差分
このページの2つのバージョン間の差分を表示します。
両方とも前のリビジョン 前のリビジョン 次のリビジョン | 前のリビジョン | ||
linux:commands:network:network_manager_bridge [2023/03/14 18:03] – [参考・関連文献] ともやん | linux:commands:network:network_manager_bridge [2024/02/04 03:05] (現在) – [トラブルシューティング] ともやん | ||
---|---|---|---|
行 152: | 行 152: | ||
<WRAP color_command>< | <WRAP color_command>< | ||
<b class=GRN> | <b class=GRN> | ||
+ | </ | ||
+ | </ | ||
+ | |||
+ | ===== トラブルシューティング ===== | ||
+ | Fedora 39 で KVM ゲストから Bridge (br0 など) で外部に通信できない場合😥\\ | ||
+ | [[https:// | ||
+ | <WRAP color_term> | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | <b class=DiYE> | ||
+ | net.bridge.bridge-nf-call-ip6tables = 1 | ||
+ | net.bridge.bridge-nf-call-iptables = 1</b> | ||
+ | net.bridge.bridge-nf-filter-pppoe-tagged = 0 | ||
+ | net.bridge.bridge-nf-filter-vlan-tagged = 0 | ||
+ | net.bridge.bridge-nf-pass-vlan-input-dev = 0 | ||
+ | </ | ||
+ | </ | ||
+ | |||
+ | iptables を設定して、全てのトラフィックがブリッジを渡って転送されるようにします🤔\\ | ||
+ | <WRAP color_term> | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | success | ||
+ | </ | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | success | ||
+ | </ | ||
+ | </ | ||
+ | <WRAP round tip 90%> | ||
+ | ルールを削除する場合\\ | ||
+ | <WRAP color_term> | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | </ | ||
+ | </ | ||
+ | </ | ||
+ | |||
+ | 設定結果の確認🤔\\ | ||
+ | <WRAP color_term> | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | & | ||
+ | <b class=DiYE>& | ||
+ | & | ||
+ | & | ||
+ | </ | ||
+ | </ | ||
+ | |||
+ | <WRAP color_term> | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result_long>< | ||
+ | # Generated by iptables-save v1.8.9 (nf_tables) on Sun Feb 4 02:07:04 2024 | ||
+ | *mangle | ||
+ | :PREROUTING ACCEPT [0:0] | ||
+ | :INPUT ACCEPT [0:0] | ||
+ | :FORWARD ACCEPT [0:0] | ||
+ | :OUTPUT ACCEPT [0:0] | ||
+ | : | ||
+ | : | ||
+ | -A POSTROUTING -j LIBVIRT_PRT | ||
+ | -A LIBVIRT_PRT -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill | ||
+ | COMMIT | ||
+ | # Completed on Sun Feb 4 02:07:04 2024 | ||
+ | # Generated by iptables-save v1.8.9 (nf_tables) on Sun Feb 4 02:07:04 2024 | ||
+ | *filter | ||
+ | :INPUT ACCEPT [0:0] | ||
+ | :FORWARD DROP [0:0] | ||
+ | :OUTPUT ACCEPT [0:0] | ||
+ | :DOCKER - [0:0] | ||
+ | : | ||
+ | : | ||
+ | : | ||
+ | : | ||
+ | : | ||
+ | : | ||
+ | : | ||
+ | : | ||
+ | -A INPUT -j LIBVIRT_INP | ||
+ | -A FORWARD -j DOCKER-ISOLATION-STAGE-1 | ||
+ | -A FORWARD -j DOCKER-USER | ||
+ | -A FORWARD -o docker0 -m conntrack --ctstate RELATED, | ||
+ | -A FORWARD -o docker0 -j DOCKER | ||
+ | -A FORWARD -i docker0 ! -o docker0 -j ACCEPT | ||
+ | -A FORWARD -i docker0 -o docker0 -j ACCEPT | ||
+ | -A FORWARD -j LIBVIRT_FWX | ||
+ | -A FORWARD -j LIBVIRT_FWI | ||
+ | -A FORWARD -j LIBVIRT_FWO | ||
+ | <b class=DiYE> | ||
+ | -A OUTPUT -j LIBVIRT_OUT | ||
+ | -A DOCKER-ISOLATION-STAGE-1 -j RETURN | ||
+ | -A DOCKER-ISOLATION-STAGE-2 -j RETURN | ||
+ | -A DOCKER-USER -j RETURN | ||
+ | -A LIBVIRT_FWI -d 192.168.122.0/ | ||
+ | -A LIBVIRT_FWI -o virbr0 -j REJECT --reject-with icmp-port-unreachable | ||
+ | -A LIBVIRT_FWO -s 192.168.122.0/ | ||
+ | -A LIBVIRT_FWO -i virbr0 -j REJECT --reject-with icmp-port-unreachable | ||
+ | -A LIBVIRT_FWX -i virbr0 -o virbr0 -j ACCEPT | ||
+ | -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 53 -j ACCEPT | ||
