我的 archlinux 出了点网络问题,求大佬帮忙看看

170 天前
 falser101
root@k8s-node01:~# curl 192.168.22.136:8080
curl: (7) Failed to connect to 192.168.22.136 port 8080: No route to host
root@k8s-node01:~# ping 192.168.22.136
PING 192.168.22.136 (192.168.22.136) 56(84) bytes of data.
64 bytes from 192.168.22.136: icmp_seq=1 ttl=60 time=34.5 ms
64 bytes from 192.168.22.136: icmp_seq=2 ttl=60 time=34.1 ms

192.168.22.136 是我的 archlinux,我能 ping 通,为啥 curl 会报错 no route to host 呢?

这个是 archlinux 的 route 表

$ route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         192.168.22.1    0.0.0.0         UG    100    0        0 enp3s0
10.0.0.0        192.168.22.1    255.0.0.0       UG    100    0        0 enp3s0
172.16.6.0      0.0.0.0         255.255.255.0   U     0      0        0 vmnet8
192.168.22.0    0.0.0.0         255.255.255.0   U     100    0        0 enp3s0
192.168.61.0    0.0.0.0         255.255.255.0   U     0      0        0 vmnet1
192.168.192.0   0.0.0.0         255.255.255.0   U     0      0        0 ztjlh3ajee

iptables 信息,已经关了防火墙了

$ sudo iptables -nL                         
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
1362 次点击
所在节点    Linux
9 条回复
churchmice
170 天前
你看看你有没有设置代理
falser101
170 天前
@churchmice 看本地还是那里?
RobinHuuu
170 天前
ip rule show
falser101
170 天前
@RobinHuuu $ ip rule show
0: from all lookup local
32765: from all fwmark 0x40/0xc0 lookup 100
32766: from all lookup main
32767: from all lookup default
RobinHuuu
170 天前
看看 mangle 和 nat 表，iptables 。另外，没有使用 nftable 吧
falser101
170 天前
@RobinHuuu 之前用了 nftable,我装 waydroid 卸载了,装的 iptables

$ sudo iptables -t mangle -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
TP_PRE 0 -- 0.0.0.0/0 0.0.0.0/0

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
TP_OUT 0 -- 0.0.0.0/0 0.0.0.0/0

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
CHECKSUM 17 -- 0.0.0.0/0 0.0.0.0/0 udp dpt:68 CHECKSUM fill

Chain TP_MARK (1 references)
target prot opt source destination
MARK 6 -- 0.0.0.0/0 0.0.0.0/0 tcp flags:0x17/0x02 MARK or 0x40
MARK 17 -- 0.0.0.0/0 0.0.0.0/0 ctstate NEW MARK or 0x40
CONNMARK 0 -- 0.0.0.0/0 0.0.0.0/0 CONNMARK save

Chain TP_OUT (1 references)
target prot opt source destination
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x80/0x80
TP_RULE 6 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type LOCAL dst-type !LOCAL
TP_RULE 17 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type LOCAL dst-type !LOCAL

Chain TP_PRE (1 references)
target prot opt source destination
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0 mark match ! 0x40/0xc0
TP_RULE 6 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type !LOCAL dst-type !LOCAL
TP_RULE 17 -- 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match src-type !LOCAL dst-type !LOCAL
TPROXY 6 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x40/0xc0 TPROXY redirect 127.0.0.1:52345 mark 0x0/0x0
TPROXY 17 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x40/0xc0 TPROXY redirect 127.0.0.1:52345 mark 0x0/0x0

Chain TP_RULE (4 references)
target prot opt source destination
CONNMARK 0 -- 0.0.0.0/0 0.0.0.0/0 CONNMARK restore
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0 mark match 0x40/0xc0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 0.0.0.0/0
RETURN 0 -- 0.0.0.0/0 192.168.1.0/24
RETURN 0 -- 0.0.0.0/0 192.168.240.0/24
RETURN 0 -- 0.0.0.0/0 192.168.192.0/24
RETURN 0 -- 0.0.0.0/0 172.16.6.0/24
RETURN 0 -- 0.0.0.0/0 192.168.61.0/24
RETURN 0 -- 0.0.0.0/0 192.168.22.0/24
RETURN 0 -- 0.0.0.0/0 127.0.0.0/8
RETURN 0 -- 0.0.0.0/0 0.0.0.0
RETURN 0 -- 0.0.0.0/0 10.0.0.0/8
RETURN 0 -- 0.0.0.0/0 100.64.0.0/10
RETURN 0 -- 0.0.0.0/0 169.254.0.0/16
RETURN 0 -- 0.0.0.0/0 172.16.0.0/12
RETURN 0 -- 0.0.0.0/0 192.0.0.0/24
RETURN 0 -- 0.0.0.0/0 192.0.2.0/24
RETURN 0 -- 0.0.0.0/0 192.88.99.0/24
RETURN 0 -- 0.0.0.0/0 192.168.0.0/16
RETURN 0 -- 0.0.0.0/0 198.51.100.0/24
RETURN 0 -- 0.0.0.0/0 203.0.113.0/24
RETURN 0 -- 0.0.0.0/0 224.0.0.0/4
RETURN 0 -- 0.0.0.0/0 240.0.0.0/4
TP_MARK 0 -- 0.0.0.0/0 0.0.0.0/0

$ sudo iptables -t nat -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE 0 -- 192.168.240.0/24 !192.168.240.0/24
falser101
170 天前
@RobinHuuu 果然和 nftables 有关系,如下操作后就行了!

$ sudo nft list ruleset

table inet filter {
chain input {
type filter hook input priority filter; policy drop;
ct state invalid drop comment "early drop of invalid connections"
ct state { established, related } accept comment "allow tracked connections"
iif "lo" accept comment "allow from loopback"
ip protocol icmp accept comment "allow icmp"
meta l4proto ipv6-icmp accept comment "allow icmp v6"
tcp dport 22 accept comment "allow sshd"
iifname "waydroid0" accept comment "Allow incoming network traffic from WayDroid"
meta pkttype host limit rate 5/second burst 5 packets counter packets 1393 bytes 423702 reject with icmpx admin-prohibited
counter packets 36570 bytes 7441045
}

chain forward {
type filter hook forward priority filter; policy drop;
iifname "waydroid0" accept comment "Allow outgoing network traffic from WayDroid"
ct state { established, related } counter packets 0 bytes 0 accept comment "accept established connections"
}
}

# falser @ archlinux in ~/Projects/tongpulsar_console/data on git:feat/logs x [14:26:45]
$ systemctl stop nftable
Failed to stop nftable.service: Unit nftable.service not loaded.

# falser @ archlinux in ~/Projects/tongpulsar_console/data on git:feat/logs x [14:28:05] C:5
$ sudo nft flush ruleset

# falser @ archlinux in ~/Projects/tongpulsar_console/data on git:feat/logs x [14:28:16]
$ sudo nft list ruleset
RobinHuuu
170 天前
你所有 TCP 流量要去 table 100 找路由。ip route show table 100
hanyuwei70
170 天前
可以用 cilium/pwru 查一查

这是一个专为移动设备优化的页面（即为了让你能够在 Google 搜索结果里秒开这个页面），如果你希望参与 V2EX 社区的讨论，你可以继续到 V2EX 上打开本讨论主题的完整版本。

https://www.v2ex.com/t/1065214

V2EX 是创意工作者们的社区，是一个分享自己正在做的有趣事物、交流想法，可以遇见新朋友甚至新机会的地方。

V2EX is a community of developers, designers and creative people.

© 2021 V2EX