В логе сие:
FORWARD packet died: IN=vlan256 OUT=eth0 SRC=192.168.0.2 DST=192.168.1.53 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=819 PROTO=ICMP TYPE=0 CODE=0 ID=1 SEQ=10846
FORWARD packet died: IN=vlan256 OUT=eth0 SRC=192.168.0.2 DST=192.168.1.53 LEN=60 TOS=0x00 PREC=0x00 TTL=127 ID=2298 PROTO=ICMP TYPE=8 CODE=0 ID=1 SEQ=2655
> 192.168.0.1 > 192.168.0.2 и запросы и ответы идут, только вот как они
> на eth0 у вас появились, vlan256 идет через eth0?
#cat /proc/net/vlan/config
VLAN Dev name | VLAN ID
vlan256 | 256 | eth0
> 192.168.1.53 > 192.168.0.2 не прошел через шлюз хотя правило вроде есть?
да
> покажите sysctl -a|grep forward и весь iptables-save белые адреса само собой измените
#sysctl -a | grep forward
net.ipv4.conf.all.forwarding = 1
net.ipv4.conf.all.mc_forwarding = 0
net.ipv4.conf.default.forwarding = 1
net.ipv4.conf.default.mc_forwarding = 0
net.ipv4.conf.lo.forwarding = 1
net.ipv4.conf.lo.mc_forwarding = 0
net.ipv4.conf.eth0.forwarding = 1
net.ipv4.conf.eth0.mc_forwarding = 0
net.ipv4.conf.eth1.forwarding = 1
net.ipv4.conf.eth1.mc_forwarding = 0
net.ipv4.conf.vlan256.forwarding = 1
net.ipv4.conf.vlan256.mc_forwarding = 0
net.ipv4.conf.tun0.forwarding = 1
net.ipv4.conf.tun0.mc_forwarding = 0
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 0
net.ipv6.conf.all.mc_forwarding = 0
net.ipv6.conf.default.forwarding = 0
net.ipv6.conf.default.mc_forwarding = 0
net.ipv6.conf.lo.forwarding = 0
net.ipv6.conf.lo.mc_forwarding = 0
net.ipv6.conf.eth0.forwarding = 0
net.ipv6.conf.eth0.mc_forwarding = 0
net.ipv6.conf.eth1.forwarding = 0
net.ipv6.conf.eth1.mc_forwarding = 0
net.ipv6.conf.vlan256.forwarding = 0
net.ipv6.conf.vlan256.mc_forwarding = 0
net.ipv6.conf.tun0.forwarding = 0
net.ipv6.conf.tun0.mc_forwarding = 0
#iptables-save
*mangle
:PREROUTING ACCEPT [27020318:21672755150]
:INPUT ACCEPT [23137147:18709445366]
:FORWARD ACCEPT [3868810:2962530354]
:OUTPUT ACCEPT [21572244:18681127573]
:POSTROUTING ACCEPT [25429511:21642590953]
COMMIT
*nat
:PREROUTING ACCEPT [1097918:60771855]
:POSTROUTING ACCEPT [628590:39771147]
:OUTPUT ACCEPT [559147:35687666]
COMMIT
*filter
:INPUT DROP [591866:33286352]
:FORWARD DROP [12605:1157695]
:OUTPUT ACCEPT [6:648]
:bad_packets - [0:0]
:bad_tcp_packets - [0:0]
:door - [0:0]
:icmp_packets - [0:0]
:stage1 - [0:0]
:stage2 - [0:0]
:tcp_inbound - [0:0]
:tcp_outbound - [0:0]
:udp_inbound - [0:0]
:udp_outbound - [0:0]
-A INPUT -s 192.168.3.0/24 -i tun0 -j ACCEPT
-A INPUT -d ip/32 -p tcp -m tcp --dport 1194 -j ACCEPT
-A INPUT -s 127.0.0.1/32 -i lo -j ACCEPT
-A INPUT -s 192.168.1.0/24 -i lo -j ACCEPT
-A INPUT -s 192.168.3.0/24 -i tun0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -s 10.15.32.0/24 -i tun0 -p udp -m udp --dport 53 -j ACCEPT
-A INPUT -s 192.168.0.2/32 -i vlan256 -j ACCEPT
-A INPUT -s 192.168.0.2/32 -d 192.168.1.0/24 -j ACCEPT
-A INPUT -j bad_packets
-A INPUT -d 224.0.0.1/32 -j DROP
-A INPUT -s 192.168.1.0/24 -i eth0 -j ACCEPT
-A INPUT -d 192.168.1.255/32 -i eth0 -j ACCEPT
-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i eth1 -p tcp -j tcp_inbound
-A INPUT -i eth1 -p udp -j udp_inbound
-A INPUT -i eth1 -p icmp -j icmp_packets
-A INPUT -m pkttype --pkt-type broadcast -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -m recent --rcheck --seconds 5 --name heaven --rsource -j ACCEPT
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j door
-A INPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "INPUT packet died: "
-A FORWARD -j bad_packets
-A FORWARD -i eth0 -o vlan256 -p tcp -j ACCEPT
-A FORWARD -i tun0 -o vlan256 -p tcp -j ACCEPT
-A FORWARD -i tun0 -o eth0 -p tcp -j ACCEPT
-A FORWARD -i vlan256 -o eth0 -p tcp -j ACCEPT
-A FORWARD -i vlan256 -o tun0 -p tcp -j ACCEPT