+ | -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT | ||
+ | -A LIBVIRT_INP -i virbr0 -p udp -m udp --dport 67 -j ACCEPT | ||
+ | -A LIBVIRT_INP -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT | ||
+ | -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 53 -j ACCEPT | ||
+ | -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 53 -j ACCEPT | ||
+ | -A LIBVIRT_OUT -o virbr0 -p udp -m udp --dport 68 -j ACCEPT | ||
+ | -A LIBVIRT_OUT -o virbr0 -p tcp -m tcp --dport 68 -j ACCEPT | ||
+ | COMMIT | ||
+ | # Completed on Sun Feb 4 02:07:04 2024 | ||
+ | # Generated by iptables-save v1.8.9 (nf_tables) on Sun Feb 4 02:07:04 2024 | ||
+ | *nat | ||
+ | :PREROUTING ACCEPT [0:0] | ||
+ | :INPUT ACCEPT [0:0] | ||
+ | :OUTPUT ACCEPT [0:0] | ||
+ | : | ||
+ | :DOCKER - [0:0] | ||
+ | : | ||
+ | -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER | ||
+ | -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER | ||
+ | -A POSTROUTING -s 172.17.0.0/ | ||
+ | -A POSTROUTING -j LIBVIRT_PRT | ||
+ | -A DOCKER -i docker0 -j RETURN | ||
+ | -A LIBVIRT_PRT -s 192.168.122.0/ | ||
+ | -A LIBVIRT_PRT -s 192.168.122.0/ | ||
+ | -A LIBVIRT_PRT -s 192.168.122.0/ | ||
+ | -A LIBVIRT_PRT -s 192.168.122.0/ | ||
+ | -A LIBVIRT_PRT -s 192.168.122.0/ | ||
+ | COMMIT | ||
+ | # Completed on Sun Feb 4 02:07:04 2024 | ||
+ | </ | ||
+ | </ | ||
+ | |||
+ | ゲストで疎通確認😎\\ | ||
+ | <WRAP color_term> | ||
+ | <WRAP color_command>< | ||
+ | $ ping google.com | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | PING google.com (142.251.222.46) 56(84) バイトのデータ | ||
+ | 64 バイト応答 送信元 nrt13s72-in-f14.1e100.net (142.251.222.46): | ||
+ | 64 バイト応答 送信元 nrt13s72-in-f14.1e100.net (142.251.222.46): | ||
+ | 64 バイト応答 送信元 nrt13s72-in-f14.1e100.net (142.251.222.46): | ||
+ | 64 バイト応答 送信元 nrt13s72-in-f14.1e100.net (142.251.222.46): | ||
+ | ^C | ||
+ | </ | ||
+ | </ | ||
+ | |||
+ | ちなみに、< | ||
+ | なので Fedora 39 ではブリッジの転送許可を firewall-cmd で設定するしかない😉\\ | ||
+ | <WRAP color_term> | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | # sysctl settings are defined through files in | ||
+ | # / | ||
+ | # | ||
+ | # Vendors settings live in / | ||
+ | # To override a whole file, create a new file with the same in | ||
+ | # / | ||
+ | # only specific settings, add a file with a lexically later | ||
+ | # name in / | ||
+ | # | ||
+ | # For more information, | ||
+ | net.bridge.bridge-nf-call-ip6tables = 0 | ||
+ | net.bridge.bridge-nf-call-iptables = 0 | ||
+ | net.bridge.bridge-nf-call-arptables = 0 | ||
+ | </ | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | 合計 4 | ||
+ | lrwxrwxrwx. 1 root root 14 1月 22 09:00 <font color="# | ||
+ | </ | ||
+ | <WRAP color_command>< | ||
+ | <font color="# | ||
+ | </ | ||
+ | <WRAP color_result>< | ||
+ | net.bridge.bridge-nf-call-arptables = 1 | ||
+ | net.bridge.bridge-nf-call-ip6tables = 1 | ||
+ | net.bridge.bridge-nf-call-iptables = 1 | ||
+ | net.bridge.bridge-nf-filter-pppoe-tagged = 0 | ||
+ | net.bridge.bridge-nf-filter-vlan-tagged = 0 | ||
+ | net.bridge.bridge-nf-pass-vlan-input-dev = 0 | ||
</ | </ | ||
</ | </ | ||
行 160: | 行 356: | ||
[[https:// | [[https:// | ||
- | ====== ☢️古い資料です☢️ ====== | + | ==== 付録 ==== |
+ | [[tw> | ||
+ | |||
+ | ====== ☢️古い資料です | ||
===== ブリッジ接続の設定(network編) ===== | ===== ブリッジ接続の設定(network編) ===== |