARK 0 -- 0.0.0.0/0 0.0.0.0/0 CONNMARK save

Chain TP_OUT (1 references)
target prot opt source destination
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x80/0x80
TP_RULE 6 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type LOCAL dst-type !LOCAL
TP_RULE 17 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type LOCAL dst-type !LOCAL

Chain TP_PRE (1 references)
target prot opt source destination
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0 mark match ! 0x40/0xc0
TP_RULE 6 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type !LOCAL dst-type !LOCAL
TP_RULE 17 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type !LOCAL dst-type !LOCAL
TPROXY 6 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x40/0xc0 TPROXY redirect 127.0.0.1:52345 mark 0x0/0x0
TPROXY 17 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x40/0xc0 TPROXY redirect 127.0.0.1:52345 mark 0x0/0x0

Chain TP_RULE (4 references)
target prot opt source destination
CONNMARK 0 -- 0.0.0.0/0 0.0.0.0/0 CONNMARK restore
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x40/0xc0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 192.168.1.0/24
RETURN 0 -- 0.0.0.0/0 192.168.240.0/24
RETURN 0 -- 0.0.0.0/0 192.168.192.0/24
RETURN 0 -- 0.0.0.0/0 172.16.6.0/24
RETURN 0 -- 0.0.0.0/0 192.168.61.0/24
RETURN 0 -- 0.0.0.0/0 192.168.22.0/24
RETURN 0 -- 0.0.0.0/0 127.0.0.0/8
RETURN 0 -- 0.0.0.0/0 0.0.0.0
RETURN 0 -- 0.0.0.0/0 10.0.0.0/8
RETURN 0 -- 0.0.0.0/0 100.64.0.0/10
RETURN 0 -- 0.0.0.0/0 169.254.0.0/16
RETURN 0 -- 0.0.0.0/0 172.16.0.0/12
RETURN 0 -- 0.0.0.0/0 192.0.0.0/24
RETURN 0 -- 0.0.0.0/0 192.0.2.0/24
RETURN 0 -- 0.0.0.0/0 192.88.99.0/24
RETURN 0 -- 0.0.0.0/0 192.168.0.0/16
RETURN 0 -- 0.0.0.0/0 198.51.100.0/24
RETURN 0 -- 0.0.0.0/0 203.0.113.0/24
RETURN 0 -- 0.0.0.0/0 224.0.0.0/4
RETURN 0 -- 0.0.0.0/0 240.0.0.0/4
TP_MARK 0 -- 0.0.0.0/0 0.0.0.0/0

$ sudo iptables -t nat -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE 0 -- 192.168.240.0/24 !192.168.240.0/24

falser101

111 天前

@RobinHuuu 果然和 nftables 有关系,如下操作后就行了!

$ sudo nft list ruleset

table inet filter {
chain input {
type filter hook input priority filter; policy drop;
ct state invalid drop comment "early drop of invalid connections"
ct state { established, related } accept comment "allow tracked connections"
iif "lo" accept comment "allow from loopback"
ip protocol icmp accept comment "allow icmp"
meta l4proto ipv6-icmp accept comment "allow icmp v6"
tcp dport 22 accept comment "allow sshd"
iifname "waydroid0" accept comment "Allow incoming network traffic from WayDroid"
meta pkttype host limit rate 5/second burst 5 packets counter packets 1393 bytes 423702 reject with icmpx admin-prohibited
counter packets 36570 bytes 7441045
}

chain forward {
type filter hook forward priority filter; policy drop;
iifname "waydroid0" accept comment "Allow outgoing network traffic from WayDroid"
ct state { established, related } counter packets 0 bytes 0 accept comment "accept established connections"
}
}

# falser @ archlinux in ~/Projects/tongpulsar_console/data on git:feat/logs x [14:26:45]
$ systemctl stop nftable
Failed to stop nftable.service: Unit nftable.service not loaded.

# falser @ archlinux in ~/Projects/tongpulsar_console/data on git:feat/logs x [14:28:05] C:5
$ sudo nft flush ruleset

# falser @ archlinux in ~/Projects/tongpulsar_console/data on git:feat/logs x [14:28:16]
$ sudo nft list ruleset

RobinHuuu

111 天前 via iPhone

你所有 TCP 流量要去 table 100 找路由。ip route show table 100

hanyuwei70

111 天前

可以用 cilium/pwru 查一查