-A FORWARD -i eth0 -o tun0 -p tcp -j ACCEPT
-A FORWARD -s 192.168.0.0/24 -d 192.168.1.0/24 -p tcp -j ACCEPT
-A FORWARD -d 192.168.1.0/24 -i vlan256 -p tcp -j ACCEPT
-A FORWARD -s 192.168.1.0/24 -o vlan256 -p tcp -j ACCEPT
-A FORWARD -s 192.168.3.0/24 -o vlan256 -p tcp -j ACCEPT
-A FORWARD -i eth0 -p tcp -j tcp_outbound
-A FORWARD -i tun0 -p tcp -j tcp_outbound
-A FORWARD -i eth0 -p udp -j udp_outbound
-A FORWARD -i tun0 -p udp -j udp_outbound
-A FORWARD -i eth0 -j ACCEPT
-A FORWARD -i tun0 -j ACCEPT
-A FORWARD -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i tun0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "FORWARD packet died: "
-A OUTPUT -p icmp -m state --state INVALID -j DROP
-A OUTPUT -s 127.0.0.1/32 -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -s 192.168.1.1/32 -j ACCEPT
-A OUTPUT -o eth0 -j ACCEPT
-A OUTPUT -s 192.168.0.1/32 -j ACCEPT
-A OUTPUT -o vlan256 -j ACCEPT
-A OUTPUT -o eth1 -j ACCEPT
-A OUTPUT -m limit --limit 3/min --limit-burst 3 -j LOG --log-prefix "OUTPUT packet died: "
-A bad_packets -s 192.168.1.0/24 -i eth1 -j LOG --log-prefix "Illegal source: "
-A bad_packets -s 192.168.1.0/24 -i eth1 -j DROP
-A bad_packets -m state --state INVALID -j LOG --log-prefix "Invalid packet: "
-A bad_packets -m state --state INVALID -j DROP
-A bad_packets -p tcp -j bad_tcp_packets
-A bad_packets -j RETURN
-A bad_tcp_packets -i eth0 -p tcp -j RETURN
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j LOG --log-prefix "New not syn: "
-A bad_tcp_packets -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,PSH,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,ACK,URG -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags SYN,RST SYN,RST -j DROP
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j LOG --log-prefix "Stealth scan: "
-A bad_tcp_packets -p tcp -m tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
-A bad_tcp_packets -p tcp -j RETURN
-A door -m recent --rcheck --seconds 5 --name knock2 --rsource -j stage2
-A door -m recent --rcheck --seconds 5 --name knock --rsource -j stage1
-A door -p tcp -m tcp --dport xxx -m recent --set --name knock --rsource
-A icmp_packets -p icmp -f -j LOG --log-prefix "ICMP Fragment: "
-A icmp_packets -p icmp -f -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 8 -j DROP
-A icmp_packets -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A icmp_packets -p icmp -j RETURN
-A stage1 -m recent --remove --name knock --rsource
-A stage1 -p tcp -m tcp --dport xxx -m recent --set --name knock2 --rsource
-A stage2 -m recent --remove --name knock2 --rsource
-A stage2 -p tcp -m tcp --dport xxx -m recent --set --name heaven --rsource
-A tcp_inbound -p tcp -m tcp --dport 80 -j ACCEPT
-A tcp_inbound -s 192.168.1.0/24 -i eth0 -p tcp -m tcp --dport 21 -j ACCEPT
-A tcp_inbound -s 192.168.1.0/24 -i eth0 -p tcp -m tcp --sport 20 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 25 -j ACCEPT
-A tcp_inbound -p tcp -m tcp --dport 110 -j ACCEPT
-A tcp_inbound -s 192.168.1.0/24 -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT
-A tcp_inbound -s 192.168.1.0/24 -i eth0 -p tcp -m tcp --dport 8080 -j ACCEPT
-A tcp_inbound -s 192.168.1.0/24 -i eth0 -p tcp -m tcp --dport 123 -j ACCEPT
-A tcp_inbound -p tcp -j RETURN
-A tcp_outbound -p tcp -j ACCEPT
-A udp_inbound -s 192.168.1.0/24 -i eth0 -p udp -m udp --dport 53 -j ACCEPT
-A udp_inbound -s 192.168.1.0/24 -i vlan256 -p udp -m udp --dport 53 -j ACCEPT
-A udp_inbound -s 192.168.3.0/24 -i tun0 -p udp -m udp --dport 53 -j ACCEPT
-A udp_inbound -s 10.5.3.0/24 -i tun0 -p udp -m udp --dport 53 -j ACCEPT
-A udp_inbound -p udp -j RETURN
-A udp_outbound -p udp -j ACCEPT
Напомню что при политике FORWARD ACCEPT пакеты ходют.
Вариант для распечатки
